Git Product home page Git Product logo

graphql-js's Introduction

GraphQL.js

The JavaScript reference implementation for GraphQL, a query language for APIs created by Facebook.

npm version Build Status Coverage Status

See more complete documentation at https://graphql.org/ and https://graphql.org/graphql-js/.

Looking for help? Find resources from the community.

Getting Started

A general overview of GraphQL is available in the README for the Specification for GraphQL. That overview describes a simple set of GraphQL examples that exist as tests in this repository. A good way to get started with this repository is to walk through that README and the corresponding tests in parallel.

Using GraphQL.js

Install GraphQL.js from npm

With npm:

npm install --save graphql

or using yarn:

yarn add graphql

GraphQL.js provides two important capabilities: building a type schema and serving queries against that type schema.

First, build a GraphQL type schema which maps to your codebase.

import {
  graphql,
  GraphQLSchema,
  GraphQLObjectType,
  GraphQLString,
} from 'graphql';

var schema = new GraphQLSchema({
  query: new GraphQLObjectType({
    name: 'RootQueryType',
    fields: {
      hello: {
        type: GraphQLString,
        resolve() {
          return 'world';
        },
      },
    },
  }),
});

This defines a simple schema, with one type and one field, that resolves to a fixed value. The resolve function can return a value, a promise, or an array of promises. A more complex example is included in the top-level tests directory.

Then, serve the result of a query against that type schema.

var query = '{ hello }';

graphql(schema, query).then((result) => {
  // Prints
  // {
  //   data: { hello: "world" }
  // }
  console.log(result);
});

This runs a query fetching the one field defined. The graphql function will first ensure the query is syntactically and semantically valid before executing it, reporting errors otherwise.

var query = '{ BoyHowdy }';

graphql(schema, query).then((result) => {
  // Prints
  // {
  //   errors: [
  //     { message: 'Cannot query field BoyHowdy on RootQueryType',
  //       locations: [ { line: 1, column: 3 } ] }
  //   ]
  // }
  console.log(result);
});

Note: Please don't forget to set NODE_ENV=production if you are running a production server. It will disable some checks that can be useful during development but will significantly improve performance.

Want to ride the bleeding edge?

The npm branch in this repository is automatically maintained to be the last commit to master to pass all tests, in the same form found on npm. It is recommended to use builds deployed to npm for many reasons, but if you want to use the latest not-yet-released version of graphql-js, you can do so by depending directly on this branch:

npm install graphql@git://github.com/graphql/graphql-js.git#npm

Using in a Browser

GraphQL.js is a general-purpose library and can be used both in a Node server and in the browser. As an example, the GraphiQL tool is built with GraphQL.js!

Building a project using GraphQL.js with webpack or rollup should just work and only include the portions of the library you use. This works because GraphQL.js is distributed with both CommonJS (require()) and ESModule (import) files. Ensure that any custom build configurations look for .mjs files!

Contributing

We actively welcome pull requests. Learn how to contribute.

Changelog

Changes are tracked as GitHub releases.

License

GraphQL.js is MIT-licensed.

Credits

The *.d.ts files in this project are based on DefinitelyTyped definitions written by:

graphql-js's People

Contributors

andimarek avatar asiandrummer avatar baer avatar cito avatar danielrearden avatar dependabot-preview[bot] avatar dependabot[bot] avatar dherault avatar dschafer avatar enaqx avatar excitement-engineer avatar freiksenet avatar greenkeeper[bot] avatar greenkeeperio-bot avatar ivangoncharov avatar jeffrmoore avatar josephsavona avatar kassens avatar leebyron avatar mjmahone avatar mohawk2 avatar nodkz avatar patrickjs avatar robzhu avatar schrockn-zz avatar skevy avatar snyk-bot avatar swolchok avatar urigo avatar wincent avatar

Watchers

 avatar

Forkers

codacy-badger

graphql-js's Issues

CVE-2021-23362 (Medium) detected in hosted-git-info-2.8.8.tgz - autoclosed

CVE-2021-23362 - Medium Severity Vulnerability

Vulnerable Library - hosted-git-info-2.8.8.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/hosted-git-info/package.json

Dependency Hierarchy:

  • eslint-plugin-import-2.22.1.tgz (Root Library)
    • read-pkg-up-2.0.0.tgz
      • read-pkg-2.0.0.tgz
        • normalize-package-data-2.5.0.tgz
          • hosted-git-info-2.8.8.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8


Step up your Open Source Security Game with WhiteSource here

DepShield encountered errors while building your project - autoclosed

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled when a change to a manifest file* occurs. If the build is successful this issue will be closed, otherwise the error message will be updated.

This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.

* Supported manifest files are: pom.xml, package.json, package-lock.json, npm-shrinkwrap.json, Cargo.lock, Cargo.toml, main.rs, lib.rs, build.gradle, build.gradle.kts, settings.gradle, settings.gradle.kts, gradle.properties, gradle-wrapper.properties, go.mod, go.sum

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flattendeep:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flattendeep:4.4.0 results in the following vulnerability(s):


Occurrences

lodash.flattendeep:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

nyc:15.1.0
        └─ caching-transform:4.0.0
              └─ package-hash:4.0.0
                    └─ lodash.flattendeep:4.4.0

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

[DepShield] (CVSS 7.5) Vulnerability due to usage of hosted-git-info:2.8.8

Vulnerabilities

DepShield reports that this application's usage of hosted-git-info:2.8.8 results in the following vulnerability(s):


Occurrences

hosted-git-info:2.8.8 is a transitive dependency introduced by the following direct dependency(s):

eslint-plugin-import:2.22.1
        └─ read-pkg-up:2.0.0
              └─ read-pkg:2.0.0
                    └─ normalize-package-data:2.5.0
                          └─ hosted-git-info:2.8.8

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-23364 (Medium) detected in browserslist-4.16.1.tgz - autoclosed

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Library - browserslist-4.16.1.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/browserslist/package.json

Dependency Hierarchy:

  • preset-env-7.12.11.tgz (Root Library)
    • helper-compilation-targets-7.12.5.tgz
      • browserslist-4.16.1.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 8.2) Vulnerability due to usage of y18n:4.0.0

Vulnerabilities

DepShield reports that this application's usage of y18n:4.0.0 results in the following vulnerability(s):


Occurrences

y18n:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

mocha:8.2.1
        └─ yargs:13.3.2
              └─ y18n:4.0.0

nyc:15.1.0
        └─ yargs:15.3.1
              └─ y18n:4.0.0

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.debounce:4.0.8

Vulnerabilities

DepShield reports that this application's usage of lodash.debounce:4.0.8 results in the following vulnerability(s):


Occurrences

lodash.debounce:4.0.8 is a transitive dependency introduced by the following direct dependency(s):

@babel/preset-env:7.14.7
        └─ babel-plugin-polyfill-corejs2:0.2.2
              └─ @babel/helper-define-polyfill-provider:0.2.3
                    └─ lodash.debounce:4.0.8

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/path-parse/package.json

Dependency Hierarchy:

  • babel-eslint-10.1.0.tgz (Root Library)
    • resolve-1.17.0.tgz
      • path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash:4.17.19

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.19 results in the following vulnerability(s):


Occurrences

lodash:4.17.19 is a transitive dependency introduced by the following direct dependency(s):

@babel/core:7.10.5
        └─ @babel/helper-module-transforms:7.11.0
              └─ lodash:4.17.19
        └─ @babel/traverse:7.11.0
              └─ lodash:4.17.19
        └─ @babel/types:7.11.0
              └─ lodash:4.17.19
        └─ lodash:4.17.19
        └─ @babel/helpers:7.10.4
              └─ @babel/traverse:7.11.0
                    └─ lodash:4.17.19
              └─ @babel/types:7.11.0
                    └─ lodash:4.17.19

@babel/register:7.10.5
        └─ lodash:4.17.19

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2020-7774 (High) detected in y18n-4.0.0.tgz

CVE-2020-7774 - High Severity Vulnerability

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/y18n/package.json

Dependency Hierarchy:

  • mocha-8.2.0.tgz (Root Library)
    • yargs-13.3.2.tgz
      • y18n-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 972f0f818792ee924636343ae37cd5da2e83c6f7

Found in base branch: master

Vulnerability Details

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7774

Release Date: 2020-11-17

Fix Resolution: 5.0.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-44906 (High) detected in minimist-1.2.5.tgz - autoclosed

CVE-2021-44906 - High Severity Vulnerability

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Dependency Hierarchy:

  • core-7.16.0.tgz (Root Library)
    • json5-2.2.0.tgz
      • minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 2baee691bb15938b5009b6bc83a2c362d466b4a7

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/issues/164

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (@babel/core): 7.16.10


Step up your Open Source Security Game with WhiteSource here

CVE-2020-28500 (Medium) detected in lodash-4.17.20.tgz - autoclosed

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/lodash/package.json

Dependency Hierarchy:

  • core-7.12.10.tgz (Root Library)
    • lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: lodash-4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-4.17.20.tgz - autoclosed

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/lodash/package.json

Dependency Hierarchy:

  • core-7.12.10.tgz (Root Library)
    • lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23566 (Medium) detected in nanoid-3.1.25.tgz - autoclosed

CVE-2021-23566 - Medium Severity Vulnerability

Vulnerable Library - nanoid-3.1.25.tgz

A tiny (108 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.25.tgz

Dependency Hierarchy:

  • mocha-9.1.3.tgz (Root Library)
    • nanoid-3.1.25.tgz (Vulnerable Library)

Found in HEAD commit: 2baee691bb15938b5009b6bc83a2c362d466b4a7

Found in base branch: master

Vulnerability Details

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Publish Date: 2022-01-14

URL: CVE-2021-23566

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: ai/nanoid#328

Release Date: 2022-01-14

Fix Resolution (nanoid): 3.1.31

Direct dependency fix Resolution (mocha): 9.1.4


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7751 (High) detected in pathval-1.1.0.tgz

CVE-2020-7751 - High Severity Vulnerability

Vulnerable Library - pathval-1.1.0.tgz

Object value retrieval given a string path

Library home page: https://registry.npmjs.org/pathval/-/pathval-1.1.0.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/pathval/package.json

Dependency Hierarchy:

  • chai-4.2.0.tgz (Root Library)
    • pathval-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 972f0f818792ee924636343ae37cd5da2e83c6f7

Found in base branch: master

Vulnerability Details

This affects all versions of package pathval.

Publish Date: 2020-10-26

URL: CVE-2020-7751

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):


Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

eslint-plugin-import:2.22.0
        └─ eslint-import-resolver-node:0.3.4
              └─ debug:2.6.9
        └─ eslint-module-utils:2.6.0
              └─ debug:2.6.9
        └─ debug:2.6.9

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-3807 (High) detected in ansi-regex-5.0.0.tgz - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Library - ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/table/node_modules/ansi-regex/package.json,graphql-js/node_modules/eslint/node_modules/ansi-regex/package.json,graphql-js/node_modules/yargs/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • nyc-15.1.0.tgz (Root Library)
    • yargs-15.3.1.tgz
      • cliui-6.0.0.tgz
        • strip-ansi-6.0.0.tgz
          • ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 97bb35e89290792d60a2b007998f1959c03fa5f5

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of ini:1.3.8

Vulnerabilities

DepShield reports that this application's usage of ini:1.3.8 results in the following vulnerability(s):


Occurrences

ini:1.3.8 is a transitive dependency introduced by the following direct dependency(s):

cspell:5.1.3
        └─ cspell-lib:5.1.3
              └─ resolve-global:1.0.0
                    └─ global-dirs:0.1.1
                          └─ ini:1.3.8

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clonedeep:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):


Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

eslint:7.30.0
        └─ table:6.7.1
              └─ lodash.clonedeep:4.5.0

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

[DepShield] (CVSS 9.8) Vulnerability due to usage of lodash:4.17.20

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.20 results in the following vulnerability(s):


Occurrences

lodash:4.17.20 is a transitive dependency introduced by the following direct dependency(s):

@babel/core:7.12.10
        └─ @babel/helper-module-transforms:7.12.1
              └─ lodash:4.17.20
        └─ @babel/traverse:7.12.12
              └─ lodash:4.17.20
        └─ @babel/types:7.12.12
              └─ lodash:4.17.20
        └─ @babel/helpers:7.12.5
              └─ @babel/traverse:7.12.12
                    └─ lodash:4.17.20
              └─ @babel/types:7.12.12
                    └─ lodash:4.17.20
        └─ lodash:4.17.20

@babel/preset-env:7.12.11
        └─ @babel/helper-module-imports:7.12.5
              └─ @babel/types:7.12.12
                    └─ lodash:4.17.20
        └─ @babel/plugin-proposal-async-generator-functions:7.12.12
              └─ @babel/helper-remap-async-to-generator:7.12.1
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
                    └─ @babel/helper-wrap-function:7.12.3
                          └─ @babel/traverse:7.12.12
                                └─ lodash:4.17.20
                          └─ @babel/types:7.12.12
                                └─ lodash:4.17.20
        └─ @babel/plugin-proposal-class-properties:7.12.1
              └─ @babel/helper-create-class-features-plugin:7.12.1
                    └─ @babel/helper-function-name:7.12.11
                          └─ @babel/types:7.12.12
                                └─ lodash:4.17.20
                    └─ @babel/helper-member-expression-to-functions:7.12.7
                          └─ @babel/types:7.12.12
                                └─ lodash:4.17.20
        └─ @babel/plugin-proposal-optional-chaining:7.12.7
              └─ @babel/helper-skip-transparent-expression-wrappers:7.12.1
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
        └─ @babel/plugin-transform-classes:7.12.1
              └─ @babel/helper-annotate-as-pure:7.12.10
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
              └─ @babel/helper-define-map:7.10.5
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
                    └─ lodash:4.17.20
              └─ @babel/helper-optimise-call-expression:7.12.10
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
              └─ @babel/helper-replace-supers:7.12.11
                    └─ @babel/traverse:7.12.12
                          └─ lodash:4.17.20
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
              └─ @babel/helper-function-name:7.12.11
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
        └─ @babel/plugin-transform-exponentiation-operator:7.12.1
              └─ @babel/helper-builder-binary-assignment-operator-visitor:7.10.4
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
                    └─ @babel/helper-explode-assignable-expression:7.12.1
                          └─ @babel/types:7.12.12
                                └─ lodash:4.17.20
        └─ @babel/plugin-transform-function-name:7.12.1
              └─ @babel/helper-function-name:7.12.11
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
        └─ @babel/plugin-transform-modules-amd:7.12.1
              └─ @babel/helper-module-transforms:7.12.1
                    └─ @babel/traverse:7.12.12
                          └─ lodash:4.17.20
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
                    └─ lodash:4.17.20
        └─ @babel/plugin-transform-modules-commonjs:7.12.1
              └─ @babel/helper-simple-access:7.12.1
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
        └─ @babel/plugin-transform-modules-systemjs:7.12.1
              └─ @babel/helper-hoist-variables:7.10.4
                    └─ @babel/types:7.12.12
                          └─ lodash:4.17.20
        └─ @babel/types:7.12.12
              └─ lodash:4.17.20

@babel/register:7.12.10
        └─ lodash:4.17.20

babel-eslint:10.1.0
        └─ @babel/traverse:7.9.6
              └─ @babel/generator:7.9.6
                    └─ lodash:4.17.20
              └─ lodash:4.17.20
        └─ @babel/types:7.9.6
              └─ lodash:4.17.20

eslint-plugin-flowtype:5.2.0
        └─ lodash:4.17.20

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

WS-2021-0154 (Medium) detected in glob-parent-5.1.1.tgz - autoclosed

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Library - glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • mocha-8.2.1.tgz (Root Library)
    • chokidar-3.4.3.tgz
      • glob-parent-5.1.1.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469 (High) detected in glob-parent-5.1.1.tgz - autoclosed

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: graphql-js/package.json

Path to vulnerable library: graphql-js/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • mocha-8.2.1.tgz (Root Library)
    • chokidar-3.4.3.tgz
      • glob-parent-5.1.1.tgz (Vulnerable Library)

Found in HEAD commit: f54355ed4a2ab11fcde4aa860cb14d2202ee415d

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.