Update dependency webpack-dev-middleware to v7.1.0 [SECURITY] (#1957)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[webpack-dev-middleware](https://togithub.com/webpack/webpack-dev-middleware)
| [`7.0.0` ->
`7.1.0`](https://renovatebot.com/diffs/npm/webpack-dev-middleware/7.0.0/7.1.0)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/webpack-dev-middleware/7.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/webpack-dev-middleware/7.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/webpack-dev-middleware/7.0.0/7.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/webpack-dev-middleware/7.0.0/7.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2024-29180](https://togithub.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6)

### Summary
_The **webpack-dev-middleware** middleware does not validate the
supplied URL address sufficiently before returning the local file. It is
possible to access any file on the developer's machine._

### Details
The middleware can either work with the physical filesystem when reading
the files or it can use a virtualized in-memory _memfs_ filesystem.
If _writeToDisk_ configuration option is set to **true**, the physical
filesystem is used:

[https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21](https://togithub.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21)

The _**getFilenameFromUrl**_ method is used to parse URL and build the
local file path.
The public path prefix is stripped from the URL, and the **unsecaped**
path suffix is appended to the _outputPath_:

[https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/getFilenameFromUrl.js#L82](https://togithub.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/getFilenameFromUrl.js#L82)
As the URL is not unescaped and normalized automatically before calling
the midlleware, it is possible to use _%2e_ and _%2f_ sequences to
perform path traversal attack.

### PoC
_A blank project can be created containing the following configuration
file **webpack.config.js**:_
`module.exports = {
  devServer: {
    devMiddleware: {
      writeToDisk: true
    }
  }
};
`

When started, it is possible to access any local file, e.g.
_/etc/passwd_:
`$ curl localhost:8080/public/..%2f..%2f..%2f..%2f../etc/passwd`
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
```

### Impact
The developers using _webpack-dev-server_ or _webpack-dev-middleware_
are affected by the issue. When the project is started, an attacker
might access any file on the developer's machine and exfiltrate the
content (e.g. password, configuration files, private source code, ...).

If the development server is listening on a public IP address (or
**0.0.0.0**), an attacker on the local network can access the local
files without any interaction from the victim (direct connection to the
port).

If the server allows access from third-party domains (CORS,
**_Allow-Access-Origin: *_** ), an attacker can send a malicious link to
the victim. When visited, the client side script can connect to the
local server and exfiltrate the local files.

### Recommendation
The URL should be unescaped and normalized before any further
processing.

---

### Release Notes

<details>
<summary>webpack/webpack-dev-middleware
(webpack-dev-middleware)</summary>

###
[`v7.1.0`](https://togithub.com/webpack/webpack-dev-middleware/blob/HEAD/CHANGELOG.md#710-2024-03-19)

[Compare
Source](https://togithub.com/webpack/webpack-dev-middleware/compare/v7.0.0...v7.1.0)

##### Features

- prefer to use `fs.createReadStream` over `fs.readFileSync` to read
files
([ab533de](https://togithub.com/webpack/webpack-dev-middleware/commit/ab533de933c6684218172b86992f35c3ca6c58a4))

##### Bug Fixes

- cleaup stream and handle errors
([#&#8203;1769](https://togithub.com/webpack/webpack-dev-middleware/issues/1769))
([1258fdd](https://togithub.com/webpack/webpack-dev-middleware/commit/1258fdd3d9c175dbacf6bc3b36d5c3c545738f13))
- **security:** do not allow to read files above
([#&#8203;1771](https://togithub.com/webpack/webpack-dev-middleware/issues/1771))
([e10008c](https://togithub.com/webpack/webpack-dev-middleware/commit/e10008c762e4d5821ed6990348dabf0d4d93a10e))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log [here](https://developer.mend.io/github/ni/nimble).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjEuMCIsInVwZGF0ZWRJblZlciI6IjM3LjI2MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>