Git Product home page Git Product logo

agents's People

Contributors

amaybaum avatar annarozin avatar artiompetrov avatar asafsavichws avatar chenluigi avatar erez-ws avatar eugenhoro avatar euhoro avatar hasanm91 avatar hasanwhitesource avatar kathief avatar muhammadaews avatar nabeelsaabna avatar noamdolovichws avatar ofirnir123 avatar philipabed avatar raboof avatar raznitzan4 avatar renovate-bot avatar romansoko avatar ruslangox avatar samisalamiws avatar shereind avatar shimondeitch avatar sramakrishna avatar tomshapira avatar whitesource-ci avatar whitesource-edo avatar ws-on-ws[bot] avatar yoswein avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

salewski smithdm orenavitov raboof connectionmaster osvaldorino cloudappleq bbenzikry silvrbckw

agents's Issues

jackson-databind-2.13.3.jar: 2 vulnerabilities (highest severity is: 8.7)

Vulnerable Library - jackson-databind-2.13.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /wss-agent-report/pom.xml

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jackson-databind version) Remediation Possible**
CVE-2022-42004 High 7.5 jackson-databind-2.13.3.jar Direct 2.13.4 ✅
CVE-2022-42003 High 7.5 jackson-databind-2.13.3.jar Direct 2.13.4.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-42004

Vulnerable Library - jackson-databind-2.13.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /wss-agent-report/pom.xml

Dependency Hierarchy:

  • ❌ jackson-databind-2.13.3.jar (Vulnerable Library)

Found in base branches: integration, master

Vulnerability Details

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Publish Date: 2022-10-02

URL: CVE-2022-42004

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#3582

Release Date: 2022-10-02

Fix Resolution: 2.13.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-42003

Vulnerable Library - jackson-databind-2.13.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /wss-agent-report/pom.xml

Dependency Hierarchy:

  • ❌ jackson-databind-2.13.3.jar (Vulnerable Library)

Found in base branches: integration, master

Vulnerability Details

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Publish Date: 2022-10-02

URL: CVE-2022-42003

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#3590

Release Date: 2022-10-02

Fix Resolution: 2.13.4.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

WS-2021-0616 (Medium) detected in jackson-core-2.11.3.jar, jackson-databind-2.11.3.jar - autoclosed

WS-2021-0616 - Medium Severity Vulnerability

Vulnerable Libraries - jackson-core-2.11.3.jar, jackson-databind-2.11.3.jar

jackson-core-2.11.3.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

Library home page: https://github.com/FasterXML/jackson-core

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.11.3/jackson-core-2.11.3.jar

Dependency Hierarchy:

  • jackson-databind-2.11.3.jar (Root Library)
    • ❌ jackson-core-2.11.3.jar (Vulnerable Library)
jackson-databind-2.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.11.3/jackson-databind-2.11.3.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.11.3.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind before 2.12.6 and 2.13.1 there is DoS when using JDK serialization to serialize JsonNode.

Publish Date: 2021-11-20

URL: WS-2021-0616

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#3328

Release Date: 2021-11-20

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.6, 2.13.1; com.fasterxml.jackson.core:jackson-core:2.12.6, 2.13.1

Dependency Dashboard

This issue provides visibility into Renovate updates and their statuses. Learn more

Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

  • Update dependency ch.qos.logback:logback-classic to v1.2.11
  • Update dependency org.apache.maven.plugins:maven-enforcer-plugin to v3.0.0
  • Update dependency org.apache.maven.plugins:maven-shade-plugin to v2.4.3
  • Update dependency org.codehaus.mojo:findbugs-maven-plugin to v2.5.5
  • Update dependency org.codehaus.mojo:jdepend-maven-plugin to v2.0
  • Update dependency org.freemarker:freemarker to v2.3.31
  • Update dependency org.mozilla:rhino to v1.7.14
  • Update dependency org.slf4j:slf4j-api to v1.7.36
  • Update dependency com.fasterxml.jackson.core:jackson-databind to v2.13.2
  • Update dependency com.github.github:site-maven-plugin to v0.12
  • Update dependency com.google.code.gson:gson to v2.9.0
  • Update dependency com.google.code.gson:gson to v2.9.0
  • Update dependency commons-io:commons-io to v2.11.0
  • Update dependency net.java.dev.jna:jna-platform to v5.10.0
  • Update dependency org.apache.maven.plugins:maven-checkstyle-plugin to v2.17
  • Update dependency org.apache.maven.plugins:maven-compiler-plugin to v2.5.1
  • Update dependency org.apache.maven.plugins:maven-gpg-plugin to v1.6
  • Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v2.10.4
  • Update dependency org.apache.maven.plugins:maven-jxr-plugin to v2.5
  • Update dependency org.apache.maven.plugins:maven-plugin-plugin to v3.6.4
  • Update dependency org.apache.maven.plugins:maven-project-info-reports-plugin to v2.9
  • Update dependency org.apache.maven.plugins:maven-site-plugin to v3.11.0
  • Update dependency org.apache.maven.plugins:maven-source-plugin to v2.4
  • Update dependency org.apache.maven.plugins:maven-surefire-plugin to v2.22.2
  • Update dependency org.apache.maven.plugins:maven-surefire-report-plugin to v2.22.2
  • Update dependency org.codehaus.mojo:cobertura-maven-plugin to v2.7
  • Update dependency org.mockito:mockito-core to v1.10.19
  • Update dependency org.whitesource:whitesource-maven-plugin to v3.3.1
  • Update dependency org.whitesource:wss-agent-parent to v2.10.0
  • Update dependency org.apache.maven.plugins:maven-checkstyle-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-gpg-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-jxr-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-pmd-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-project-info-reports-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-shade-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-source-plugin to v3
  • Update dependency org.codehaus.mojo:findbugs-maven-plugin to v3
  • Update dependency org.codehaus.mojo:taglist-maven-plugin to v3
  • Update dependency org.mockito:mockito-core to v4
  • Update dependency org.whitesource:whitesource-maven-plugin to v20
  • Update dependency org.whitesource:wss-agent-parent to v18

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

  • Check this box to trigger a request for Renovate to run again on this repository

WS-2021-0419 (High) detected in gson-2.8.5.jar, gson-2.8.7.jar

WS-2021-0419 - High Severity Vulnerability

Vulnerable Libraries - gson-2.8.5.jar, gson-2.8.7.jar

gson-2.8.5.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: agents/wss-agent-api/pom.xml

Path to vulnerable library: .m2/repository/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar

Dependency Hierarchy:

  • ❌ gson-2.8.5.jar (Vulnerable Library)
gson-2.8.7.jar

Library home page: https://github.com/google/gson

Path to dependency file: agents/wss-agent-client/pom.xml

Path to vulnerable library: .m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar

Dependency Hierarchy:

  • ❌ gson-2.8.7.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.

Publish Date: 2021-10-11

URL: WS-2021-0419

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/google/gson/releases/tag/gson-parent-2.8.9

Release Date: 2021-10-11

Fix Resolution: com.google.code.gson:gson:2.8.9

handle all policy actions

Currently a policy is shown as either rejecting or approving where in real life we can have reassignments / conditions as well. This actions shouldn't show "APPROVED" since they are still waiting for approval.

gson-2.8.7.jar: 1 vulnerabilities (highest severity is: 7.7) - autoclosed

Vulnerable Library - gson-2.8.7.jar

Library home page: https://github.com/google/gson

Path to dependency file: /wss-agent-client/pom.xml

Path to vulnerable library: /.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
WS-2021-0419 High 7.7 gson-2.8.7.jar Direct com.google.code.gson:gson:2.8.9 ✅

Details

WS-2021-0419

Vulnerable Library - gson-2.8.7.jar

Library home page: https://github.com/google/gson

Path to dependency file: /wss-agent-client/pom.xml

Path to vulnerable library: /.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar,/home/wss-scanner/.m2/repository/com/google/code/gson/gson/2.8.7/gson-2.8.7.jar

Dependency Hierarchy:

  • ❌ gson-2.8.7.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.

Publish Date: 2021-10-11

URL: WS-2021-0419

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/google/gson/releases/tag/gson-parent-2.8.9

Release Date: 2021-10-11

Fix Resolution: com.google.code.gson:gson:2.8.9

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

Dependency Dashboard

This issue provides visibility into Renovate updates and their statuses. Learn more

Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

  • Update dependency ch.qos.logback:logback-classic to v1.2.10
  • Update dependency org.apache.maven.plugins:maven-enforcer-plugin to v3.0.0
  • Update dependency org.apache.maven.plugins:maven-shade-plugin to v2.4.3
  • Update dependency org.codehaus.mojo:findbugs-maven-plugin to v2.5.5
  • Update dependency org.codehaus.mojo:jdepend-maven-plugin to v2.0
  • Update dependency org.freemarker:freemarker to v2.3.31
  • Update dependency org.mozilla:rhino to v1.7.14
  • Update dependency org.slf4j:slf4j-api to v1.7.33
  • Update dependency com.fasterxml.jackson.core:jackson-databind to v2.13.1
  • Update dependency com.github.github:site-maven-plugin to v0.12
  • Update dependency commons-codec:commons-codec to v1.15
  • Update dependency commons-io:commons-io to v2.11.0
  • Update dependency net.java.dev.jna:jna-platform to v5.10.0
  • Update dependency org.apache.maven.plugins:maven-checkstyle-plugin to v2.17
  • Update dependency org.apache.maven.plugins:maven-compiler-plugin to v2.5.1
  • Update dependency org.apache.maven.plugins:maven-gpg-plugin to v1.6
  • Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v2.10.4
  • Update dependency org.apache.maven.plugins:maven-jxr-plugin to v2.5
  • Update dependency org.apache.maven.plugins:maven-plugin-plugin to v3.6.4
  • Update dependency org.apache.maven.plugins:maven-project-info-reports-plugin to v2.9
  • Update dependency org.apache.maven.plugins:maven-site-plugin to v3.10.0
  • Update dependency org.apache.maven.plugins:maven-source-plugin to v2.4
  • Update dependency org.apache.maven.plugins:maven-surefire-plugin to v2.22.2
  • Update dependency org.apache.maven.plugins:maven-surefire-report-plugin to v2.22.2
  • Update dependency org.codehaus.mojo:cobertura-maven-plugin to v2.7
  • Update dependency org.mockito:mockito-core to v1.10.19
  • Update dependency org.whitesource:whitesource-maven-plugin to v3.3.1
  • Update dependency org.whitesource:wss-agent-parent to v2.10.0
  • Update dependency org.apache.maven.plugins:maven-checkstyle-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-gpg-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-jxr-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-pmd-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-project-info-reports-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-shade-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-source-plugin to v3
  • Update dependency org.codehaus.mojo:findbugs-maven-plugin to v3
  • Update dependency org.mockito:mockito-core to v4
  • Update dependency org.whitesource:whitesource-maven-plugin to v20
  • Update dependency org.whitesource:wss-agent-parent to v18

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

  • Update dependency org.apache.httpcomponents:httpclient to v4.5.14
  • Update dependency org.apache.maven.plugins:maven-shade-plugin to v2.4.3
  • Update dependency org.codehaus.mojo:findbugs-maven-plugin to v2.5.5
  • Update dependency org.codehaus.mojo:jdepend-maven-plugin to v2.0
  • Update dependency org.freemarker:freemarker to v2.3.32
  • Update dependency org.mozilla:rhino to v1.7.14
  • Update dependency org.slf4j:slf4j-api to v1.7.36
  • Update dependency com.github.github:site-maven-plugin to v0.12
  • Update dependency com.google.code.gson:gson to v2.10.1
  • Update dependency com.google.code.gson:gson to v2.10.1
  • Update dependency commons-codec:commons-codec to v1.16.0
  • Update dependency commons-io:commons-io to v2.15.1
  • Update dependency net.java.dev.jna:jna-platform to v5.14.0
  • Update dependency org.apache.maven.plugins:maven-checkstyle-plugin to v2.17
  • Update dependency org.apache.maven.plugins:maven-compiler-plugin to v2.5.1
  • Update dependency org.apache.maven.plugins:maven-enforcer-plugin to v3.4.1
  • Update dependency org.apache.maven.plugins:maven-gpg-plugin to v1.6
  • Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v2.10.4
  • Update dependency org.apache.maven.plugins:maven-jxr-plugin to v2.5
  • Update dependency org.apache.maven.plugins:maven-plugin-plugin to v3.11.0
  • Update dependency org.apache.maven.plugins:maven-project-info-reports-plugin to v2.9
  • Update dependency org.apache.maven.plugins:maven-site-plugin to v3.12.1
  • Update dependency org.apache.maven.plugins:maven-source-plugin to v2.4
  • Update dependency org.apache.maven.plugins:maven-surefire-plugin to v2.22.2
  • Update dependency org.apache.maven.plugins:maven-surefire-report-plugin to v2.22.2
  • Update dependency org.bidib.com.github.markusbernhardt:proxy-vole to v1.1.2
  • Update dependency org.codehaus.mojo:cobertura-maven-plugin to v2.7
  • Update dependency org.mockito:mockito-core to v1.10.19
  • Update dependency org.whitesource:whitesource-maven-plugin to v3.3.1
  • Update dependency org.whitesource:wss-agent-parent to v2.10.0
  • Update dependency org.apache.maven.plugins:maven-checkstyle-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-gpg-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-jxr-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-pmd-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-project-info-reports-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-release-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-shade-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-source-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3
  • Update dependency org.apache.maven.plugins:maven-surefire-report-plugin to v3
  • Update dependency org.codehaus.mojo:findbugs-maven-plugin to v3
  • Update dependency org.codehaus.mojo:taglist-maven-plugin to v3
  • Update dependency org.mockito:mockito-core to v5
  • Update dependency org.slf4j:slf4j-api to v2
  • Update dependency org.whitesource:whitesource-maven-plugin to v20
  • Update dependency org.whitesource:wss-agent-parent to v18
  • 🔐 Create all pending approval PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

maven
pom.xml
  • org.sonatype.oss:oss-parent 7
  • commons-codec:commons-codec 1.13
  • org.apache.httpcomponents:httpclient 4.5.13
  • com.google.code.gson:gson 2.9.0
  • commons-lang:commons-lang 2.6
  • junit:junit 4.13.2
  • org.apache.httpcomponents:httpclient 4.5.13
  • org.mockito:mockito-core 1.9.0
  • org.hamcrest:hamcrest-integration 1.3
  • commons-io:commons-io 2.9.0
  • org.apache.maven.plugins:maven-enforcer-plugin 3.0.0-M3
  • org.apache.maven.plugins:maven-site-plugin 3.1
  • org.apache.maven.plugins:maven-project-info-reports-plugin 2.5
  • org.apache.maven.plugins:maven-plugin-plugin 3.1
  • org.apache.maven.plugins:maven-jxr-plugin 2.3
  • org.apache.maven.plugins:maven-surefire-report-plugin 2.12.2
  • org.apache.maven.plugins:maven-javadoc-plugin 2.8.1
  • org.apache.maven.plugins:maven-checkstyle-plugin 2.9.9.01-SNAPSHOT
  • org.codehaus.mojo:findbugs-maven-plugin 2.5.2
  • org.codehaus.mojo:jdepend-maven-plugin 2.0-beta-2
  • org.codehaus.mojo:cobertura-maven-plugin 2.5.1
  • org.codehaus.mojo:taglist-maven-plugin 2.4
  • org.apache.maven.plugins:maven-pmd-plugin 2.7.1
  • org.apache.maven.plugins:maven-compiler-plugin 2.3.2
  • org.apache.maven.plugins:maven-surefire-plugin 2.12
  • org.apache.maven.plugins:maven-source-plugin 2.1.2
  • org.apache.maven.plugins:maven-javadoc-plugin 2.8.1
  • org.apache.maven.plugins:maven-gpg-plugin 1.4
  • org.apache.maven.plugins:maven-project-info-reports-plugin 2.4
  • org.apache.maven.plugins:maven-release-plugin 2.5.3
  • com.mycila.maven-license-plugin:maven-license-plugin 1.9.0
  • org.whitesource:whitesource-maven-plugin 3.2.5
  • com.github.github:site-maven-plugin 0.8
  • org.apache.maven.plugins:maven-shade-plugin 2.4.2
  • commons-codec:commons-codec 1.13
  • commons-io:commons-io 2.9.0
  • commons-io:commons-io 2.9.0
  • commons-codec:commons-codec 1.13
wss-agent-api/pom.xml
  • org.whitesource:wss-agent-parent 2.9.9.89-SNAPSHOT
  • com.google.code.gson:gson 2.9.0
wss-agent-client/pom.xml
  • org.whitesource:wss-agent-parent 2.9.9.89-SNAPSHOT
  • org.bidib.com.github.markusbernhardt:proxy-vole 1.0.16
wss-agent-hash-calculator/pom.xml
  • org.whitesource:wss-agent-parent 2.9.9.89-SNAPSHOT
  • org.whitesource:pecoff4j 0.0.2.1
  • net.java.dev.jna:jna-platform 5.6.0
  • org.mozilla:rhino 1.7.7.2
  • org.slf4j:slf4j-api 1.7.30
  • ch.qos.logback:logback-classic 1.2.3
wss-agent-report/pom.xml
  • org.whitesource:wss-agent-parent 2.9.9.89-SNAPSHOT
  • commons-collections:commons-collections 3.2.2
  • com.fasterxml.jackson.core:jackson-databind 2.13.3
  • org.freemarker:freemarker 2.3.28
wss-agent-utils/pom.xml
  • org.whitesource:wss-agent-parent 2.9.9.89-SNAPSHOT
  • org.slf4j:slf4j-api 1.7.30
wss-agent-via-api/pom.xml
  • org.whitesource:wss-agent-parent 2.9.9.89-SNAPSHOT

Feature Request: Add Score Field to VulnerabilityInfo

We're currently working with the Whitesource Plugin in Artifactory, but we don't have quick access to the CVSS score attached to the vulnerability in the VulnerabilityInfo object we get back from Whitesource as it only has the 'name' and 'severity' fields. Would it be possible to add the 'score' field as well?

Dependency type 'CONDA' is not allowed to be with empty sha1

I have set "conda.resolveDependencies=true" for whitesource scan with Unified Agent and also have this environment.yml in my repository:

channels:
  - pytorch
  - defaults
  - akode
  - conda-forge
  - bashtage
dependencies:
  - _libgcc_mutex=0.1
  - _openmp_mutex=4.5
  - ca-certificates=2021.10.8
  - ld_impl_linux-64=2.36.1
  - libffi=3.4.2
  - libgcc-ng=11.2.0
  - libgomp=11.2.0
  - libnsl=2.0.0
  - libstdcxx-ng=11.2.0
  - libzlib=1.2.11
  - ncurses=6.3
  - openssl=3.0.0
  - pip=22.0.3
  - python=3.8.12
  - python_abi=3.8
  - readline=8.1
  - setuptools=60.9.3
  - sqlite=3.37.0
  - tk=8.6.12
  - wheel=0.37.1
  - xz=5.2.5
  - zlib=1.2.11
  - pip:
    - pvt-py-pkg==1.1.1

I get this error while uploading the scan results to server:

[ERROR] [2022-03-09 09:11:00,752 +0000] - Failed to send request to WhiteSource server: Illegal arguments: Invalid dependency info, DependencyInfo@8556f1ec[groupId= null,artifactId= xz,version= 5.2.5,filename= xz-5.2.5-h7b6447c_0,dependencyType= CONDA ]  Dependency type 'CONDA' is not allowed to be with empty sha1
[DEBUG] [2022-03-09 09:11:00,752 +0000] - Failed to send request to WhiteSource server: Illegal arguments: Invalid dependency info, DependencyInfo@8556f1ec[groupId= null,artifactId= xz,version= 5.2.5,filename= xz-5.2.5-h7b6447c_0,dependencyType= CONDA ]  Dependency type 'CONDA' is not allowed to be with empty sha1
org.whitesource.agent.client.WssServiceException: Illegal arguments: Invalid dependency info, DependencyInfo@8556f1ec[groupId= null,artifactId= xz,version= 5.2.5,filename= xz-5.2.5-h7b6447c_0,dependencyType= CONDA ]  Dependency type 'CONDA' is not allowed to be with empty sha1
	at org.whitesource.agent.client.WssServiceClientImpl.extractResultData(WssServiceClientImpl.java:492)
	at org.whitesource.agent.client.WssServiceClientImpl.service(WssServiceClientImpl.java:339)
	at org.whitesource.agent.client.WssServiceClientImpl.updateInventory(WssServiceClientImpl.java:199)
	at org.whitesource.agent.client.WhitesourceService.update(WhitesourceService.java:371)
	at org.whitesource.request.ProjectsSender.update(ProjectsSender.java:791)
	at org.whitesource.request.ProjectsSender.sendRequest(ProjectsSender.java:296)
	at org.whitesource.request.ProjectsSender.sendProjects(ProjectsSender.java:165)
	at org.whitesource.fs.Main.sendScanResults(Main.java:209)
	at org.whitesource.fs.Main.main(Main.java:95)
[INFO] [2022-03-09 09:11:00,752 +0000] - Support token: 03e500d6fae8d4cf897be53ab3c1b80311646817060686

Looks like following is the reason why the above error occurs :

[DEBUG] [2022-03-09 09:10:31,594 +0000] - CondaDependencyResolver - calcSha1 - failed to calculate sha1 for xz:5.2.5
java.io.FileNotFoundException: /opt/conda/miniconda/pkgs/xz-5.2.5-h7b6447c_0 (Is a directory)
	at java.base/java.io.FileInputStream.open0(Native Method)
	at java.base/java.io.FileInputStream.open(FileInputStream.java:212)
	at java.base/java.io.FileInputStream.<init>(FileInputStream.java:154)
	at org.whitesource.agent.hash.HashCalculator.calculateHash(HashCalculator.java:172)
	at org.whitesource.agent.hash.HashCalculator.calculateSHA1(HashCalculator.java:161)
	at org.whitesource.agent.DependencyCalculator.calculateSHA1(DependencyCalculator.java:140)
	at org.whitesource.agent.dependency.resolver.conda.CondaDependencyResolver.calcSha1(CondaDependencyResolver.java:379)
	at org.whitesource.agent.dependency.resolver.conda.CondaDependencyResolver.createDepInfo(CondaDependencyResolver.java:370)
	at org.whitesource.agent.dependency.resolver.conda.CondaDependencyResolver.createAllDepInfos(CondaDependencyResolver.java:343)
	at org.whitesource.agent.dependency.resolver.conda.CondaDependencyResolver.buildCondaTree(CondaDependencyResolver.java:274)
	at org.whitesource.agent.dependency.resolver.conda.CondaDependencyResolver.collect(CondaDependencyResolver.java:155)
	at org.whitesource.agent.dependency.resolver.conda.CondaDependencyResolver.resolveDependencies(CondaDependencyResolver.java:126)
	at org.whitesource.agent.dependency.resolver.DependencyResolutionService.resolveDependenciesOfResolver(DependencyResolutionService.java:382)
	at org.whitesource.agent.dependency.resolver.DependencyResolutionService.resolveDependencies(DependencyResolutionService.java:207)
	at org.whitesource.agent.FileSystemScanner.createProjects(FileSystemScanner.java:255)
	at org.whitesource.fs.scanOrigins.GeneralScanOrigin.getProjects(GeneralScanOrigin.java:189)
	at org.whitesource.fs.scanOrigins.GeneralScanOrigin.scan(GeneralScanOrigin.java:98)
	at org.whitesource.fs.scanOrigins.ScanOrigin.runOriginScan(ScanOrigin.java:36)
	at org.whitesource.fs.FileSystemAgent.createProjects(FileSystemAgent.java:176)
	at org.whitesource.fs.Main.scanProjects(Main.java:116)
	at org.whitesource.fs.Main.main(Main.java:90)

Seems to me that "/opt/conda/miniconda/pkgs/xz-5.2.5-h7b6447c_0" is expected to be a file as per

agents/wss-agent-hash-calculator/src/main/java/org/whitesource/agent/hash/HashCalculator.java

Line 172 in af982a6

try (InputStream inputStream = new FileInputStream(resourceFile);

Do we need to handle such a case? Or am I missing something?

handle no new libraries

When a project have no new libraries the policy check report should display a nice output rather then just blank content.

maven.additionalArguments with url

We don't want to save the Maven Settings file locally, but reference it via URL.
However, with the parameter
maven.additionalArguments = -s = https: //url.com/settings.xml
we have not yet found a way to specify a URL.

Is that possible?

jackson-databind-2.13.2.jar: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - jackson-databind-2.13.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /5083620_PTUBKW/downloadResource_LPGQPB/20220815083648/jackson-databind-2.13.2.jar

Found in HEAD commit: c7ed4e2fc4d08891ef7634d627157e4c8310a145

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2020-36518 High 7.5 jackson-databind-2.13.2.jar Direct 2.13.2.1 ✅

Details

CVE-2020-36518

Vulnerable Library - jackson-databind-2.13.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /5083620_PTUBKW/downloadResource_LPGQPB/20220815083648/jackson-databind-2.13.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.13.2.jar (Vulnerable Library)

Found in HEAD commit: c7ed4e2fc4d08891ef7634d627157e4c8310a145

Found in base branch: integration

Vulnerability Details

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.

Publish Date: 2022-03-11

URL: CVE-2020-36518

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2816

Release Date: 2022-03-11

Fix Resolution: 2.13.2.1

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

ServiceProvider in client

Provide some ServiceProvider to wrap common configuration and usage of the api client.
Its a repeating class in almost every agent.

Action Required: Fix WhiteSource Configuration File - .whitesource

There is an error with this repository's WhiteSource configuration file that needs to be fixed. As a precaution, scans will stop until it is resolved.

Errors:

  • Failed to parse configuration file: whitesource/agents/.whitesource: Expected BEGIN_OBJECT but was STRING at line 7 column 1 path $

gson-2.8.5.jar: 1 vulnerabilities (highest severity is: 7.7) - autoclosed

Vulnerable Library - gson-2.8.5.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: /wss-agent-api/pom.xml

Path to vulnerable library: /.m2/repository/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
WS-2021-0419 High 7.7 gson-2.8.5.jar Direct com.google.code.gson:gson:2.8.9 ✅

Details

WS-2021-0419

Vulnerable Library - gson-2.8.5.jar

Gson JSON library

Library home page: https://github.com/google/gson

Path to dependency file: /wss-agent-api/pom.xml

Path to vulnerable library: /.m2/repository/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar

Dependency Hierarchy:

  • ❌ gson-2.8.5.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.

Publish Date: 2021-10-11

URL: WS-2021-0419

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/google/gson/releases/tag/gson-parent-2.8.9

Release Date: 2021-10-11

Fix Resolution: com.google.code.gson:gson:2.8.9

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

logback-classic-1.2.3.jar: 3 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - logback-classic-1.2.3.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /wss-agent-hash-calculator/pom.xml

Path to vulnerable library: /wss-agent-hash-calculator/pom.xml

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (logback-classic version) Remediation Possible**
CVE-2023-6481 High 7.5 logback-core-1.2.3.jar Transitive 1.3.0 ✅
CVE-2023-6378 High 7.5 logback-classic-1.2.3.jar Direct 1.3.12 ✅
CVE-2021-42550 Medium 6.6 detected in multiple dependencies Direct 1.2.8 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-6481

Vulnerable Library - logback-core-1.2.3.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /wss-agent-hash-calculator/pom.xml

Path to vulnerable library: /wss-agent-hash-calculator/pom.xml

Dependency Hierarchy:

  • logback-classic-1.2.3.jar (Root Library)
    • ❌ logback-core-1.2.3.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-12-04

URL: CVE-2023-6481

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-6481

Release Date: 2023-12-04

Fix Resolution (ch.qos.logback:logback-core): 1.3.0-alpha0

Direct dependency fix Resolution (ch.qos.logback:logback-classic): 1.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-6378

Vulnerable Library - logback-classic-1.2.3.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /wss-agent-hash-calculator/pom.xml

Path to vulnerable library: /wss-agent-hash-calculator/pom.xml

Dependency Hierarchy:

  • ❌ logback-classic-1.2.3.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution: 1.3.12

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-42550

Vulnerable Libraries - logback-classic-1.2.3.jar, logback-core-1.2.3.jar

logback-classic-1.2.3.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /wss-agent-hash-calculator/pom.xml

Path to vulnerable library: /wss-agent-hash-calculator/pom.xml

Dependency Hierarchy:

  • ❌ logback-classic-1.2.3.jar (Vulnerable Library)

logback-core-1.2.3.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /wss-agent-hash-calculator/pom.xml

Path to vulnerable library: /wss-agent-hash-calculator/pom.xml

Dependency Hierarchy:

  • logback-classic-1.2.3.jar (Root Library)
    • ❌ logback-core-1.2.3.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Mend Note: Converted from WS-2021-0491, on 2022-11-07.

Publish Date: 2021-12-16

URL: CVE-2021-42550

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2021-42550

Release Date: 2021-12-16

Fix Resolution (ch.qos.logback:logback-core): 1.2.8

Direct dependency fix Resolution (ch.qos.logback:logback-classic): 1.2.8

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

jackson-databind-2.11.3.jar: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - jackson-databind-2.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /7131447_CZPCBK/downloadResource_UWDXQW/20220317131506/jackson-databind-2.11.3.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2020-36518 High 7.5 jackson-databind-2.11.3.jar Direct com.fasterxml.jackson.core:jackson-databind:2.12.6.1,2.13.2.1 ✅
WS-2021-0616 Medium 5.9 jackson-databind-2.11.3.jar Direct com.fasterxml.jackson.core:jackson-databind:2.12.6, 2.13.1; com.fasterxml.jackson.core:jackson-core:2.12.6, 2.13.1 ❌

Details

CVE-2020-36518

Vulnerable Library - jackson-databind-2.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /7131447_CZPCBK/downloadResource_UWDXQW/20220317131506/jackson-databind-2.11.3.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.11.3.jar (Vulnerable Library)

Found in base branch: integration

Vulnerability Details

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.

Publish Date: 2022-03-11

URL: CVE-2020-36518

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2816

Release Date: 2022-03-11

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.6.1,2.13.2.1

⛑️ Automatic Remediation is available for this issue

WS-2021-0616

Vulnerable Library - jackson-databind-2.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /7131447_CZPCBK/downloadResource_UWDXQW/20220317131506/jackson-databind-2.11.3.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.11.3.jar (Vulnerable Library)

Found in base branch: integration

Vulnerability Details

FasterXML jackson-databind before 2.12.6 and 2.13.1 there is DoS when using JDK serialization to serialize JsonNode.

Publish Date: 2021-11-20

URL: WS-2021-0616

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#3328

Release Date: 2021-11-20

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.6, 2.13.1; com.fasterxml.jackson.core:jackson-core:2.12.6, 2.13.1

⛑️ Automatic Remediation is available for this issue.

NPE setProxy

NPE when username is null on setProxy.

Solution should also take into consideration NTLM authentication scheme via NTCredentials

Avoid sun.misc.BASE64Encoder

As that no longer exists when running jdk9.

The 'official' replacement is java.util.Base64, but that is only available from jdk8 onwards, and fe086f4 suggests you still support java 7

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.