Git Product home page Git Product logo

base-api-client's Introduction

Logo

base-api-client

Base API client backed by axios.

Version Bundle size Downloads

CodeFactor SonarCloud Codacy Scrutinizer

Dependencies Security Build Status Coverage Status

Commit activity FOSSA License Made in Ukraine

πŸ‡ΊπŸ‡¦ Help Ukraine

I woke up on my 26th birthday at 5 am from the blows of russian missiles. They attacked the city of Kyiv, where I live, as well as the cities in which my family and friends live. Now my country is a war zone.

We fight for democratic values, freedom, for our future! Once again Ukrainians have to stand against evil, terror, against genocide. The outcome of this war will determine what path human history is taking from now on.

πŸ’›πŸ’™ Help Ukraine! We need your support! There are dozen ways to help us, just do it!

Table of Contents

Requirements

Platform Status

To use library you need to have node and npm installed in your machine:

  • node >=10
  • npm >=6

Package is continuously tested on darwin, linux and win32 platforms. All active and maintenance LTS node releases are supported.

Installation

To install the library run the following command

  npm i --save base-api-client

Usage

Example of telegram client extended from BaseAPI:

import BaseAPI from 'base-api-client';

export default class TelegramAPI extends BaseAPI {
    constructor(id, token) {
        super(`https://api.telegram.org/${id}:${token}`);
    }

    message(chatId, html) {
        return this.post('sendMessage', {
            'parse_mode' : 'HTML',
            'text'       : html,
            'chat_id'    : chatId
        });
    }

    file(chatId, fileId) {
        return this.post('sendDocument', {
            'document' : fileId,
            'chat_id'  : chatId
        });
    }
}

Constructor arguments

  1. url - base URL of the API. Can consist apiPrefix. Will be cast to nodeJS URL object.
  2. options - object with next attributes:
    • timeout - timeout in ms format. Will be cast to integer (in milliseconds). Default: 1m.
    • logger - if applied, will add debug and verbose messages before and after each request. Should have next interface: logger.log(level, object).

Methods

HTTP methods:

  • get(url, params, options)
  • post(url, data, options)
  • patch(url, data, options)
  • put(url, data, options)
  • delete(url, options)

in all aforementioned methods url can be both global, or relative to base URL (defined in constructor). params are url query params, and data is JSON body. options are passed directly to axios request

Headers

Implement getHeaders() method to define select headers for API. Alternativelly, pass headers in options for each request if headers need behave differently.

Basic auth use auth setting, if you want to use basic auth for each request.

this.auth = {
    username : '',
    password : ''
};

Data processing

Next methods can be used for default data pre/post-processing:

        onError(error) {
            if (error.isAxiosError) {
                throw new API_ERROR(error);
            }
            throw error;
        },

        onResponse(res) {
            return res.data;
        }

Errors

the package exposes API_ERROR, that can be used outside:

import BaseAPI, { API_ERROR } from 'base-api-client';

class API extends BaseAPI {
    constructor() {
        super('http://wiwbif.is/fugo');
    }

    async createUser(email) {
        try {
            const user = await this.post('/users', { email });


            return user.id;
        } catch (error) {
            if (error instanceof API_ERROR) {
                console.log('raw http error:', error.payload);
                throw error;
            }
        }
    }
}

Logging and Tracing

You can pass logger while api creation, but also this can be done by calling initLogger(logger) method directly.

Alternatively, use polymorphism and implement the log(level, data) method on descendants.

Autogenerated Trace ID is atached to each log. If you need control over traceId generation, implement getTraceId(reqOptions, settings) method.

Testing

Depending on selected approach use setMock(mockFuction) or implement _axios(axiosOptions) method. Both mockFuction and _axios will receive axios options instead of axios instance, and should return expected result. Default mock function is () => ({ data: 1 }).

To check examples of api mocks and tesing, see implementation section.

Implementations

Looking for more examples? Check real implementations of famous APIs:

API Organization Reference Examples
Telegram Bot Telegram Bot API
Telegra.ph Telegram Telegraph API
AWS SNS Amazon AWS docs
Gitea Gitea Swagger
GitHub Apps Microsoft Apps Reference
GitHub Repos Microsoft Repositories Reference
Heroku Salesforce Platform API Reference
JIRA Atlassian REST API
Confluence Atlassian REST API

Contribute

Make the changes to the code and tests. Then commit to your branch. Be sure to follow the commit message conventions. Read Contributing Guidelines for details.

base-api-client's People

Contributors

lalaps[bot] avatar lgtm-com[bot] avatar pustovitdmytro avatar renovate-bot avatar renovate[bot] avatar semantic-release-bot avatar

Stargazers

 avatar  avatar

Watchers

 avatar  avatar  avatar

Forkers

lgtm-migrator

base-api-client's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

  • Chore: Update devDependencies (non-major) (@babel/cli, @babel/core, @babel/node, @babel/plugin-proposal-class-properties, @babel/plugin-proposal-decorators, @babel/plugin-proposal-object-rest-spread, @babel/plugin-proposal-optional-chaining, @babel/preset-env, @babel/runtime, @commitlint/cli, @commitlint/lint, @semantic-release/changelog, chai, chance, danger, eslint, eslint-config-incredible, eslint-plugin-censor, eslint-plugin-import, eslint-plugin-mocha, eslint-plugin-no-secrets, eslint-plugin-node, eslint-plugin-promise, eslint-plugin-regexp, eslint-plugin-security, eslint-plugin-sonarjs, express, fs-extra, jscpd, lockfile-lint, mocha, mocha-junit-reporter, node-package-tester, semantic-release)
  • chore: update actions/checkout action to v4
  • chore: update actions/setup-node action to v4
  • Chore: Lock file maintenance
  • πŸ” Create all rate-limited PRs at once πŸ”

Pending Status Checks

These updates await pending status checks. To force their creation now, click the checkbox below.

  • chore: update github/codeql-action action to v3

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

github-actions
.github/workflows/codeql.yml
  • actions/checkout v3
  • github/codeql-action v2
  • github/codeql-action v2
  • github/codeql-action v2
.github/workflows/npt.yml
  • actions/checkout v2
  • actions/setup-node v2
  • actions/setup-node v2
npm
package.json
  • axios 0.25.0
  • ms 2.1.3
  • myrmidon 1.7.2
  • uuid 8.3.2
  • @babel/cli ^7.17.0
  • @babel/core ^7.17.0
  • @babel/node ^7.16.8
  • @babel/plugin-proposal-class-properties ^7.16.7
  • @babel/plugin-proposal-decorators ^7.17.0
  • @babel/plugin-proposal-object-rest-spread ^7.16.7
  • @babel/plugin-proposal-optional-chaining ^7.16.7
  • @babel/polyfill ^7.12.1
  • @babel/preset-env ^7.16.11
  • @babel/runtime ^7.17.0
  • @commitlint/cli ^16.1.0
  • @commitlint/lint ^16.0.0
  • @semantic-release/changelog ^6.0.1
  • @semantic-release/git ^10.0.1
  • babel-plugin-module-resolver ^4.1.0
  • chai ^4.3.6
  • chance ^1.1.8
  • conventional-changelog-eslint ^3.0.9
  • coveralls ^3.1.1
  • danger ^11.2.3
  • eslint ^8.8.0
  • eslint-config-incredible ^2.4.1
  • eslint-plugin-censor ^1.5.2
  • eslint-plugin-import ^2.25.4
  • eslint-plugin-markdown ^2.2.1
  • eslint-plugin-mocha ^10.0.3
  • eslint-plugin-no-secrets ^0.8.9
  • eslint-plugin-node ^11.1.0
  • eslint-plugin-promise ^6.0.0
  • eslint-plugin-regexp ^1.5.1
  • eslint-plugin-scanjs-rules ^0.2.1
  • eslint-plugin-security ^1.4.0
  • eslint-plugin-sonarjs ^0.11.0
  • eslint-plugin-unicorn ^40.1.0
  • express ^4.18.2
  • fs-extra ^10.0.0
  • husky ^7.0.4
  • jscpd ^3.4.5
  • lockfile-lint ^4.6.2
  • mocha ^9.2.0
  • mocha-junit-reporter ^2.0.2
  • node-package-tester ^1.3.3
  • nyc ^15.1.0
  • semantic-release ^19.0.3
  • semantic-release-telegram ^1.6.2
  • node >=10

  • Check this box to trigger a request for Renovate to run again on this repository

CVE-2022-2216 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2216 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

  • semantic-release-telegram-1.5.1.tgz (Root Library)
    • git-url-parse-11.6.0.tgz
      • git-up-4.0.5.tgz
        • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2216

CVSS 3 Score Details (9.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-31051 (High) detected in semantic-release-19.0.2.tgz - autoclosed

CVE-2022-31051 - High Severity Vulnerability

Vulnerable Library - semantic-release-19.0.2.tgz

Automated semver compliant package publishing

Library home page: https://registry.npmjs.org/semantic-release/-/semantic-release-19.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semantic-release/package.json

Dependency Hierarchy:

  • ❌ semantic-release-19.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Publish Date: 2022-06-09

URL: CVE-2022-31051

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x2pg-mjhr-2m5x

Release Date: 2022-06-09

Fix Resolution: 19.0.3


Step up your Open Source Security Game with Mend here

CVE-2021-3918 (High) detected in json-schema-0.2.3.tgz - autoclosed

CVE-2021-3918 - High Severity Vulnerability

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json,/node_modules/npm/node_modules/json-schema/package.json

Dependency Hierarchy:

  • coveralls-3.1.1.tgz (Root Library)
    • request-2.88.2.tgz
      • http-signature-1.2.0.tgz
        • jsprim-1.4.1.tgz
          • ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution: json-schema - 0.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2024-28849 (Medium) detected in follow-redirects-1.15.2.tgz

CVE-2024-28849 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • axios-0.25.0.tgz (Root Library)
    • ❌ follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6


Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/node_modules/string-width/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • semantic-release-19.0.2.tgz (Root Library)
    • npm-9.0.0.tgz
      • npm-8.4.1.tgz
        • npmlog-6.0.0.tgz
          • gauge-4.0.0.tgz
            • wide-align-1.1.5.tgz
              • string-width-2.1.1.tgz
                • strip-ansi-4.0.0.tgz
                  • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)
ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/node_modules/cli-table3/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • semantic-release-19.0.2.tgz (Root Library)
    • npm-9.0.0.tgz
      • npm-8.4.1.tgz
        • cli-table3-0.6.1.tgz
          • string-width-4.2.2.tgz
            • strip-ansi-6.0.0.tgz
              • ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (semantic-release): 19.0.3

Fix Resolution (ansi-regex): 5.0.1

Direct dependency fix Resolution (semantic-release): 19.0.3


Step up your Open Source Security Game with Mend here

Lalaps Dashboard

This issue provides visibility into Lalaps updates and their statuses.

npm

decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Root Libraries:

  • ❌ danger

minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
Root Libraries:

  • ❌ mocha

Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
Root Libraries:

Cross site scripting in parse-url
Library: parse-url
Affected versions: <6.0.1
Severity: moderate
Root Libraries:

Last Updated: 01 Dec 2022, at 01:08 UTC

CVE-2021-23490 (High) detected in parse-link-header-1.0.1.tgz - autoclosed

CVE-2021-23490 - High Severity Vulnerability

Vulnerable Library - parse-link-header-1.0.1.tgz

Parses a link header and returns paging information for each contained link.

Library home page: https://registry.npmjs.org/parse-link-header/-/parse-link-header-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-link-header/package.json

Dependency Hierarchy:

  • danger-10.6.6.tgz (Root Library)
    • ❌ parse-link-header-1.0.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.

Publish Date: 2021-12-24

URL: CVE-2021-23490

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23490

Release Date: 2021-12-24

Fix Resolution: parse-link-header - 2.0.0


Step up your Open Source Security Game with WhiteSource here

Bug: Error handling

Issue Description
Organize brief error handling:

  • idempotency
  • way for further testing

CVE-2022-0722 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-0722 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

  • semantic-release-telegram-1.5.1.tgz (Root Library)
    • git-url-parse-11.6.0.tgz
      • git-up-4.0.5.tgz
        • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-0722

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-2217 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2217 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

  • semantic-release-telegram-1.5.1.tgz (Root Library)
    • git-url-parse-11.6.0.tgz
      • git-up-4.0.5.tgz
        • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2217

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/4e046c63-b1ca-4bcc-b418-29796918a71b/

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1


Step up your Open Source Security Game with Mend here

CVE-2021-43307 (High) detected in semver-regex-3.1.3.tgz - autoclosed

CVE-2021-43307 - High Severity Vulnerability

Vulnerable Library - semver-regex-3.1.3.tgz

Regular expression for matching semver versions

Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-3.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver-regex/package.json

Dependency Hierarchy:

  • semantic-release-19.0.2.tgz (Root Library)
    • find-versions-4.0.0.tgz
      • ❌ semver-regex-3.1.3.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Publish Date: 2022-06-02

URL: CVE-2021-43307

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/

Release Date: 2022-06-02

Fix Resolution (semver-regex): 3.1.4

Direct dependency fix Resolution (semantic-release): 19.0.3


Step up your Open Source Security Game with Mend here

CVE-2023-45857 (Medium) detected in axios-0.25.0.tgz

CVE-2023-45857 - Medium Severity Vulnerability

Vulnerable Library - axios-0.25.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • ❌ axios-0.25.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: 0.28.0


Step up your Open Source Security Game with Mend here

CVE-2023-26159 (Medium) detected in follow-redirects-1.15.2.tgz

CVE-2023-26159 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • axios-0.25.0.tgz (Root Library)
    • ❌ follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (axios): 0.26.0


Step up your Open Source Security Game with Mend here

CVE-2022-2218 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2218 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

  • semantic-release-telegram-1.5.1.tgz (Root Library)
    • git-url-parse-11.6.0.tgz
      • git-up-4.0.5.tgz
        • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2218

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/024912d3-f103-4daf-a1d0-567f4d9f2bf5/

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-0624 (Medium) detected in parse-path-4.0.3.tgz - autoclosed

CVE-2022-0624 - Medium Severity Vulnerability

Vulnerable Library - parse-path-4.0.3.tgz

Parse paths (local paths, urls: ssh/git/etc)

Library home page: https://registry.npmjs.org/parse-path/-/parse-path-4.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-path/package.json

Dependency Hierarchy:

  • semantic-release-telegram-1.5.1.tgz (Root Library)
    • git-url-parse-11.6.0.tgz
      • git-up-4.0.5.tgz
        • parse-url-6.0.0.tgz
          • ❌ parse-path-4.0.3.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.

Publish Date: 2022-06-28

URL: CVE-2022-0624

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0624

Release Date: 2022-06-28

Fix Resolution: parse-path - 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-43616 (High) detected in npm-7.24.2.tgz - autoclosed

CVE-2021-43616 - High Severity Vulnerability

Vulnerable Library - npm-7.24.2.tgz

a package manager for JavaScript

Library home page: https://registry.npmjs.org/npm/-/npm-7.24.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/package.json

Dependency Hierarchy:

  • semantic-release-18.0.1.tgz (Root Library)
    • npm-8.0.3.tgz
      • ❌ npm-7.24.2.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.

Publish Date: 2021-11-13

URL: CVE-2021-43616

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43616

Release Date: 2021-11-13

Fix Resolution: npm - 8.1.4


Step up your Open Source Security Game with WhiteSource here

CVE-2022-29244 (High) detected in npm-8.4.1.tgz - autoclosed

CVE-2022-29244 - High Severity Vulnerability

Vulnerable Library - npm-8.4.1.tgz

a package manager for JavaScript

Library home page: https://registry.npmjs.org/npm/-/npm-8.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/package.json

Dependency Hierarchy:

  • semantic-release-19.0.2.tgz (Root Library)
    • npm-9.0.0.tgz
      • ❌ npm-8.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Publish Date: 2022-06-13

URL: CVE-2022-29244

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hj9c-8jmm-8c52

Release Date: 2022-04-14

Fix Resolution: npm - 8.11.0


Step up your Open Source Security Game with Mend here

CVE-2022-0155 (High) detected in follow-redirects-1.14.6.tgz - autoclosed

CVE-2022-0155 - High Severity Vulnerability

Vulnerable Library - follow-redirects-1.14.6.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.21.4.tgz (Root Library)
    • ❌ follow-redirects-1.14.6.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (8.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution: follow-redirects - v1.14.7


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23807 (High) detected in jsonpointer-4.1.0.tgz - autoclosed

CVE-2021-23807 - High Severity Vulnerability

Vulnerable Library - jsonpointer-4.1.0.tgz

Simple JSON Addressing.

Library home page: https://registry.npmjs.org/jsonpointer/-/jsonpointer-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonpointer/package.json

Dependency Hierarchy:

  • danger-10.6.6.tgz (Root Library)
    • ❌ jsonpointer-4.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

Publish Date: 2021-11-03

URL: CVE-2021-23807

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23807

Release Date: 2021-11-03

Fix Resolution: jsonpointer - 5.0.0


Step up your Open Source Security Game with WhiteSource here

CVE-2022-1214 (High) detected in axios-0.21.4.tgz, axios-0.25.0.tgz - autoclosed

CVE-2022-1214 - High Severity Vulnerability

Vulnerable Libraries - axios-0.21.4.tgz, axios-0.25.0.tgz

axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • semantic-release-telegram-1.5.1.tgz (Root Library)
    • base-api-client-1.5.3.tgz
      • ❌ axios-0.21.4.tgz (Vulnerable Library)
axios-0.25.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.25.0.tgz (Vulnerable Library)

Found in HEAD commit: 05e1fac43b1966bb4ea1c1c7974e0b61a93da69d

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.

Publish Date: 2022-05-03

URL: CVE-2022-1214

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/

Release Date: 2022-05-03

Fix Resolution: 0.26.0


Step up your Open Source Security Game with WhiteSource here

CVE-2022-0235 (Medium) detected in node-fetch-2.6.1.tgz - autoclosed

CVE-2022-0235 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

  • danger-10.8.0.tgz (Root Library)
    • ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: cd7f358dd4df0fbd28be7fe3f43a1ec12ea0a004

Found in base branch: master

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution: node-fetch - 2.6.7,3.1.1


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    πŸ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. πŸ“ŠπŸ“ˆπŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❀️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.