Git Product home page Git Product logo

number-insight-graphql's Introduction

Number Insight API GraphQL Example

Deploy Deploy to now

Nexmo's Number Insight API is a great way to get more information about numbers that you have stored in your system.

This repository contains an example GraphQL server for retreiving information from the Number Insight API, it will work with the basic, standard and advanced levels of information retrieval.

The server is written in Node.js and uses the Apollo GraphQL Server.

Installation

Clone the repository and run the following command to install the project dependencies:

npm install

Note: Dependencies are apollo-server, graphql, apollo-datasource-rest and config

API Key & Secret

You will need a Nexmo API Key and API Secret. If you don't have these credentials then sign up for a Nexmo account to get them.

config expects credentials to be found at this path ./config/default.json so create this file first.

Set your default.json file up like this:

{
  "nexmo_api_key": "<your api key>",
  "nexmo_api_secret": "<your api secret>",
  "graphql_playground": true,
  "graphql_introspection": true
}

Starting The Server

To start the server locally run this command:

npm start

The server will launch on port 4000. If you need to change this port then you can by modifying line 24 of server.js.

Running Queries

You are free to run queries against this server however you like, but the best place to start is by using the interactive query editor provided by the Apollo GraphQL Server.

You can launch this with your server running by going to http://localhost:4000 in your browser.

Example Query - Basic

Here is a basic query to start with:

query {
  insight(number: "<enter your number here>") {
    country_name
  }
}

This will return a JSON response similar to this:

{
  "data": {
    "insight": {
      "country_name": "United Kingdom"
    }
  }
}

Example Query - Standard

To retrieve standard level insight (which cost slightly more), run your queries with an additional type parameter in the request.

For example:

query {
  insight(number: "<enter your number here>", type: "standard") {
    country_name
    current_carrier {
      name
    }
  }
}

This will return a JSON response similar to this:

{
  "data": {
    "insight": {
      "country_name": "United Kingdom",
      "current_carrier": {
        "name": "Telefonica UK Limited"
      }
    }
  }
}

The full list of available parameters from the Number Insight API, and at what level you can access them, can be found in the API Reference.

Deploying The Server

The quickest way to deploy this to a production server would be to use the one-click deploy buttons at the top of this readme. They will both as you to set your NEXMO_API_KEY and NEXMO_API_SECRET as part of the deployment.

If deploying to your own server, ensure that these environment variables are also set.

GraphQL Playground and Introspection in Production

By default, introspection and the GraphQL playground are not available when the NODE_ENV on a server is set to production. If you do want to use either of these options once you have deployed the server make sure to set the GRAPHQL_INTROSPECTION and GRAPHQL_PLAYGROUND to true in your environment variables.

number-insight-graphql's People

Contributors

martyndavies avatar

Stargazers

 avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

number-insight-graphql's Issues

apollo-server-2.25.4.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - apollo-server-2.25.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Found in HEAD commit: ff56293600df828da156a92ddb85edb5a9680818

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-24434 High 7.5 dicer-0.3.0.tgz Transitive N/A

Details

CVE-2022-24434

Vulnerable Library - dicer-0.3.0.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

  • apollo-server-2.25.4.tgz (Root Library)
    • apollo-server-core-2.25.4.tgz
      • graphql-upload-8-fork-8.1.3.tgz
        • busboy-0.3.1.tgz
          • dicer-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: ff56293600df828da156a92ddb85edb5a9680818

Found in base branch: main

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

apollo-datasource-rest-0.4.0.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - apollo-datasource-rest-0.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/http-cache-semantics/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (apollo-datasource-rest version) Remediation Available
CVE-2022-25881 Medium 5.3 http-cache-semantics-4.1.0.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-25881

Vulnerable Library - http-cache-semantics-4.1.0.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/http-cache-semantics/package.json

Dependency Hierarchy:

  • apollo-datasource-rest-0.4.0.tgz (Root Library)
    • http-cache-semantics-4.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-25881

Release Date: 2023-01-31

Fix Resolution: http-cache-semantics - 4.1.1

apollo-server-2.26.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - apollo-server-2.26.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Found in HEAD commit: ff56293600df828da156a92ddb85edb5a9680818

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (apollo-server version) Remediation Available
CVE-2022-24434 High 7.5 dicer-0.3.0.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-24434

Vulnerable Library - dicer-0.3.0.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

  • apollo-server-2.26.0.tgz (Root Library)
    • apollo-server-core-2.26.0.tgz
      • graphql-upload-8-fork-8.1.3.tgz
        • busboy-0.3.1.tgz
          • dicer-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: ff56293600df828da156a92ddb85edb5a9680818

Found in base branch: main

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

config-3.3.8.tgz: 1 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - config-3.3.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (config version) Remediation Available
CVE-2022-46175 High 8.8 json5-2.2.1.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-46175

Vulnerable Library - json5-2.2.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • config-3.3.8.tgz (Root Library)
    • json5-2.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.