From 91bcaa46ae5349453f904ec346a6fc82399804d9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 22 May 2026 19:57:05 +0000 Subject: [PATCH 1/6] Bump qs and express Bumps [qs](https://github.com/ljharb/qs) and [express](https://github.com/expressjs/express). These dependencies needed to be updated together. Updates `qs` from 6.14.1 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.15.2) Updates `express` from 4.22.1 to 4.22.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md) - [Commits](https://github.com/expressjs/express/compare/v4.22.1...v4.22.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect - dependency-name: express dependency-version: 4.22.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 132 ++++++++++++++++++++++++++++++++++------------ 1 file changed, 99 insertions(+), 33 deletions(-) diff --git a/package-lock.json b/package-lock.json index 88c6ec13..86c31387 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6962,22 +6962,24 @@ "license": "MIT" }, "node_modules/body-parser": { - "version": "1.20.3", + "version": "1.20.5", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz", + "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==", "dev": true, "license": "MIT", "dependencies": { - "bytes": "3.1.2", + "bytes": "~3.1.2", "content-type": "~1.0.5", "debug": "2.6.9", "depd": "2.0.0", - "destroy": "1.2.0", - "http-errors": "2.0.0", - "iconv-lite": "0.4.24", - "on-finished": "2.4.1", - "qs": "6.13.0", - "raw-body": "2.5.2", + "destroy": "~1.2.0", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "on-finished": "~2.4.1", + "qs": "~6.15.1", + "raw-body": "~2.5.3", "type-is": "~1.6.18", - "unpipe": "1.0.0" + "unpipe": "~1.0.0" }, "engines": { "node": ">= 0.8", @@ -6986,17 +6988,52 @@ }, "node_modules/body-parser/node_modules/debug": { "version": "2.6.9", + "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", + "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==", "dev": true, "license": "MIT", "dependencies": { "ms": "2.0.0" } }, + "node_modules/body-parser/node_modules/http-errors": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" + }, + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/body-parser/node_modules/ms": { "version": "2.0.0", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz", + "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", "dev": true, "license": "MIT" }, + "node_modules/body-parser/node_modules/statuses": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, "node_modules/bonjour-service": { "version": "1.0.14", "dev": true, @@ -7971,6 +8008,8 @@ }, "node_modules/content-type": { "version": "1.0.5", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", + "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", "dev": true, "license": "MIT", "engines": { @@ -10186,13 +10225,15 @@ } }, "node_modules/express": { - "version": "4.22.1", + "version": "4.22.2", + "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz", + "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==", "dev": true, "license": "MIT", "dependencies": { "accepts": "~1.3.8", "array-flatten": "1.1.1", - "body-parser": "~1.20.3", + "body-parser": "~1.20.5", "content-disposition": "~0.5.4", "content-type": "~1.0.4", "cookie": "~0.7.1", @@ -10211,7 +10252,7 @@ "parseurl": "~1.3.3", "path-to-regexp": "~0.1.12", "proxy-addr": "~2.0.7", - "qs": "~6.14.0", + "qs": "~6.15.1", "range-parser": "~1.2.1", "safe-buffer": "5.2.1", "send": "~0.19.0", @@ -10248,20 +10289,6 @@ "dev": true, "license": "MIT" }, - "node_modules/express/node_modules/qs": { - "version": "6.14.1", - "dev": true, - "license": "BSD-3-Clause", - "dependencies": { - "side-channel": "^1.1.0" - }, - "engines": { - "node": ">=0.6" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/express/node_modules/safe-buffer": { "version": "5.2.1", "dev": true, @@ -15525,6 +15552,8 @@ }, "node_modules/media-typer": { "version": "0.3.0", + "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz", + "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==", "dev": true, "license": "MIT", "engines": { @@ -17703,11 +17732,13 @@ } }, "node_modules/qs": { - "version": "6.13.0", + "version": "6.15.2", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", + "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", "dev": true, "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.0.6" + "side-channel": "^1.1.0" }, "engines": { "node": ">=0.6" @@ -17757,19 +17788,52 @@ } }, "node_modules/raw-body": { - "version": "2.5.2", + "version": "2.5.3", + "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz", + "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==", "dev": true, "license": "MIT", "dependencies": { - "bytes": "3.1.2", - "http-errors": "2.0.0", - "iconv-lite": "0.4.24", - "unpipe": "1.0.0" + "bytes": "~3.1.2", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "unpipe": "~1.0.0" }, "engines": { "node": ">= 0.8" } }, + "node_modules/raw-body/node_modules/http-errors": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" + }, + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/raw-body/node_modules/statuses": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, "node_modules/rc": { "version": "1.2.8", "dev": true, @@ -20009,6 +20073,8 @@ }, "node_modules/type-is": { "version": "1.6.18", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz", + "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==", "dev": true, "license": "MIT", "dependencies": { From d0910cd1b5ea27a5fe7c5cd58c40042383e662ba Mon Sep 17 00:00:00 2001 From: Jeremy-Z Date: Tue, 26 May 2026 11:17:33 -0400 Subject: [PATCH 2/6] Added additional logging for client auth signature validation failures. Also made sure to log this api call. --- src/layouts/entry-page/entry-page.vue | 18 ++++++++++++------ src/store/index.js | 6 +++++- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/src/layouts/entry-page/entry-page.vue b/src/layouts/entry-page/entry-page.vue index 503827ac..7347e051 100644 --- a/src/layouts/entry-page/entry-page.vue +++ b/src/layouts/entry-page/entry-page.vue @@ -45,13 +45,7 @@ export default { showIssLoadingModal(false); return; } - - // Populate all the ISS Config values from the service call returns. - this.populateISSConfigValues(clientData); - // Session should only be created / validated on successful client tag validation to avoid unnecessary sessions for unauthorized users. - await analyticsMixin.methods.validateSession(); - try { // Check cookie const issCookie = getISSCookie(); @@ -119,6 +113,7 @@ export default { return { isAuthorized: false }; } + // Set the client tag on thes store here so we can use it for logging if need be. this.mainStore.issConfig.clientTag = clientTag; const resp = await validateISSClientTag(clientTag); @@ -126,6 +121,12 @@ export default { return { isAuthorized: false }; } + // Populate all the ISS Config values from the service call returns. + this.populateISSConfigValues(resp); + + // Session should only be created / validated on successful client tag validation to avoid unnecessary sessions for unauthorized users. + await analyticsMixin.methods.validateSession(); + let isAuthorized = false; let clientData = null; const decryptedParams = {}; @@ -143,6 +144,11 @@ export default { isAuthorized = vsigResp?.valid ?? false; this.mainStore.issConfig.isAuthenticated = isAuthorized; + + // Log the signature validation failure so we can monitor/alert on it. + if ( !isAuthorized ) { + global.$logger.logError(`[Entry Page] Client signature validation failed for Client Tag: ${clientTag} - Reason: ${vsigResp?.failureReason ?? ''} - Token: ${token} - Signature: ${signature}`); + } } else { isAuthorized = true; } diff --git a/src/store/index.js b/src/store/index.js index 6b6cd308..20bc7261 100644 --- a/src/store/index.js +++ b/src/store/index.js @@ -2942,6 +2942,8 @@ export const useMainStore = defineStore({ issConfig.billToAccountNumber = billToInfo.toString(); }, + // Do not log API call failure here since this is a validation call that can be spammy. + // Do not bailout because this is a fatal error here. async validateClientTag(clientTag) { return globalMethods.callHttpClient({ method: endpoints.ValidateClientTag.method, @@ -2958,11 +2960,13 @@ export const useMainStore = defineStore({ signature }; + // Log API call failure so we can monitor / alert on failed signature validations. + // Do not bailout because this is a fatal error here. return await globalMethods.callHttpClient({ method: endpoints.ValidateClientSignature.method, endpoint: endpoints.ValidateClientSignature.url, payload, - logApiCall: false, + logApiCall: true, bailoutOnError: false }); }, From c9a5a47e5347d7922e57be7cc3ba951abea4e474 Mon Sep 17 00:00:00 2001 From: Jeremy-Z Date: Tue, 26 May 2026 11:36:20 -0400 Subject: [PATCH 3/6] Updating imports to support the log error call. --- src/layouts/entry-page/entry-page.spec.js | 7 +++++++ src/layouts/entry-page/entry-page.vue | 1 + 2 files changed, 8 insertions(+) diff --git a/src/layouts/entry-page/entry-page.spec.js b/src/layouts/entry-page/entry-page.spec.js index ee238737..b5319974 100644 --- a/src/layouts/entry-page/entry-page.spec.js +++ b/src/layouts/entry-page/entry-page.spec.js @@ -10,6 +10,13 @@ import { useMainStore } from '@/store'; import settleAllPromises from '@/helpers/layout-helper.js'; import { fetchCmsContentForPage } from '@/helpers/cms-content-helper'; import * as clientAuthHelper from '@/helpers/clientauth-helper'; +import Logger from "@/helpers/logger"; +import crypto from 'crypto'; + +// Instantiate global logging object +global.$logger = new Logger(); + +global.crypto = crypto; // Mock our module for promises. jest.mock('@/helpers/layout-helper.js', () => jest.fn()); diff --git a/src/layouts/entry-page/entry-page.vue b/src/layouts/entry-page/entry-page.vue index 7347e051..c245907b 100644 --- a/src/layouts/entry-page/entry-page.vue +++ b/src/layouts/entry-page/entry-page.vue @@ -16,6 +16,7 @@ import showIssLoadingModal from '@/helpers/loading-modal-helper'; import applicationConfig from '@/constants/application-config'; import { toPossessive } from '@/helpers/text-helper'; import analyticsMixin from '@/mixins/analytics-mixin'; +import crypto from 'crypto'; export default { name: 'entry-page', From 0130fe4f3556610405f9ab16b9612062d48d8547 Mon Sep 17 00:00:00 2001 From: Jeremy-Z Date: Tue, 26 May 2026 12:15:48 -0400 Subject: [PATCH 4/6] VS Code did not save this file. --- src/layouts/entry-page/entry-page.vue | 1 - 1 file changed, 1 deletion(-) diff --git a/src/layouts/entry-page/entry-page.vue b/src/layouts/entry-page/entry-page.vue index c245907b..7347e051 100644 --- a/src/layouts/entry-page/entry-page.vue +++ b/src/layouts/entry-page/entry-page.vue @@ -16,7 +16,6 @@ import showIssLoadingModal from '@/helpers/loading-modal-helper'; import applicationConfig from '@/constants/application-config'; import { toPossessive } from '@/helpers/text-helper'; import analyticsMixin from '@/mixins/analytics-mixin'; -import crypto from 'crypto'; export default { name: 'entry-page', From 06371e0043d465f03eba24c53f26bead08f945fd Mon Sep 17 00:00:00 2001 From: Jeremy-Z Date: Tue, 26 May 2026 12:16:25 -0400 Subject: [PATCH 5/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/layouts/entry-page/entry-page.vue | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/layouts/entry-page/entry-page.vue b/src/layouts/entry-page/entry-page.vue index 7347e051..a87f81c8 100644 --- a/src/layouts/entry-page/entry-page.vue +++ b/src/layouts/entry-page/entry-page.vue @@ -113,7 +113,7 @@ export default { return { isAuthorized: false }; } - // Set the client tag on thes store here so we can use it for logging if need be. + // Set the client tag on the store here so we can use it for logging if need be. this.mainStore.issConfig.clientTag = clientTag; const resp = await validateISSClientTag(clientTag); From 06ff83716e37c02b64c6b753d6976d29ab448084 Mon Sep 17 00:00:00 2001 From: Jeremy-Z Date: Tue, 26 May 2026 12:17:42 -0400 Subject: [PATCH 6/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/layouts/entry-page/entry-page.spec.js | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/layouts/entry-page/entry-page.spec.js b/src/layouts/entry-page/entry-page.spec.js index b5319974..442e2067 100644 --- a/src/layouts/entry-page/entry-page.spec.js +++ b/src/layouts/entry-page/entry-page.spec.js @@ -10,11 +10,15 @@ import { useMainStore } from '@/store'; import settleAllPromises from '@/helpers/layout-helper.js'; import { fetchCmsContentForPage } from '@/helpers/cms-content-helper'; import * as clientAuthHelper from '@/helpers/clientauth-helper'; -import Logger from "@/helpers/logger"; import crypto from 'crypto'; -// Instantiate global logging object -global.$logger = new Logger(); +// Stub global logging object to avoid real network calls in tests +global.$logger = { + logError: jest.fn(), + logInfo: jest.fn(), + logWarn: jest.fn(), + logDebug: jest.fn() +}; global.crypto = crypto;