Fortify XML import error: exception error occurred during the report import:child index out of range

Hello,
Problem description
I am trying to import Fortify xml file. I am receiving the following error message: An exception error occurred during the report import:child index out of range. I am using Fortify v21.2.3
Steps to reproduce

Create Fortify XML file by following instructions at https://github.com/DefectDojo/django-DefectDojo/tree/master/dojo/tools/fortify
For a product navigate to Findings tab and click on import scan results.
.Fill up the required details and choose scan type as Fortify Scan and upload the xml file
See error: An exception error occurred during the report import:child index out of range

Expected behavior
Successful import of Fortify XML file
Deployment method (select with an X)

[ ] Docker Compose
[X ] Kubernetes
[ ] GoDojo

Can you provide a sample file which reproduces the error?

I am facing the same issue while importing Fortify .xml file report into Defectdojo.

From having done a quick investigation, I believe this error occurs because the parser is configured to work with the "Fortify Security Report" which appears to now be deemed a "legacy report" (see Appendix B of https://www.microfocus.com/documentation/fortify-static-code-analyzer-and-tools/2220/AWB_Guide_22.2.0.pdf).
The parser is looking for text element "[2]" of the "Properties" sub-section "[4]" of the "Detailed Project Summary" report section "[8]", (i.e. the root[8][4][2].text reference).
All it is looking for in there is existence of this line com.fortify.sca.Phase0HigherOrder.Languages= to then find the languages, e.g. com.fortify.sca.Phase0HigherOrder.Languages=python,ruby,swift.
I believe (yet to be tried) that if you follow the instructions in the manual, in section "Generating Legacy Reports" and create using the template "Fortify Security Report", the appropriate fields will be present and it can be imported.
I would then suggest someone more knowledgeable in this area than I, makes a decision as to whether the parser gets updated for the "non-legacy" report format being used in newer versions of Fortify.

Linked issue = #6082

@devdatta2019 did you manage to confirm Fortify v22 "Fortify Security Report" template was compatible with the existing parser?

@mtcolman Yes I confirmed that Fortify Security Report ( legacy report) is compatible with existing parser.

@damiencarol, as the last person to change the Fortify parser, would you have a view on the above please?

Will need fresh data to work on it.

Fortify Security Report

/MF_logo.png
Copyright 2022 Micro Focus or one of its affiliates.

Executive Summary

Issues Overview
This section provides an overview of the issues uncovered during analysis. The report covers a summary of vulnerability categories discovered by the tool. The auditor should augment this section with higher-level conclusions derived from human review of the application (including architecture reviews, black-box testing, compliance issues, etc.)
On Jan 4, 2023, a source code review was performed over the javaWebApp code base. 15 files, 126 LOC (Executable) were scanned and reviewed for defects that could lead to potential security vulnerabilities. A total of 22 reviewed findings were uncovered during the analysis.

Issue Summary by Fortify Priority Order
A table summarizing the number of issues found and the breakdown of issues in each Fortify Priority Level

Fortify Priority Order
Analysis

Low

High

Recommendations and Conclusions
This section gives some high-level recommendations on remediating the issues discussed in the Issues Summary sub section. Recommendations will vary based on deployment scenarios, risk appetite, and existing mitigating strategies. The auditor should supplement the Fortify generic recommendations with specific information that takes into account the application specific variables.
The Issues Category section provides Fortify recommendations for addressing issues at a generic level.  The recommendations for specific fixes can be extrapolated from those generic recommendations by the development group.

Project Summary

Code Base Summary
Summary of the Codebase that was analyzed
Code location: C:/Fortify/Fortify_SCA_and_Apps_22.1.0/Samples/advanced/javaWebApp/LoginProject
Number of Files: 15
Lines of Code: 126
Build Label: <No Build Label>

Scan Information
Details of the analysis
Scan time: 01:14
SCA Engine version: <IP_ADDRESS>6
Machine Name: LT094139
Username running scan: n170294

Results Certification
A full summary of the Results Certification for this project
Results Certification Valid
Details:
Results Signature:
SCA Analysis Results has Valid signature

Rules Signature:
There were no custom rules used in this scan</Text>
    </SubSection>
    <SubSection enabled="true">
        <Title>Attack Surface</Title>
        <Description>A full summary of the attack surface for this project</Description>
        <Text>Attack Surface:

System Information:
null.null.null
Web:
null.null.null

Filter Set Summary
A brief summary of the filterset used to create this report
Current Enabled Filter Set:
Security Auditor View
Filter Set Details:
Folder Filters:
If [fortify priority order] contains critical Then set folder to Critical
If [fortify priority order] contains high Then set folder to High
If [fortify priority order] contains medium Then set folder to Medium
If [fortify priority order] contains low Then set folder to Low

Audit Guide Summary
Summary of the impact of the audit guide
Audit guide not enabled

Results Outline

Overall number of results
Results count
The scan found 22 issues.

Vulnerability Examples by Category
Results summary for critical and high priority issues.  Vulnerability examples are provided by category.

[fortify priority order]:critical OR [fortify priority order]:high

Category
Analysis

Privacy Violation: Autocomplete

Abstract
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.

Explanation
With autocompletion enabled, some browsers retain user input across sessions, which could allow someone using the computer after the initial user to see information previously submitted.

Recommendations
Explicitly disable autocompletion on forms or sensitive inputs. By disabling autocompletion, information previously entered will not be presented back to the user as they type. It will also disable the "remember my password" functionality of most major browsers.
Example 1: In an  HTML form, disable autocompletion for all input fields by explicitly setting the value of the autocomplete attribute to off on the form tag.
<form method="post" autocomplete="off">
Address: <input name="address" />
Password: <input name="password" type="password" />
</form>
Example 2: Alternatively, disable autocompletion for specific input fields by explicitly setting the value of the autocomplete attribute to off on the corresponding tags.
<form method="post">
Address: <input name="address" />
Password: <input name="password" type="password" autocomplete="off"/>
</form>
Note that the default value of the autocomplete attributed is on. Therefore do not omit the attribute when dealing with sensitive inputs.

<Unaudited>
0

Not an Issue
4

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Privacy Violation: Autocomplete
High
Security Features
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

login.html
login.html
19
        ç”¨æˆ·ç™»å½•

USER:
 <input type="text" name="user"></input>

PASS:
<input type="password" name="pass"></input>

null()

Unreleased Resource: Database

Abstract
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.

Explanation
Resource leaks have at least two common causes:

Error conditions and other exceptional circumstances.

Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service attack by depleting the resource pool.
Example: Under normal conditions, the following code executes a database query, processes the results returned by the database, and closes the allocated statement object. But if an exception occurs while executing the SQL or processing the results, the statement object will not be closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries.
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
harvestResults(rs);
stmt.close();

Recommendations
1. Never rely on finalize() to reclaim resources. In order for an object's finalize() method to be invoked, the garbage collector must determine that the object is eligible for garbage collection. Because the garbage collector is not required to run unless the JVM is low on memory, there is no guarantee that an object's finalize() method will be invoked in an expedient fashion. When the garbage collector finally does run, it may cause a large number of resources to be reclaimed in a short period of time, which can lead to "bursty" performance and lower overall system throughput. This effect becomes more pronounced as the load on the system increases.
Finally, if it is possible for a resource reclamation operation to hang (if it requires communicating over a network to a database, for example), then the thread that is executing the finalize() method will hang.

Release resources in a finally block. The code for the Example should be rewritten as follows:

public void execCxnSql(Connection conn) {
Statement stmt;
try {
stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
...
}
finally {
if (stmt != null) {
safeClose(stmt);
}
}
}
public static void safeClose(Statement stmt) {
if (stmt != null) {
try {
stmt.close();
} catch (SQLException e) {
log(e);
}
}
}
This solution uses a helper function to log the exceptions that might occur when trying to close the statement. Presumably this helper function will be reused whenever a statement needs to be closed.
Also, the execCxnSql method does not initialize the stmt object to null. Instead, it checks to ensure that stmt is not null before calling safeClose(). Without the null check, the Java compiler reports that stmt might not be initialized. This choice takes advantage of Java's ability to detect uninitialized variables. If stmt is initialized to null in a more complex method, cases in which stmt is used without being initialized will not be detected by the compiler.

Tips
1. Be aware that closing a database connection may or may not automatically free other resources associated with the connection object. If the application uses connection pooling, it is best to explicitly close the other resources after the connection is closed. If the application is not using connection pooling, the other resources are automatically closed when the database connection is closed. In such a case, this vulnerability is invalid.

<Unaudited>
0

Not an Issue
1

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Unreleased Resource: Database
High
Code Quality
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

MyContextListener.java
src/adrui/MyContextListener.java
28
		try{
Class.forName(driver);//åŠ è½½é©±åŠ¨ç¨‹åº�ç±», é«˜ç‰ˆæœ¬jdbcå�¯ä»¥çœ�åŽ», ç›¸å…³å�¯è‡ªè¡Œç™¾åº¦
Connection conn = DriverManager.getConnection(url, user, pass);
sc.setAttribute("conn", conn);
System.out.println("Connect Succeed!");
conn = getConnection(...)

Issue Count by Category

Issues By Category

Category
Analysis

Privacy Violation: Autocomplete

Cross-Site Request Forgery

Poor Error Handling: Overly Broad Catch

Poor Logging Practice: Use of a System Output Stream

System Information Leak

SQL Injection

J2EE Bad Practices: getConnection()

J2EE Misconfiguration: Excessive Session Timeout

J2EE Misconfiguration: Missing Error Handling

Unreleased Resource: Database

Issue Breakdown by Analysis

Issue by Analysis

Analysis
Analysis

Not an Issue

`

Fortify Security Report

/MF_logo.png
Copyright 2022 Micro Focus or one of its affiliates.

Executive Summary

Issues Overview
This section provides an overview of the issues uncovered during analysis. The report covers a summary of vulnerability categories discovered by the tool. The auditor should augment this section with higher-level conclusions derived from human review of the application (including architecture reviews, black-box testing, compliance issues, etc.)
On Jan 4, 2023, a source code review was performed over the javaWebApp code base. 15 files, 126 LOC (Executable) were scanned and reviewed for defects that could lead to potential security vulnerabilities. A total of 22 reviewed findings were uncovered during the analysis.

Issue Summary by Fortify Priority Order
A table summarizing the number of issues found and the breakdown of issues in each Fortify Priority Level

Fortify Priority Order
Analysis

Low

High

Recommendations and Conclusions
This section gives some high-level recommendations on remediating the issues discussed in the Issues Summary sub section. Recommendations will vary based on deployment scenarios, risk appetite, and existing mitigating strategies. The auditor should supplement the Fortify generic recommendations with specific information that takes into account the application specific variables.
The Issues Category section provides Fortify recommendations for addressing issues at a generic level.  The recommendations for specific fixes can be extrapolated from those generic recommendations by the development group.

Project Summary

Code Base Summary
Summary of the Codebase that was analyzed
Code location: C:/Fortify/Fortify_SCA_and_Apps_22.1.0/Samples/advanced/javaWebApp/LoginProject
Number of Files: 15
Lines of Code: 126
Build Label: <No Build Label>

Scan Information
Details of the analysis
Scan time: 01:14
SCA Engine version: <IP_ADDRESS>6
Machine Name: LT094139
Username running scan: n170294

Results Certification
A full summary of the Results Certification for this project
Results Certification Valid
Details:
Results Signature:
SCA Analysis Results has Valid signature

Rules Signature:
There were no custom rules used in this scan</Text>
    </SubSection>
    <SubSection enabled="true">
        <Title>Attack Surface</Title>
        <Description>A full summary of the attack surface for this project</Description>
        <Text>Attack Surface:

System Information:
null.null.null
Web:
null.null.null

Filter Set Summary
A brief summary of the filterset used to create this report
Current Enabled Filter Set:
Security Auditor View
Filter Set Details:
Folder Filters:
If [fortify priority order] contains critical Then set folder to Critical
If [fortify priority order] contains high Then set folder to High
If [fortify priority order] contains medium Then set folder to Medium
If [fortify priority order] contains low Then set folder to Low

Audit Guide Summary
Summary of the impact of the audit guide
Audit guide not enabled

Results Outline

Overall number of results
Results count
The scan found 22 issues.

Vulnerability Examples by Category
Results summary for critical and high priority issues.  Vulnerability examples are provided by category.

[fortify priority order]:critical OR [fortify priority order]:high

Category
Analysis

Privacy Violation: Autocomplete

Abstract
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.

Explanation
With autocompletion enabled, some browsers retain user input across sessions, which could allow someone using the computer after the initial user to see information previously submitted.

Recommendations
Explicitly disable autocompletion on forms or sensitive inputs. By disabling autocompletion, information previously entered will not be presented back to the user as they type. It will also disable the "remember my password" functionality of most major browsers.
Example 1: In an  HTML form, disable autocompletion for all input fields by explicitly setting the value of the autocomplete attribute to off on the form tag.
<form method="post" autocomplete="off">
Address: <input name="address" />
Password: <input name="password" type="password" />
</form>
Example 2: Alternatively, disable autocompletion for specific input fields by explicitly setting the value of the autocomplete attribute to off on the corresponding tags.
<form method="post">
Address: <input name="address" />
Password: <input name="password" type="password" autocomplete="off"/>
</form>
Note that the default value of the autocomplete attributed is on. Therefore do not omit the attribute when dealing with sensitive inputs.

<Unaudited>
0

Not an Issue
4

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Privacy Violation: Autocomplete
High
Security Features
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

login.html
login.html
19
        ç”¨æˆ·ç™»å½•

USER:
 <input type="text" name="user"></input>

PASS:
<input type="password" name="pass"></input>

null()

Unreleased Resource: Database

Abstract
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.

Explanation
Resource leaks have at least two common causes:

Error conditions and other exceptional circumstances.

Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service attack by depleting the resource pool.
Example: Under normal conditions, the following code executes a database query, processes the results returned by the database, and closes the allocated statement object. But if an exception occurs while executing the SQL or processing the results, the statement object will not be closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries.
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
harvestResults(rs);
stmt.close();

Recommendations
1. Never rely on finalize() to reclaim resources. In order for an object's finalize() method to be invoked, the garbage collector must determine that the object is eligible for garbage collection. Because the garbage collector is not required to run unless the JVM is low on memory, there is no guarantee that an object's finalize() method will be invoked in an expedient fashion. When the garbage collector finally does run, it may cause a large number of resources to be reclaimed in a short period of time, which can lead to "bursty" performance and lower overall system throughput. This effect becomes more pronounced as the load on the system increases.
Finally, if it is possible for a resource reclamation operation to hang (if it requires communicating over a network to a database, for example), then the thread that is executing the finalize() method will hang.

Release resources in a finally block. The code for the Example should be rewritten as follows:

public void execCxnSql(Connection conn) {
Statement stmt;
try {
stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
...
}
finally {
if (stmt != null) {
safeClose(stmt);
}
}
}
public static void safeClose(Statement stmt) {
if (stmt != null) {
try {
stmt.close();
} catch (SQLException e) {
log(e);
}
}
}
This solution uses a helper function to log the exceptions that might occur when trying to close the statement. Presumably this helper function will be reused whenever a statement needs to be closed.
Also, the execCxnSql method does not initialize the stmt object to null. Instead, it checks to ensure that stmt is not null before calling safeClose(). Without the null check, the Java compiler reports that stmt might not be initialized. This choice takes advantage of Java's ability to detect uninitialized variables. If stmt is initialized to null in a more complex method, cases in which stmt is used without being initialized will not be detected by the compiler.

Tips
1. Be aware that closing a database connection may or may not automatically free other resources associated with the connection object. If the application uses connection pooling, it is best to explicitly close the other resources after the connection is closed. If the application is not using connection pooling, the other resources are automatically closed when the database connection is closed. In such a case, this vulnerability is invalid.

<Unaudited>
0

Not an Issue
1

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Unreleased Resource: Database
High
Code Quality
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

MyContextListener.java
src/adrui/MyContextListener.java
28
		try{
Class.forName(driver);//åŠ è½½é©±åŠ¨ç¨‹åº�ç±», é«˜ç‰ˆæœ¬jdbcå�¯ä»¥çœ�åŽ», ç›¸å…³å�¯è‡ªè¡Œç™¾åº¦
Connection conn = DriverManager.getConnection(url, user, pass);
sc.setAttribute("conn", conn);
System.out.println("Connect Succeed!");
conn = getConnection(...)

Issue Count by Category

Issues By Category

Category
Analysis

Privacy Violation: Autocomplete

Cross-Site Request Forgery

Poor Error Handling: Overly Broad Catch

Poor Logging Practice: Use of a System Output Stream

System Information Leak

SQL Injection

J2EE Bad Practices: getConnection()

J2EE Misconfiguration: Excessive Session Timeout

J2EE Misconfiguration: Missing Error Handling

Unreleased Resource: Database

Issue Breakdown by Analysis

Issue by Analysis

Analysis
Analysis

Not an Issue

`

`

Fortify Security Report

/MF_logo.png
Copyright 2022 Micro Focus or one of its affiliates.

Executive Summary

Issues Overview
This section provides an overview of the issues uncovered during analysis. The report covers a summary of vulnerability categories discovered by the tool. The auditor should augment this section with higher-level conclusions derived from human review of the application (including architecture reviews, black-box testing, compliance issues, etc.)
On Jan 4, 2023, a source code review was performed over the javaWebApp code base. 15 files, 126 LOC (Executable) were scanned and reviewed for defects that could lead to potential security vulnerabilities. A total of 22 reviewed findings were uncovered during the analysis.

Issue Summary by Fortify Priority Order
A table summarizing the number of issues found and the breakdown of issues in each Fortify Priority Level

Fortify Priority Order
Analysis

Low

High

Recommendations and Conclusions
This section gives some high-level recommendations on remediating the issues discussed in the Issues Summary sub section. Recommendations will vary based on deployment scenarios, risk appetite, and existing mitigating strategies. The auditor should supplement the Fortify generic recommendations with specific information that takes into account the application specific variables.
The Issues Category section provides Fortify recommendations for addressing issues at a generic level.  The recommendations for specific fixes can be extrapolated from those generic recommendations by the development group.

Project Summary

Code Base Summary
Summary of the Codebase that was analyzed
Code location: C:/Fortify/Fortify_SCA_and_Apps_22.1.0/Samples/advanced/javaWebApp/LoginProject
Number of Files: 15
Lines of Code: 126
Build Label: <No Build Label>

Scan Information
Details of the analysis
Scan time: 01:14
SCA Engine version: <IP_ADDRESS>6
Machine Name: LT094139
Username running scan: n170294

Results Certification
A full summary of the Results Certification for this project
Results Certification Valid
Details:
Results Signature:
SCA Analysis Results has Valid signature

Rules Signature:
There were no custom rules used in this scan</Text>
    </SubSection>
    <SubSection enabled="true">
        <Title>Attack Surface</Title>
        <Description>A full summary of the attack surface for this project</Description>
        <Text>Attack Surface:

System Information:
null.null.null
Web:
null.null.null

Filter Set Summary
A brief summary of the filterset used to create this report
Current Enabled Filter Set:
Security Auditor View
Filter Set Details:
Folder Filters:
If [fortify priority order] contains critical Then set folder to Critical
If [fortify priority order] contains high Then set folder to High
If [fortify priority order] contains medium Then set folder to Medium
If [fortify priority order] contains low Then set folder to Low

Audit Guide Summary
Summary of the impact of the audit guide
Audit guide not enabled

Results Outline

Overall number of results
Results count
The scan found 22 issues.

Vulnerability Examples by Category
Results summary for critical and high priority issues.  Vulnerability examples are provided by category.

[fortify priority order]:critical OR [fortify priority order]:high

Category
Analysis

Privacy Violation: Autocomplete

Abstract
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.

Explanation
With autocompletion enabled, some browsers retain user input across sessions, which could allow someone using the computer after the initial user to see information previously submitted.

Recommendations
Explicitly disable autocompletion on forms or sensitive inputs. By disabling autocompletion, information previously entered will not be presented back to the user as they type. It will also disable the "remember my password" functionality of most major browsers.
Example 1: In an  HTML form, disable autocompletion for all input fields by explicitly setting the value of the autocomplete attribute to off on the form tag.
<form method="post" autocomplete="off">
Address: <input name="address" />
Password: <input name="password" type="password" />
</form>
Example 2: Alternatively, disable autocompletion for specific input fields by explicitly setting the value of the autocomplete attribute to off on the corresponding tags.
<form method="post">
Address: <input name="address" />
Password: <input name="password" type="password" autocomplete="off"/>
</form>
Note that the default value of the autocomplete attributed is on. Therefore do not omit the attribute when dealing with sensitive inputs.

<Unaudited>
0

Not an Issue
4

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Privacy Violation: Autocomplete
High
Security Features
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

login.html
login.html
19
        ç”¨æˆ·ç™»å½•

USER:
 <input type="text" name="user"></input>

PASS:
<input type="password" name="pass"></input>

null()

Unreleased Resource: Database

Abstract
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.

Explanation
Resource leaks have at least two common causes:

Error conditions and other exceptional circumstances.

Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service attack by depleting the resource pool.
Example: Under normal conditions, the following code executes a database query, processes the results returned by the database, and closes the allocated statement object. But if an exception occurs while executing the SQL or processing the results, the statement object will not be closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries.
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
harvestResults(rs);
stmt.close();

Recommendations
1. Never rely on finalize() to reclaim resources. In order for an object's finalize() method to be invoked, the garbage collector must determine that the object is eligible for garbage collection. Because the garbage collector is not required to run unless the JVM is low on memory, there is no guarantee that an object's finalize() method will be invoked in an expedient fashion. When the garbage collector finally does run, it may cause a large number of resources to be reclaimed in a short period of time, which can lead to "bursty" performance and lower overall system throughput. This effect becomes more pronounced as the load on the system increases.
Finally, if it is possible for a resource reclamation operation to hang (if it requires communicating over a network to a database, for example), then the thread that is executing the finalize() method will hang.

Release resources in a finally block. The code for the Example should be rewritten as follows:

public void execCxnSql(Connection conn) {
Statement stmt;
try {
stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
...
}
finally {
if (stmt != null) {
safeClose(stmt);
}
}
}
public static void safeClose(Statement stmt) {
if (stmt != null) {
try {
stmt.close();
} catch (SQLException e) {
log(e);
}
}
}
This solution uses a helper function to log the exceptions that might occur when trying to close the statement. Presumably this helper function will be reused whenever a statement needs to be closed.
Also, the execCxnSql method does not initialize the stmt object to null. Instead, it checks to ensure that stmt is not null before calling safeClose(). Without the null check, the Java compiler reports that stmt might not be initialized. This choice takes advantage of Java's ability to detect uninitialized variables. If stmt is initialized to null in a more complex method, cases in which stmt is used without being initialized will not be detected by the compiler.

Tips
1. Be aware that closing a database connection may or may not automatically free other resources associated with the connection object. If the application uses connection pooling, it is best to explicitly close the other resources after the connection is closed. If the application is not using connection pooling, the other resources are automatically closed when the database connection is closed. In such a case, this vulnerability is invalid.

<Unaudited>
0

Not an Issue
1

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Unreleased Resource: Database
High
Code Quality
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

MyContextListener.java
src/adrui/MyContextListener.java
28
		try{
Class.forName(driver);//åŠ è½½é©±åŠ¨ç¨‹åº�ç±», é«˜ç‰ˆæœ¬jdbcå�¯ä»¥çœ�åŽ», ç›¸å…³å�¯è‡ªè¡Œç™¾åº¦
Connection conn = DriverManager.getConnection(url, user, pass);
sc.setAttribute("conn", conn);
System.out.println("Connect Succeed!");
conn = getConnection(...)

Issue Count by Category

Issues By Category

Category
Analysis

Privacy Violation: Autocomplete

Cross-Site Request Forgery

Poor Error Handling: Overly Broad Catch

Poor Logging Practice: Use of a System Output Stream

System Information Leak

SQL Injection

J2EE Bad Practices: getConnection()

J2EE Misconfiguration: Excessive Session Timeout

J2EE Misconfiguration: Missing Error Handling

Unreleased Resource: Database

Issue Breakdown by Analysis

Issue by Analysis

Analysis
Analysis

Not an Issue

`

Fortify Security Report

/MF_logo.png
Copyright 2022 Micro Focus or one of its affiliates.

Executive Summary

Issues Overview
This section provides an overview of the issues uncovered during analysis. The report covers a summary of vulnerability categories discovered by the tool. The auditor should augment this section with higher-level conclusions derived from human review of the application (including architecture reviews, black-box testing, compliance issues, etc.)
On Jan 4, 2023, a source code review was performed over the javaWebApp code base. 15 files, 126 LOC (Executable) were scanned and reviewed for defects that could lead to potential security vulnerabilities. A total of 22 reviewed findings were uncovered during the analysis.

Issue Summary by Fortify Priority Order
A table summarizing the number of issues found and the breakdown of issues in each Fortify Priority Level

Fortify Priority Order
Analysis

Low

High

Recommendations and Conclusions
This section gives some high-level recommendations on remediating the issues discussed in the Issues Summary sub section. Recommendations will vary based on deployment scenarios, risk appetite, and existing mitigating strategies. The auditor should supplement the Fortify generic recommendations with specific information that takes into account the application specific variables.
The Issues Category section provides Fortify recommendations for addressing issues at a generic level.  The recommendations for specific fixes can be extrapolated from those generic recommendations by the development group.

Project Summary

Code Base Summary
Summary of the Codebase that was analyzed
Code location: C:/Fortify/Fortify_SCA_and_Apps_22.1.0/Samples/advanced/javaWebApp/LoginProject
Number of Files: 15
Lines of Code: 126
Build Label: <No Build Label>

Scan Information
Details of the analysis
Scan time: 01:14
SCA Engine version: <IP_ADDRESS>6
Machine Name: LT094139
Username running scan: n170294

Results Certification
A full summary of the Results Certification for this project
Results Certification Valid
Details:
Results Signature:
SCA Analysis Results has Valid signature

Rules Signature:
There were no custom rules used in this scan</Text>
    </SubSection>
    <SubSection enabled="true">
        <Title>Attack Surface</Title>
        <Description>A full summary of the attack surface for this project</Description>
        <Text>Attack Surface:

System Information:
null.null.null
Web:
null.null.null

Filter Set Summary
A brief summary of the filterset used to create this report
Current Enabled Filter Set:
Security Auditor View
Filter Set Details:
Folder Filters:
If [fortify priority order] contains critical Then set folder to Critical
If [fortify priority order] contains high Then set folder to High
If [fortify priority order] contains medium Then set folder to Medium
If [fortify priority order] contains low Then set folder to Low

Audit Guide Summary
Summary of the impact of the audit guide
Audit guide not enabled

Results Outline

Overall number of results
Results count
The scan found 22 issues.

Vulnerability Examples by Category
Results summary for critical and high priority issues.  Vulnerability examples are provided by category.

[fortify priority order]:critical OR [fortify priority order]:high

Category
Analysis

Privacy Violation: Autocomplete

Abstract
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.

Explanation
With autocompletion enabled, some browsers retain user input across sessions, which could allow someone using the computer after the initial user to see information previously submitted.

Recommendations
Explicitly disable autocompletion on forms or sensitive inputs. By disabling autocompletion, information previously entered will not be presented back to the user as they type. It will also disable the "remember my password" functionality of most major browsers.
Example 1: In an  HTML form, disable autocompletion for all input fields by explicitly setting the value of the autocomplete attribute to off on the form tag.
<form method="post" autocomplete="off">
Address: <input name="address" />
Password: <input name="password" type="password" />
</form>
Example 2: Alternatively, disable autocompletion for specific input fields by explicitly setting the value of the autocomplete attribute to off on the corresponding tags.
<form method="post">
Address: <input name="address" />
Password: <input name="password" type="password" autocomplete="off"/>
</form>
Note that the default value of the autocomplete attributed is on. Therefore do not omit the attribute when dealing with sensitive inputs.

<Unaudited>
0

Not an Issue
4

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Privacy Violation: Autocomplete
High
Security Features
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

login.html
login.html
19
        ç”¨æˆ·ç™»å½•

USER:
 <input type="text" name="user"></input>

PASS:
<input type="password" name="pass"></input>

null()

Unreleased Resource: Database

Abstract
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.

Explanation
Resource leaks have at least two common causes:

Error conditions and other exceptional circumstances.

Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service attack by depleting the resource pool.
Example: Under normal conditions, the following code executes a database query, processes the results returned by the database, and closes the allocated statement object. But if an exception occurs while executing the SQL or processing the results, the statement object will not be closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries.
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
harvestResults(rs);
stmt.close();

Recommendations
1. Never rely on finalize() to reclaim resources. In order for an object's finalize() method to be invoked, the garbage collector must determine that the object is eligible for garbage collection. Because the garbage collector is not required to run unless the JVM is low on memory, there is no guarantee that an object's finalize() method will be invoked in an expedient fashion. When the garbage collector finally does run, it may cause a large number of resources to be reclaimed in a short period of time, which can lead to "bursty" performance and lower overall system throughput. This effect becomes more pronounced as the load on the system increases.
Finally, if it is possible for a resource reclamation operation to hang (if it requires communicating over a network to a database, for example), then the thread that is executing the finalize() method will hang.

Release resources in a finally block. The code for the Example should be rewritten as follows:

public void execCxnSql(Connection conn) {
Statement stmt;
try {
stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
...
}
finally {
if (stmt != null) {
safeClose(stmt);
}
}
}
public static void safeClose(Statement stmt) {
if (stmt != null) {
try {
stmt.close();
} catch (SQLException e) {
log(e);
}
}
}
This solution uses a helper function to log the exceptions that might occur when trying to close the statement. Presumably this helper function will be reused whenever a statement needs to be closed.
Also, the execCxnSql method does not initialize the stmt object to null. Instead, it checks to ensure that stmt is not null before calling safeClose(). Without the null check, the Java compiler reports that stmt might not be initialized. This choice takes advantage of Java's ability to detect uninitialized variables. If stmt is initialized to null in a more complex method, cases in which stmt is used without being initialized will not be detected by the compiler.

Tips
1. Be aware that closing a database connection may or may not automatically free other resources associated with the connection object. If the application uses connection pooling, it is best to explicitly close the other resources after the connection is closed. If the application is not using connection pooling, the other resources are automatically closed when the database connection is closed. In such a case, this vulnerability is invalid.

<Unaudited>
0

Not an Issue
1

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Unreleased Resource: Database
High
Code Quality
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

MyContextListener.java
src/adrui/MyContextListener.java
28
		try{
Class.forName(driver);//åŠ è½½é©±åŠ¨ç¨‹åº�ç±», é«˜ç‰ˆæœ¬jdbcå�¯ä»¥çœ�åŽ», ç›¸å…³å�¯è‡ªè¡Œç™¾åº¦
Connection conn = DriverManager.getConnection(url, user, pass);
sc.setAttribute("conn", conn);
System.out.println("Connect Succeed!");
conn = getConnection(...)

Issue Count by Category

Issues By Category

Category
Analysis

Privacy Violation: Autocomplete

Cross-Site Request Forgery

Poor Error Handling: Overly Broad Catch

Poor Logging Practice: Use of a System Output Stream

System Information Leak

SQL Injection

J2EE Bad Practices: getConnection()

J2EE Misconfiguration: Excessive Session Timeout

J2EE Misconfiguration: Missing Error Handling

Unreleased Resource: Database

Issue Breakdown by Analysis

Issue by Analysis

Analysis
Analysis

Not an Issue

`

Fortify Security Report

/MF_logo.png
Copyright 2022 Micro Focus or one of its affiliates.

Executive Summary

Issues Overview
This section provides an overview of the issues uncovered during analysis. The report covers a summary of vulnerability categories discovered by the tool. The auditor should augment this section with higher-level conclusions derived from human review of the application (including architecture reviews, black-box testing, compliance issues, etc.)
On Jan 4, 2023, a source code review was performed over the javaWebApp code base. 15 files, 126 LOC (Executable) were scanned and reviewed for defects that could lead to potential security vulnerabilities. A total of 22 reviewed findings were uncovered during the analysis.

Issue Summary by Fortify Priority Order
A table summarizing the number of issues found and the breakdown of issues in each Fortify Priority Level

Fortify Priority Order
Analysis

Low

High

Recommendations and Conclusions
This section gives some high-level recommendations on remediating the issues discussed in the Issues Summary sub section. Recommendations will vary based on deployment scenarios, risk appetite, and existing mitigating strategies. The auditor should supplement the Fortify generic recommendations with specific information that takes into account the application specific variables.
The Issues Category section provides Fortify recommendations for addressing issues at a generic level.  The recommendations for specific fixes can be extrapolated from those generic recommendations by the development group.

Project Summary

Code Base Summary
Summary of the Codebase that was analyzed
Code location: C:/Fortify/Fortify_SCA_and_Apps_22.1.0/Samples/advanced/javaWebApp/LoginProject
Number of Files: 15
Lines of Code: 126
Build Label: <No Build Label>

Scan Information
Details of the analysis
Scan time: 01:14
SCA Engine version: <IP_ADDRESS>6
Machine Name: LT094139
Username running scan: n170294

Results Certification
A full summary of the Results Certification for this project
Results Certification Valid
Details:
Results Signature:
SCA Analysis Results has Valid signature

Rules Signature:
There were no custom rules used in this scan</Text>
    </SubSection>
    <SubSection enabled="true">
        <Title>Attack Surface</Title>
        <Description>A full summary of the attack surface for this project</Description>
        <Text>Attack Surface:

System Information:
null.null.null
Web:
null.null.null

Filter Set Summary
A brief summary of the filterset used to create this report
Current Enabled Filter Set:
Security Auditor View
Filter Set Details:
Folder Filters:
If [fortify priority order] contains critical Then set folder to Critical
If [fortify priority order] contains high Then set folder to High
If [fortify priority order] contains medium Then set folder to Medium
If [fortify priority order] contains low Then set folder to Low

Audit Guide Summary
Summary of the impact of the audit guide
Audit guide not enabled

Results Outline

Overall number of results
Results count
The scan found 22 issues.

Vulnerability Examples by Category
Results summary for critical and high priority issues.  Vulnerability examples are provided by category.

[fortify priority order]:critical OR [fortify priority order]:high

Category
Analysis

Privacy Violation: Autocomplete

Abstract
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.

Explanation
With autocompletion enabled, some browsers retain user input across sessions, which could allow someone using the computer after the initial user to see information previously submitted.

Recommendations
Explicitly disable autocompletion on forms or sensitive inputs. By disabling autocompletion, information previously entered will not be presented back to the user as they type. It will also disable the "remember my password" functionality of most major browsers.
Example 1: In an  HTML form, disable autocompletion for all input fields by explicitly setting the value of the autocomplete attribute to off on the form tag.
<form method="post" autocomplete="off">
Address: <input name="address" />
Password: <input name="password" type="password" />
</form>
Example 2: Alternatively, disable autocompletion for specific input fields by explicitly setting the value of the autocomplete attribute to off on the corresponding tags.
<form method="post">
Address: <input name="address" />
Password: <input name="password" type="password" autocomplete="off"/>
</form>
Note that the default value of the autocomplete attributed is on. Therefore do not omit the attribute when dealing with sensitive inputs.

<Unaudited>
0

Not an Issue
4

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Privacy Violation: Autocomplete
High
Security Features
The form in login.html uses autocompletion on line 19, which allows some browsers to retain sensitive information in their history.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

login.html
login.html
19
        ç”¨æˆ·ç™»å½•

USER:
 <input type="text" name="user"></input>

PASS:
<input type="password" name="pass"></input>

null()

Unreleased Resource: Database

Abstract
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.

Explanation
Resource leaks have at least two common causes:

Error conditions and other exceptional circumstances.

Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service attack by depleting the resource pool.
Example: Under normal conditions, the following code executes a database query, processes the results returned by the database, and closes the allocated statement object. But if an exception occurs while executing the SQL or processing the results, the statement object will not be closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries.
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
harvestResults(rs);
stmt.close();

Recommendations
1. Never rely on finalize() to reclaim resources. In order for an object's finalize() method to be invoked, the garbage collector must determine that the object is eligible for garbage collection. Because the garbage collector is not required to run unless the JVM is low on memory, there is no guarantee that an object's finalize() method will be invoked in an expedient fashion. When the garbage collector finally does run, it may cause a large number of resources to be reclaimed in a short period of time, which can lead to "bursty" performance and lower overall system throughput. This effect becomes more pronounced as the load on the system increases.
Finally, if it is possible for a resource reclamation operation to hang (if it requires communicating over a network to a database, for example), then the thread that is executing the finalize() method will hang.

Release resources in a finally block. The code for the Example should be rewritten as follows:

public void execCxnSql(Connection conn) {
Statement stmt;
try {
stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(CXN_SQL);
...
}
finally {
if (stmt != null) {
safeClose(stmt);
}
}
}
public static void safeClose(Statement stmt) {
if (stmt != null) {
try {
stmt.close();
} catch (SQLException e) {
log(e);
}
}
}
This solution uses a helper function to log the exceptions that might occur when trying to close the statement. Presumably this helper function will be reused whenever a statement needs to be closed.
Also, the execCxnSql method does not initialize the stmt object to null. Instead, it checks to ensure that stmt is not null before calling safeClose(). Without the null check, the Java compiler reports that stmt might not be initialized. This choice takes advantage of Java's ability to detect uninitialized variables. If stmt is initialized to null in a more complex method, cases in which stmt is used without being initialized will not be detected by the compiler.

Tips
1. Be aware that closing a database connection may or may not automatically free other resources associated with the connection object. If the application uses connection pooling, it is best to explicitly close the other resources after the connection is closed. If the application is not using connection pooling, the other resources are automatically closed when the database connection is closed. In such a case, this vulnerability is invalid.

<Unaudited>
0

Not an Issue
1

Reliability Issue
0

Bad Practice
0

Suspicious
0

Exploitable
0

Unreleased Resource: Database
High
Code Quality
The function contextInitialized() in MyContextListener.java sometimes fails to release a database resource allocated by getConnection() on line 28.
High

Analysis
Not an Issue

Severity
High

Date
2023-01-04

MyContextListener.java
src/adrui/MyContextListener.java
28
		try{
Class.forName(driver);//åŠ è½½é©±åŠ¨ç¨‹åº�ç±», é«˜ç‰ˆæœ¬jdbcå�¯ä»¥çœ�åŽ», ç›¸å…³å�¯è‡ªè¡Œç™¾åº¦
Connection conn = DriverManager.getConnection(url, user, pass);
sc.setAttribute("conn", conn);
System.out.println("Connect Succeed!");
conn = getConnection(...)

Issue Count by Category

Issues By Category

Category
Analysis

Privacy Violation: Autocomplete

Cross-Site Request Forgery

Poor Error Handling: Overly Broad Catch

Poor Logging Practice: Use of a System Output Stream

System Information Leak

SQL Injection

J2EE Bad Practices: getConnection()

J2EE Misconfiguration: Excessive Session Timeout

J2EE Misconfiguration: Missing Error Handling

Unreleased Resource: Database

Issue Breakdown by Analysis

Issue by Analysis

Analysis
Analysis

Not an Issue

`

@damiencarol
Please find the file with fresh data.
https://github.com/devdatta2019/django-DefectDojo/blob/master/fortifysamplejavawebappsample.xml

Fixed with #7592

@damiencarol Thanks.


How to build Jar

Hello. I'm having trouble building the Jar. I checked out the project, and when I run maven clean package I get the following errors:
[ERROR] /home/mc/Desarrollo/git/camunda-cockpit-plugin-statistics/src/main/java/org/camunda/cockpit/plugin/statistics/resources/StatisticsPluginRootResource.java:[8,47] package org.camunda.bpm.engine.rest.sub.runtime does not exist [ERROR] /home/mc/Desarrollo/git/camunda-cockpit-plugin-statistics/src/main/java/org/camunda/cockpit/plugin/statistics/resources/process/IncidentResource.java:[9,47] package org.camunda.bpm.engine.rest.dto.runtime does not exist [ERROR] /home/mc/Desarrollo/git/camunda-cockpit-plugin-statistics/src/main/java/org/camunda/cockpit/plugin/statistics/resources/process/IncidentResource.java:[31,17] cannot find symbol   symbol:   class IncidentDto   location: class org.camunda.cockpit.plugin.statistics.resources.process.IncidentResource [ERROR] /home/mc/Desarrollo/git/camunda-cockpit-plugin-statistics/src/main/java/org/camunda/cockpit/plugin/statistics/resources/process/IncidentResource.java:[33,37] cannot find symbol   symbol:   class IncidentDto   location: class org.camunda.cockpit.plugin.statistics.resources.process.IncidentResource
I also tried de Plugin store, but I get the following error there:
Could not clone and build plugin: https://github.com/camunda/camunda-cockpit-plugin-statistics/blob/master/pom.xml
With this root cause:
java.lang.IllegalStateException: ${maven.home} is not specified as a directory: '/usr/share/maven-bin-3.0'.
How can I build the Jar for this plugin?

Hi manugarciac,
I just tried a 'green field' clone and successfully built the jar using maven clean package. Did you check out the master branch? Did you do anything before your build?
cheers,
Eric

The only thing I did manually was downloading this dependency:
org.camunda.bpm.webapp:camunda-webapp-core:jar:7.3.0
Because when I don't, I get this error:
[ERROR] Failed to execute goal on project camunda-cockpit-plugin-statistics-root: Could not resolve dependencies for project org.camunda.bpm.extension:camunda-cockpit-plugin-statistics-root:jar:1.0.0: Failure to find org.camunda.bpm.webapp:camunda-webapp-core:jar:7.3.0 in http://repo.contentamobile.com.ar/nexus/content/groups/public was cached in the local repository, resolution will not be reattempted until the update interval of nexus has elapsed or updates are forced -> [Help 1] [ERROR]  [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR]  [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException
Any ideas? Maybe something different in my setting.xml? I added this:
  <profile>     <id>camunda-bpm</id>     <repositories>       <repository>         <id>camunda-bpm-nexus</id>         <name>camunda-bpm-nexus</name>         <releases>           <enabled>true</enabled>         </releases>         <snapshots>           <enabled>true</enabled>         </snapshots>         <url>https://app.camunda.com/nexus/content/groups/public</url>       </repository>     </repositories>   </profile>
And this:
<activeProfiles>   <activeProfile>camunda-bpm</activeProfile> </activeProfiles>

:) great

Hi, I am using the same version of camunda as specified 7.6 tomcat distribution then I build this project with mvn clean install and copy the jar from ./target/camunda-cockpit-plugin-statistics-root-1.0.0.jar to lib folder of above distribution zip. But I dont see the plugin when I start the server on cockpit dashboard. What am I doing wrong?


Verify MultisigTx.origin is deserialized correctly

https://github.com/gnosis/safe-react/issues/836
Currently, the gw just handles a json expecting only a url field from which the actual SafeAppInfo is fetched.
https://github.com/gnosis/safe-client-gateway/blob/main/src/models/converters/transactions/safe_app_info.rs
This structure will change, it will only be a URL string to be returned.
Note: beware of the schema, it would be nice to be able to easily distinguish ipfs from https

Closing this one as not planned for now. See https://github.com/safe-global/safe-react/issues/836#issuecomment-1084650983


frontend ts conflict during compilation

Who didn't set "skipLibCheck": true or "lib": ["dom" ... ] to tsconfig.json will see the error all the time.
c7:22:29 PM - File change detected. Starting incremental compilation...

node_modules/admin-bro/types/src/frontend/components/app/drop-area.d.ts(8,33): error TS2304: Cannot find name 'FileList'.

Not such a big probem.
Possible solution: splitting backend and frontend to different packages.

v1.6.0-beta.5

duplicates #237 - simly add DOM types to tsconfig. But regarding spliting you are right. I am thinking about extracting frontend components to a separate repository but this is the plan for march probably


1443/listing finder disclaimer

Pull Request Template
Issue Overview
This PR addresses #1443

[x] This change addresses the issue in full
[ ] This change addresses only certain aspects of the issue
[ ] This change is a dependency for another issue
[ ] This change has a dependency from another issue

Description
This PR adds the disclaimer page to the listings finder. This page will show whether the user clicks through the entire form or  clicks the skip button at an earlier portion of the form.
Two Design Notes

Based on engineering team conversations, it was agreed that the color differences in the alert box and the bullet points were acceptable since a broader refactoring of color/text-color tokens is coming soon.
You'll note the progress header section differs from the Figma. This new design (all steps completed and no step header) was confirmed by @slowbot as the new desired design.

How Can This Be Tested/Reviewed?
This can be tested by going to the listings finder and either clicking the skip button or clicking next through the form. Each path will take you to the disclaimer page and ensure that this page matches the Figma (with the exception of Design notes) linked in the issue.
Checklist:

[x] My code follows the style guidelines of this project
[x] I have added QA notes to the issue with applicable URLs
[x] I have performed a self-review of my own code
[x] I have reviewed the changes in a desktop view
[x] I have reviewed the changes in a mobile view
[ ] I have commented my code, particularly in hard-to-understand areas
[ ] I have made corresponding changes to the documentation
[ ] My changes generate no new warnings
[ ] I have added tests that prove my fix is effective or that my feature works
[ ] New and existing unit tests pass locally with my changes
[ ] Any dependent changes have been merged and published in downstream modules
[x] I have assigned reviewers
[ ] I have run yarn generate:client and/or created a migration if I made backend changes that require them
[ ] I have exported any new pieces added to ui-components
[ ] My commit message(s) is/are polished, and any breaking changes are indicated in the message and are well-described
[ ] Commits made across packages purposefully have the same commit message/version change, else are separated into different commits

Reviewer Notes:
Steps to review a PR:

Read and understand the issue, and ensure the author has added QA notes
Review the code itself from a style point of view
Pull the changes down locally and test that the acceptance criteria is met
Also review the acceptance criteria on the Netlify deploy preview (noting that these do not yet include any backend changes made in the PR)
Either explicitly ask a clarifying question, request changes, or approve the PR if there are small remaining changes but the PR is otherwise good to go

On Merge:
If you have one commit and message, squash. If you need each message to be applied, rebase and merge.

@emilyjablonski Thank you for the review! All those issues should be addressed now.

@ludtkemorgan Yep, that's intended. Also, just made the code updates that you suggested!


added validation

Related Issue
[Cite any related issue(s) this pull request addresses. If none, simply state “None”]
Fixes:  #906
Description
I have added validation to booking page
Type of PR

[ ] Bug fix
[x] Feature enhancement
[ ] Documentation update
[ ] Other (specify): _______________

Screenshots / videos (if applicable)
[Attach any relevant screenshots or videos demonstrating the changes. Make sure to attach before & after screenshots in your PR.]
Checklist:

[ ] I have made this change from my own.
[ ] I have taken help from some online resources.
[ ] My code follows the style guidelines of this project.
[ ] I have performed a self-review of my own code.
[ ] I have commented my code, particularly in hard-to-understand areas.
[ ] I have made corresponding changes to the documentation.
[ ] My changes generate no new warnings.
[ ] I have tested the changes thoroughly before submitting this pull request.
[ ] I have provided relevant issue numbers and screenshots after making the changes.

@Gauravtb2253 Your contribution removes

Please Remodify your contribution. Ensure you pull all the latest changes before pushing your feature/bug fixes to the main branch. After resolving the conflicts, please open a new PR for review.
Thank you!


2-D Frequency scan fails on start attempt

Here is a screenshot of the error.

This module doesn't exist anymore, so I'm closing the issue.


fix: fix cyber thread_pool.h Enqueue() task_queue_.Enqueue possible f…

if task_queue_.Enqueue fail,  will cause abnormal operation.

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


  Second, nothing says that you need to select a premium CDN to use SSL!  Third, at step #8 nothing says that it can take hours before the CDN is up and running, I'm getting a 404 error

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 92ace583-56d5-c9d5-7ef4-c38bbfaa657b
Version Independent ID: aececd35-06b1-ec4b-8229-0cf67826052c
Content: Tutorial: Enable custom domain with SSL on a static website using Azure CDN - Azure Storage
Content Source: articles/storage/blobs/storage-blob-static-website-custom-domain.md
Service: storage
GitHub Login: @tamram
Microsoft Alias: tamram

@danbord Thanks for the feedback! I have assigned the issue to the content author to evaluate and update as appropriate.

I must be missing something, if I navigate to [mystaticwebcdn].azureedge.net I get an error:

InvalidQueryParameterValue
Value for one of the query parameters specified in the request URI is invalid. RequestId:75f0f848-601e-0013-6123-a4aff5000000 Time:2019-01-04T11:52:05.9894406Z
comp

I have to add the explicit file to the url: [mystaticwebcdn].azureedge.net$web/default.html
It doesn't seem to respect the index page and 404 page I set in the azure config.

I was able to fix this by going into my CDN endpoint and updating the origin type from "Storage" to "Custom Origin" and setting my origin hostname and origin host header to my x.z.web.core.windows.net URL instead of the x.blob.core.windows.net URL.

Nice one @awickham10 that was the trick, thanks.
As @danbord said, it took a while to propagate, but it seems to work fine.

@awickham10 Having the same problem. In your example x.z.web.core.windows.net which part is your custom domain? Is it x.z.web or just x.z? Thanks

I used the Custom Origin option and a hostname from the Storage Account > Static Website > Primary Endpoint which is x.z.web.core.windows.net instead of the x.blob.core.windows.net URL you get when using an origin type of Storage.
Hopefully that helps.

Did the trick for me too. Thanks

@danbord @awickham10 @bjthomson @smithsson68 @Djiit - Thanks for your feedback. We'll investigate this further and update the article as needed.
#please-close

Why did you close the issue if it hasn't been resolved?

@awickham10 I just re-opened the case, i'll provide some feedback to the CDN team to update the documentation as appropriate.

@mdgattuso Would you be able to help with this issue ?
Thanks,
Adam

It looks like this documentation is owned by the storage team, so it needs to be assigned to someone from there.
However, you don't need to use the premium tier in order to use SSL. You can bring your own SSL cert on Azure CDN from Microsoft Standard, or use the CDN managed cert on any of the other tiers.

Setting Origin type and Origin host was indeed a bit vague in the docs. Took me a while to learn which values I had to use.
I used this page: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-https-custom-domain-cdn
The page mentions the Origin type setting, but doesn't mention the proper value of Origin host.

@normesta - FYI

Setting Origin type and Origin host was indeed a bit vague in the docs. Took me a while to learn which values I had to use.
I used this page: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-https-custom-domain-cdn
The page mentions the Origin type setting, but doesn't mention the proper value of Origin host.

what are the values??
It woulb be nice, that docs would have a status that remains in the beta phase. It is really frustrating.

Is microsoft planning to update the document?
Is azure testing the document they publish ?
It is not the firt time the they document are out of date even it is preview, actually does not work as the document.
I have add this configuration in godaddy provider,
Type              Name                                       Value
CNAME	     *              	                               urlstaticlorenzo.azureedge.net
CNAME	    cdnverify.www.lorenzo.com cdnverify.urlstaticlorenzo.azureedge.net
CNAME	   www	                                        urlstaticlorenzo.azureedge.net
The step in order to add ssl, is not as the document describes, but actually already was able to add https, but I have not been able to reach www.lorenzobrito.com

@lorenzobrito - Yes, we are working on updating the document, thanks for your feedback.

Thanks, all, for your feedback and your patience. I have updated the doc and hopefully it is more clear now. Please don't hesitate to open another issue if you encounter problems.
@normesta - FYI
#please-close

Looks good!

Regarding to map to custom domain , i have follow the custom configuration and still not working.

@lorenzobrito Can you please open a new issue as we believe the original issue was resolved. This will help us to ensure we give the issue you are encountering the visibility that it deserves.
@danbord We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.


Implement release workflow

This will enable automatic releases for each GitHub release that is created and will allow all djangonauts to relesae.
It will require every contributor to write a release note.
The person that releases should update to the correct version number and date.
After this is merged someone needs to set two secrets to the GitHub repo (in the settings):

[ ] TWINE_USERNAME
[ ] TWINE_PASSWORD

looks good

The issue is not releasing, what takes time is to review and ensure the information in the change log and the README is up to date.
Thanks for the reminder.

@nemesisdesign I'd recommend to cherry pick the compliance and cheanglog commit then. the changelog is for the next release and the compliance commit will force contributors to write a release note, putting load of you.

Solved in #303, we added a trusted publisher on PyPi. Thanks for the suggestion!


Add canvas grid & snap to grid

add canvas grid (background img)
snap to grid

moved to wishlist


Bump OCM SDK to v0.1.251

ginkgo & gomega were also upgraded because they are dependencies of the SDK itself
 $ go mod graph | grep ocm-sdk-go
...
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>...

Handled as part of https://github.com/openshift/rosa/pull/643


raft: simplify leadership transfer

keep sync with etcd
https://github.com/coreos/etcd/pull/5313/files /cc @xiang90
@siddontang @BusyJay @ngaut

This PR has not merged in etcd yet. We should wait and then merge.

Can someone review the code in etcd/raft? Then I can get it merged.

the pr in etcd is merged

LGTM

LGTM


Support for newer CircuitPython firmwares

rp2040js is unable to boot newer CircuitPython firmware. The default version is 8.0.2, which indeed works. Since then, several releases have been made. I tested a few of them:

Version
Works?

8.0.5
✅

8.1.0
❌
hangs

8.2.0
❌
[RP2040] read from address 100a692d, which is not 32 bit aligned

Others including 8.2.9 and 9.0.0-beta.0 fail with similar unaligned read errors:
$  npm run start:circuitpython -- --image=adafruit-circuitpython-raspberry_pi_pico-en_US-9.0.0-beta.0.uf2
...
Error: [RP2040] read from address 2, which is not 32 bit aligned
    at ConsoleLogger.error (/private/tmp/rp2040js/src/utils/logging.ts:48:15)
    at RP2040.readUint32 (/private/tmp/rp2040js/src/rp2040.ts:202:19)
    at CortexM0Core.readUint32 (/private/tmp/rp2040js/src/cortex-m0-core.ts:194:24)
    at CortexM0Core.executeInstruction (/private/tmp/rp2040js/src/cortex-m0-core.ts:826:36)
    at RP2040.execute (/private/tmp/rp2040js/src/rp2040.ts:381:17)
    at Timeout._onTimeout (/private/tmp/rp2040js/src/rp2040.ts:384:49)
    at listOnTimeout (node:internal/timers:573:17)
    at process.processTimers (node:internal/timers:514:7)

Performed a bisection of commits between 8.0.5 and 8.1.0 and found this was the first that fails: https://github.com/adafruit/circuitpython/commit/cbfb2d0f55a59d025c186cb6bdfea8ce5a8afb6c (which modifies ports/raspberrypi/supervisor/port.c).
After reverting that commit, rp2040js can run all the way up to 9.0.0!
$ git apply -R <(git diff cbfb2d0'^':ports/raspberrypi/supervisor/port.c cbfb2d0:ports/raspberrypi/supervisor/port.c)

Details of the awful bisect script
I had to remove the part of demo/micropython-run.ts that handles process.stdin. Note I'm on macOS so gmake is GNU make, sed is slightly different.
#!/bin/bash -eu

make fetch-submodules

make -C mpy-cross

cd ports/raspberrypi
sed -i '' 's/-Werror //g' Makefile
gmake -j8 BOARD=raspberry_pi_pico

git checkout Makefile

# Run the program with a timeout
cd /tmp/rp2040js
exec gtimeout 12 npm run start:circuitpython -- --image=circuitpython/ports/raspberrypi/build-raspberry_pi_pico/firmware.uf2 --expect-text "Press any key to enter the REPL"

Good job! I believe this is the culprit:
https://github.com/adafruit/circuitpython/commit/cbfb2d0f55a59d025c186cb6bdfea8ce5a8afb6c#diff-a05d314adb461e8edad8e3a970d717cafb82f7a41fa4e9fe4220e003f7c947abR107-R111

That would be the offset from XIP_BASE to XIP_NOCACHE_NOALLOC_BASE. The RP2040 datasheet, §<IP_ADDRESS> "XIP Cache" explains this is a "mirror" of the base address which bypasses the cache.

Thanks again for spotting the issue. One of the best bug reports I ever received :)


GraphCore IPU support

:tada: This PR is included in version 0.4.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


Environment variables for plugins

I am writing a new plugin for integrating with InfluxDB. From what I gather from the source code, only the CABOT_PLUGINS_ENABLED is get from the environment and the values for the inbuilt plugins like graphite, jenkins and so on. I want to use more environment variables for InfluxDB like INFLUXDB_API, USER, but I am not able to figure out on how to best to do it.
Any help would be highly appreciated.

Your plugin code can simply read the environment variable with os.environ.get('MA_VAR')

For example https://github.com/cabotapp/cabot-alert-slack/blob/a547ce46ec00b6a57946ce78b78c763d37e9243b/cabot_alert_slack/models.py#L68 @kishuagarwal


Partial implementation of API get route handlers

General Setup

Created tentative folder structure
Installed node-postegres
Configured and connected to postgres server
Configured express.routes middleware for get and post routes

Implemented API GET request for List Reviews

Initially built it using error first callback pattern
Refactored to promise-based
Tested connection using postman
Tested connection to database
Getting data, not yet manipulating it

Implemented API GET request for Metadata

Tested connection using postman
Tested connection to database
Getting partial data, not yet manipulating it

 Install an applications to interface with PostgresSQL database

 Implement List Reviews

 Implement Get Review Metadata

We climbed this whole mountain. 5TRON6


is there any instructions to generate counterfactual data?

Thank you for your nice work. It helps me a lot!
It would be better if there are some instructions or docs about how to reproduce your steps.
Thanks in advance.

Hi, thank you for your interest in our work! We are currently upgrading the codebase for the camera-ready submission. We will soon update the code and provide more detailed instructions.

Is this paper accepted by ACL2023 ?

Yes, this paper was recently accepted by ACL2023.


Release: hwc-buildpack 3.1.17

Dependency Changes:
No dependency changes

New Commits on Develop:
7a540b0 Bootstraps with github-config
15ca1f4 Update libbuildpack
501ef0b Update libbuildpack
59ea704 Update libbuildpack
ce24114 Update libbuildpack
ffd4469 Update libbuildpack
Refer to release instructions.

Note that this diff includes commit(s) that set up the github-config syncing workflows. These will only start to run when this buildpack is released and the workflows land on main.

Released


Adds Ant Design example (with custom theme).

Example with Ant Design that includes the webpack configuration to override theme Less variables (using less-loader).

The package.json seems to be missing the Extract Text Plugin.

To get this working with the latest of everything I had to change from 'static/css/[name].[contenthash].css' to 'static/css/[name].[md5:contenthash:hex:20].css'. Ideally it would use the mini-css-extract-plugin though. Really great work, I spent more than a day trying to make this work before I found your repo.

not work~~~~


support LogConfig with serde

serde is feature that used

serde is feature that used
make use default.not use feature

custom serialize OutKind

fix with 1.0.1


Panel height isn't showing properly after several toggles.

VSCode Version: 1.12.2
OS Version: macOS 10.12.5

Steps to Reproduce:

>View: Close Panel
>View: Toggle Maximized panel
>View: Toggle Panel Visibility
>View: Toggle Panel Visibility
>View: Toggle Maximized panel

So the issue is that in the last step the panel is minimized and you would expect it to be the same size as in step 0 (mid screen)?

Yes, it should preserve the size in step 0. Minimized panel is a lack of usability.

The problem seems to have been fixed in v1.18.0. 👍

@arzyu thanks for letting us know


bug: windows install gptcommit  v0.5.16 is fail by cargo

Describe the bug
To Reproduce
use cargo install  gptcommit  v0.5.16
Expected behavior
A clear and concise description of what you expected to happen.
Screenshots

Run your command with the RUST_LOG=trace environment variable for the best support
System Info (please complete the following information):

OS:  Windows
Version v0.5.16

Additional context
error[E0635]: unknown feature stdsimd
--> C:\Users\zhuang.cargo\registry\src\index.crates.io-6f17d22bba15001f\ahash-0.7.7\src/lib.rs:33:42
|
33 | #![cfg_attr(feature = "stdsimd", feature(stdsimd))]
|                                          ^^^^^^^

Hi @Zander-1024 , thanks for the details bug report. This should be fixed with the latest version of Rust and gptcommit 0.5.17


Add auto merge

@conda-forge-admin, please add bot automerge

Hi! This is the friendly automated conda-forge-webservice.
I just wanted to let you know that I added bot automerge in conda-forge/fortio-feedstock#2.


[Bug]: Puppeteer docker container is always increasing memory usage

Bug description
Steps to reproduce the problem:
1.- I've created a docker container that receives http requests from another container and creates a base-64 PDF per request. It returns the base-64 as response.
2.- So I have two containers: send-request and process-requests
The problem is that the process-requests container is always increasing memory usage. I check this with the command docker ps --size
process-requests     2.52GB (virtual 6.24GB)
I am using browser.close this way:

buffer = await page.pdf(optionsPuppeteer).then(async (data) => {
       await browser.close();
       return Buffer.from(Object.values(data));
    })

Puppeteer version
14.4.0
Node.js version
16.15.1
npm version
8.11.0
What operating system are you seeing the problem on?
Linux
Relevant log output
Tasks:  15 total,   2 running,  13 sleeping,   0 stopped,   0 zombie
%Cpu(s): 26.9 us,  5.3 sy,  0.0 ni, 67.0 id,  0.1 wa,  0.0 hi,  0.7 si,  0.0 st
MiB Mem :  15862.5 total,    768.6 free,   8079.1 used,   7014.9 buff/cache
MiB Swap:   2048.0 total,   2045.0 free,      3.0 used.   6867.2 avail Mem

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
  58656 puser  20   0 1124.8g<PHONE_NUMBER>36 R  75.4   1.2   0:02.61 chrome
  58707 puser  20   0 1124.8g<PHONE_NUMBER>40 S  66.8   1.3   0:02.24 chrome
  58757 puser  20   0 1124.8g<PHONE_NUMBER>68 S  34.9   1.2   0:01.28 chrome
     31 puser  20   0<PHONE_NUMBER>64  32924 S  26.2   1.0   5:28.29 node
  58804 puser  20   0 1124.8g<PHONE_NUMBER>04 S  12.0   0.9   0:00.36 chrome
  58860 puser  20   0 1124.8g<PHONE_NUMBER>84 S   8.0   0.9   0:00.24 chrome
     19 puser  20   0  707920  57416  34820 S   0.3   0.4   0:04.17 npm start
      1 puser  20   0    2420    340    272 S   0.0   0.0   0:00.03 sh
      8 puser  20   0  630856  53456  32568 S   0.0   0.3   0:03.98 node
     30 puser  20   0    2420    348    276 S   0.0   0.0   0:00.00 sh
  46383 puser  20   0 1124.7g<PHONE_NUMBER>60 S   0.0   0.9   0:00.31 chrome
  57443 puser  20   0    4100   3272   2776 S   0.0   0.0   0:00.04 bash
  57660 puser  20   0    7004   3240   2708 R   0.0   0.0   0:00.02 top
  57755 puser  20   0 1124.7g<PHONE_NUMBER>16 S   0.0   0.9   0:00.26 chrome
  57864 puser  20   0 1124.7g<PHONE_NUMBER>04 S   0.0   0.9   0:00.29 chrome

Hey, could you please provide a complete script that demonstrates a memory leak?

Hey, I've found that it wasn't a memory leak problem. The problem was that Google Chrome generates puppeteer_dev_profile-XXXXXX in order to store some profile data. Those files were filling the container. Here I found some solutions to it. Thank you very much anyway.


Change for services and options and Blog related stuff in own namespace.

The structure of BlazorStatic services has been updated, with adjustments to service responsibilities. This update separates Blog-related functionality into its own folder (with the namespace BlazorStatic.Blog). This separation provides a template for extending BlazorStatic functionality in the future.
The primary motivation behind this change was to better handle tags. Previously, tags were part of IFrontMatter; now they’re managed by a new interface, IBlogFrontMatter : IFrontMatter. Other services and options have been adjusted in a similar way to support this separation.
Key changes include:

In Program.cs, .AddBlazorStaticContentService<MyFrontMatter> either remains as is (but without tags) or becomes .AddBlogService<MyFrontMatter>. In the latter case, MyFrontMatter needs to implement IBlogFrontMatter (which makes tags available).
Update service injections (typically in .razor files) accordingly:@inject BlazorStaticContentService<BlogFrontMatter> blazorStaticContentService

becomes@inject BlogService<BlogFrontMatter> blogService

Rationale Behind This Update
Tags are a blog-specific feature, not a generic static content feature. While tags could be part of static content, categories, future extensibility, or additional tag logic require clear boundaries. This separation now aligns "general static content" (such as media, posts, URLs) with BlazorStaticContentOptions, while "blog-related content" (currently tags) falls under BlogOptions.
Additional Updates
An interface for options, IBlazorStaticContentOptions, has been implemented with a few required properties and methods, including CheckOptions, which verifies that necessary properties are configured. This approach provides flexibility that the required keyword doesn’t, as required would make service setup challenging. For example:
  .AddBlazorStaticContentService<ProjectFrontMatter>(opt => {
      opt.ContentPath = Path.Combine("Content", "Projects"); // `opt` must be initialized here
      opt.PageUrl = WebsiteKeys.ProjectsUrl;
  });

(Or have you got an idea how to make it better? Check the CheckOptions method)..
The code is now ready to support List<Tag> Tags instead of List<string> Tags, where:
public class Tag
{
    public string Name { get; set; }
    public string EncodedName { get; set; }
}//or similar

This change will enable tags with special characters, such as non-URL-friendly tags (c#, tag with spaces, €ŤČ...), to work seamlessly by default. I’ll implement this in the next step.

for tags why not use attributes? we already use reflection to get the site's routes so it shouldn't be an issue
i'm thinking something like this:
class MyFrontMatter {

    public string Title { get; set; }
    [BlogTags]
    public string[] categories { get; set; }
}

that way the user can name the variable whatever they wish or omit it completely if they don't need it without us having to maintain 2 different interfaces

for tags why not use attributes?

That made me think about the Tags from a different perspective...
Because Tags wont be List<string> anymore, but we still need the List<string> to parse the data from yml...
Which means we need to "free" the IFrontMatter from anything that is not used as strongly typed metadata... Which means we need to put it in Post (List<string> Tags in FrontMatter and List<Tag> Tags in Post), which kind of means we need to provide an interface for the Post itself...
It is somehow getting together. I will see, how the Attribute goes along with it..

The BlazorStaticWebsite/Content/Blog/release-1.0.0-beta.14.md file sums up the changes


K8SPS-146 Fix replication logs

Test name
Status

auto-config
passed

demand-backup
failed

init-deploy
passed

gr-init-deploy
passed

monitoring
passed

semi-sync
passed

service-per-pod
passed

scaling
passed

sidecars
passed

limits
passed

users
passed

config
passed

We run 12 out of 12

commit: https://github.com/percona/percona-server-mysql-operator/pull/168/commits/f7565fa4f9fb1119f5401ab2d2809fb9eb3f47d4
image: perconalab/percona-server-mysql-operator:PR-168-f7565fa


Implement _check

The typechecking was getting repeated in each function. I commented it out, added it to exports._check function, and invoked the function inside each of the exports functions.

Thanks for the project.
I usually skip the semi colons as javascript generally works perfectly without them.


change react-tap-event-plugin version

Sorry guys , no idea why i actually used 0.2.0 there...

What's the issue?

oh well i can't seem to be able to install it because of react-tap-event-plugin

I don't think that where is release published to npm 0.11.1. That's probably why the build fail

npm ERR! notarget No compatible version found<EMAIL_ADDRESS><0.12.0'
npm ERR! notarget Valid install targets:
npm ERR! notarget ["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0"]

ah yes, tried installing again it worked this time...
must have been some other issue i had before.
thx !


[BUG]

🐞 Describe the bug:
When I try to run the tests, with the command 'npx playwright test' I have an error :
Error: locator.fill : value : expected string, got undefined
at tests\pages\login-page.ts:24
await this.password.fill(password) ;
👻 To Reproduce:
Steps to reproduce the behavior: (On the project code)

Go to 'Terminal'
run the command 'npx playwright test'
tests don't start
See error

🌵 Expected behavior:
Tests starts
📸 Screenshots/GIFs/Videos:

💈 Dependencies' Version (please complete the following information):

OS: Windows 10
Browser Chromium
Playwright Version   1.35.1",
DotEnv Version 16.1.4
Applitools Version 1.17.5
VS Code Version 1.79.1
npm Version 9.5.1

🎡  A picture of your pet or a toy or something really cool:
🧪 🤟🏽

Hi @mahefasolofo ,
As per the error message, it's not finding the "password" variable.
The test is getting the password from the .env file.
Could you please check your .env file and see if the password is there?
Here are the instructions I left on the project setup to guide you.
Let me know how it goes :)

Thank you for your response.
Sorry I forgot to remove the word 'example' on the .env file.
But I have a new bug after that : tests don't want to start because I have
the error.
Error: Timed out 5000ms waiting for expect(received).toHaveURL(expected)
Expected pattern: /.*profile/
Received string:  "https://demoqa.com/login"
Call log:

locator._expect with timeout 5000ms
waiting for locator(':root')
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"
locator resolved to …
unexpected value "https://demoqa.com/login"

at tests\ui\pages\login-page.ts:34
32 |
33 |   async checkLoggedIn() {

34 |     await expect(this.page).toHaveURL(/.*profile/);
|                             ^
35 |     await expect(this.page).toHaveTitle(/DEMOQA/);
36 |   }
37 |

at LoginPage.checkLoggedIn

(C:\Users\ADMIN\Documents\00-codes\tau-advanced-playwright\tests\ui\pages\login-page.ts:34:29)
at globalSetup
(C:\Users\ADMIN\Documents\00-codes\tau-advanced-playwright\tests\setup\global-setup.ts:15:19)
I don't know if I have to send one other Bug report or it's ok?
Thank you,
Le ven. 25 août 2023 à 12:44, Renata Andrade @.***> a
écrit :

Hi @mahefasolofo https://github.com/mahefasolofo ,
As per the error message, it's not finding the "password" variable.
The test is getting the password from the .env file.
Could you please check your .env file and see if the password is there?
Here are the instructions
https://github.com/raptatinha/tau-advanced-playwright#:~:text=IMPORTANT%3A Create your .env file following the .env.example. The APPLITOOLS_API_KEY is the only param you'll need to uptdate to your credentials.
I left on the project setup to guide you.
Let me know how it goes :)
—
Reply to this email directly, view it on GitHub
https://github.com/raptatinha/tau-advanced-playwright/issues/2#issuecomment-1693086594,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOSTYWBJNLTFSYOHFLVBPZLXXBXYHANCNFSM6AAAAAA36E3AZQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
Mahefa Rasolofonirina
P:  +261 3 <+261+33+29+731+07>2 07 130 09
E:  @.***
https://mysignature.io/editor/?utm_source=freepixel

@mahefasolofo
Probably the login is not happening.
Can you create a new account at "https://demoqa.com/login" and update your .env file with your credentials?

It doesn't work.
How can I get the UserId ?
It's the information that I don't have.
Le ven. 25 août 2023 à 16:53, Renata Andrade @.***> a
écrit :

@mahefasolofo https://github.com/mahefasolofo
Probably the login is not happening.
Can you create a new account at "https://demoqa.com/login" and update
your .env file with your credentials?
—
Reply to this email directly, view it on GitHub
https://github.com/raptatinha/tau-advanced-playwright/issues/2#issuecomment-1693397381,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOSTYWA6QYIJKOO5Q5QDOUTXXCU7JANCNFSM6AAAAAA36E3AZQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
Mahefa Rasolofonirina
P:  +261 3 <+261+33+29+731+07>2 07 130 09
E:  @.***
https://mysignature.io/editor/?utm_source=freepixel

I explain this in the first chapter: https://testautomationu.applitools.com/playwright-advanced/chapter1.1.html

what command are you using to run the test (https://github.com/raptatinha/tau-advanced-playwright#run-the-project)?

npm run test-ui-c
I already have all the information from DEMOQA
Le ven. 25 août 2023 à 17:22, Renata Andrade @.***> a
écrit :

what command are you using to run the test (
https://github.com/raptatinha/tau-advanced-playwright#run-the-project)?
—
Reply to this email directly, view it on GitHub
https://github.com/raptatinha/tau-advanced-playwright/issues/2#issuecomment-1693443935,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOSTYWDH6NVQ2PAC4Y5GTRLXXCYK5ANCNFSM6AAAAAA36E3AZQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
Mahefa Rasolofonirina
P:  +261 3 <+261+33+29+731+07>2 07 130 09
E:  @.***
https://mysignature.io/editor/?utm_source=freepixel

I've commented out the 2 lines in checkLoggedIn() and the tests run.
I've checked with the command 'npx playwright test --ui' and it works.
I uncommented the 2 lines in checkLoggedIn() and the tests run and restart
the tests on the UI : It's work : we have the URL : '
https://demoqa.com/profile'
And I've closed the windows. I restart tests with the command 'test-ui-c'
: tests no longer work.
Thanks for your help, I think this is a special case. I've had other
problems with Playwright (with other exercises, but I don't know where to
ask the questions).
Le ven. 25 août 2023 à 17:22, Renata Andrade @.***> a
écrit :

what command are you using to run the test (
https://github.com/raptatinha/tau-advanced-playwright#run-the-project)?
—
Reply to this email directly, view it on GitHub
https://github.com/raptatinha/tau-advanced-playwright/issues/2#issuecomment-1693443935,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOSTYWDH6NVQ2PAC4Y5GTRLXXCYK5ANCNFSM6AAAAAA36E3AZQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
Mahefa Rasolofonirina
P:  +261 3 <+261+33+29+731+07>2 07 130 09
E:  @.***
https://mysignature.io/editor/?utm_source=freepixel

This is really weird @mahefasolofo ..
You can post your questions here (I may take a few hours/day to reply), or at the discord channel https://aka.ms/playwright/discord (you have the whole community to help)...

I have the same issue:

<EMAIL_ADDRESS>test-ui-c
npx playwright test tests/ui/specs/ --project=chromium
Error: locator.fill: value: expected string, got undefined

at tests\ui\pages\login-page.ts:29
27 |   async doLogin(email: string, password: string) {
28 |     await this.fillEmail(email);

29 |     await this.fillPassword(password);
|                         ^
30 |     await this.loginButton.click();
31 |   }
32 |

I pasted the content from example.env to the new .env file and replaced USERNAME and PASSWORD with the ones from my new profile on demoqa. The password in .env file is correct as well as the username. Where could it go wrong? Do I need to do anything extra to .env other than just creating it and copy-pasting the structure from example + changing username/password to mine?
Thanks!
BTW I had half the tests red in the basic course as well, probably because something is commented out while it shouldn't or something is not updated

Hi @CIALdev,
quick question, are you following the classes at test automation university?
I'm asking because the classes show the test execution isolated to exemplify each example (I'll send a PR later updating the readme to make it clear here too).
The application we are using for this training doesn't deal well with multiple sessions (I mention this in some of the chapters), for this reason, we need to use ".only" for a few tests, or do some specific changes to run a test successfully. These tests are not meant to be run all together (due to the application limitation).
For example: In chapter 1.1 around minute 4:54 I show the test passing with the ".only" on line 12. And so on for each chapter...
In chapter 1.2 I also mention other changes that need to be done to run the command "npm run test-ui-auth-user".
Regarding the "UPD" you mentioned: The login locator is "this.userName = page.getByPlaceholder('UserName');" as you can see on file login-page.ts. I named the method "fillEmail" (on line 19 of the same file) but you can see it receives a string, which can be anything, and it will use what is passed as parameter for each test; for example, for the test login.spec.ts it will use "const userName = process.env.USERNAME!;" for the test "test(successfull login, async () => {" line 20; and it will use "userData.invalidUsername;" for the test "  test(failing login - invalid username, async () => {" line 25. So it's targeting the right locator of the application (I double-checked) and it's using a different parameter for each test, as expected. I explain more about data management in chapter 4.
Let me know if you need more clarification on how locators are used, I can plan a webinar about it to help you understand better. I recommend you take a look at these 2 resources meanwhile: https://github.com/raptatinha/tau-introduction-to-playwright/blob/main/extra-resources/chapter1.MD and https://github.com/raptatinha/tau-introduction-to-playwright/blob/main/extra-resources/chapter2.MD.
I'll check the Intro Course too and will get back to you ASAP.

@CIALdev

Do I need to do anything extra to .env other than just creating it and copy-pasting the structure from example + changing username/password to mine?

After you create your .env file, and change any values.
You should run source .env in the terminal from the repo root. This will apply your changes.
My test run
Here's what I ran, and the results for a comparison.
I'll have a better understanding of needs fixing when I complete the course. This run was enough for me to know that I'm setup.
// Create a `.env` file which has the same contents as `.env.example`
source .env
npm run test-ui-c

This resulted in:

@flynnbops I did what you mentioned regarding the env variables and it didn't work, but it made me check what was going on with my environmental variables and it seems every time I was executing a test, the username variable was overridden by a local variable and that's why the login is not done, so maybe one solution would be to rename the USERNAME env variable with other name as EMAIL or something different....or another solution would be to discover what's the variable that your computer is overriding and create an account in demoqa with that user.


✨ Support retrieving raw binary data from QR codes

What feature or enhancement are you suggesting?
Currently, if the data inside of the code cannot be decoded into text then no value can be retrieved at all. It would be nice to have something similar to the API provided in https://github.com/cozmo/jsQR which provides both the decoded text and raw binary representation.
What Platforms whould this feature/enhancement affect?
iOS, Android
Alternatives/Workarounds
For the time being this can be achieved using frame processors, however out of all the native plugins listed at https://react-native-vision-camera.com/docs/guides/frame-processor-plugins, the two which seem like they might support this are either deprecated (https://github.com/rodgomesc/vision-camera-code-scanner/tree/master) or rely on a proprietary library (https://github.com/xulihang/vision-camera-dynamsoft-barcode-reader)
Additional information

[X] I agree to follow this project's Code of Conduct
[X] I searched for similar feature requests in this repository and found none.

My use case is using QR codes as a sort of 'cute and tangible' offline way of exchanging data between app users. Since they're obviously pretty limited in the amount of data they can store, I've made up a binary format to store the data more compactly.
However, after a lot more digging through Stack Overflow threads, and various project documentations. it seems like support for using QR codes in this way is a little limited across the board. The ISO standard makes no mention of it and is entirely focused on various text encodings. Even the so-called "Byte Mode" really just means "a text encoding which happens to have 8-bit wide characters".
So it seems like it's really up to individual tools to decide whether they want to support a way of short-circuiting the whole decoding process like this. For example, ZBar only added an option for this in 2019 in response to this issue

Closing this for now since I've been able to put together a basic frame processor plugin for this on Android for what I need.

but why would you need the raw data?

The original use case for the feature was encoding 4096 bit RSA secret keys as QR codes so they could be printed out, stored in a safe and then quickly restored via laptop camera.
Others have since then found rather creative uses for it:

Can you fit a whole game into a QR code?

It seems like @gev2002's react-native-vision-camera-v3-barcode-scanner supports getting raw values from barcodes, and uses MLKit on both iOS and Android :)

another feature request created here btw: https://github.com/mrousavy/react-native-vision-camera/issues/2701


Update Cargo.toml files to inherit workspace level configs,

Shares edition, description, license, repository and documentation fields

Pull Request Test Coverage Report for Build<PHONE_NUMBER>

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 98.624%

Totals

Change from base Build<PHONE_NUMBER>:
0.0%

Covered Lines:
39273

Relevant Lines:
39821

💛  - Coveralls


Cant Change Image

I cant change my Image on avatar

How do i fix this?

Press Ctrl + Shift + I select console tab then run $app.debugWebRequests = true; then try upload again and screenshot the console after.

Didnt work same error

Didnt work same error

Press Ctrl + Shift + I select console tab then run $app.debugWebRequests = true; then try upload again and screenshot the console after.

still not working


Don't Compile Assets if SKIP_EMBER set

Allows for co-located Rails / Ember apps to still utilize
ember-cli-deploy

LGTM.
Do you have an example of an ember-cli-rails app using ember-cli-deploy?