Coder Social home page Coder Social logo

meidam2 / otp-april Goto Github PK

View Code? Open in Web Editor NEW

This project forked from erlang/otp

0.0 0.0 0.0 518.99 MB

Erlang/OTP

Home Page: http://erlang.org

License: Apache License 2.0

Shell 0.55% Ruby 0.01% C++ 7.82% Python 0.14% Perl 0.18% C 16.24% Emacs Lisp 0.42% Erlang 72.57% Objective-C 0.01% Java 0.47% Assembly 0.18% Elixir 0.03% XSLT 0.02% CSS 0.01% Makefile 0.80% HTML 0.36% NSIS 0.01% DTrace 0.20% Batchfile 0.01% DIGITAL Command Language 0.01%

otp-april's Introduction

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability.

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. Learn more about Erlang and OTP.

Learn how to program in Erlang.

Examples

There are several examples on the website to help you get started. The below example defines a function world/0 that prints "Hello, world" in the Erlang shell:

-module(hello).
-export([world/0]).

world() -> io:format("Hello, world\n").

Save the file as hello.erl and run erl to enter the Erlang shell to compile the module.

Erlang/OTP 24 [erts-12.2] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [jit]

Eshell V12.2  (abort with ^G)
1> c(hello).
{ok,hello}
2> hello:world().
Hello, world
ok

Learn more about the Erlang syntax of modules, functions and expressions on Erlang.org.

Installation

Binary Distributions

Erlang/OTP is available as pre-built binary packages by most OS package managers.

apt-get install erlang

Compiling from source

To compile Erlang from source, run the following commands. The complete building and installation instructions can be found here.

git clone https://github.com/erlang/otp.git
cd otp

Checkout the branch or tag of your choice

git checkout maint-26    # current latest stable version

Configure, build and install

./configure
make
make install

Alternatively, you can use Kerl, a script that lets you easily build Erlang with a few commands.

Bug Reports

Please visit our GitHub Issues page for reporting bugs. The instructions for submitting bugs reports can be found here.

Security Disclosure

We take security bugs in Erlang/OTP seriously. Please disclose the issues regarding security by sending an email to erlang-security [at] erlang [dot] org and not by creating a public issue.

Contributing

We are grateful to the community for contributing bug fixes and improvements. Read below to learn how you can take part in improving Erlang/OTP. We appreciate your help!

Contribution Guide

Read our contribution guide to learn about our development process, how to propose fixes and improvements, and how to test your changes to Erlang/OTP before submitting a pull request.

Help Wanted

We have a list of Help Wanted bugs that we would appreciate external help from the community. This is a great place to get involved.

Awesome-Erlang

You can find more projects, tools and articles related to Erlang/OTP on the awesome-erlang list. Add your project there.

License

Erlang/OTP is released under the Apache License 2.0.

%CopyrightBegin%

Copyright Ericsson AB 2010-2023. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

%CopyrightEnd%

otp-april's People

Contributors

bjorng avatar bmk avatar garazdawi avatar ingelaandin avatar sverker avatar hansn avatar rickard-green avatar psyeugenic avatar uabboli avatar jhogberg avatar raimoniskanen avatar dgud avatar sirihansen avatar proxyles avatar peterdmv avatar rimmius avatar bufflig avatar u3s avatar kostis avatar lthor avatar zhird avatar kjellwinblad avatar aronisstav avatar nox avatar kikofernandez avatar hogand avatar margnus1 avatar frazze-jobb avatar frej avatar legoscia avatar

otp-april's Issues

jquery-3.3.1.slim.min.js: 2 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.3.1.slim.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.slim.min.js

Path to dependency file: /erts/test/parallel_messages_SUITE_data/visualize_throughput.html

Path to vulnerable library: /erts/test/parallel_messages_SUITE_data/visualize_throughput.html,/lib/stdlib/test/ets_SUITE_data/visualize_throughput.html

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jquery version) Remediation Possible**
CVE-2020-11023 Medium 6.1 jquery-3.3.1.slim.min.js Direct jquery - 3.5.0;jquery-rails - 4.4.0
CVE-2019-11358 Medium 6.1 jquery-3.3.1.slim.min.js Direct jquery - 3.4.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-11023

Vulnerable Library - jquery-3.3.1.slim.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.slim.min.js

Path to dependency file: /erts/test/parallel_messages_SUITE_data/visualize_throughput.html

Path to vulnerable library: /erts/test/parallel_messages_SUITE_data/visualize_throughput.html,/lib/stdlib/test/ets_SUITE_data/visualize_throughput.html

Dependency Hierarchy:

  • jquery-3.3.1.slim.min.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

CVE-2019-11358

Vulnerable Library - jquery-3.3.1.slim.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.slim.min.js

Path to dependency file: /erts/test/parallel_messages_SUITE_data/visualize_throughput.html

Path to vulnerable library: /erts/test/parallel_messages_SUITE_data/visualize_throughput.html,/lib/stdlib/test/ets_SUITE_data/visualize_throughput.html

Dependency Hierarchy:

  • jquery-3.3.1.slim.min.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

jquery-1.4.2.min.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to vulnerable library: /lib/common_test/priv/jquery-latest.js

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jquery version) Remediation Possible**
CVE-2020-7656 Medium 6.1 jquery-1.4.2.min.js Direct jquery - 1.9.0
CVE-2015-9251 Medium 6.1 jquery-1.4.2.min.js Direct jQuery - 3.0.0
CVE-2012-6708 Medium 6.1 jquery-1.4.2.min.js Direct jQuery - v1.9.0
CVE-2011-4969 Low 3.7 jquery-1.4.2.min.js Direct 1.6.3

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-7656

Vulnerable Library - jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to vulnerable library: /lib/common_test/priv/jquery-latest.js

Dependency Hierarchy:

  • jquery-1.4.2.min.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q4m3-2j7h-f7xw

Release Date: 2020-05-19

Fix Resolution: jquery - 1.9.0

CVE-2015-9251

Vulnerable Library - jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to vulnerable library: /lib/common_test/priv/jquery-latest.js

Dependency Hierarchy:

  • jquery-1.4.2.min.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - 3.0.0

CVE-2012-6708

Vulnerable Library - jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to vulnerable library: /lib/common_test/priv/jquery-latest.js

Dependency Hierarchy:

  • jquery-1.4.2.min.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

CVE-2011-4969

Vulnerable Library - jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to vulnerable library: /lib/common_test/priv/jquery-latest.js

Dependency Hierarchy:

  • jquery-1.4.2.min.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Publish Date: 2013-03-08

URL: CVE-2011-4969

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-4969

Release Date: 2013-03-08

Fix Resolution: 1.6.3

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.