From 7d283db19046fb0b102cdf3ecdf609b218eeb1af Mon Sep 17 00:00:00 2001 From: Gemma Talbot Date: Wed, 13 Nov 2024 15:59:12 +0000 Subject: [PATCH 01/15] add wait --- test/browser/2-0-additional-evidence.cy.test.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/test/browser/2-0-additional-evidence.cy.test.ts b/test/browser/2-0-additional-evidence.cy.test.ts index cd1da2569..39d8fe124 100644 --- a/test/browser/2-0-additional-evidence.cy.test.ts +++ b/test/browser/2-0-additional-evidence.cy.test.ts @@ -82,9 +82,8 @@ describe.skip('CY - Additional Evidence @mya @nightly99', function () { assignCasePage.verifyLanguage('cy'); await assignCasePage.fillPostcode('TN32 6PL'); await assignCasePage.submit(); - await page.reload(); - statusPage.verifyPage(); + await statusPage.verifyPage(); await additionalEvidencePage.visitPage(); }); From a691c65985956c901f7c5912b234eeb52dd06751 Mon Sep 17 00:00:00 2001 From: Gemma Talbot Date: Wed, 13 Nov 2024 16:09:53 +0000 Subject: [PATCH 02/15] add wait --- test/browser/2-0-additional-evidence.cy.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/browser/2-0-additional-evidence.cy.test.ts b/test/browser/2-0-additional-evidence.cy.test.ts index 39d8fe124..d75a212be 100644 --- a/test/browser/2-0-additional-evidence.cy.test.ts +++ b/test/browser/2-0-additional-evidence.cy.test.ts @@ -83,7 +83,8 @@ describe.skip('CY - Additional Evidence @mya @nightly99', function () { await assignCasePage.fillPostcode('TN32 6PL'); await assignCasePage.submit(); await page.reload(); - await statusPage.verifyPage(); + this.await(10) + statusPage.verifyPage(); await additionalEvidencePage.visitPage(); }); From 3ea14aeac031e8f26b98c758d2d8363b61fedcbb Mon Sep 17 00:00:00 2001 From: Gemma Talbot Date: Wed, 13 Nov 2024 16:40:33 +0000 Subject: [PATCH 03/15] add semicolon --- test/browser/2-0-additional-evidence.cy.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/browser/2-0-additional-evidence.cy.test.ts b/test/browser/2-0-additional-evidence.cy.test.ts index d75a212be..3739e26c4 100644 --- a/test/browser/2-0-additional-evidence.cy.test.ts +++ b/test/browser/2-0-additional-evidence.cy.test.ts @@ -83,7 +83,7 @@ describe.skip('CY - Additional Evidence @mya @nightly99', function () { await assignCasePage.fillPostcode('TN32 6PL'); await assignCasePage.submit(); await page.reload(); - this.await(10) + this.await(10); statusPage.verifyPage(); await additionalEvidencePage.visitPage(); }); From bd46e169f3fe82051562adf05f09ac93eda93c70 Mon Sep 17 00:00:00 2001 From: Gemma Talbot Date: Wed, 13 Nov 2024 17:32:57 +0000 Subject: [PATCH 04/15] add welsh charges translation --- app/common/locale/content.json | 1 + 1 file changed, 1 insertion(+) diff --git a/app/common/locale/content.json b/app/common/locale/content.json index fc4979473..4d4a6d09f 100644 --- a/app/common/locale/content.json +++ b/app/common/locale/content.json @@ -1609,6 +1609,7 @@ "telephone": { "title": "Ffoniwch ni", "desc": "Siaradwch ag un o’n asiantau dros y ffôn nawr.", + "charges": "Gwybodaeth am brisiau galwadau", "England": { "desc": "Llinell gymorth apeliadau budd-daliadau (Cymru a Lloegr - Siaradwyr Cymraeg)", "phone": "Rhif ffôn: 0300 303 5170", From ed1d8c531bf7934d5812ac02e766022d2875ec78 Mon Sep 17 00:00:00 2001 From: Gemma Talbot Date: Tue, 19 Nov 2024 15:02:59 +0000 Subject: [PATCH 05/15] add wait --- test/browser/2-0-additional-evidence.test.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/test/browser/2-0-additional-evidence.test.ts b/test/browser/2-0-additional-evidence.test.ts index 84b50ef4c..a909faa9c 100644 --- a/test/browser/2-0-additional-evidence.test.ts +++ b/test/browser/2-0-additional-evidence.test.ts @@ -85,6 +85,7 @@ describe('Additional Evidence @mya @nightly', function () { await page.reload(); statusPage.verifyPage(); + this.await(10); await additionalEvidencePage.visitPage(); }); From 050fd1126c5cf5a5eabe641972e26a5fdc6c15d7 Mon Sep 17 00:00:00 2001 From: Katalin Kovacs Date: Tue, 26 Nov 2024 10:14:03 +0000 Subject: [PATCH 06/15] Added cookie@npm:1.0.2 and cross-spawn@npm:7.0.6 to resolutions --- package.json | 10 +- yarn-audit-known-issues | 2 +- yarn.lock | 401 ++++++++++++---------------------------- 3 files changed, 121 insertions(+), 292 deletions(-) diff --git a/package.json b/package.json index 861c98116..8417b917d 100644 --- a/package.json +++ b/package.json @@ -63,7 +63,7 @@ "computed-style": "^0.3.0", "config": "3.3.9", "connect-redis": "^6.1.3", - "cookie-parser": "^1.4.3", + "cookie-parser": "^1.4.7", "copy-webpack-plugin": "^12.0.2", "csurf": "^1.10.0", "eslint-plugin-mocha": "^10.1.0", @@ -107,7 +107,7 @@ "@types/cli-color": "^2.0.2", "@types/config": "3.3.0", "@types/connect-redis": "^0.0.19", - "@types/cookie-parser": "^1.4.1", + "@types/cookie-parser": "^1.4.7", "@types/joi": "^13.5.2", "@types/jquery": "^3.5.29", "@types/mocha": "^10.0.0", @@ -124,7 +124,7 @@ "chai-http": "^4.3.0", "chai-string": "^1.5.0", "cli-color": "^2.0.3", - "codeceptjs": "^3.6.5", + "codeceptjs": "^3.6.7", "concurrently": "^7.0.0", "cross-env": "^4.0.0", "domready": "^1.0.8", @@ -184,7 +184,9 @@ "braces": "^3.0.3", "ws": "^8.17.1", "micromatch": "^4.0.8", - "body-parser": "^1.20.3" + "body-parser": "^1.20.3", + "cookie": "^1.0.2", + "cross-spawn": "^7.0.6" }, "typeScriptVersion": "4.8", "packageManager": "yarn@3.6.0" diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues index f46cae9ac..4bf64e365 100755 --- a/yarn-audit-known-issues +++ b/yarn-audit-known-issues @@ -1 +1 @@ -{"actions":[],"advisories":{"1096727":{"findings":[{"version":"2.88.2","paths":["promise-request-retry>request","promise-request-retry>coveralls>request"]}],"found_by":null,"deleted":null,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2023-28155\n- https://github.com/request/request/issues/3442\n- https://github.com/request/request/pull/3444\n- https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf\n- https://github.com/github/advisory-database/pull/2500\n- https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116\n- https://github.com/request/request/blob/master/lib/redirect.js#L111\n- https://github.com/cypress-io/request/pull/28\n- https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f\n- https://github.com/cypress-io/request/releases/tag/v3.0.0\n- https://security.netapp.com/advisory/ntap-20230413-0007\n- https://github.com/advisories/GHSA-p8p7-x288-28g6","created":"2023-03-16T15:30:19.000Z","id":1096727,"npm_advisory_id":null,"overview":"The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).\n\nNOTE: The `request` package is no longer supported by the maintainer.","reported_by":null,"title":"Server-Side Request Forgery in Request","metadata":null,"cves":["CVE-2023-28155"],"access":"public","severity":"moderate","module_name":"request","vulnerable_versions":"<=2.88.2","github_advisory_id":"GHSA-p8p7-x288-28g6","recommendation":"None","patched_versions":"<0.0.0","updated":"2024-03-21T17:47:21.000Z","cvss":{"score":6.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-918"],"url":"https://github.com/advisories/GHSA-p8p7-x288-28g6"},"1099516":{"findings":[{"version":"3.0.0","paths":["i18next-conv>node-gettext"]}],"found_by":null,"deleted":null,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-21528\n- https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943\n- https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js#L113\n- https://github.com/advisories/GHSA-g974-hxvm-x689","created":"2024-09-10T06:30:48.000Z","id":1099516,"npm_advisory_id":null,"overview":"All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.","reported_by":null,"title":"node-gettext vulnerable to Prototype Pollution","metadata":null,"cves":["CVE-2024-21528"],"access":"public","severity":"moderate","module_name":"node-gettext","vulnerable_versions":"<=3.0.0","github_advisory_id":"GHSA-g974-hxvm-x689","recommendation":"None","patched_versions":"<0.0.0","updated":"2024-09-10T15:52:57.000Z","cvss":{"score":5.9,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-1321"],"url":"https://github.com/advisories/GHSA-g974-hxvm-x689"},"1099846":{"findings":[{"version":"0.4.1","paths":["cookie-parser>cookie"]}],"found_by":null,"deleted":null,"references":"- https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x\n- https://github.com/jshttp/cookie/pull/167\n- https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c\n- https://github.com/advisories/GHSA-pxg6-pf52-xh8x","created":"2024-10-04T20:31:00.000Z","id":1099846,"npm_advisory_id":null,"overview":"### Impact\n\nThe cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize(\"userName=; Max-Age=2592000; a\", value)` would result in `\"userName=; Max-Age=2592000; a=test\"`, setting `userName` cookie to `; Max-Age=2592000; a\", value)` would result in `\"userName=; Max-Age=2592000; a=test\"`, setting `userName` cookie to `; Max-Age=2592000; a\", value)` would result in `\"userName=; Max-Age=2592000; a=test\"`, setting `userName` cookie to `; Max-Age=2592000; a\", value)` would result in `\"userName=; Max-Age=2592000; a=test\"`, setting `userName` cookie to `; Max-Age=2592000; a\", value)` would result in `\"userName=; Max-Age=2592000; a=test\"`, setting `userName` cookie to `