Update for getobject-0.1.0

Synopsys Black Duck - Vulnerabilities Reported
SUMMARY Direct Dependencies with vulnerabilities:

Direct Dependency
Changed
Num Direct Vulns
Max Direct Vuln Severity
Num Indirect Vulns
Max Indirect Vuln Severity
Upgrade to

eslint/6.6.0
No
0
0
7
8.8
v6.8.0

multer/1.4.2
No
0
0
1
7.3
v1.4.4

ajv/6.10.2
No
1
7.1
0
0
6.12.6

lodash/4.17.15
No
5
8.8
0
0
4.17.21

mongodb/3.3.3
No
0
0
1
7.9
3.7.3

connect-mongodb-session/2.2.0
No
0
0
2
7.9
2.4.1

eslint-plugin-import/2.18.2
No
0
0
2
6.7
2.25.4

underscore/1.9.1
No
1
7.3
0
0
1.13.2

mkdirp/0.5.1
No
0
0
1
7.3
0.5.5

axios/0.19.0
No
2
7.8
1
7.7
0.26.0

ava/2.4.0
No
0
0
7
9.1

express-handlebars/3.1.0
No
1
8.6
5
8.4

cheerio/0.22.0
No
0
0
2
7.5

gulp/4.0.2
No
0
0
14
8.8

eslint-plugin-node/9.2.0
No
0
0
1
6.7

sitemap/1.13.0
No
0
0
0
0

getobject/0.1.0
No
1
9.8
0
0

nodemailer/4.7.0
No
2
8.4
0
0

async/2.6.3
No
0
0
0
0

Vulnerable Direct Dependencies listed below:
Direct Dependency: ava/2.4.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

ava/2.4.0
yargs-parser/10.1.0
BDSA-2021-1478
9.1
Not-Pixiapp security (project-specific)
yargs-parser is vulnerable to privilege escalation and remote code execution (RCE) via prototype pollution.
No

ava/2.4.0
dot-prop/4.2.0
BDSA-2020-0654
7.4
No Critical Vulns
dot-prop is vulnerable to a prototype pollution flaw. A remote attacker able to supply specially crafted input to a dot-prop method could cause a denial-of-service (DoS) of the application, or aff ...
No

ava/2.4.0
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

ava/2.4.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

ava/2.4.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

ava/2.4.0
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

ava/2.4.0
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: axios/0.19.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
axios/0.19.0
BDSA-2020-3243
7.8
No Critical Vulns
It was found that axios could allow for server side request forgery (SSRF) attacks if it is used to pass user-supplied URL requests via a proxy. This vulnerability could be used to bypass the prox ...
No

axios/0.19.0
follow-redirects/1.5.10
BDSA-2022-0139
7.7
No Critical Vulns
follow-redirects contains an information disclosure vulnerability due to insecure cookie headers. An attacker could exploit this issue to disclose potentially sensitive information belonging to th ...
No

-/-
axios/0.19.0
CVE-2021-3749
7.5
Old and Insecure Components
axios is vulnerable to Inefficient Regular Expression Complexity
No

Direct Dependency: gulp/4.0.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

gulp/4.0.2
set-value/2.0.1
BDSA-2021-2911
8.8
No Critical Vulns
set-value is vulnerable to a prototype pollution attack due to a type confusion error which can lead to a bypass of CVE-2019-10747 (BDSA-2019-4362). A remote attacker may be able to execut ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2333
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via insufficient absolute path sanitization.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2632
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2334
7.8
Old and Insecure Components
The node-tar package is vulnerable to arbitrary file creation/overwrite issues due to a flaw in the symlink protection measures that allows for an untrusted tar file to symlink into an arbitrary l ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2634
7.8
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite via insufficient relative path sanitization.   Note: This only affects users on Windows systems.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2631
7.5
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
set-value/2.0.1
BDSA-2019-4362
7.4
Old and Insecure Components
set-value is vulnerable to prototype pollution due to insufficient input validation.  An attacker could exploit this vulnerability to modify the Object prototype properties which causes additional ...
No

gulp/4.0.2
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

gulp/4.0.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

gulp/4.0.2
kind-of/6.0.2
BDSA-2020-0551
6.7
Old and Insecure Components
The kind-of module contains a validation bypass vulnerability.  This allows attacker to potentially bypass validation checks being performed on user-supplied input by applications using the kind-o ...
No

gulp/4.0.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

gulp/4.0.2
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

gulp/4.0.2
y18n/3.2.1
BDSA-2020-3620
6.6
Old and Insecure Components
y18n is vulnerable to prototype pollution due to the unsafe construction of objects. An attacker could modify the properties of underlying prototypes by sending maliciously crafted requests to a v ...
No

gulp/4.0.2
copy-props/2.0.4
BDSA-2021-4156
6.6
Old and Insecure Components
copy-props contains a prototype pollution vulnerability. This could allow an attacker to trigger denial-of-service (DoS) or potentially result in remote code execution (RCE).
No

Direct Dependency: eslint-plugin-import/2.18.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-import/2.18.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

eslint-plugin-import/2.18.2
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: eslint/6.6.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint/6.6.0
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

eslint/6.6.0
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

eslint/6.6.0
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

eslint/6.6.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

eslint/6.6.0
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

eslint/6.6.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

eslint/6.6.0
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Direct Dependency: ajv/6.10.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
ajv/6.10.2
BDSA-2020-3798
7.1
No Critical Vulns
nodejs-ajv is vulnerable to a prototype pollution flaw. A remote attacker could leverage this to execute arbitrary code.
No

Direct Dependency: cheerio/0.22.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

cheerio/0.22.0
css-what/2.1.0
CVE-2021-33587
7.5
No Critical Vulns
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
No

cheerio/0.22.0
nth-check/1.0.1
BDSA-2021-2906
6.7
Old and Insecure Components
nth-check is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted CSS nth-checks are mishandled.  An attacker could submit a crafted string that, when bein ...
No

Direct Dependency: sitemap/1.13.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

Direct Dependency: underscore/1.9.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
underscore/1.9.1
BDSA-2021-1143
7.3
No Critical Vulns
The Underscore Javascript library contains an arbitrary code execution vulnerability.  This allows an attacker to create malicious content that, if processed by Underscore may lead to the executio ...
No

Direct Dependency: getobject/0.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
getobject/0.1.0
CVE-2020-28282
9.8
Not-Pixiapp security (project-specific)
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
No

Direct Dependency: eslint-plugin-node/9.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-node/9.2.0
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: nodemailer/4.7.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
nodemailer/4.7.0
BDSA-2020-3322
8.4
No Critical Vulns
Nodemailer is vulnerable to a command injection issue due to insufficient validation of provided email addresses.  An attacker could supply crafted email addresses in order to execute arbitrary co ...
No

-/-
nodemailer/4.7.0
BDSA-2021-4168
7.9
Old and Insecure Components
A HTTP header injection vulnerability has been identified in nodemailer. An attacker could exploit this by passing crafted input containing newlines and carriage returns to an address object.
No

Direct Dependency: mongodb/3.3.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mongodb/3.3.3
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

Direct Dependency: connect-mongodb-session/2.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

connect-mongodb-session/2.2.0
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

connect-mongodb-session/2.2.0
mpath/0.5.1
BDSA-2021-2895
6.6
Old and Insecure Components
mpath is vulnerable to prototype pollution due to the existence of a type confusion flaw. A remote attacker could modify the properties of an object by sending maliciously crafted requests to a vu ...
No

Direct Dependency: mkdirp/0.5.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mkdirp/0.5.1
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: multer/1.4.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

multer/1.4.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: express-handlebars/3.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
express-handlebars/3.1.0
CVE-2021-32820
8.6
No Critical Vulns
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the lay ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3682
8.4
No Critical Vulns
The handlebars package is vulnerable to cross-site scripting (XSS) and remote code execution (RCE) attacks due to improper validation of user-supplied input. In a cross-site scripting scenario, an ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3692
8.2
Old and Insecure Components
The handlebars package is vulnerable to arbitrary code execution via prototype pollution. A remote attacker can run malicious code by modifying properties of the Object prototype. Unsuccessful att ...
No

express-handlebars/3.1.0
minimist/0.0.10
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-0925
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to remote code execution (RCE) when compiling templates that come from untrusted sources. Successful exploitation als ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-1225
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to Prototype Pollution when compiling templates that come from untrusted sources. Although successful exploitation co ...
No

Direct Dependency: async/2.6.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

Direct Dependency: lodash/4.17.15

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

-/-
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

-/-
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

-/-
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

-/-
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Synopsys Black Duck - Vulnerabilities Reported
SUMMARY Direct Dependencies with vulnerabilities:

Direct Dependency
Changed
Num Direct Vulns
Max Direct Vuln Severity
Num Indirect Vulns
Max Indirect Vuln Severity
Upgrade to

eslint/6.6.0
No
0
0
7
8.8
v6.8.0

multer/1.4.2
No
0
0
1
7.3
v1.4.4

ajv/6.10.2
No
1
7.1
0
0
6.12.6

lodash/4.17.15
No
5
8.8
0
0
4.17.21

mongodb/3.3.3
No
0
0
1
7.9
3.7.3

connect-mongodb-session/2.2.0
No
0
0
2
7.9
2.4.1

eslint-plugin-import/2.18.2
No
0
0
2
6.7
2.25.4

underscore/1.9.1
No
1
7.3
0
0
1.13.2

mkdirp/0.5.1
No
0
0
1
7.3
0.5.5

axios/0.19.0
No
2
7.8
1
7.7
0.26.0

ava/2.4.0
No
0
0
7
9.1

express-handlebars/3.1.0
No
1
8.6
5
8.4

cheerio/0.22.0
No
0
0
2
7.5

gulp/4.0.2
No
0
0
14
8.8

eslint-plugin-node/9.2.0
No
0
0
1
6.7

sitemap/1.13.0
No
0
0
0
0

getobject/0.1.0
No
1
9.8
0
0

nodemailer/4.7.0
No
2
8.4
0
0

async/2.6.3
No
0
0
0
0

Vulnerable Direct Dependencies listed below:
Direct Dependency: ava/2.4.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

ava/2.4.0
yargs-parser/10.1.0
BDSA-2021-1478
9.1
Not-Pixiapp security (project-specific)
yargs-parser is vulnerable to privilege escalation and remote code execution (RCE) via prototype pollution.
No

ava/2.4.0
dot-prop/4.2.0
BDSA-2020-0654
7.4
No Critical Vulns
dot-prop is vulnerable to a prototype pollution flaw. A remote attacker able to supply specially crafted input to a dot-prop method could cause a denial-of-service (DoS) of the application, or aff ...
No

ava/2.4.0
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

ava/2.4.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

ava/2.4.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

ava/2.4.0
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

ava/2.4.0
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: axios/0.19.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
axios/0.19.0
BDSA-2020-3243
7.8
No Critical Vulns
It was found that axios could allow for server side request forgery (SSRF) attacks if it is used to pass user-supplied URL requests via a proxy. This vulnerability could be used to bypass the prox ...
No

axios/0.19.0
follow-redirects/1.5.10
BDSA-2022-0139
7.7
No Critical Vulns
follow-redirects contains an information disclosure vulnerability due to insecure cookie headers. An attacker could exploit this issue to disclose potentially sensitive information belonging to th ...
No

-/-
axios/0.19.0
CVE-2021-3749
7.5
Old and Insecure Components
axios is vulnerable to Inefficient Regular Expression Complexity
No

Direct Dependency: gulp/4.0.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

gulp/4.0.2
set-value/2.0.1
BDSA-2021-2911
8.8
No Critical Vulns
set-value is vulnerable to a prototype pollution attack due to a type confusion error which can lead to a bypass of CVE-2019-10747 (BDSA-2019-4362). A remote attacker may be able to execut ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2333
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via insufficient absolute path sanitization.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2632
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2334
7.8
Old and Insecure Components
The node-tar package is vulnerable to arbitrary file creation/overwrite issues due to a flaw in the symlink protection measures that allows for an untrusted tar file to symlink into an arbitrary l ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2634
7.8
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite via insufficient relative path sanitization.   Note: This only affects users on Windows systems.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2631
7.5
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
set-value/2.0.1
BDSA-2019-4362
7.4
Old and Insecure Components
set-value is vulnerable to prototype pollution due to insufficient input validation.  An attacker could exploit this vulnerability to modify the Object prototype properties which causes additional ...
No

gulp/4.0.2
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

gulp/4.0.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

gulp/4.0.2
kind-of/6.0.2
BDSA-2020-0551
6.7
Old and Insecure Components
The kind-of module contains a validation bypass vulnerability.  This allows attacker to potentially bypass validation checks being performed on user-supplied input by applications using the kind-o ...
No

gulp/4.0.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

gulp/4.0.2
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

gulp/4.0.2
y18n/3.2.1
BDSA-2020-3620
6.6
Old and Insecure Components
y18n is vulnerable to prototype pollution due to the unsafe construction of objects. An attacker could modify the properties of underlying prototypes by sending maliciously crafted requests to a v ...
No

gulp/4.0.2
copy-props/2.0.4
BDSA-2021-4156
6.6
Old and Insecure Components
copy-props contains a prototype pollution vulnerability. This could allow an attacker to trigger denial-of-service (DoS) or potentially result in remote code execution (RCE).
No

Direct Dependency: eslint-plugin-import/2.18.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-import/2.18.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

eslint-plugin-import/2.18.2
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: eslint/6.6.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint/6.6.0
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

eslint/6.6.0
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

eslint/6.6.0
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

eslint/6.6.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

eslint/6.6.0
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

eslint/6.6.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

eslint/6.6.0
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Direct Dependency: ajv/6.10.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
ajv/6.10.2
BDSA-2020-3798
7.1
No Critical Vulns
nodejs-ajv is vulnerable to a prototype pollution flaw. A remote attacker could leverage this to execute arbitrary code.
No

Direct Dependency: cheerio/0.22.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

cheerio/0.22.0
css-what/2.1.0
CVE-2021-33587
7.5
No Critical Vulns
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
No

cheerio/0.22.0
nth-check/1.0.1
BDSA-2021-2906
6.7
Old and Insecure Components
nth-check is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted CSS nth-checks are mishandled.  An attacker could submit a crafted string that, when bein ...
No

Direct Dependency: sitemap/1.13.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

Direct Dependency: underscore/1.9.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
underscore/1.9.1
BDSA-2021-1143
7.3
No Critical Vulns
The Underscore Javascript library contains an arbitrary code execution vulnerability.  This allows an attacker to create malicious content that, if processed by Underscore may lead to the executio ...
No

Direct Dependency: getobject/0.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
getobject/0.1.0
CVE-2020-28282
9.8
Not-Pixiapp security (project-specific)
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
No

Direct Dependency: eslint-plugin-node/9.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-node/9.2.0
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: nodemailer/4.7.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
nodemailer/4.7.0
BDSA-2020-3322
8.4
No Critical Vulns
Nodemailer is vulnerable to a command injection issue due to insufficient validation of provided email addresses.  An attacker could supply crafted email addresses in order to execute arbitrary co ...
No

-/-
nodemailer/4.7.0
BDSA-2021-4168
7.9
Old and Insecure Components
A HTTP header injection vulnerability has been identified in nodemailer. An attacker could exploit this by passing crafted input containing newlines and carriage returns to an address object.
No

Direct Dependency: mongodb/3.3.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mongodb/3.3.3
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

Direct Dependency: connect-mongodb-session/2.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

connect-mongodb-session/2.2.0
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

connect-mongodb-session/2.2.0
mpath/0.5.1
BDSA-2021-2895
6.6
Old and Insecure Components
mpath is vulnerable to prototype pollution due to the existence of a type confusion flaw. A remote attacker could modify the properties of an object by sending maliciously crafted requests to a vu ...
No

Direct Dependency: mkdirp/0.5.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mkdirp/0.5.1
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: multer/1.4.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

multer/1.4.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: express-handlebars/3.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
express-handlebars/3.1.0
CVE-2021-32820
8.6
No Critical Vulns
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the lay ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3682
8.4
No Critical Vulns
The handlebars package is vulnerable to cross-site scripting (XSS) and remote code execution (RCE) attacks due to improper validation of user-supplied input. In a cross-site scripting scenario, an ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3692
8.2
Old and Insecure Components
The handlebars package is vulnerable to arbitrary code execution via prototype pollution. A remote attacker can run malicious code by modifying properties of the Object prototype. Unsuccessful att ...
No

express-handlebars/3.1.0
minimist/0.0.10
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-0925
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to remote code execution (RCE) when compiling templates that come from untrusted sources. Successful exploitation als ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-1225
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to Prototype Pollution when compiling templates that come from untrusted sources. Although successful exploitation co ...
No

Direct Dependency: async/2.6.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

Direct Dependency: lodash/4.17.15

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

-/-
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

-/-
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

-/-
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

-/-
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Synopsys Black Duck - Vulnerabilities Reported
SUMMARY Direct Dependencies with vulnerabilities:

Direct Dependency
Changed
Num Direct Vulns
Max Direct Vuln Severity
Num Indirect Vulns
Max Indirect Vuln Severity
Upgrade to

Vulnerable Direct Dependencies listed below:

Synopsys Black Duck - Vulnerabilities Reported
SUMMARY Direct Dependencies with vulnerabilities:

Direct Dependency
Changed
Num Direct Vulns
Max Direct Vuln Severity
Num Indirect Vulns
Max Indirect Vuln Severity
Upgrade to

Vulnerable Direct Dependencies listed below:

Synopsys Black Duck - Vulnerabilities Reported
SUMMARY Direct Dependencies with vulnerabilities:

Direct Dependency
Changed
Num Direct Vulns
Max Direct Vuln Severity
Num Indirect Vulns
Max Indirect Vuln Severity
Upgrade to

eslint/6.6.0
No
0
0
3
7.3
v6.8.0

multer/1.4.2
No
0
0
1
7.3
v1.4.4

ajv/6.10.2
No
1
7.1
0
0
6.12.6

lodash/4.17.15
No
5
8.8
0
0
4.17.21

mongodb/3.3.3
No
0
0
1
7.9
3.7.3

connect-mongodb-session/2.2.0
No
0
0
3
7.9
2.4.1

eslint-plugin-import/2.18.2
No
0
0
2
6.7
2.25.4

underscore/1.9.1
No
1
7.3
0
0
1.13.2

mkdirp/0.5.1
No
0
0
1
7.3
0.5.5

axios/0.19.0
No
2
7.8
1
7.7
0.26.0

express-handlebars/3.1.0
No
1
8.6
5
8.4

async/2.6.3
No
0
0
5
8.8

cheerio/0.22.0
No
0
0
2
7.5

gulp/4.0.2
No
0
0
14
8.8

ava/2.4.0
No
0
0
12
9.1

eslint-plugin-node/9.2.0
No
0
0
1
6.7

sitemap/1.13.0
No
0
0
0
0

getobject/0.1.0
No
1
9.8
0
0

nodemailer/4.7.0
No
2
8.4
0
0

Vulnerable Direct Dependencies listed below:
Direct Dependency: ava/2.4.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

ava/2.4.0
yargs-parser/10.1.0
BDSA-2021-1478
9.1
Not-Pixiapp security (project-specific)
yargs-parser is vulnerable to privilege escalation and remote code execution (RCE) via prototype pollution.
No

ava/2.4.0
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

ava/2.4.0
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

ava/2.4.0
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

ava/2.4.0
dot-prop/4.2.0
BDSA-2020-0654
7.4
No Critical Vulns
dot-prop is vulnerable to a prototype pollution flaw. A remote attacker able to supply specially crafted input to a dot-prop method could cause a denial-of-service (DoS) of the application, or aff ...
No

ava/2.4.0
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

ava/2.4.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

ava/2.4.0
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

ava/2.4.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

ava/2.4.0
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

ava/2.4.0
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

ava/2.4.0
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Direct Dependency: ajv/6.10.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
ajv/6.10.2
BDSA-2020-3798
7.1
No Critical Vulns
nodejs-ajv is vulnerable to a prototype pollution flaw. A remote attacker could leverage this to execute arbitrary code.
No

Direct Dependency: eslint/6.6.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint/6.6.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

eslint/6.6.0
ajv/6.10.2
BDSA-2020-3798
7.1
No Critical Vulns
nodejs-ajv is vulnerable to a prototype pollution flaw. A remote attacker could leverage this to execute arbitrary code.
No

eslint/6.6.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

Direct Dependency: gulp/4.0.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

gulp/4.0.2
set-value/2.0.1
BDSA-2021-2911
8.8
No Critical Vulns
set-value is vulnerable to a prototype pollution attack due to a type confusion error which can lead to a bypass of CVE-2019-10747 (BDSA-2019-4362). A remote attacker may be able to execut ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2333
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via insufficient absolute path sanitization.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2632
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2334
7.8
Old and Insecure Components
The node-tar package is vulnerable to arbitrary file creation/overwrite issues due to a flaw in the symlink protection measures that allows for an untrusted tar file to symlink into an arbitrary l ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2634
7.8
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite via insufficient relative path sanitization.   Note: This only affects users on Windows systems.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2631
7.5
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
set-value/2.0.1
BDSA-2019-4362
7.4
Old and Insecure Components
set-value is vulnerable to prototype pollution due to insufficient input validation.  An attacker could exploit this vulnerability to modify the Object prototype properties which causes additional ...
No

gulp/4.0.2
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

gulp/4.0.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

gulp/4.0.2
kind-of/6.0.2
BDSA-2020-0551
6.7
Old and Insecure Components
The kind-of module contains a validation bypass vulnerability.  This allows attacker to potentially bypass validation checks being performed on user-supplied input by applications using the kind-o ...
No

gulp/4.0.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

gulp/4.0.2
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

gulp/4.0.2
y18n/3.2.1
BDSA-2020-3620
6.6
Old and Insecure Components
y18n is vulnerable to prototype pollution due to the unsafe construction of objects. An attacker could modify the properties of underlying prototypes by sending maliciously crafted requests to a v ...
No

gulp/4.0.2
copy-props/2.0.4
BDSA-2021-4156
6.6
Old and Insecure Components
copy-props contains a prototype pollution vulnerability. This could allow an attacker to trigger denial-of-service (DoS) or potentially result in remote code execution (RCE).
No

Direct Dependency: eslint-plugin-import/2.18.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-import/2.18.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

eslint-plugin-import/2.18.2
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: cheerio/0.22.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

cheerio/0.22.0
css-what/2.1.0
CVE-2021-33587
7.5
No Critical Vulns
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
No

cheerio/0.22.0
nth-check/1.0.1
BDSA-2021-2906
6.7
Old and Insecure Components
nth-check is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted CSS nth-checks are mishandled.  An attacker could submit a crafted string that, when bein ...
No

Direct Dependency: axios/0.19.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
axios/0.19.0
BDSA-2020-3243
7.8
No Critical Vulns
It was found that axios could allow for server side request forgery (SSRF) attacks if it is used to pass user-supplied URL requests via a proxy. This vulnerability could be used to bypass the prox ...
No

axios/0.19.0
follow-redirects/1.5.10
BDSA-2022-0139
7.7
No Critical Vulns
follow-redirects contains an information disclosure vulnerability due to insecure cookie headers. An attacker could exploit this issue to disclose potentially sensitive information belonging to th ...
No

-/-
axios/0.19.0
CVE-2021-3749
7.5
Old and Insecure Components
axios is vulnerable to Inefficient Regular Expression Complexity
No

Direct Dependency: sitemap/1.13.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

Direct Dependency: underscore/1.9.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
underscore/1.9.1
BDSA-2021-1143
7.3
No Critical Vulns
The Underscore Javascript library contains an arbitrary code execution vulnerability.  This allows an attacker to create malicious content that, if processed by Underscore may lead to the executio ...
No

Direct Dependency: getobject/0.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
getobject/0.1.0
CVE-2020-28282
9.8
Not-Pixiapp security (project-specific)
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
No

Direct Dependency: express-handlebars/3.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
express-handlebars/3.1.0
CVE-2021-32820
8.6
No Critical Vulns
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the lay ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3682
8.4
No Critical Vulns
The handlebars package is vulnerable to cross-site scripting (XSS) and remote code execution (RCE) attacks due to improper validation of user-supplied input. In a cross-site scripting scenario, an ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3692
8.2
Old and Insecure Components
The handlebars package is vulnerable to arbitrary code execution via prototype pollution. A remote attacker can run malicious code by modifying properties of the Object prototype. Unsuccessful att ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-0925
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to remote code execution (RCE) when compiling templates that come from untrusted sources. Successful exploitation als ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-1225
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to Prototype Pollution when compiling templates that come from untrusted sources. Although successful exploitation co ...
No

express-handlebars/3.1.0
minimist/0.0.10
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: eslint-plugin-node/9.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-node/9.2.0
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: nodemailer/4.7.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
nodemailer/4.7.0
BDSA-2020-3322
8.4
No Critical Vulns
Nodemailer is vulnerable to a command injection issue due to insufficient validation of provided email addresses.  An attacker could supply crafted email addresses in order to execute arbitrary co ...
No

-/-
nodemailer/4.7.0
BDSA-2021-4168
7.9
Old and Insecure Components
A HTTP header injection vulnerability has been identified in nodemailer. An attacker could exploit this by passing crafted input containing newlines and carriage returns to an address object.
No

Direct Dependency: connect-mongodb-session/2.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

connect-mongodb-session/2.2.0
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

connect-mongodb-session/2.2.0
mpath/0.5.1
BDSA-2021-2895
6.6
Old and Insecure Components
mpath is vulnerable to prototype pollution due to the existence of a type confusion flaw. A remote attacker could modify the properties of an object by sending maliciously crafted requests to a vu ...
No

connect-mongodb-session/2.2.0
standard-error/1.1.0
GNU Affero General Public License v3.0

Test License Policy
License violation
No

Direct Dependency: mongodb/3.3.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mongodb/3.3.3
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

Direct Dependency: mkdirp/0.5.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mkdirp/0.5.1
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: multer/1.4.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

multer/1.4.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: lodash/4.17.15

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

-/-
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

-/-
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

-/-
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

-/-
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Direct Dependency: async/2.6.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

async/2.6.3
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

async/2.6.3
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

async/2.6.3
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

async/2.6.3
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

async/2.6.3
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Synopsys Black Duck - Vulnerabilities Reported
SUMMARY Direct Dependencies with vulnerabilities:

Direct Dependency
Changed
Num Direct Vulns
Max Direct Vuln Severity
Num Indirect Vulns
Max Indirect Vuln Severity
Upgrade to

ajv/6.10.2
No
1
7.1
0
0
6.12.6

lodash/4.17.15
No
5
8.8
0
0
4.17.21

underscore/1.9.1
No
1
7.3
0
0
1.13.2

axios/0.19.0
No
2
7.8
1
7.7
0.26.0

express-handlebars/3.1.0
No
1
8.6
5
8.4

getobject/0.1.0
No
1
9.8
0
0

nodemailer/4.7.0
No
2
8.4
0
0

SUMMARY License violations:

Parent
Child Component
License
Policy Violated
Direct Dep Changed

connect-mongodb-session/2.2.0
standard-error/1.1.0
GNU Affero General Public License v3.0
Test License Policy
No

Vulnerable Direct Dependencies listed below:
Direct Dependency: ava/2.4.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

ava/2.4.0
yargs-parser/10.1.0
BDSA-2021-1478
9.1
Not-Pixiapp security (project-specific)
yargs-parser is vulnerable to privilege escalation and remote code execution (RCE) via prototype pollution.
No

ava/2.4.0
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

ava/2.4.0
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

ava/2.4.0
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

ava/2.4.0
dot-prop/4.2.0
BDSA-2020-0654
7.4
No Critical Vulns
dot-prop is vulnerable to a prototype pollution flaw. A remote attacker able to supply specially crafted input to a dot-prop method could cause a denial-of-service (DoS) of the application, or aff ...
No

ava/2.4.0
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

ava/2.4.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

ava/2.4.0
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

ava/2.4.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

ava/2.4.0
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

ava/2.4.0
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

ava/2.4.0
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Direct Dependency: ajv/6.10.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
ajv/6.10.2
BDSA-2020-3798
7.1
No Critical Vulns
nodejs-ajv is vulnerable to a prototype pollution flaw. A remote attacker could leverage this to execute arbitrary code.
No

Direct Dependency: eslint/6.6.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint/6.6.0
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

eslint/6.6.0
ajv/6.10.2
BDSA-2020-3798
7.1
No Critical Vulns
nodejs-ajv is vulnerable to a prototype pollution flaw. A remote attacker could leverage this to execute arbitrary code.
No

eslint/6.6.0
ansi-regex/4.1.0
BDSA-2021-2904
6.7
Old and Insecure Components
ansi-regex is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted ANSI escaped codes are mishandled.  An attacker could submit a crafted string that, when ...
No

Direct Dependency: gulp/4.0.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

gulp/4.0.2
set-value/2.0.1
BDSA-2021-2911
8.8
No Critical Vulns
set-value is vulnerable to a prototype pollution attack due to a type confusion error which can lead to a bypass of CVE-2019-10747 (BDSA-2019-4362). A remote attacker may be able to execut ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2333
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via insufficient absolute path sanitization.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2632
8.1
No Critical Vulns
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2334
7.8
Old and Insecure Components
The node-tar package is vulnerable to arbitrary file creation/overwrite issues due to a flaw in the symlink protection measures that allows for an untrusted tar file to symlink into an arbitrary l ...
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2634
7.8
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite via insufficient relative path sanitization.   Note: This only affects users on Windows systems.
No

gulp/4.0.2
tar/4.4.8
BDSA-2021-2631
7.5
Old and Insecure Components
The tar package for Node.js is vulnerable to arbitrary file creation/overwrite and arbitrary code execution via directory cache poisoning.
No

gulp/4.0.2
set-value/2.0.1
BDSA-2019-4362
7.4
Old and Insecure Components
set-value is vulnerable to prototype pollution due to insufficient input validation.  An attacker could exploit this vulnerability to modify the Object prototype properties which causes additional ...
No

gulp/4.0.2
ini/1.3.5
BDSA-2020-4530
7.3
No Critical Vulns
The ini package is vulnerable to prototype pollution attacks.  A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) condition. The impact of this vulnerabili ...
No

gulp/4.0.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

gulp/4.0.2
kind-of/6.0.2
BDSA-2020-0551
6.7
Old and Insecure Components
The kind-of module contains a validation bypass vulnerability.  This allows attacker to potentially bypass validation checks being performed on user-supplied input by applications using the kind-o ...
No

gulp/4.0.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

gulp/4.0.2
path-parse/1.0.5
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

gulp/4.0.2
y18n/3.2.1
BDSA-2020-3620
6.6
Old and Insecure Components
y18n is vulnerable to prototype pollution due to the unsafe construction of objects. An attacker could modify the properties of underlying prototypes by sending maliciously crafted requests to a v ...
No

gulp/4.0.2
copy-props/2.0.4
BDSA-2021-4156
6.6
Old and Insecure Components
copy-props contains a prototype pollution vulnerability. This could allow an attacker to trigger denial-of-service (DoS) or potentially result in remote code execution (RCE).
No

Direct Dependency: eslint-plugin-import/2.18.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-import/2.18.2
hosted-git-info/2.5.0
BDSA-2020-4571
6.7
Old and Insecure Components
hosted-git-info is vulnerable to regular expression denial of service (ReDoS) via fromUrl(). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume reso ...
No

eslint-plugin-import/2.18.2
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: cheerio/0.22.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

cheerio/0.22.0
css-what/2.1.0
CVE-2021-33587
7.5
No Critical Vulns
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
No

cheerio/0.22.0
nth-check/1.0.1
BDSA-2021-2906
6.7
Old and Insecure Components
nth-check is vulnerable to a regular expression denial-of-service (ReDoS) issue due to how certain crafted CSS nth-checks are mishandled.  An attacker could submit a crafted string that, when bein ...
No

Direct Dependency: axios/0.19.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
axios/0.19.0
BDSA-2020-3243
7.8
No Critical Vulns
It was found that axios could allow for server side request forgery (SSRF) attacks if it is used to pass user-supplied URL requests via a proxy. This vulnerability could be used to bypass the prox ...
No

axios/0.19.0
follow-redirects/1.5.10
BDSA-2022-0139
7.7
No Critical Vulns
follow-redirects contains an information disclosure vulnerability due to insecure cookie headers. An attacker could exploit this issue to disclose potentially sensitive information belonging to th ...
No

-/-
axios/0.19.0
CVE-2021-3749
7.5
Old and Insecure Components
axios is vulnerable to Inefficient Regular Expression Complexity
No

Direct Dependency: sitemap/1.13.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

Direct Dependency: underscore/1.9.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
underscore/1.9.1
BDSA-2021-1143
7.3
No Critical Vulns
The Underscore Javascript library contains an arbitrary code execution vulnerability.  This allows an attacker to create malicious content that, if processed by Underscore may lead to the executio ...
No

Direct Dependency: getobject/0.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
getobject/0.1.0
CVE-2020-28282
9.8
Not-Pixiapp security (project-specific)
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
No

Direct Dependency: express-handlebars/3.1.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
express-handlebars/3.1.0
CVE-2021-32820
8.6
No Critical Vulns
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the lay ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3682
8.4
No Critical Vulns
The handlebars package is vulnerable to cross-site scripting (XSS) and remote code execution (RCE) attacks due to improper validation of user-supplied input. In a cross-site scripting scenario, an ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2019-3692
8.2
Old and Insecure Components
The handlebars package is vulnerable to arbitrary code execution via prototype pollution. A remote attacker can run malicious code by modifying properties of the Object prototype. Unsuccessful att ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-0925
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to remote code execution (RCE) when compiling templates that come from untrusted sources. Successful exploitation als ...
No

express-handlebars/3.1.0
handlebars/4.4.5
BDSA-2021-1225
7.3
Old and Insecure Components
handlebars.js, an extension to the Mustache templating language, is vulnerable to Prototype Pollution when compiling templates that come from untrusted sources. Although successful exploitation co ...
No

express-handlebars/3.1.0
minimist/0.0.10
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: eslint-plugin-node/9.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

eslint-plugin-node/9.2.0
path-parse/1.0.6
BDSA-2021-2284
6.7
Old and Insecure Components
path-parse contains a vulnerability to regular expression denial of service (ReDoS). An attacker could exploit this vulnerability by supplying a maliciously crafted input to consume the applicatio ...
No

Direct Dependency: nodemailer/4.7.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
nodemailer/4.7.0
BDSA-2020-3322
8.4
No Critical Vulns
Nodemailer is vulnerable to a command injection issue due to insufficient validation of provided email addresses.  An attacker could supply crafted email addresses in order to execute arbitrary co ...
No

-/-
nodemailer/4.7.0
BDSA-2021-4168
7.9
Old and Insecure Components
A HTTP header injection vulnerability has been identified in nodemailer. An attacker could exploit this by passing crafted input containing newlines and carriage returns to an address object.
No

Direct Dependency: connect-mongodb-session/2.2.0

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

connect-mongodb-session/2.2.0
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

connect-mongodb-session/2.2.0
mpath/0.5.1
BDSA-2021-2895
6.6
Old and Insecure Components
mpath is vulnerable to prototype pollution due to the existence of a type confusion flaw. A remote attacker could modify the properties of an object by sending maliciously crafted requests to a vu ...
No

Direct Dependency: mongodb/3.3.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mongodb/3.3.3
bson/1.1.1
BDSA-2020-0604
7.9
No Critical Vulns
Bson contains a deserialization of untrusted data vulnerability due to improper handling of user input. An attacker could exploit this vulnerability through specially crafted input which could lea ...
No

Direct Dependency: mkdirp/0.5.1

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

mkdirp/0.5.1
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: multer/1.4.2

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

multer/1.4.2
minimist/0.0.8
BDSA-2020-4373
7.3
No Critical Vulns
minimist is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding ...
No

Direct Dependency: lodash/4.17.15

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

-/-
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

-/-
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

-/-
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

-/-
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

-/-
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No

Direct Dependency: async/2.6.3

Parent
Child Component
Vulnerability
Score
Policy Violated
Description
Direct Dep Changed

async/2.6.3
lodash/4.17.15
BDSA-2020-1674
8.8
No Critical Vulns
Lodash is vulnerable to remote code execution (RCE) due to the potential to modify the properties of objects in memory. A remote attacker could run arbitrary commands on a vulnerable server, or ca ...
No

async/2.6.3
lodash/4.17.15
BDSA-2021-0392
8.8
No Critical Vulns
Lodash is vulnerable to command injection via the template function. An attacker can take advantage of this vulnerability in order to run arbitrary commands.
No

async/2.6.3
lodash/4.17.15
BDSA-2020-3839
8.5
Old and Insecure Components
lodash is vulnerable to a prototype pollution flaw. A remote attacker may be able to supply specially crafted input to cause serious confidentiality, integrity and availability impacts to the appl ...
No

async/2.6.3
lodash/4.17.15
BDSA-2019-3842
7.1
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability.  This is due to multiple methods not validating the length of content supplied to it.  If an application is passing untrusted-input to the  ...
No

async/2.6.3
lodash/4.17.15
BDSA-2021-0375
6.7
Old and Insecure Components
Lodash contains a denial-of-service (DoS) vulnerability. An attacker can exploit this using crafted regular expressions to exhaust system resources.
No


Missing gauge metrics for labels only used in subprocess

When using the multiprocess collector and gauges, the exposed metrics only list those gauges that  have labels set in the parent process. Output of test case:
# HELP some_gauge Multiprocess metric
# TYPE some_gauge gauge
some_gauge{labelname="labelvalue",pid="1493"} 1.0
some_gauge{labelname="labelvalue",pid="1503"} 0.0
some_gauge{labelname="sub-process",pid="1503"} 2.0
# HELP some_gauge Some Description
# TYPE some_gauge gauge
some_gauge{labelname="labelvalue"} 1.0

I would expect at least the following additional line:
some_gauge{labelname="sub-process"} 2.0

Test case for reproducing (prometheus-client 0.7.1, Python 3.7.3)
# NOTE: Do not import any prometheus modules here, as that may initialize some of the static variables while
#       the prometheus_multiproc_dir environment variable is not yet set.
import multiprocessing
import os
import shutil
import time
from multiprocessing import current_process
from unittest import TestCase

class TestMultiProcessPrometheus(TestCase):

    @classmethod
    def setUpClass(cls) -> None:
        os.environ.update({"prometheus_multiproc_dir": "/tmp/prom"})

    def setUp(self) -> None:
        if os.path.exists("/tmp/prom"):
            shutil.rmtree("/tmp/prom")
        os.makedirs("/tmp/prom")

    def test_multiprocessing_gauge(self):
        import prometheus_client
        from prometheus_client.multiprocess import MultiProcessCollector
        from prometheus_client.registry import CollectorRegistry
        from prometheus_client import generate_latest

        gauge = prometheus_client.Gauge("some_gauge", "Some Description", labelnames=["labelname"], registry=None)
        registry = CollectorRegistry()
        MultiProcessCollector(registry=registry)
        registry.register(gauge)

        gauge.labels("labelvalue").set(1)

        def subprocess():
            gauge.labels("sub-process").set(2)

        process = multiprocessing.Process(target=subprocess)
        process.start()
        process.join()

        text = generate_latest(registry).decode('utf-8')
        print(text)
        self.assertIn('some_gauge{labelname="labelvalue"} 2.0', text.split('\n'))

This is working as I'd expect, however your usage isn't sane. In particular registry.register(gauge) is incorrect, only the MultiProcessCollector should be in that registry not any direct instrumentation.

Well, if I only register the MultiProcessCollector no metrics will ever end up in the registry, unless i use the default REGISTRY for the gauge.
Still, event with correct usage how is that the expected behavior? If process A (parent) uses labelvalue "A" and process B (child) used value "B", why is only the A metric exposed and B silently dropped?
I consider the MultiProcessCollector as a reduce operation grouped by metric name and label values. I.e. every combination of name, and labelnames should result in a reduced metric. Where am I thinking wrong?

Well, if I only register the MultiProcessCollector no metrics will ever end up in the registry, unless i use the default REGISTRY for the gauge.

That's not how multiprocess mode works, it's eschews normal registries.

why is only the A metric exposed and B silently dropped?

I don't see anything being dropped here.

I think i get it now. I took the
some_gauge{labelname="sub-process"} 2.0

as the "main metric of interest" and assumed the
some_gauge{labelname="sub-process",pid="1503"} 2.0

metrics more detailed and considered for internal use. I guess instead i should consider those as the metrics of interest.
One more thing:
In my usecase it would be nice to allow custom labename and value instead of pid=XYZ as all my processes have names matching their purpose (they are not all just "worker"). Ill get back to you if i manage to integrate such functionality into the MultiprocessCollector class :)
Thanks!


Adding missing "Elite" to  Shapeshifters and Tinkerers in instructions.json

Adding missing "Elite" to  Shapeshifters and Tinkerers in instructions.json

@Noldorion as FYI as it may need to be checked (and possibly fixed) for other languages as well.


ISPN-6859 StateTransferLock should have non-blocking API

https://issues.jboss.org/browse/ISPN-6859

I'm not an expert in this area but I like the idea! :+1:

@danberindei Besides the need to rebase this, do you have any concerns?

@danberindei Rebased, just messed imports...

Rebased and addressed comments.

@danberindei Rebased & updated.

@danberindei Are you satisfied with this PR? It looks good to me so I would like to integrate it...

@danberindei Addressed comments. Regarding the SuspectException, I've let it to wait all the time and throw an exception in the case you describe; hopefully I'll hit it again and will isolate a test case for that.

Rebased (or rather completely rewritten on the interceptor side).

@danberindei Updated.

@danberindei Updated.

Integrated, thanks Radim!


Cannot convert from 'string[]' to 'Microsoft.Quantum.Simulation.Core.IQArray'

Describe the bug
I cannot pass a string array to a Quantum Simulator.
To Reproduce
private static string Test()
{
  string[] array = new string[5];
  array[0] = "carrot";
  array[1] = "cucumber";
  array[2] = "radish";
  array[3] = "beet";
  array[4] = "potato";
  var ret = "XXX";

  using (var qsim = new QuantumSimulator())
  {
    ret = RunQSharpCode.Run(qsim, array).Result;
  }
}

operation RunQSharpCode(array : String[]) : String
{
  mutable test = "";

  for (arra in array)
  {
    test += arra;
  }

  return test;
}

Expected behavior
It to just work.
Actual behavior
error CS1503: Argument 2: cannot convert from 'string[]' to 'Microsoft.Quantum.Simulation.Core.IQArray<string>'

System information
$ lsb_release -a
LSB Version:    1.4
Distributor ID: Arch
Description:    Arch Linux
Release:        rolling
Codename:       n/a

$ dotnet --version
3.1.103

I understand that "Quantum Arrays" are just Lists under-the-hood but shouldn't the compiler implicitly convert those T[]s to IQArray<T>s?

To pass a string[] to your Q# operation, you can construct a QArray<string> object from it:
var qarray = new QArray<string>(array);
ret = RunQSharpCode.Run(qsim, qarray).Result;

Also note that in your Q# code there is a problem with the line inside the for-loop, which should be:
set test += arra;

To pass a string[] to your Q# operation, you can construct a QArray<string> object from it:
var qarray = new QArray<string>(array);
ret = RunQSharpCode.Run(qsim, qarray).Result;

Also note that in your Q# code there is a problem with the line inside the for-loop, which should be:
set test += arra;

Yupp, that’s what I’m using. I just find it tedious that a string converts implicitly but not a string array. Does the documentation state this anywhere? I had a copy of the runtime sources available so I looked through QArray.cs but that’s the only way I could figure this out, as the wanted type was IQArray<string> which is immutable.
Also, I came up with the test code for the sake of an example GitHub. My apologies for the mistake, and I’ll update the issue to fix that.

Also, I came up with the test code for the sake of an example GitHub. My apologies for the mistake, and I’ll update the issue to fix that.

No problem at all! I just thought I mentioned it in my response, since I tried out the code on my end.


APP: NFT position moving does not update in multiplayer

https://github.com/TheNexusCity/webaverse-app/pull/29


fix(settings): Fix update settings bug

Even though logseq specifies this as a number, and enforces the input is
a number, it gets saved as a string. This parses it if neccesary.
closes #6

:tada: This PR is included in version 1.0.1 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


Allow reserved characters on websocket URI

I've tried to utilize the Websocket client to request some data to Binance Exchange API, using the URI shown below:
wss://stream.binance.com:9443/ws/ethusdt@kline_15m

The problem is that the presence of '@' disables the connect button, interpreting as a non-valid character for WSS URIs. As mentioned in RFC 6455 and 3986, the '@' symbol is do part of the reserved character's group, but this doesn't turns into an invalid URI.
I do agree that Binance API syntax may not fully implement the RFC, where it should be accepting  the percent-encoded alias of '@', which is %40. But I also think that the client should not be filtering reserved characters, denying me to a send a request to a malformed API.
On a daily basis, I establish a bunch of wss connections to similar endpoints on a micro service implementation using gorilla/websocket, I can guarantee these are accepted URIs.
I have to say this is mine interpretation of the RFC, and as an inexperienced developer I could be equivocated. I'ld be glad to receive your feedback if that's the case.
To Reproduce
Steps to reproduce the behavior:

Launch Postwoman
Click on 'WebSocket'
Try to establish a connection to the example URI

Desktop

OS: Ubuntu 18.04 LTS
Browser: Firefox
npm version output

{ postwoman: '1.0.0',
  npm: '3.5.2',
  ares: '1.14.0',
  cldr: '32.0.1',
  http_parser: '2.7.1',
  icu: '60.2',
  modules: '57',
  nghttp2: '1.30.0',
  node: '8.10.0',
  openssl: '1.0.2n',
  tz: '2017c',
  unicode: '10.0',
  uv: '1.18.0',
  v8: '6.2.414.50',
  zlib: '1.2.11' }

Will fix it ASAP

Just pushed a quick fix for this issue. Please verify and let me know whether there's any issues persist

Thanks very much! Just updated, tested, and it's all good. Glad to see you're implementing a regex parser yourself, and not importing it from an "obscure" dependency.

Glad it worked out!
btw, there was an text overflowing issues with large single ling responses such as the one you mentioned. You bug report helped me find and fix that too. It's now fixed. Enjoy PW. Star the project, share among your friends/teams!


CONNECT METHOD data not recognized as client-body

Actually I am trying to resolve the error messages like these:
upstream read timed out (peer:xxx.xxx.xxx.xxx:443) while connecting to upstream
client read timed out while connecting to upstream, client: xx.xx.xx.xx

upstream read error could easily be resolved by
        proxy_connect_read_timeout 600s;
        proxy_connect_send_timeout 600s;

but it is hard to find way to resolve the client read
after investigating nginx conf directives, finally found a magic directive
client_body_timeout 600s;

the default value of client_body_timeout is set to 60.
No matter how many data transferred through CONNECT METHOD, no bits was count to client-body.
As a result, if a connect method is longer than 60s, error occurs.
Hmm, the easiest solution is put
client_body_timeout 600s;

in your nginx conf file (I think 600s is quite enough for common usage.)
The long-term solution is wish @chobits could made nginx treat data transfer as client-body.

Yea，this is a legacy.
This module borrows client_body_timeout currently, we should add new directive for proxy_connect_client_{read|write}_timeout instead.

similar to another issue: https://github.com/chobits/ngx_http_proxy_connect_module/issues/177#issuecomment-774150511

think it resolved. feel free to reopen if u still have the same problem


This started as a "simple" kludge to restore rootston hooks when xwayland restarts, I'm still not quite happy with that part so comments more than welcome: basically, I'm just copying over listeners as a list + seat from old struct to new struct and it's not very pretty and quite fragile.
I think there needs to be some work to have a wlr_xwayland_reinit() function instead of using init() that doesn't memset(0) the whole struct as blindly as I used to do. Happy to do that either in this PR or in another one. Done here.
The rest is quite good though:

some small xwm leak (there's tons left when I switch VT, but it's hard to tell where it comes from)
on restart, the shutdown happens in a different order to shutdown was completly broken, so added an event for when wlr_seat destroys itself that others can listen on.
Rootston apparently needed that event too because I kept crashing on shutdown after adding that event.

At this point, this works with no crash for me, so test plan:

start some Xwaylands stuff / wayland stuff
pkill Xwayland, Xwayland windows die (make sure there's been at least 5s since start or previous pkill)
start some new Xwayland window, they should appear (didn't previously, the last time this worked was on example compositor pre-rootston)
shutdown rootston, this shouldn't crash either.

LGTM and works, thanks!


GTM objects in the HTML file when the device does not have GTM provision

This affected some BIG-IP versions (11.0.0 as an example) as tmsh command to check LC failed.

Fixed in version 1.2.0.


Use installing package manager in README

Fixes #7411
Replaces npm commands to yarn commands if the user uses yarn

This is great. Just one small change from me and then I think we can merge it. @mrmckeb has been doing some work on this part of the code. Any concerns?

@iansu I saw the PR raised by him. I have no concerns. Let me know if you want something to be done from the end.

@iansu can you please review this PR. Is the failing test cases stopping this from getting merged? Or do you have any concerns on the PR?

I think this won't cause any issues for now, I'll need to do a rebase before we move forward on templates anyway.

@mrmckeb cool thanks. If changing the base branch to feature/templates helps you, which has your template changes. Go ahead and change the base branch. I will resolve the conflicts if any arises.

Restarting CI

Thank you!


Auto-find installation directories

It is unfortunate that when building the crates from an existing installation, we must manually specify the OPENVINO_INSTALL_DIR. In most cases, OpenVINO will install itself to a default location, e.g., /opt/intel/openvino. In build.rs, if OPENVINO_INSTALL_DIR is not present, we should check those locations before failing.

See openvino-finder.


In public when showing a text only diary entry make it bigger

For now, it is too small and we can do something more adapted with big responsive text filling the whole space

See a trick like this: https://stackoverflow.com/a/30921225/696517


Fix capitalization in RData file

Script currently fails looking for *.Rdata.
cc @prrathi

Thanks for making the capitalization consistent @MaxGhenis!


authenticator and totp giving different results

Describe the bug
Authenticator and TOTP give different results (Authenticator is correct, TOTP is wrong)
Authenticator
Code:
authenticator.options = {
    algorithm: 'sha1',
    digits: 6,
    encoding: 'hex',
    epoch: Date.now(),
    step: 30,
    window: 0,
}
authenticator.generate(this.secret)

Options:
{
  algorithm: 'sha1',
  createDigest: [Function: createDigest],
  createHmacKey: [Function: totpCreateHmacKey],
  digits: 6,
  encoding: 'hex',
  epoch:<PHONE_NUMBER>570,
  step: 30,
  window: 0,
  createRandomBytes: [Function: createRandomBytes],
  keyDecoder: [Function: keyDecoder],
  keyEncoder: [Function: keyEncoder]
}

Result: 649517
TOTP
Code:
totp.options = {
    algorithm: 'sha1',
    digits: 6,
    encoding: 'hex',
    epoch: Date.now(),
    step: 30,
    window: 0,
}
totp.generate(this.secret)

Options:
{
  algorithm: 'sha1',
  createDigest: [Function: createDigest],
  createHmacKey: [Function: totpCreateHmacKey],
  digits: 6,
  encoding: 'hex',
  epoch:<PHONE_NUMBER>570,
  step: 30,
  window: 0
}

Result: 821648

otplib version: 12.0.1
os: macOS 11.0 Big Sur
browser: Google Chrome 83
node: 14.4
frameworks (if any): express

@tsndr  are you using the exact same secret for both?
Authenticator requires the secret to be decoded first before it's used.
TOTP takes the secret AS-IS

So do I have to encode my secret to be able to use it with TOTP or is it possible to set an option to tell it that the given secret is decoded? Because that's what's in my database.

If you want to use totp on the backend, while using an authenticator compatible app to generate your tokens, then just
encode the secret before passing to the app. On the backend, you retain and use the decoded secret with totp.

Encode to what?

Ok, the secret I have is in Base32 but no matter what I do TOTP is always giving me a wrong token.

Ok, this is my secret H2OPLFINLGZR2ZWJ, why doesn't I work with TOTP? What do I have to do to get it to work?


Profiles & Formats (Youtube Chapters)

This could be added in the 0.2 or 0.2.1 release.
There is a paid app that does this. Since our tool is able to read and parse out FCP's Markers, I believe it makes sense to add this which could be valuable for the broader Youtube community.
For Youtube Chapters, the output file could be a plain .txt file. For this format, no csv or images will be created.
Marker Position Marker Name
Example -
0:00 Intro
0:53 Chapter 2
1:39 Chapter 3
3:21 Chapter 4
4:37 Chapter 5
6:47 Chapter 6
7:41 Chapter 7

@orchetect Apart from our Notion and Airtable Profiles (which is highly database centric), I think it would be great if we can prioritise and include this Profile in the during public beta of our Marker Data app. Furthermore users could realise the potential usefulness of our app.

A new YouTube profile that that only outputs a .txt file. No manifests (csv, json) and no thumbnails.
Is there a specific format for the text file? How does the user use this?

A new YouTube profile that that only outputs a .txt file. No manifests (csv, json) and no thumbnails.

Yes.

It appears to be M:SS MarkerName. In the event of > 59:59, I assume the timestamp becomes H:MM:SS?

Yes, I assume it is in H:MM:SS

If consistent with the existing done file(s), it would be done.json with "txtPath" key and the path to the text file as the value.

We don't exactly need the done file for this profile. But as you mention to keep it consistent, we can still generate it with the .txt path, if the end user needs any automation.

Example of Youtube video with timestamp with longer than 1hr.
https://www.youtube.com/watch?v=bYsL3CwDUmA

I now have this implemented as a new export profile.
For sake of clarity: We are outputting elapsed real time (wall clock time). YouTube videos start at 0:00, so we treat times as offsets from the project start (and not absolute times).
For example:
Using a project start timecode of 00:59:50:00 @ 25fps:

Marker
Marker Position

Marker 1
01:00:01:00

Marker 2
01:00:34:17

Marker 3
01:00:54:00

Would output as this for YouTube Chapters:
0:11 Marker 1
0:44 Marker 2
1:04 Marker 3

Awesome! Thanks for adding this new profile.

Will close this for now. Will re-open back, if users reports any issues.


Bugfix for state increment array referencing

A bugfix for state increment array referencing in Update Type 13 for when we have SMAP observations.
Tested to give identical results as Update Type 10 over 8 cycles.

Thanks, @amfox37, for finding this bug and putting the PR together, and sorry for introducing the bug in my cleanup.
I changed the label to 0-diff because there's no change in the results from the standard suite of nightly tests, which do not (yet) engage update_type=13.  It's also not really a science change in the new functionality (update_type=13).  Just a bug fix.


Update inf-manufacturer-section.md

fix formatting of INF Manufacturer Section documentation

Hi @jasonknichel, I'm your friendly neighborhood Microsoft Pull Request Bot (You can call me MSBOT). Thanks for your contribution!

This seems like a small (but important) contribution, so no Contribution License Agreement is required at this point. Real humans will now evaluate your PR.

TTYL, MSBOT;


Clicking on a module name on the EXTENDS line should open the module

If one clicks on a module name on the EXTENDS line in the toolbox, an editor for that module is opened (including standard modules).

@peterzeller Thanks for the update! :-)

I suggest extending SanyStdoutParser.  LSP might strategically be the preferred (@alygin had reasons not to use LSP), and the TLA+ debugger indeed introduced lsp4j in TLC. However, it does not use anything besides the DebugAdapterProtocol, and creating the infrastructure for a server process is a lot of work and might re-encounter tech dept we ran into in the past.
For trace expression/exploration, we moved Toolbox code into tla2tools.jar. Would this also make sense in this case?

FWIW: https://github.com/alygin/vscode-tlaplus/blob/775dbf770a0a182341b68e5af91e5b34965fae0e/src/commands/checkModel.ts#L240-L241 is another use-case where access to SANY's AST would be useful.


[BROOKLYN-166] Replace existing textareas for editing  YAML with Composer Tab + Codemirror

Continuatiion of work started in https://github.com/apache/incubator-brooklyn/pull/865 by @azbarcea for BROOKLYN-166

i've done the dull part, tomorrow i'll do the fun part, trying it out.  thanks @m4rkmckenna @azbarcea!

@ahgittin This PR does not address autocomplete ... thought it better to get the basic functionality in fist
Example of basic auto complete HERE

Nice work @m4rkmckenna @azbarcea .  Merged (and combined all the license items as "codemirror" with a list of files.)
It looks like we now have all the old functionality.  A few things I think still need work:
Important:

Composer should indicate whether I'm adding to catalog or deploying
In wizard popup:

need a way to get to composer when not selecting a catalog item, ie writing new yaml (common user workflow)
"preview" button is not working; it could instead become "Open in Composer"
probably no need for the tabs?

Nice to have:

In composer, blueprint-to-deploy mode could have an option "open as catalog item"
In catalog, could have "Edit" mode for blueprints that have associated yaml (would be easy and very nice i think!)

Probably not worth it:

In composer, if in catalog mode, with a single item, we could have an "open as blueprint" mode

One more important item:

The dialog should track whether it is a catalog item or a blueprint. Otherwise someone might deploy when they intended to add to the catalog!

(This will help prevent autodetect mode problems, which happen for instance if you have a comment on a line before a brooklyn.catalog: line!)

Changes are done in #5 and #7


🐛 [BUG]: elementsSelectable does not disable user selection rect

Is there an existing issue for this?

[X] I have searched the existing issues and this is a new bug.

Current Behavior
When disabling elementsSelectable the user can still create a selection box around elements and select them through that.
Expected Behavior
When elementsSelectable is set to false, a user should not be able to create a selection box.
Steps To Reproduce
No response
Relevant log output
No response
Anything else?
No response

Related PR: #378

Fixed with 1.2.1


Mail API using node js

Can I contribute to this? @YasharF

Duplicate: https://github.com/sahat/hackathon-starter/issues/1110


Update to failing retry tests

Updated retryKeepFailing and retryNoRecover to use fake clock.
Added full exception logging to build.gradle file so that exception and test failure details are available in Travis output.

It looks like your branch has unsquashed commits, and somehow I am seeing all of the old diffs again. Could you get the commits in your fork squashed so that this PR is cleaner?

Ok I think that should be a lot cleaner now

LGTM.