Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .gitignore
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Node.js Tools for Visual Studio
.ntvs_analysis.dat
node_modules/
nestserver-*.exe
nestserver-*
.vscode
dist/
yarn-error.log
3 changes: 1 addition & 2 deletions cobigen-nest-server/.npmignore
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,4 @@
node_modules/
.vscode
dist/
nestserver-linux-1.0.7
nestserver-macos-1.0.7
nestserver-*
6 changes: 6 additions & 0 deletions cobigen-nest-server/lerna.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"packages": [
"packages/*"
],
"version": "0.0.0"
}
74 changes: 16 additions & 58 deletions cobigen-nest-server/package.json
Original file line number Diff line number Diff line change
@@ -1,64 +1,22 @@
{
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/ts-loader@4.5.0

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/unset-value@1.0.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-0459] Unknown

        unset-value - Prototype Pollution

        CVSS Score: 9.4

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

        CWE: CWE-1321

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/pkg@4.4.9

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/json-schema@0.2.3
      CRITICAL Vulnerabilities (1)

        [CVE-2021-3918] CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

        json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-915

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/jest@23.6.0

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/y18n@3.2.1
      CRITICAL Vulnerabilities (1)

        [sonatype-2020-1040] CWE-471: Modification of Assumed-Immutable Data (MAID)

        y18n - Prototype Pollution [ CVE-2020-7774 ]

        The software does not properly protect an assumed-immutable element from being modified by an attacker.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-471

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/nodemon@1.18.10

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/npm-bundled@1.0.6
      CRITICAL Vulnerabilities (1)

        [CVE-2019-16776] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

        Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

        CVSS Score: 8.1

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

        CWE: CWE-22

      SEVERE Vulnerabilities (1)

        [CVE-2019-16775] CWE-61: UNIX Symbolic Link (Symlink) Following

        Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

        CVSS Score: 6.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-61

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:npm/jest@23.6.0

0 Critical, 1 Severe, 1 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/request@2.88.0
      SEVERE Vulnerabilities (1)

        [sonatype-2017-0655] Unknown

        request - Weak Authentication Algorithm

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-310

      MODERATE Vulnerabilities (1)

        [sonatype-2021-0749] CWE-326: Inadequate Encryption Strength

        request - Inadequate Encryption Strength

        The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

        CVSS Score: 3.7

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

        CWE: CWE-326

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/jest@23.6.0

8 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/handlebars@4.1.1
      CRITICAL Vulnerabilities (8)
        sonatype-2019-0253

        [sonatype-2019-0253] CWE-94: Improper Control of Generation of Code ('Code Injection')

        Handlebars - Remote Code Execution (RCE)

        The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-94

        sonatype-2019-0394

        [sonatype-2019-0394] CWE-20: Improper Input Validation

        handlebars - Prototype Pollution [CVE-2019-19919]

        The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-20

        sonatype-2019-0058

        [sonatype-2019-0058] Unknown

        handlebars - Prototype Pollution

        CVSS Score: 8.8

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-1321

        sonatype-2021-0236

        [sonatype-2021-0236] CWE-94: Improper Control of Generation of Code ('Code Injection')

        handlebars - Code Injection [CVE-2021-23369]

        The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

        CVSS Score: 8.8

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

        CWE: CWE-94

        sonatype-2021-0449

        [sonatype-2021-0449] Unknown

        handlebars - Prototype Pollution [CVE-2021-23369]

        CVSS Score: 8.8

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-1321

        sonatype-2019-0462

        [sonatype-2019-0462] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        handlebars - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

        sonatype-2019-0496

        [sonatype-2019-0496] CWE-20: Improper Input Validation

        handlebars - Prototype Pollution

        The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-20

        sonatype-2020-0293

        [sonatype-2020-0293] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        handlebars - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/tslint@5.11.0

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/js-yaml@3.13.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2019-0120] CWE-94: Improper Control of Generation of Code ('Code Injection')

        js-yaml - Remote Code Execution (RCE)

        The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-94

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/%40nestjs/core@5.7.4

5 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/lodash@4.17.11
      CRITICAL Vulnerabilities (5)
        sonatype-2019-0500

        [sonatype-2019-0500] CWE-471: Modification of Assumed-Immutable Data (MAID)

        lodash - Prototype Pollution via _.template

        The software does not properly protect an assumed-immutable element from being modified by an attacker.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-471

        sonatype-2020-0739

        [sonatype-2020-0739] CWE-471: Modification of Assumed-Immutable Data (MAID)

        lodash - Prototype Pollution

        The software does not properly protect an assumed-immutable element from being modified by an attacker.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-471

        CVE-2019-10744

        [CVE-2019-10744] CWE-284: Improper Access Control

        Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

        CVSS Score: 9.1

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

        CWE: CWE-284

        sonatype-2020-0292

        [sonatype-2020-0292] CWE-471: Modification of Assumed-Immutable Data (MAID)

        lodash - Prototype Pollution [ CVE-2020-8203 ]

        The software does not properly protect an assumed-immutable element from being modified by an attacker.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-471

        CVE-2021-23337

        [CVE-2021-23337] CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

        Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

        CVSS Score: 7.2

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-77

      SEVERE Vulnerabilities (1)

        [CVE-2020-28500] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

        CVSS Score: 5.3

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

        CWE: CWE-400

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/ts-loader@4.5.0

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/kind-of@6.0.2
      CRITICAL Vulnerabilities (1)

        [CVE-2019-20149] CWE-668: Exposure of Resource to Wrong Sphere

        ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-668

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/jest@27.5.1

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/fb-watchman@2.0.1
      CRITICAL Vulnerabilities (1)

        [CVE-2022-21944] CWE-59: Improper Link Resolution Before File Access ('Link Following')

        A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

        CVSS Score: 7.8

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-59

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/express@4.17.3
      CRITICAL Vulnerabilities (1)

        [sonatype-2012-0022] CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

        expressjs - HTTP Splitting Attack

        The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-113

      SEVERE Vulnerabilities (1)

        [sonatype-2021-0078] CWE-23: Relative Path Traversal

        express + hbs - Local File Read via Path Traversal

        The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-23

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/multer@1.4.4
      SEVERE Vulnerabilities (1)

        [sonatype-2016-0121] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        multer - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 6.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/jest@27.5.1

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/fb-watchman@2.0.1
      CRITICAL Vulnerabilities (1)

        [CVE-2022-21944] CWE-59: Improper Link Resolution Before File Access ('Link Following')

        A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

        CVSS Score: 7.8

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-59

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/express@4.17.3
      CRITICAL Vulnerabilities (1)

        [sonatype-2012-0022] CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

        expressjs - HTTP Splitting Attack

        The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-113

      SEVERE Vulnerabilities (1)

        [sonatype-2021-0078] CWE-23: Relative Path Traversal

        express + hbs - Local File Read via Path Traversal

        The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-23

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/multer@1.4.4
      SEVERE Vulnerabilities (1)

        [sonatype-2016-0121] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        multer - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 6.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/jest@27.5.1

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/fb-watchman@2.0.1
      CRITICAL Vulnerabilities (1)

        [CVE-2022-21944] CWE-59: Improper Link Resolution Before File Access ('Link Following')

        A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

        CVSS Score: 7.8

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-59

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/express@4.17.3
      CRITICAL Vulnerabilities (1)

        [sonatype-2012-0022] CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

        expressjs - HTTP Splitting Attack

        The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-113

      SEVERE Vulnerabilities (1)

        [sonatype-2021-0078] CWE-23: Relative Path Traversal

        express + hbs - Local File Read via Path Traversal

        The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-23

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/multer@1.4.4
      SEVERE Vulnerabilities (1)

        [sonatype-2016-0121] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        multer - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 6.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/jest@27.5.1

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/fb-watchman@2.0.1
      CRITICAL Vulnerabilities (1)

        [CVE-2022-21944] CWE-59: Improper Link Resolution Before File Access ('Link Following')

        A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

        CVSS Score: 7.8

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-59

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/express@4.17.3
      CRITICAL Vulnerabilities (1)

        [sonatype-2012-0022] CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

        expressjs - HTTP Splitting Attack

        The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

        CWE: CWE-113

      SEVERE Vulnerabilities (1)

        [sonatype-2021-0078] CWE-23: Relative Path Traversal

        express + hbs - Local File Read via Path Traversal

        The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-23

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:npm/%40nestjs/platform-express@8.4.4

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/multer@1.4.4
      SEVERE Vulnerabilities (1)

        [sonatype-2016-0121] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        multer - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 6.5

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

"name": "@devonfw/cobigen-nestserver",
"bin": "dist/main.js",
"version": "1.1.7",
"description": "Nestjs server to implement the input reader and merger for CobiGen",
"author": "CobiGen Team",
"license": "MIT",
"name": "cobigen-nest-server",
"private": true,
"workspaces": [
"packages/*"
],
"scripts": {
"build": "tsc -p tsconfig.build.json",
"format": "prettier --write \"src/**/*.ts\"",
"start": "ts-node -r tsconfig-paths/register src/main.ts",
"start:dev": "nodemon",
"start:debug": "nodemon --config nodemon-debug.json",
"prestart:prod": "rimraf dist && npm run build",
"start:prod": "node dist/main.js",
"lint": "tslint -p tsconfig.json -c tslint.json",
"test": "jest",
"test:watch": "jest --watch",
"test:cov": "jest --coverage",
"test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
"test:e2e": "jest --config ./test/jest-e2e.json"
"build": "npm run cleanup:root && npm run cleanup:packages && tsc -p tsconfig.build.json && npm run copy:rename && npm run compress",
"cleanup:root": "rimraf dist",
"cleanup:packages": "rimraf packages/*/dist/ && rimraf packages/*/nestserver-*",
"copy:rename": "npm run copy && npm run rename",
"copy": "copyfiles -f \"node_modules/@devonfw/ts-merger/dist/ts-merger.umd.js\" \"node_modules/@devonfw/ts-merger/build/\"",
"rename": "node -e \"require('fs').rename('node_modules/@devonfw/ts-merger/build/ts-merger.umd.js', 'node_modules/@devonfw/ts-merger/build/index.js', function(err) { if (err) console.log(err); console.log('File successfully renamed!') })\"",
"compress": "terser node_modules/@devonfw/ts-merger/build/index.js --compress --mangle --warn --output node_modules/@devonfw/ts-merger/build/index.js"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you programmed all this stuff here by hand. Why didn't you use webpack? https://webpack.js.org/guides/getting-started/
Any reason?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

},
"dependencies": {
"@devonfw/ts-merger": "^2.2.9",
"@nestjs/common": "^5.4.0",
"@nestjs/core": "^5.4.0",
"js-beautify": "^1.9.0",
"pkg": "^4.4.8",
"reflect-metadata": "^0.1.12",
"rimraf": "^2.6.2",
"rxjs": "^6.2.2",
"typescript": "^3.0.1"
},
"devDependencies": {
"@nestjs/testing": "^5.1.0",
"@types/express": "^4.16.0",
"@types/jest": "^23.3.1",
"@types/node": "^10.7.1",
"@types/supertest": "^2.0.5",
"jest": "^23.5.0",
"nodemon": "^1.18.3",
"prettier": "^1.14.2",
"supertest": "^3.1.0",
"ts-jest": "^23.1.3",
"ts-loader": "^4.4.2",
"ts-node": "^7.0.1",
"tsconfig-paths": "^3.5.0",
"tslint": "5.11.0"
},
"jest": {
"moduleFileExtensions": [
"js",
"json",
"ts"
],
"rootDir": "src",
"testRegex": ".spec.ts$",
"transform": {
"^.+\\.(t|j)s$": "ts-jest"
},
"coverageDirectory": "../coverage",
"testEnvironment": "node"
"copyfiles": "^2.4.1",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/copyfiles@2.4.1

4 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 4 dependencies

Components
    pkg:npm/ansi-regex@5.0.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-1169] Unknown

        ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807]

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

    pkg:npm/minimatch@3.0.4
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-4879] Unknown

        minimatch - Regular Expression Denial of Service (ReDoS)

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

    pkg:npm/ansi-regex@5.0.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-1169] Unknown

        ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807]

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

    pkg:npm/minimatch@3.0.4
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-4879] Unknown

        minimatch - Regular Expression Denial of Service (ReDoS)

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/copyfiles@2.4.1

2 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components
    pkg:npm/ansi-regex@5.0.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-1169] Unknown

        ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807]

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

    pkg:npm/minimatch@3.0.4
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-4879] Unknown

        minimatch - Regular Expression Denial of Service (ReDoS)

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/copyfiles@2.4.1

2 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components
    pkg:npm/ansi-regex@5.0.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-1169] Unknown

        ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807]

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

    pkg:npm/minimatch@3.0.4
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-4879] Unknown

        minimatch - Regular Expression Denial of Service (ReDoS)

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/copyfiles@2.4.1

2 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components
    pkg:npm/ansi-regex@5.0.0
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-1169] Unknown

        ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807]

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

    pkg:npm/minimatch@3.0.4
      CRITICAL Vulnerabilities (1)

        [sonatype-2021-4879] Unknown

        minimatch - Regular Expression Denial of Service (ReDoS)

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-1333

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

"lerna": "^4.0.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/lerna@4.0.0

1 Critical, 2 Severe, 1 Moderate, 0 Unknown vulnerabilities have been found across 3 dependencies

Components
    pkg:npm/request@2.88.2
      SEVERE Vulnerabilities (1)

        [sonatype-2017-0655] Unknown

        request - Weak Authentication Algorithm

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-310

      MODERATE Vulnerabilities (1)

        [sonatype-2021-0749] CWE-326: Inadequate Encryption Strength

        request - Inadequate Encryption Strength

        The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

        CVSS Score: 3.7

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

        CWE: CWE-326

    pkg:npm/hosted-git-info@2.8.9
      SEVERE Vulnerabilities (1)

        [CVE-2021-23362] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

        CVSS Score: 5.3

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

        CWE: CWE-400

    pkg:npm/lodash.template@4.5.0
      CRITICAL Vulnerabilities (1)

        [CVE-2021-23337] CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

        Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

        CVSS Score: 7.2

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-77

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/lerna@4.0.0

1 Critical, 2 Severe, 1 Moderate, 0 Unknown vulnerabilities have been found across 3 dependencies

Components
    pkg:npm/request@2.88.2
      SEVERE Vulnerabilities (1)

        [sonatype-2017-0655] Unknown

        request - Weak Authentication Algorithm

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-310

      MODERATE Vulnerabilities (1)

        [sonatype-2021-0749] CWE-326: Inadequate Encryption Strength

        request - Inadequate Encryption Strength

        The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

        CVSS Score: 3.7

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

        CWE: CWE-326

    pkg:npm/hosted-git-info@2.8.9
      SEVERE Vulnerabilities (1)

        [CVE-2021-23362] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

        CVSS Score: 5.3

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

        CWE: CWE-400

    pkg:npm/lodash.template@4.5.0
      CRITICAL Vulnerabilities (1)

        [CVE-2021-23337] CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

        Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

        CVSS Score: 7.2

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-77

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/lerna@4.0.0

1 Critical, 2 Severe, 1 Moderate, 0 Unknown vulnerabilities have been found across 3 dependencies

Components
    pkg:npm/request@2.88.2
      SEVERE Vulnerabilities (1)

        [sonatype-2017-0655] Unknown

        request - Weak Authentication Algorithm

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-310

      MODERATE Vulnerabilities (1)

        [sonatype-2021-0749] CWE-326: Inadequate Encryption Strength

        request - Inadequate Encryption Strength

        The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

        CVSS Score: 3.7

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

        CWE: CWE-326

    pkg:npm/hosted-git-info@2.8.9
      SEVERE Vulnerabilities (1)

        [CVE-2021-23362] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

        CVSS Score: 5.3

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

        CWE: CWE-400

    pkg:npm/lodash.template@4.5.0
      CRITICAL Vulnerabilities (1)

        [CVE-2021-23337] CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

        Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

        CVSS Score: 7.2

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-77

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:npm/lerna@4.0.0

1 Critical, 2 Severe, 1 Moderate, 0 Unknown vulnerabilities have been found across 3 dependencies

Components
    pkg:npm/request@2.88.2
      SEVERE Vulnerabilities (1)

        [sonatype-2017-0655] Unknown

        request - Weak Authentication Algorithm

        CVSS Score: 5.9

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-310

      MODERATE Vulnerabilities (1)

        [sonatype-2021-0749] CWE-326: Inadequate Encryption Strength

        request - Inadequate Encryption Strength

        The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

        CVSS Score: 3.7

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

        CWE: CWE-326

    pkg:npm/hosted-git-info@2.8.9
      SEVERE Vulnerabilities (1)

        [CVE-2021-23362] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

        CVSS Score: 5.3

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

        CWE: CWE-400

    pkg:npm/lodash.template@4.5.0
      CRITICAL Vulnerabilities (1)

        [CVE-2021-23337] CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

        Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

        CVSS Score: 7.2

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

        CWE: CWE-77

(at-me in a reply with help or ignore)


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

"rimraf": "^3.0.2",
"terser": "^5.12.1"
}
}
69 changes: 69 additions & 0 deletions cobigen-nest-server/packages/linux/package.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
{
"name": "@devonfw/cobigen-nestserver-linux",
"bin": "dist/main.js",
"version": "1.1.10",
"description": "Nestjs server to implement the input reader and merger for CobiGen",
"author": "CobiGen Team",
"license": "MIT",
"scripts":{
"build": "tsc -p tsconfig.build.json",
"format": "prettier --write \"src/**/*.ts\"",
"start": "ts-node -r tsconfig-paths/register src/main.ts",
"start:dev": "nodemon",
"start:debug": "nodemon --config nodemon-debug.json",
"prestart:prod": "rimraf dist && npm run build",
"start:prod": "node dist/main.js",
"lint": "tslint -p tsconfig.json -c tslint.json",
"test": "jest",
"test:watch": "jest --watch",
"test:cov": "jest --coverage",
"test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
"test:e2e": "jest --config ./test/jest-e2e.json",
"prepare": "npm run package",
"package": "pkg --targets latest-linux-x64 --output \"nestserver-linux-%npm_package_version%\" dist/main.js"
},
"dependencies": {
"@devonfw/ts-merger": "^2.2.10",
"@nestjs/common": "^8.4.4",
"@nestjs/core": "^8.4.4",
"@nestjs/platform-express": "^8.4.4",
"js-beautify": "^1.14.3",
"pkg": "^5.6.0",
"reflect-metadata": "^0.1.13",
"rimraf": "^3.0.2",
"rxjs": "^7.5.5",
"typescript": "^4.6.3"
},
"devDependencies": {
"@nestjs/testing": "^8.4.4",
"@types/express": "^4.17.13",
"@types/jest": "^27.4.1",
"@types/node": "^17.0.25",
"@types/supertest": "^2.0.12",
"express": "4.17.3",
"jest": "^27.5.1",
"nodemon": "^2.0.15",
"prettier": "^2.6.2",
"supertest": "^6.2.2",
"ts-jest": "^27.1.4",
"ts-loader": "^9.2.8",
"ts-node": "^10.7.0",
"tsconfig-paths": "^3.14.1",
"eslint": "8.13.0",
"webpack": "5.72.0"
},
"jest": {
"moduleFileExtensions": [
"js",
"json",
"ts"
],
"rootDir": "src",
"testRegex": ".spec.ts$",
"transform": {
"^.+\\.(t|j)s$": "ts-jest"
},
"coverageDirectory": "../coverage",
"testEnvironment": "node"
}
}
64 changes: 64 additions & 0 deletions cobigen-nest-server/packages/linux/src/main.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import { Request, Response } from 'express';
import properties from './config/properties';
import * as express from 'express';

// We need these variables for resetting the timeout
let counter: number = 0;
let time: NodeJS.Timeout;
// Will hold the server
let server;

/**
* This function resets the current timeout.
* We don't want to close the server if we have just received a new request.
* @export
* @param {Request} req the current request
* @param {Response} res the result of the request
* @param {*} next to pass control to the next middleware function. Otherwise, the request will be left hanging.
*/
export function resetTimeout(req: Request, res: Response, next) {
counter++;

if (counter % 2 === 0) {
// We need to start again the timeout
time = setTimeout(() => {
if (server === undefined) {
// If no server is found, let's just exit
process.exit();
} else {
// Gracefully close the server
server.close();
}
}, properties.timeout);
// The request should be passed to the controller
next();
} else {
// Let's clear the timeout and then set it again
clearTimeout(time);
resetTimeout(req, res, next);
}
}

async function bootstrap() {
const app = await NestFactory.create(AppModule);
// Port is passed as argument when creating the process
let port: string = process.argv[2];
// We need to parse long JSON files on requests
app.use(express.json({ limit: '12mb' }));
app.use(express.urlencoded({ limit: '12mb', extended: true }));

if (port === undefined) {
// Default port when no parameter was passed
port = '5000';
}

server = await app.listen(port);

// We set the timeout, so that the server gets closed after some time of inactivity
time = setTimeout(() => {
server.close();
}, properties.timeout);
}
bootstrap();
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
import { ModelEto } from './../etos/model.eto';
import { InputFileEto } from '../etos/input-file.eto';
import * as tsm from '@devonfw/ts-merger';

export class InputReader {
readonly content;

public async getInputObjects(inputFile:InputFileEto, removeEmptyFields : boolean) {
const tsm = require('@devonfw/ts-merger');
const parsedFile = tsm.readFile(inputFile.content);

// Extending the model
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import { Controller, Get, Post, Body } from '@nestjs/common';
import { InputFileEto } from './etos/input-file.eto';
import { MergerEto } from './etos/merger.eto';
import { InputReader } from './inputreader/input-reader';
import * as tsm from '@devonfw/ts-merger';

const config = require('../../package.json');

Expand Down Expand Up @@ -39,7 +40,6 @@ export class ProcessmanagementController {
const baseContent: string = merger.baseContent.replace(/\\n/gm, '\n');
const patchOverrides: boolean = merger.patchOverrides;

const tsm = require('@devonfw/ts-merger');
const mergedCode: string = tsm.merge(
baseContent,
patchContent,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ describe('Testing input reader request to the server', () => {
return request(app.getHttpServer())
.post('processmanagement/tsplugin/getInputModel')
.send({ content: 'class a {}' })
.expect(201)
.toBeNonEmptyString();
.expect(201);
});
});
4 changes: 4 additions & 0 deletions cobigen-nest-server/packages/linux/tsconfig.build.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"extends": "./tsconfig.json",
"exclude": ["node_modules", "test", "**/*spec.ts"]
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are there two different ts configurations?

14 changes: 14 additions & 0 deletions cobigen-nest-server/packages/linux/tsconfig.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
{
"compilerOptions": {
"module": "commonjs",
"declaration": true,
"removeComments": true,
"emitDecoratorMetadata": true,
"experimentalDecorators": true,
"target": "es6",
"sourceMap": true,
"outDir": "./dist",
"baseUrl": "./"
},
"exclude": ["node_modules"]
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you can easily inherit from the parent's tsconfig to not duplicate all code https://www.typescriptlang.org/docs/handbook/release-notes/typescript-3-2.html#tsconfigjson-inheritance-via-nodejs-packages

4 changes: 4 additions & 0 deletions cobigen-nest-server/packages/macos/.prettierrc
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"singleQuote": true,
"trailingComma": "all"
}
Loading