add patch for axios to fix CVE issue

build/scripts/ui.sh

@@ -25,7 +25,9 @@ build_ui() {
     fi
 
     rm -rf dist
-    mkdir -p public/static/js
+    mkdir -p patches
+    PATCH_PATH=$(realpath "$SCRIPT_BASEDIR/../../third_party/patch/axios+0.19.2.patch")
+    cp $PATCH_PATH patches/
 
     npm config set strict-ssl false
     npm config set unsafe-perm true

mindinsight/ui/package.json

@@ -6,7 +6,8 @@
     "serve": "vue-cli-service serve",
     "build": "vue-cli-service build",
     "lint": "eslint src/**/*.js src/**/*.vue",
-    "i18n:report": "vue-cli-service i18n:report --src './src/**/*.?(js|vue)' --locales './src/locales/**/*.json'"
+    "i18n:report": "vue-cli-service i18n:report --src './src/**/*.?(js|vue)' --locales './src/locales/**/*.json'",
+    "postinstall": "patch-package"
   },
   "dependencies": {
     "axios": "0.19.2",
@@ -33,6 +34,7 @@
     "sass": "1.25.0",
     "sass-loader": "8.0.0",
     "vue-cli-plugin-i18n": "0.6.1",
-    "vue-template-compiler": "2.6.11"
+    "vue-template-compiler": "2.6.11",
+    "patch-package": "6.2.2"
   }
 }

third_party/patch/axios+0.19.2.patch

@@ -0,0 +1,55 @@
+diff --git a/node_modules/axios/lib/adapters/http.js b/node_modules/axios/lib/adapters/http.js
+index 16dad12..0330430 100644
+--- a/node_modules/axios/lib/adapters/http.js
++++ b/node_modules/axios/lib/adapters/http.js
+@@ -16,6 +16,31 @@ var enhanceError = require('../core/enhanceError');
+ 
+ var isHttps = /https:?/;
+ 
++/**
++ *
++ * @param {http.ClientRequestArgs} options
++ * @param {AxiosProxyConfig} proxy
++ * @param {string} location
++ */
++function setProxy(options, proxy, location) {
++  options.hostname = proxy.host;
++  options.host = proxy.host;
++  options.port = proxy.port;
++  options.path = location;
++
++  // Basic proxy authorization
++  if (proxy.auth) {
++    var base64 = Buffer.from(proxy.auth.username + ':' + proxy.auth.password, 'utf8').toString('base64');
++    options.headers['Proxy-Authorization'] = 'Basic ' + base64;
++  }
++
++  // If a proxy is used, any redirects must also pass through the proxy
++  options.beforeRedirect = function beforeRedirect(redirection) {
++    redirection.headers.host = redirection.host;
++    setProxy(redirection, proxy, redirection.href);
++  };
++}
++
+ /*eslint consistent-return:0*/
+ module.exports = function httpAdapter(config) {
+   return new Promise(function dispatchHttpRequest(resolvePromise, rejectPromise) {
+@@ -145,17 +170,8 @@ module.exports = function httpAdapter(config) {
+     }
+ 
+     if (proxy) {
+-      options.hostname = proxy.host;
+-      options.host = proxy.host;
+       options.headers.host = parsed.hostname + (parsed.port ? ':' + parsed.port : '');
+-      options.port = proxy.port;
+-      options.path = protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path;
+-
+-      // Basic proxy authorization
+-      if (proxy.auth) {
+-        var base64 = Buffer.from(proxy.auth.username + ':' + proxy.auth.password, 'utf8').toString('base64');
+-        options.headers['Proxy-Authorization'] = 'Basic ' + base64;
+-      }
++      setProxy(options, proxy, protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path);
+     }
+ 
+     var transport;