upgrade http/https/socks proxy agents

* [V1 Only] Change dev server's data path to ./data/v1

* Fix GHSA-2qgm-m29m-cj2h

package.json

@@ -1,6 +1,6 @@
 {
     "name": "uptime-kuma",
-    "version": "1.23.15",
+    "version": "1.23.16",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -24,7 +24,7 @@
         "start-frontend-devcontainer": "cross-env NODE_ENV=development DEVCONTAINER=1 vite --host --config ./config/vite.config.js",
         "start": "npm run start-server",
         "start-server": "node server/server.js",
-        "start-server-dev": "cross-env NODE_ENV=development node server/server.js",
+        "start-server-dev": "cross-env NODE_ENV=development node server/server.js --data-dir=./data/v1/",
         "build": "vite build --config ./config/vite.config.js",
         "test": "node test/prepare-test-server.js && npm run jest-backend",
         "test-with-build": "npm run build && npm test",
@@ -42,7 +42,7 @@
         "build-docker-nightly-amd64": "docker buildx build -f docker/dockerfile --platform linux/amd64 -t louislam/uptime-kuma:nightly-amd64 --target nightly . --push --progress plain",
         "build-docker-pr-test": "docker buildx build -f docker/dockerfile --platform linux/amd64,linux/arm64 -t louislam/uptime-kuma:pr-test --target pr-test . --push",
         "upload-artifacts": "docker buildx build -f docker/dockerfile --platform linux/amd64 -t louislam/uptime-kuma:upload-artifact --build-arg VERSION --build-arg GITHUB_TOKEN --target upload-artifact . --progress plain",
-        "setup": "git checkout 1.23.15 && npm ci --production && npm run download-dist",
+        "setup": "git checkout 1.23.16 && npm ci --production && npm run download-dist",
         "download-dist": "node extra/download-dist.js",
         "mark-as-nightly": "node extra/mark-as-nightly.js",
         "reset-password": "node extra/reset-password.js",
@@ -104,8 +104,8 @@
         "gamedig": "^4.2.0",
         "html-escaper": "^3.0.3",
         "http-graceful-shutdown": "~3.1.7",
-        "http-proxy-agent": "~5.0.0",
-        "https-proxy-agent": "~5.0.1",
+        "http-proxy-agent": "~7.0.2",
+        "https-proxy-agent": "~7.0.6",
         "iconv-lite": "~0.6.3",
         "isomorphic-ws": "^5.0.0",
         "jsesc": "~3.0.2",
@@ -140,7 +140,7 @@
         "semver": "~7.5.4",
         "socket.io": "~4.8.0",
         "socket.io-client": "~4.8.0",
-        "socks-proxy-agent": "6.1.1",
+        "socks-proxy-agent": "~8.0.5",
         "tar": "~6.2.1",
         "tcp-ping": "~0.1.1",
         "thirty-two": "~1.0.2",

server/monitor-types/real-browser-monitor-type.js

@@ -193,6 +193,14 @@ class RealBrowserMonitorType extends MonitorType {
         const context = await browser.newContext();
         const page = await context.newPage();
 
+        // Prevent Local File Inclusion
+        // Accept only http:// and https://
+        // https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h
+        let url = new URL(monitor.url);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new Error("Invalid url protocol, only http and https are allowed.");
+        }
+
         const res = await page.goto(monitor.url, {
             waitUntil: "networkidle",
             timeout: monitor.interval * 1000 * 0.8,

server/proxy.js

@@ -1,7 +1,7 @@
 const { R } = require("redbean-node");
-const HttpProxyAgent = require("http-proxy-agent");
-const HttpsProxyAgent = require("https-proxy-agent");
-const SocksProxyAgent = require("socks-proxy-agent");
+const { HttpProxyAgent } = require("http-proxy-agent");
+const { HttpsProxyAgent } = require("https-proxy-agent");
+const { SocksProxyAgent } = require("socks-proxy-agent");
 const { debug } = require("../src/util");
 const { UptimeKumaServer } = require("./uptime-kuma-server");
 
@@ -97,41 +97,35 @@ class Proxy {
         let httpAgent;
         let httpsAgent;
 
-        const proxyOptions = {
-            protocol: proxy.protocol,
-            host: proxy.host,
-            port: proxy.port,
-        };
+        const proxyUrl = new URL(`${proxy.protocol}://${proxy.host}:${proxy.port}`);
 
         if (proxy.auth) {
-            proxyOptions.auth = `${proxy.username}:${proxy.password}`;
+            proxyUrl.username = proxy.username;
+            proxyUrl.password = proxy.password;
         }
 
-        debug(`Proxy Options: ${JSON.stringify(proxyOptions)}`);
+        debug(`Proxy URL: ${proxyUrl.toString()}`);
         debug(`HTTP Agent Options: ${JSON.stringify(httpAgentOptions)}`);
         debug(`HTTPS Agent Options: ${JSON.stringify(httpsAgentOptions)}`);
 
         switch (proxy.protocol) {
             case "http":
             case "https":
-                httpAgent = new HttpProxyAgent({
-                    ...httpAgentOptions || {},
-                    ...proxyOptions
+                httpAgent = new HttpProxyAgent(proxyUrl.toString(), {
+                    ...(httpAgentOptions || {}),
                 });
 
-                httpsAgent = new HttpsProxyAgent({
-                    ...httpsAgentOptions || {},
-                    ...proxyOptions,
+                httpsAgent = new HttpsProxyAgent(proxyUrl.toString(), {
+                    ...(httpsAgentOptions || {}),
                 });
                 break;
             case "socks":
             case "socks5":
             case "socks5h":
             case "socks4":
-                agent = new SocksProxyAgent({
+                agent = new SocksProxyAgent(proxyUrl.toString(), {
                     ...httpAgentOptions,
                     ...httpsAgentOptions,
-                    ...proxyOptions,
                     tls: {
                         rejectUnauthorized: httpsAgentOptions.rejectUnauthorized,
                     },