Git Product home page Git Product logo

myreads's Introduction

MyReads Project

Greenkeeper badge License: MIT

This is the starter template for the final assessment project for Udacity's React Fundamentals course. The goal of this template is to save you time by providing a static example of the CSS and HTML markup that may be used, but without any of the React code that is needed to complete the project. If you choose to start with this template, your job will be to add interactivity to the app by refactoring the static code in this template.

Of course, you are free to start this project from scratch if you wish! Just be sure to use Create React App to bootstrap the project.

TL;DR

To get started developing right away:

  • install all project dependencies with npm install
  • start the development server with npm start

What You're Getting

├── CONTRIBUTING.md
├── README.md - This file.
├── SEARCH_TERMS.md # The whitelisted short collection of available search terms for you to use with your app.
├── package.json # npm package manager file. It's unlikely that you'll need to modify this.
├── public
│   ├── favicon.ico # React Icon, You may change if you wish.
│   └── index.html # DO NOT MODIFY
└── src
    ├── App.css # Styles for your app. Feel free to customize this as you desire.
    ├── App.js # This is the root of your app. Contains static HTML right now.
    ├── App.test.js # Used for testing. Provided with Create React App. Testing is encouraged, but not required.
    ├── BooksAPI.js # A JavaScript API for the provided Udacity backend. Instructions for the methods are below.
    ├── icons # Helpful images for your app. Use at your discretion.
    │   ├── add.svg
    │   ├── arrow-back.svg
    │   └── arrow-drop-down.svg
    ├── index.css # Global styles. You probably won't need to change anything here.
    └── index.js # You should not need to modify this file. It is used for DOM rendering only.

Remember that good React design practice is to create new JS files for each component and use import/require statements to include them where they are needed.

Backend Server

To simplify your development process, we've provided a backend server for you to develop against. The provided file BooksAPI.js contains the methods you will need to perform necessary operations on the backend:

getAll

Method Signature:

getAll()
  • Returns a Promise which resolves to a JSON object containing a collection of book objects.
  • This collection represents the books currently in the bookshelves in your app.

update

Method Signature:

update(book, shelf)
  • book: <Object> containing at minimum an id attribute
  • shelf: <String> contains one of ["wantToRead", "currentlyReading", "read"]
  • Returns a Promise which resolves to a JSON object containing the response data of the POST request

search

Method Signature:

search(query)
  • query: <String>
  • Returns a Promise which resolves to a JSON object containing a collection of a maximum of 20 book objects.
  • These books do not know which shelf they are on. They are raw results only. You'll need to make sure that books have the correct state while on the search page.

Important

The backend API uses a fixed set of cached search results and is limited to a particular set of search terms, which can be found in SEARCH_TERMS.md. That list of terms are the only terms that will work with the backend, so don't be surprised if your searches for Basket Weaving or Bubble Wrap don't come back with any results.

Create React App

This project was bootstrapped with Create React App. You can find more information on how to perform common tasks here.

Contributing

This repository is the starter code for all Udacity students. Therefore, we most likely will not accept pull requests.

For details, check out CONTRIBUTING.md.

myreads's People

Contributors

alpersonalwebsite avatar greenkeeper[bot] avatar

Watchers

 avatar

myreads's Issues

CVE-2015-9251 (Medium) detected in jquery-1.7.1.min.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/myReads/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: /myReads/node_modules/sockjs/examples/express/index.html,/myReads/node_modules/sockjs/examples/multiplex/index.html,/myReads/node_modules/vm-browserify/example/run/index.html,/myReads/node_modules/sockjs/examples/echo/index.html,/myReads/node_modules/sockjs/examples/hapi/html/index.html,/myReads/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 9d78f8cf9a0c6413c5b55917c4151fb4791348b2

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7608 (Medium) detected in yargs-parser-10.1.0.tgz

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - yargs-parser-10.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-3.0.0.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • yargs-12.0.2.tgz
        • yargs-parser-10.1.0.tgz (Vulnerable Library)

Found in HEAD commit: e2906d58b513fa7136b06e93de1d187b505ee653

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608

Release Date: 2020-03-16

Fix Resolution: v18.1.1;13.1.2;15.0.1


Step up your Open Source Security Game with WhiteSource here

WS-2016-0090 (Medium) detected in jquery-1.7.1.min.js

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/myReads/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: /myReads/node_modules/sockjs/examples/express/index.html,/myReads/node_modules/sockjs/examples/multiplex/index.html,/myReads/node_modules/vm-browserify/example/run/index.html,/myReads/node_modules/sockjs/examples/echo/index.html,/myReads/node_modules/sockjs/examples/hapi/html/index.html,/myReads/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 9d78f8cf9a0c6413c5b55917c4151fb4791348b2

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0032 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0032 - Medium Severity Vulnerability

Vulnerable Library - js-yaml-3.12.2.tgz

YAML 1.2 parser and serializer

path: /tmp/git/myReads/node_modules/js-yaml/package.json

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.2.tgz

Dependency Hierarchy:

  • react-scripts-2.1.8.tgz (Root Library)
    • eslint-5.12.0.tgz
      • js-yaml-3.12.2.tgz (Vulnerable Library)

Found in HEAD commit: dfbd26ad4a20dcaa179ca51fdb44659ad8fd9544

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-26

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-26

Fix Resolution: 3.13.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-16769 (Low) detected in serialize-javascript-1.9.1.tgz

CVE-2019-16769 - Low Severity Vulnerability

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

  • react-scripts-3.0.0.tgz (Root Library)
    • terser-webpack-plugin-1.2.3.tgz
      • serialize-javascript-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: aad8b14f11c540140775004b4fa5d8b105d8d5c7

Vulnerability Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Publish Date: 2019-12-05

URL: CVE-2019-16769

CVSS 2 Score Details (3.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769

Release Date: 2019-12-05

Fix Resolution: v2.1.1


Step up your Open Source Security Game with WhiteSource here

An in-range update of react is breaking the build 🚨

There have been updates to the react monorepo:

    • The dependency react was updated from 16.8.4 to 16.8.5.
  • The dependency react-dom was updated from 16.8.4 to 16.8.5.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

This monorepo update includes releases of one or more dependencies which all belong to the react group definition.

react is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details
  • WhiteSource Security Check: The Security Check found 1 vulnerabilities.

Severity CVSS Score CVE GitHub Issue
Medium 5.0 WS-2019-0019 #1

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

WS-2020-0070 (High) detected in lodash-4.17.15.tgz

WS-2020-0070 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/lodash/package.json

Dependency Hierarchy:

  • react-scripts-3.0.0.tgz (Root Library)
    • core-7.4.3.tgz
      • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 53fdd366e851c25b48c253f0f8f72629f27627d4

Vulnerability Details

a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7598 (High) detected in minimist-0.0.8.tgz

CVE-2020-7598 - High Severity Vulnerability

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/loader-fs-cache/node_modules/minimist/package.json

Dependency Hierarchy:

  • react-scripts-3.0.0.tgz (Root Library)
    • eslint-loader-2.1.2.tgz
      • loader-fs-cache-1.0.2.tgz
        • mkdirp-0.5.1.tgz
          • minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: e2906d58b513fa7136b06e93de1d187b505ee653

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.2


Step up your Open Source Security Game with WhiteSource here

CVE-2019-20149 (Medium) detected in multiple libraries

CVE-2019-20149 - Medium Severity Vulnerability

Vulnerable Libraries - kind-of-3.2.2.tgz, kind-of-4.0.0.tgz, kind-of-2.0.1.tgz, kind-of-5.1.0.tgz

kind-of-3.2.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-3.3.1.tgz (Root Library)
    • webpack-4.3.3.tgz
      • plugin-svgo-4.3.1.tgz
        • merge-deep-3.0.2.tgz
          • kind-of-3.2.2.tgz (Vulnerable Library)
kind-of-4.0.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/has-values/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-3.3.1.tgz (Root Library)
    • webpack-4.41.5.tgz
      • micromatch-3.1.10.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • has-value-1.0.0.tgz
                • has-values-1.0.0.tgz
                  • kind-of-4.0.0.tgz (Vulnerable Library)
kind-of-2.0.1.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-2.0.1.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/shallow-clone/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-3.3.1.tgz (Root Library)
    • webpack-4.3.3.tgz
      • plugin-svgo-4.3.1.tgz
        • merge-deep-3.0.2.tgz
          • clone-deep-0.2.4.tgz
            • shallow-clone-0.1.2.tgz
              • kind-of-2.0.1.tgz (Vulnerable Library)
kind-of-5.1.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/is-descriptor/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-3.3.1.tgz (Root Library)
    • webpack-4.41.5.tgz
      • micromatch-3.1.10.tgz
        • snapdragon-0.8.2.tgz
          • define-property-0.2.5.tgz
            • is-descriptor-0.1.6.tgz
              • kind-of-5.1.0.tgz (Vulnerable Library)

Found in HEAD commit: e20ef7c8f1390af826b02497e2f5afa0ae3414e8

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 2 Score Details (5.0)

Base Score Metrics not available


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11358 (Medium) detected in jquery-1.11.1.min.js, jquery-1.12.4.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.11.1.min.js, jquery-1.12.4.min.js

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/myReads/node_modules/@babel/compat-data/build/compat-table/es2016plus/compiler-skeleton.html

Path to vulnerable library: /myReads/node_modules/@babel/compat-data/build/compat-table/es2016plus/compiler-skeleton.html

Dependency Hierarchy:

  • jquery-1.11.1.min.js (Vulnerable Library)
jquery-1.12.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/myReads/node_modules/@babel/compat-data/build/compat-table/es5/index.html

Path to vulnerable library: /myReads/node_modules/@babel/compat-data/build/compat-table/es5/index.html,/myReads/node_modules/@babel/compat-data/build/compat-table/es2016plus/index.html

Dependency Hierarchy:

  • jquery-1.12.4.min.js (Vulnerable Library)

Found in HEAD commit: e20ef7c8f1390af826b02497e2f5afa0ae3414e8

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 (Medium) detected in jquery-1.7.1.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/myReads/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: /myReads/node_modules/sockjs/examples/express-3.x/index.html,/myReads/node_modules/sockjs/examples/hapi/html/index.html,/myReads/node_modules/sockjs/examples/express/index.html,/myReads/node_modules/sockjs/examples/echo/index.html,/myReads/node_modules/sockjs/examples/multiplex/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 53fdd366e851c25b48c253f0f8f72629f27627d4

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0


Step up your Open Source Security Game with WhiteSource here

WS-2020-0068 (High) detected in yargs-parser-10.1.0.tgz, yargs-parser-13.1.2.tgz

WS-2020-0068 - High Severity Vulnerability

Vulnerable Libraries - yargs-parser-10.1.0.tgz, yargs-parser-13.1.2.tgz

yargs-parser-10.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-3.0.0.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • yargs-12.0.2.tgz
        • yargs-parser-10.1.0.tgz (Vulnerable Library)
yargs-parser-13.1.2.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-13.1.2.tgz

Path to dependency file: /tmp/ws-scm/myReads/package.json

Path to vulnerable library: /tmp/ws-scm/myReads/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-3.0.0.tgz (Root Library)
    • jest-24.7.1.tgz
      • jest-cli-24.9.0.tgz
        • yargs-13.3.2.tgz
          • yargs-parser-13.1.2.tgz (Vulnerable Library)

Found in HEAD commit: 53fdd366e851c25b48c253f0f8f72629f27627d4

Vulnerability Details

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --foo.proto.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.

Publish Date: 2020-05-01

URL: WS-2020-0068

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/package/yargs-parser

Release Date: 2020-05-04

Fix Resolution: https://www.npmjs.com/package/yargs-parser/v/18.1.2,https://www.npmjs.com/package/yargs-parser/v/15.0.1


Step up your Open Source Security Game with WhiteSource here

WS-2019-0019 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

path: /tmp/git/myReads/node_modules/braces/package.json

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Dependency Hierarchy:

  • react-scripts-2.1.3.tgz (Root Library)
    • jest-23.6.0.tgz
      • jest-cli-23.6.0.tgz
        • micromatch-2.3.11.tgz
          • braces-1.8.5.tgz (Vulnerable Library)

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-02-21

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1


Step up your Open Source Security Game with WhiteSource here

An in-range update of react-router-dom is breaking the build 🚨

The dependency react-router-dom was updated from 4.3.1 to 4.4.0.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

react-router-dom is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details
  • WhiteSource Security Check: The Security Check found 1 vulnerabilities.

Severity CVSS Score CVE GitHub Issue
Medium 5.0 WS-2019-0019 #1

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

Action required: Greenkeeper could not be activated 🚨

🚨 You need to enable Continuous Integration on Greenkeeper branches of this repository. 🚨

To enable Greenkeeper, you need to make sure that a commit status is reported on all branches. This is required by Greenkeeper because it uses your CI build statuses to figure out when to notify you about breaking changes.

Since we didn’t receive a CI status on the greenkeeper/initial branch, it’s possible that you don’t have CI set up yet. We recommend using Travis CI, but Greenkeeper will work with every other CI service as well.

If you have already set up a CI for this repository, you might need to check how it’s configured. Make sure it is set to run on all new branches. If you don’t want it to run on absolutely every branch, you can whitelist branches starting with greenkeeper/.

Once you have installed and configured CI on this repository correctly, you’ll need to re-trigger Greenkeeper’s initial pull request. To do this, please click the 'fix repo' button on account.greenkeeper.io.

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/myReads/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: /myReads/node_modules/sockjs/examples/express/index.html,/myReads/node_modules/sockjs/examples/multiplex/index.html,/myReads/node_modules/vm-browserify/example/run/index.html,/myReads/node_modules/sockjs/examples/echo/index.html,/myReads/node_modules/sockjs/examples/hapi/html/index.html,/myReads/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 9d78f8cf9a0c6413c5b55917c4151fb4791348b2

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.