Git Product home page Git Product logo

martijnvisser / flink-only-sql Goto Github PK

View Code? Open in Web Editor NEW
11.0 0.0 6.0 90.59 MB

Traditionally, engineers were needed to implement business logic via data pipelines before business users can start using it. Using this demo, we would explain how data analysts and non-engineers can use only Flink SQL to explore and transform data into insights and actions, without writing any Java or Python code.

License: Apache License 2.0

HTML 99.99% JavaScript 0.01% Dockerfile 0.01%
flink sql

flink-only-sql's Introduction

Conference usage

This demo is used by Martijn Visser in the following conference talks:

Twitter Follow GitHub Follow

Docker

We'll use Docker Compose to start all necessary services to run the demos. It will start the following services:

Demo only-sql-overview

Starting the demo

# Build and start all services
docker-compose up --build -d

# Check if all the services are running
docker-compose ps

# Start the Flink SQL Client
docker-compose run sql-client

Access the demo website

Visit http://localhost/flink/flink-docs-master/ to access the copy of the Apache Flink documentation, which is our demo website.

Explore all realtime website behaviour

Any visit to one of the webpages is sent to the Kafka topic pageview. In order to explore them, we first need to register this Kafka topic as a table in Flink's catalog.

--Create table pageviews:
CREATE TABLE pageviews (
    `title` STRING,
    `url` STRING,
    `datetime` STRING,
    `cookies` STRING,
    `browser` STRING,
    `screensize` STRING,
    `ts` TIMESTAMP(3) METADATA FROM 'timestamp',
    `proc_time` AS PROCTIME(),
    WATERMARK FOR `ts` AS `ts` 
) WITH (
    'connector' = 'kafka',
    'topic' = 'pageview',
    'properties.bootstrap.servers' = 'broker:29092',
    'properties.group.id' = 'flink-only-sql',
    'scan.startup.mode' = 'latest-offset',
    'value.format' = 'avro-confluent',
    'value.avro-confluent.schema-registry.url' = 'http://schema-registry:8091'
);

Any cookie that belongs to the domain localhost (which is where our website runs), is also sent to the topic. You are specifically interested in a cookie called identifier. You're going to register a view, which returns this value by applying a regular expressing on the incoming data.

--Create view which already extracts the identifier from the cookies
CREATE TEMPORARY VIEW web_activities AS 
    SELECT 
        `title`,
        `url`,
        `datetime`,
        `cookies`,
         REGEXP_EXTRACT(cookies, '(^| )identifier=([^;]+)', 2) as `identifier`,
        `browser`,
        `screensize`,
        `proc_time`,
        `ts`
    FROM pageviews;

By now running queries on the view while visiting a webpage, you will see data appearing in the Flink SQL Client. This is an unbounded (streaming) source of data, meaning that the application will never end.

SELECT * from web_activities;

Flink SQL Client Results

Explore historical website behaviour

This demo setup has captured some historical website behaviour data. This has been stored in the MySQL table history. In order to access this data, you first need to register this table in the Flink catalog.

--Create table history:
CREATE TABLE history (
    `title` STRING,
    `url` STRING,
    `datetime` STRING,
    `cookies` STRING,
    `identifier` STRING,
    `browser` STRING,
    `screensize` STRING,
    `proc_time` STRING,
    `ts` TIMESTAMP(3),
    PRIMARY KEY (identifier) NOT ENFORCED
) WITH (
   'connector' = 'jdbc',
   'url' = 'jdbc:mysql://mysql:3306/sql-demo',
   'table-name' = 'history',
   'username' = 'flink-only-sql',
   'password' = 'demo-sql'
);

By now running a query on this data, you will see the historical data in the Flink SQL Client. This is a bounded (batch) source of data, meaning that the application will end after processing all the data.

SELECT * from history;

Flink SQL Client Results

Determine users that are matching a certain pattern

You are going to use Flink's MATCH_RECOGNIZE function to select all identifiers that match a specific pattern. You can use this function for all sorts of Complex Event Processing capabilities. In the setup below, you select all identifiers that visit:

  1. http://localhost/flink/flink-docs-master/docs/try-flink/datastream/ followed by (both directly and indirectly)
  2. http://localhost/flink/flink-docs-master/docs/try-flink/table_api/ followed by (both directly and indirectly)
  3. http://localhost/flink/flink-docs-master/docs/try-flink/flink-operations-playground/
SELECT `identifier`
FROM web_activities
    MATCH_RECOGNIZE(
        PARTITION BY `identifier`
        ORDER BY `proc_time`
        MEASURES `url` AS url
        AFTER MATCH SKIP PAST LAST ROW
        PATTERN (A+ B+ C)
        DEFINE
            A AS A.url = 'http://localhost/flink/flink-docs-master/docs/try-flink/datastream/',
            B AS B.url = 'http://localhost/flink/flink-docs-master/docs/try-flink/table_api/',
            C AS C.url = 'http://localhost/flink/flink-docs-master/docs/try-flink/flink-operations-playground/'
);

Act on the users that are matching the defined pattern

You've just created the list of identifier that meet our defined pattern. You now want to act on this data. In order to achieve that, you're going to send the list of identifer to your Elasticsearch sink. The website checks if there's any result in the Elasticsearch results and if so, it will display the notification.

To send the data to Elasticsearch, you first have to create another table like you've done before in Flink's catalog. Use the following DDL:

--Create a sink to display a notification
CREATE TABLE notifications (
    `identifier` STRING NOT NULL,
    `notification_id` STRING,
    `notification_text` STRING,
    `notification_link` STRING,
    PRIMARY KEY (identifier) NOT ENFORCED
) WITH (
    'connector' = 'elasticsearch-7',
    'hosts' = 'http://elasticsearch:9200',
    'index' = 'notifications'
);

When that table is created, you'll re-use the previous SQL that returns the list of identifier and send those results to the previously created table.

INSERT INTO notifications (`identifier`, `notification_id`, `notification_text`)
    SELECT 
        T.identifier,
        'MyFirstNotification',
        'Are you trying to hack Flink?'
    FROM web_activities
    MATCH_RECOGNIZE(
        PARTITION BY `identifier`
        ORDER BY `proc_time`
        MEASURES `url` AS url
        AFTER MATCH SKIP PAST LAST ROW
        PATTERN (A+ B+ C)
        DEFINE
            A AS A.url = 'http://localhost/flink/flink-docs-master/docs/try-flink/datastream/',
            B AS B.url = 'http://localhost/flink/flink-docs-master/docs/try-flink/table_api/',
            C AS C.url = 'http://localhost/flink/flink-docs-master/docs/try-flink/flink-operations-playground/'
) AS T;

⚠️ The default value of the cookie identifier is anonymous. No notifications will be displayed if the value is anonymous.

In order to change the value, you need to open the Developer Tools via either Cmd + Opt + J (on Mac) or Ctrl + Shift + J (on Windows)

In the opened console, you then need to type document.cookie="identifier=YourIdentifier" to change the value of the identifier cookie.

If you've changed the value of your identifier cookie, and you follow the defined pattern, a notification will be displayed to you.

Displaying a personal notification

Join and enrich streaming data with batch data

Another common use case in SQL is that you need join data from multiple sources. In the next example, you will display a notification to the user of the website who has visited the homepage more than 3 times in 10 seconds. If the identifier is MartijnsMac, the notification will display a link to the author's Twitter handle. The Twitter handle is retrieved from the external source. In case the identifier is different, no link will be included.

The first thing that we'll do is create another table, so we can connect to the data.

CREATE TABLE customer (
    `identifier` STRING,
    `fullname` STRING,
    `twitter_handle` STRING,
    PRIMARY KEY (identifier) NOT ENFORCED
) WITH (
   'connector' = 'jdbc',
   'url' = 'jdbc:mysql://mysql:3306/sql-demo',
   'table-name' = 'customer',
   'username' = 'flink-only-sql',
   'password' = 'demo-sql'
);

You can use a Window Table-Valued Function to determine which identifiers have visited the homepage more then 3 times.

SELECT window_start, window_end, window_time, COUNT(`identifier`) AS `NumberOfVisits` FROM TABLE(
   TUMBLE(TABLE web_activities, DESCRIPTOR(ts), INTERVAL '10' SECONDS))
   WHERE `url` = 'http://localhost/flink/flink-docs-master/'
   GROUP BY window_start, window_end, window_time
   HAVING COUNT(`identifier`) > 3;

The result of the Window Table-Valued Function can also be combined in a JOIN. You can join the previous results with the data in the previously registered customer table to enrich the result. You can use the following DDL for this:

SELECT w.identifier,
       COALESCE(c.fullname,'Anonymous') as `fullname`,
       COALESCE(c.twitter_handle,'https://www.google.com') as `twitter_handle`
FROM(
       SELECT `identifier`
       FROM TABLE(TUMBLE(TABLE `web_activities`, DESCRIPTOR(ts), INTERVAL '10' SECONDS))
       WHERE `url` = 'http://localhost/flink/flink-docs-master/'
       GROUP BY `identifier`
       HAVING COUNT(`identifier`) > 3 ) w
LEFT JOIN(
       SELECT *
       FROM customer ) c
ON w.identifier = c.identifier
GROUP BY w.identifier,
         c.fullname,
         c.twitter_handle;

With a slight modification to the DDL above, you can use the result for displaying an actionable insight to these visitors:

INSERT INTO notifications (`identifier`, `notification_id`, `notification_text`, `notification_link`)
SELECT w.identifier,
       'MySecondNotification',
       CONCAT('Welcome ', COALESCE(c.fullname,'Anonymous')),
       COALESCE(c.twitter_handle,'https://www.google.com')
FROM(
       SELECT `identifier`
       FROM TABLE(TUMBLE(TABLE `web_activities`, DESCRIPTOR(ts), INTERVAL '10' SECONDS))
       WHERE `url` = 'http://localhost/flink/flink-docs-master/'
       GROUP BY `identifier`
       HAVING COUNT(`identifier`) > 3 ) w
LEFT JOIN(
       SELECT *
       FROM customer ) c
ON w.identifier = c.identifier
GROUP BY w.identifier,
         c.fullname,
         c.twitter_handle;

Displaying a notification with link

flink-only-sql's People

Contributors

martijnvisser avatar mend-bolt-for-github[bot] avatar renovate-bot avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

flink-only-sql's Issues

CVE-2017-16516 (High) detected in yajl-ruby-1.2.2.gem - autoclosed

CVE-2017-16516 - High Severity Vulnerability

Vulnerable Library - yajl-ruby-1.2.2.gem

Library home page: https://rubygems.org/gems/yajl-ruby-1.2.2.gem

Dependency Hierarchy:

  • yajl-ruby-1.2.2.gem (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.

Publish Date: 2017-11-03

URL: CVE-2017-16516

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-16516

Release Date: 2017-11-03

Fix Resolution: 1.3.1


Step up your Open Source Security Game with Mend here

CVE-2021-43861 (Medium) detected in mermaid-8.6.2.min.js

CVE-2021-43861 - Medium Severity Vulnerability

Vulnerable Library - mermaid-8.6.2.min.js

Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams and gantt charts.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/mermaid/8.6.2/mermaid.min.js

Path to vulnerable library: /nginx-init/content/flink/flink-docs-master/mermaid.min.js

Dependency Hierarchy:

  • mermaid-8.6.2.min.js (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.

Publish Date: 2021-12-30

URL: CVE-2021-43861

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43861

Release Date: 2021-12-30

Fix Resolution: mermaid - 8.13.8


Step up your Open Source Security Game with Mend here

CVE-2018-17567 (High) detected in jekyll-3.0.5.gem - autoclosed

CVE-2018-17567 - High Severity Vulnerability

Vulnerable Library - jekyll-3.0.5.gem

Jekyll is a simple, blog aware, static site generator.

Library home page: https://rubygems.org/gems/jekyll-3.0.5.gem

Dependency Hierarchy:

  • jekyll-3.0.5.gem (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.

Publish Date: 2018-09-28

URL: CVE-2018-17567

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17567

Release Date: 2018-09-28

Fix Resolution: v3.7.4,v3.8.4


Step up your Open Source Security Game with Mend here

CVE-2021-35513 (Medium) detected in mermaid-8.6.2.min.js

CVE-2021-35513 - Medium Severity Vulnerability

Vulnerable Library - mermaid-8.6.2.min.js

Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams and gantt charts.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/mermaid/8.6.2/mermaid.min.js

Path to vulnerable library: /nginx-init/content/flink/flink-docs-master/mermaid.min.js

Dependency Hierarchy:

  • mermaid-8.6.2.min.js (Vulnerable Library)

Found in HEAD commit: 6a4a16e473b2d76a096e6618552ef9f10056808e

Found in base branch: main

Vulnerability Details

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

Publish Date: 2021-06-27

URL: CVE-2021-35513

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4f6x-49g2-99fm

Release Date: 2021-06-27

Fix Resolution: mermaid - 8.11.0


Step up your Open Source Security Game with Mend here

CVE-2015-9251 (Medium) detected in jquery-2.1.0.js - autoclosed

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.0.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.0/jquery.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/jquery-2.1.0.js,/content/visualizer/js/jquery-2.1.0.js

Dependency Hierarchy:

  • jquery-2.1.0.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-20676 (Medium) detected in bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js - autoclosed

CVE-2018-20676 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js

bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to dependency file: /content/community.html

Path to vulnerable library: /content/js/bootstrap.min.js,/content/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)
bootstrap-3.1.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/bootstrap.min.js,/content/visualizer/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.1.1.min.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2022-24795 (High) detected in yajl-ruby-1.2.2.gem - autoclosed

CVE-2022-24795 - High Severity Vulnerability

Vulnerable Library - yajl-ruby-1.2.2.gem

Library home page: https://rubygems.org/gems/yajl-ruby-1.2.2.gem

Dependency Hierarchy:

  • yajl-ruby-1.2.2.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at yajl_buf.c#L64 may result in the need 32bit integer wrapping to 0 when need approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as size_t in the 2.x branch of yajl, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which size_t is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.

Publish Date: 2022-04-05

URL: CVE-2022-24795

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jj47-x69x-mxrm

Release Date: 2022-04-05

Fix Resolution: yajl-ruby - 1.4.2


Step up your Open Source Security Game with Mend here

CVE-2020-11023 (Medium) detected in jquery-2.1.0.js - autoclosed

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.0.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.0/jquery.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/jquery-2.1.0.js,/content/visualizer/js/jquery-2.1.0.js

Dependency Hierarchy:

  • jquery-2.1.0.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2022-31108 (Medium) detected in mermaid-8.6.2.min.js

CVE-2022-31108 - Medium Severity Vulnerability

Vulnerable Library - mermaid-8.6.2.min.js

Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams and gantt charts.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/mermaid/8.6.2/mermaid.min.js

Path to vulnerable library: /nginx-init/content/flink/flink-docs-master/mermaid.min.js

Dependency Hierarchy:

  • mermaid-8.6.2.min.js (Vulnerable Library)

Found in HEAD commit: 6a4a16e473b2d76a096e6618552ef9f10056808e

Found in base branch: main

Vulnerability Details

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted CSS selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the value attribute one character at a time. Whenever there is an actual match, an http request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. This issue may lead to Information Disclosure via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc. This issue has been resolved in version 9.1.3. Users are advised to upgrade. Users unable to upgrade should ensure that user input is adequately escaped before embedding it in CSS blocks.

Publish Date: 2022-06-28

URL: CVE-2022-31108

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x3vm-38hw-55wf

Release Date: 2022-06-28

Fix Resolution: mermaid - 9.1.3


Step up your Open Source Security Game with Mend here

CVE-2016-10735 (Medium) detected in bootstrap-3.1.1.min.js, bootstrap-3.3.4.min.js - autoclosed

CVE-2016-10735 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.1.1.min.js, bootstrap-3.3.4.min.js

bootstrap-3.1.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/bootstrap.min.js,/content/visualizer/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.1.1.min.js (Vulnerable Library)
bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to dependency file: /content/community.html

Path to vulnerable library: /content/js/bootstrap.min.js,/content/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Publish Date: 2019-01-09

URL: CVE-2016-10735

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10735

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0, 4.0.0-beta.2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-14001 (High) detected in kramdown-1.10.0.gem - autoclosed

CVE-2020-14001 - High Severity Vulnerability

Vulnerable Library - kramdown-1.10.0.gem

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Library home page: https://rubygems.org/gems/kramdown-1.10.0.gem

Dependency Hierarchy:

  • kramdown-1.10.0.gem (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Publish Date: 2020-07-17

URL: CVE-2020-14001

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14001

Release Date: 2020-07-17

Fix Resolution: kramdown - 2.3.0


Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

Detected dependencies

docker-compose
docker-compose.yml
  • confluentinc/cp-zookeeper 7.2.1
  • confluentinc/cp-kafka 7.2.1
  • confluentinc/cp-kafka 7.2.1
  • confluentinc/cp-schema-registry 7.2.1
  • confluentinc/cp-kafka-rest 7.2.1
  • docker.elastic.co/elasticsearch/elasticsearch 7.16.2
dockerfile
flink-init/Dockerfile
  • flink 1.15.2-scala_2.12
mysql-init/Dockerfile
  • mysql 8.0.30
nginx-init/Dockerfile
  • nginx 1.22.0

  • Check this box to trigger a request for Renovate to run again on this repository

Flink SQL CDC guarantees

I was looking for a consolidated list of features and found this.

Thus, Flink SQL collection, computing, and ETL can be unified, which has the following advantages:

Small end-to-end latency
Exactly-once guarantee for read and compute
No data storage and lower storage costs
Stream reading of full and incremental data supported
Backtracking of Binlog collection site

The documentation for this is key when we compare and contrast this with Kafka Connect Worker Clusters and its CDC support.
Where can I locate the detailed explanation of the points mentioned above ?

It is not for oracle https://ververica.github.io/flink-cdc-connectors/release-2.0/content/about.html

CVE-2019-11358 (Medium) detected in jquery-2.1.0.js - autoclosed

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.0.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.0/jquery.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/jquery-2.1.0.js,/content/visualizer/js/jquery-2.1.0.js

Dependency Hierarchy:

  • jquery-2.1.0.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0


Step up your Open Source Security Game with Mend here

CVE-2018-14042 (Medium) detected in bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js - autoclosed

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js

bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to dependency file: /content/community.html

Path to vulnerable library: /content/js/bootstrap.min.js,/content/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)
bootstrap-3.1.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/bootstrap.min.js,/content/visualizer/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.1.1.min.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0


Step up your Open Source Security Game with Mend here

CVE-2019-8331 (Medium) detected in bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js - autoclosed

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js

bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to dependency file: /content/community.html

Path to vulnerable library: /content/js/bootstrap.min.js,/content/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)
bootstrap-3.1.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/bootstrap.min.js,/content/visualizer/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.1.1.min.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1


Step up your Open Source Security Game with Mend here

CVE-2018-20677 (Medium) detected in bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js - autoclosed

CVE-2018-20677 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js

bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to dependency file: /content/community.html

Path to vulnerable library: /content/js/bootstrap.min.js,/content/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)
bootstrap-3.1.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/bootstrap.min.js,/content/visualizer/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.1.1.min.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-11022 (Medium) detected in jquery-2.1.0.js - autoclosed

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.0.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.0/jquery.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/jquery-2.1.0.js,/content/visualizer/js/jquery-2.1.0.js

Dependency Hierarchy:

  • jquery-2.1.0.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0


Step up your Open Source Security Game with Mend here

CVE-2018-14040 (Medium) detected in bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js - autoclosed

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.min.js, bootstrap-3.1.1.min.js

bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to dependency file: /content/community.html

Path to vulnerable library: /content/js/bootstrap.min.js,/content/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)
bootstrap-3.1.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js

Path to dependency file: /content/visualizer/index.html

Path to vulnerable library: /content/visualizer/js/bootstrap.min.js,/content/visualizer/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.1.1.min.js (Vulnerable Library)

Found in HEAD commit: 7022cc7e54339518cf66e1b1a1e55f8d0cddaf5f

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.