chore(deps): [security] bump http-proxy from 1.16.2 to 1.18.1

[dependabot-preview]

Bumps http-proxy from 1.16.2 to 1.18.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Denial of Service in http-proxy Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

For a proxy server running on http://localhost:3000, the following curl request triggers the unhandled exception:
curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"

Recommendation

Upgrade to version 1.18.1 or later

Affected versions: < 1.18.1

Release notes

Sourced from http-proxy's releases.

Long overdue maintenance

Due to some great contributions I'm happy to announce a new release of http-proxy containing numerous bug fixes, feature additions and documentation improvements. Thanks to all who contributed for their patience and willingness to contribute despite perceived stagnation in activity in the project. I welcome all contributions and those who are interested in getting more involved with the project. Below I will highlight the changes that landed in the latest version but you can find the full diff of the changes in nodejitsu/node-http-proxy#1251

• Add option to rewrite path of set-cookie headers. @swillis12
• Add option for overriding http METHOD when proxying request @AydinChavez
• Feature: selfHandleResponse for taking responsibility in returning your own response when listening on the proxyRes event. @cpd0101 @guoxiangyang
• Add followRedirects option @n30n0v
• Document timeout option @jlaamanen
• Fix documentation typos @carpsareokiguess
• Document buffer option @jonhunter1977
• Include websocket non-upgrade response instead of just closing the socket. Allows auth schemes to be possible with websocket proxying. @Tigge
• Stop using the writeHead method explicitly and let node handle it internally to prevent thrown errors @jakefurler
• Be more defensive in handling of detecting response state when proxying @thiagobustamante

Changelog

Sourced from http-proxy's changelog.

v1.18.1 - 2020-05-17

Merged

• Skip sending the proxyReq event when the expect header is present [#1447](https://github.com/http-party/node-http-proxy/issues/1447)
• Remove node6 support, add node12 to build [#1397](https://github.com/http-party/node-http-proxy/issues/1397)

1.18.0 - 2019-09-18

Merged

• Added in auto-changelog module set to keepachangelog format [#1373](https://github.com/http-party/node-http-proxy/issues/1373)
• fix 'Modify Response' readme section to avoid unnecessary array copying [#1300](https://github.com/http-party/node-http-proxy/issues/1300)
• Fix incorrect target name for reverse proxy example [#1135](https://github.com/http-party/node-http-proxy/issues/1135)
• Fix modify response middleware example [#1139](https://github.com/http-party/node-http-proxy/issues/1139)
• [dist] Update dependency async to v3 [#1359](https://github.com/http-party/node-http-proxy/issues/1359)
• Fix path to local http-proxy in examples. [#1072](https://github.com/http-party/node-http-proxy/issues/1072)
• fix reverse-proxy example require path [#1067](https://github.com/http-party/node-http-proxy/issues/1067)
• Update README.md [#970](https://github.com/http-party/node-http-proxy/issues/970)
• [dist] Update dependency request to ~2.88.0 [SECURITY] [#1357](https://github.com/http-party/node-http-proxy/issues/1357)
• [dist] Update dependency eventemitter3 to v4 [#1365](https://github.com/http-party/node-http-proxy/issues/1365)
• [dist] Update dependency colors to v1 [#1360](https://github.com/http-party/node-http-proxy/issues/1360)
• [dist] Update all non-major dependencies [#1356](https://github.com/http-party/node-http-proxy/issues/1356)
• [dist] Update dependency agentkeepalive to v4 [#1358](https://github.com/http-party/node-http-proxy/issues/1358)
• [dist] Update dependency nyc to v14 [#1367](https://github.com/http-party/node-http-proxy/issues/1367)
• [dist] Update dependency concat-stream to v2 [#1363](https://github.com/http-party/node-http-proxy/issues/1363)
• x-forwarded-host overwrite for mutli level proxies [#1267](https://github.com/http-party/node-http-proxy/issues/1267)
• [refactor doc] Complete rename to http-party org. [#1362](https://github.com/http-party/node-http-proxy/issues/1362)
• Highlight correct lines for createProxyServer [#1117](https://github.com/http-party/node-http-proxy/issues/1117)
• Fix docs for rewrite options - 201 also handled [#1147](https://github.com/http-party/node-http-proxy/issues/1147)
• Update .nyc_output [#1339](https://github.com/http-party/node-http-proxy/issues/1339)
• Configure Renovate [#1355](https://github.com/http-party/node-http-proxy/issues/1355)
• [examples] Restream body before proxying, support for Content-Type of application/x-www-form-urlencoded [#1264](https://github.com/http-party/node-http-proxy/issues/1264)

Commits

• [dist] New test fixtures. 7e4a0e5
• [dist] End of an era. a9b09cc
• [dist] Version bump. 1.18.0 9bbe486
• [fix] Latest versions. 59c4403
• [fix test] Update tests. dd1d08b
• [dist] Update dependency ws to v3 [SECURITY] b00911c
• [dist] .gitattributes all the things. fc93520
• [dist] Regenerate package-lock.json. 16d4f8a

1.17.0 - 2018-04-20

Merged

• Fix overwriting of global options [#1074](https://github.com/http-party/node-http-proxy/issues/1074)

Commits

• 9b96cd7 1.18.1
• 335aeeb Skip sending the proxyReq event when the expect header is present (#1447)
• dba3966 Remove node6 support, add node12 to build (#1397)
• 9bbe486 [dist] Version bump. 1.18.0
• 6e4bef4 Added in auto-changelog module set to keepachangelog format (#1373)
• d056241 fix 'Modify Response' readme section to avoid unnecessary array copying (#1300)
• 244303b Fix incorrect target name for reverse proxy example (#1135)
• b4028ba Fix modify response middleware example (#1139)
• 77a9815 [dist] Update dependency async to v3 (#1359)
• c662f9e Fix path to local http-proxy in examples. (#1072)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)