Update express to 4.17.3 to address querystring vulnerability

[eleichter-globality]

See GLOB-70859 and https://github.com/n8tz/CVE-2022-24999 for background on this vulnerability.

I managed to reproduce the exploit by borrowing from the vulnerability repo's POC in globalitydocx. I added a dummy route that looked like this:

    router.get('/api/qs-test', function(req, res, next) {
        const categories = req.query.categories;
        
        console.log('[server] Received query : ', req.query);
        console.log('[server] (categories instanceof Array) : ', (categories instanceof Array));
        
        if ( !categories || !(categories instanceof Array) ) {
            res.send('Categories is not an array, which is probably a good thing');
            return;
        }
        
        console.log('[server] Do : req.query.categories.indexOf("123")');
        console.time('[server] req.query.categories.indexOf("123")');
        req.query.categories.indexOf("123")
        console.timeEnd('[server] req.query.categories.indexOf("123")');
        
        res.send('Done!');
    });

Then sent a request to a locally-running server with this:

time curl --location -g 'http://localhost:3037/api/qs-test?categories[__proto__]&categories[__proto__]&categories[length]=100000000'

Without the update to this library, the server treated categories like an array and took 4 seconds to respond (even if its own copy of express was updated to the fix version). Once I got the local server to use this version of nodule-express, it responded to the same request quickly, and hit the Categories is not an array branch.

[michlipskiGlo]

Just want to verify that we want 4.17.3 and not ^4.17.3

[eleichter-globality]

Good call, it looks like we can. This gets us express 4.18.2, which has qs 6.11.0 which has the fix (that came from here). And I verified that I can't reproduce the vulnerability with this new version of nodule-express + express.

(I'm somewhat obsessively double-checking all this because I spent the better part of the day jumping through dependency hell to test this).

[jyoko-glob]

Appreciate you fighting with the dependencies! 🍻