Coder Social home page Coder Social logo

epact's Introduction

EPACT (Express Package Advanced Typescript)

This library provides you a compiler for node server. it compiles your code to a javascript file to run

Using esbuild allows you to use typescript without any server lag

Usage

pnpm create epact

Boot

Usage epact.config.ts

import { defineConfig } from "epact"

export default defineConfig({
  port: 3000,
  boot: ["http", "auth", "my-boot"]
})

and create file boot in src/<name boot>

src/my-boot.ts:

import { boot } from "epact"

export default boot(() => {
  return (err, req, res, next) => {
    console.log("listened request on " + req.url)
    next()
  }
})

Router & Middleware

And now in the routes directory let's create your routes. express-import-routes will import all of them for you

project
└───pages
│   │   index.ts
│   │
│   └───user
│       │   _id
│           └─── index.ts
│  
└───package.json
└───pnpm-lock.json

equivalent to

import express from "express"

const app = express()

import page

app.route("/", require("./routes/index.js"))
app.route("/user/:id", require("./routes/_id/index.,js"))

app.listen(8080, err => {
  if ( err ) {
    console.error(err)
  } else {
    console.log("App it runing on port 8080.")
  }
})

The file naming rules for configuring routers are the same as nuxtjs. Please refer here Nuxt router system

Route file writing rules

The route file in /routes requires you to export some function to render the route

index.ts

import { page } from "epact"

export default page({
  get(req, res) {
    req.end(`Hello!. This is a route /`)
  }
})

You can exports. [get | post | put | delete | options] according to the method you want to listen to

The above example is equivalent to

import { Router } from "express"

const router = Router()
router.route("/").get((req, res) => {
  req.end(`Hello!. This is a route /`)
})

export default router

** If you use an additional plugin eg multer you only need to exports an array **

const upload = multer({ dest: 'uploads/' })

exports.post = [upload.single('avatar'), function (req, res) {
  // req.file is the `avatar` file
  // req.body will hold the text fields, if there were any
}]

Middleware

Add stronger support with middleware.

You can now export the middleware to tell the plugin that you want it to apply the middleware to this route.

exports.middleware = ["auth"]

exports.get = (req, res) => {
  req.end(`Welcome back ${req.user.name}!`)
}

middleware/auth.js

module.exports = (req, res, next) => {
  try {
    if ( req.headers.authorization ) {
      req.user = jwt.verify(req.headers.authorization, SERKET_KEY)
      next()
    } else {
      throw new Error("NO_TOKEN")
    }
  } catch(err) {
    console.log( err )
    next("route")
  }
}

Specify local middleware

You can now specify each middleware for each router.

const upload = multer({ dest: 'uploads/' })

exports.post = [upload.single('avatar'), function (req, res) {
  // req.file is the `avatar` file
  // req.body will hold the text fields, if there were any
}]

or

exports.middleware = {
  post: upload.single('avatar'),
}

exports.post = function (req, res) {
  // req.file is the `avatar` file
  // req.body will hold the text fields, if there were any
}

Register

I added 2 methods for you to register the plugin to know this is a custom method. it can also combine with other modules like multer.

app.js

const express = require("express")
const multer = require("multer")
const importRoutes = require("express-import-routes")
const { registerMiddleware } = importRoutes

const app = express()

const upload = multer({ dest: "uploads/" })

registerMiddleware("file-avatar", upload.single("avatar"))

app.use(importRoutes())

app.listen(8080, err => {
  if ( err ) {
    console.error(err)
  } else {
    console.log("App it runing on port 8080.")
  }
})

Typescript

import { exposeRouter } from "express-import-routes"

export default exposeRouter({
  middleware: {
    post: upload.single('avatar'),
  },
  post (req, res) {
    // req.file is the `avatar` file
    // req.body will hold the text fields, if there were any
  }
})

epact's People

Contributors

tachibana-shin avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Watchers

 avatar

epact's Issues

jsonwebtoken-8.5.1.tgz: 4 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jsonwebtoken version) Remediation Possible**
CVE-2022-23539 High 8.1 jsonwebtoken-8.5.1.tgz Direct 9.0.0
CVE-2022-23540 High 7.6 jsonwebtoken-8.5.1.tgz Direct 9.0.0
CVE-2022-25883 High 7.5 semver-5.7.1.tgz Transitive 9.0.0
CVE-2022-23541 Medium 6.3 jsonwebtoken-8.5.1.tgz Direct 9.0.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: 9.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: 9.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/node_modules/semver/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Root Library)
    • semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 5.7.2

Direct dependency fix Resolution (jsonwebtoken): 9.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: 9.0.0

Step up your Open Source Security Game with Mend here

express-fw-next-0.0.10.tgz: 1 vulnerabilities (highest severity is: 7.1)

Vulnerable Library - express-fw-next-0.0.10.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/json5/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express-fw-next version) Remediation Available
CVE-2022-46175 High 7.1 json5-2.2.1.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-46175

Vulnerable Library - json5-2.2.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.2.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/json5/package.json

Dependency Hierarchy:

  • express-fw-next-0.0.10.tgz (Root Library)
    • esm-loader-fix-0.0.1.tgz
      • tsconfig-paths-4.0.0.tgz
        • json5-2.2.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 version 2.2.2 and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

Step up your Open Source Security Game with Mend here

express-fw-next-0.0.10.tgz: 1 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - express-fw-next-0.0.10.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/json5/package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express-fw-next version) Remediation Possible**
CVE-2022-46175 High 8.8 json5-2.2.1.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-46175

Vulnerable Library - json5-2.2.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.2.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/json5/package.json

Dependency Hierarchy:

  • express-fw-next-0.0.10.tgz (Root Library)
    • esm-loader-fix-0.0.1.tgz
      • tsconfig-paths-4.0.0.tgz
        • json5-2.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

Step up your Open Source Security Game with Mend here

jsonwebtoken-8.5.1.tgz: 4 vulnerabilities (highest severity is: 7.6)

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jsonwebtoken version) Remediation Available
CVE-2022-23529 High 7.6 jsonwebtoken-8.5.1.tgz Direct jsonwebtoken - 9.0.0
CVE-2022-23540 Medium 6.4 jsonwebtoken-8.5.1.tgz Direct jsonwebtoken - 9.0.0
CVE-2022-23539 Medium 5.9 jsonwebtoken-8.5.1.tgz Direct jsonwebtoken - 9.0.0
CVE-2022-23541 Medium 5.0 jsonwebtoken-8.5.1.tgz Direct jsonwebtoken - 9.0.0

Details

CVE-2022-23529

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control. This issue has been fixed, please update to version 9.0.0.

Publish Date: 2022-12-21

URL: CVE-2022-23529

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-27h2-hvpr-p74q

Release Date: 2022-12-21

Fix Resolution: jsonwebtoken - 9.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (6.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

Step up your Open Source Security Game with Mend here

express-4.18.1.tgz: 1 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - express-4.18.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/express/package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express version) Remediation Possible**
CVE-2024-29041 Medium 6.1 express-4.18.1.tgz Direct 4.19.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-29041

Vulnerable Library - express-4.18.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.1.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/express/package.json

Dependency Hierarchy:

  • express-4.18.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: 4.19.0

Step up your Open Source Security Game with Mend here

cli-0.0.9-beta.29.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - cli-0.0.9-beta.29.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/semver/package.json,/package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cli version) Remediation Possible**
CVE-2022-25883 High 7.5 semver-7.3.7.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-7.3.7.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.7.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/semver/package.json,/package.json

Dependency Hierarchy:

  • cli-0.0.9-beta.29.tgz (Root Library)
    • semver-7.3.7.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

Step up your Open Source Security Game with Mend here

plugin-vitest-0.0.9-beta.37.tgz: 1 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - plugin-vitest-0.0.9-beta.37.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (plugin-vitest version) Remediation Possible**
CVE-2022-46175 High 8.8 json5-1.0.1.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-46175

Vulnerable Library - json5-1.0.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • plugin-vitest-0.0.9-beta.37.tgz (Root Library)
    • vitest-tsconfig-paths-3.4.1.tgz
      • tsconfig-paths-3.14.1.tgz
        • json5-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

Step up your Open Source Security Game with Mend here

epact-0.0.9-beta.37.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - epact-0.0.9-beta.37.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (epact version) Remediation Possible**
CVE-2022-25883 High 7.5 semver-6.3.0.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • epact-0.0.9-beta.37.tgz (Root Library)
    • cspell-6.1.3.tgz
      • cspell-lib-6.1.3.tgz
        • configstore-5.0.1.tgz
          • make-dir-3.1.0.tgz
            • semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

Step up your Open Source Security Game with Mend here

plugin-vitest-0.0.9-beta.37.tgz: 1 vulnerabilities (highest severity is: 7.1)

Vulnerable Library - plugin-vitest-0.0.9-beta.37.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (plugin-vitest version) Remediation Available
CVE-2022-46175 High 7.1 json5-1.0.1.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-46175

Vulnerable Library - json5-1.0.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz

Dependency Hierarchy:

  • plugin-vitest-0.0.9-beta.37.tgz (Root Library)
    • vitest-tsconfig-paths-3.4.1.tgz
      • tsconfig-paths-3.14.1.tgz
        • json5-1.0.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 version 2.2.2 and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

Step up your Open Source Security Game with Mend here

cli-0.0.9-beta.37.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - cli-0.0.9-beta.37.tgz

Path to dependency file: /package.json

Path to vulnerable library: /demo/node_modules/braces/package.json,/package.json

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cli version) Remediation Possible**
CVE-2024-4068 High 7.5 braces-3.0.2.tgz Transitive N/A*
CVE-2024-4067 Medium 5.3 micromatch-4.0.5.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /demo/package.json

Path to vulnerable library: /demo/node_modules/braces/package.json,/package.json

Dependency Hierarchy:

  • cli-0.0.9-beta.37.tgz (Root Library)
    • chokidar-3.5.3.tgz
      • braces-3.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: braces - 3.0.3

Step up your Open Source Security Game with Mend here

CVE-2024-4067

Vulnerable Library - micromatch-4.0.5.tgz

Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json,/demo/node_modules/micromatch/package.json

Dependency Hierarchy:

  • cli-0.0.9-beta.37.tgz (Root Library)
    • globby-13.1.2.tgz
      • fast-glob-3.2.11.tgz
        • micromatch-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 0154c403ee845d0bb69539fba56e60fedfc04e97

Found in base branch: master

Vulnerability Details

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4067

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: micromatch - 4.0.6

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.