Vulnerable transitive dependency: axios 0.21.4 via adal-node (CVE-2023-45857)

[rafhermanseco]

Title: Vulnerable transitive dependency: axios 0.21.4 via adal-node (CVE-2023-45857)

Body:

The extension (currently latest, v6.8.1) bundles adal-node@0.2.4, which pins
axios: "^0.21.1". This resolves to axios@0.21.4, which is affected by
CVE-2023-45857 (axios leaks the XSRF-TOKEN header to third-party hosts
on cross-origin redirects, fixed in axios 1.6.0).

Path in the installed extension:
node_modules/adal-node/node_modules/axios/package.json → version 0.21.4

Since adal-node is deprecated in favor of MSAL and hasn't been updated
upstream, this can't be resolved by bumping a version range alone.

Could the extension move off adal-node to @azure/msal-node (as Microsoft
recommends for its own deprecated library), or otherwise dedupe/override the
axios version to close this out?

Flagged by our internal security/IT review.

[scale-tone]

Thanks for flagging this, rafhermanseco .
Good news is that this deps chain traces its roots up to @azure/ms-rest-nodeauth package, which was still being referenced, but not used anywhere in code.
Reference to @azure/ms-rest-nodeauth can be safely dropped.
And the code is safe anyway, because 1) the vulnerable versions are not used and 2) no part of extension's code anyhow utilizes that XSRF-TOKEN header (axios vulnerability you mentioned only takes effect in a single-page app).