asunder123/sonarqube-test-angular-app

Angular codebase containing real world examples (CRUD, auth, advanced patterns, etc) that adheres to the RealWorld spec and API.

  

Demo    RealWorld

This codebase was created to demonstrate a fully fledged application built with Angular that interacts with an actual backend server including CRUD operations, authentication, routing, pagination, and more. We've gone to great lengths to adhere to the Angular Styleguide & best practices.

Additionally, there is an Angular 1.5 version of this codebase that you can fork and/or learn how to recreate.

How it works

We're currently working on some docs for the codebase (explaining where functionality is located, how it works, etc) but the codebase should be straightforward to follow as is. We've also released a step-by-step tutorial w/ screencasts that teaches you how to recreate the codebase from scratch.

Making requests to the backend API

For convenience, we have a live API server running at https://conduit.productionready.io/api for the application to make requests against. You can view the API spec here which contains all routes & responses for the server.

The source code for the backend server (available for Node, Rails and Django) can be found in the main RealWorld repo.

If you want to change the API URL to a local server, simply edit src/environments/environment.ts and change api_url to the local server's URL (i.e. localhost:3000/api)

Getting started

Make sure you have the Angular CLI installed globally. We use Yarn to manage the dependencies, so we strongly recommend you to use it. you can install it from Here, then run yarn install to resolve all dependencies (might take a minute).

Run ng serve for a dev server. Navigate to http://localhost:4200/. The app will automatically reload if you change any of the source files.

Building the project

Run ng build to build the project. The build artifacts will be stored in the dist/ directory. Use the -prod flag for a production build.

Functionality overview

The example application is a social blogging site (i.e. a Medium.com clone) called "Conduit". It uses a custom API for all requests, including authentication. You can view a live demo over at https://angular.realworld.io

General functionality:

• Authenticate users via JWT (login/signup pages + logout button on settings page)
• CRU* users (sign up & settings page - no deleting required)
• CRUD Articles
• CR*D Comments on articles (no updating required)
• GET and display paginated lists of articles
• Favorite articles
• Follow other users

The general page breakdown looks like this:

• Home page (URL: /#/ )
  • List of tags
  • List of articles pulled from either Feed, Global, or by Tag
  • Pagination for list of articles
• Sign in/Sign up pages (URL: /#/login, /#/register )
  • Uses JWT (store the token in localStorage)
  • Authentication can be easily switched to session/cookie based
• Settings page (URL: /#/settings )
• Editor page to create/edit articles (URL: /#/editor, /#/editor/article-slug-here )
• Article page (URL: /#/article/article-slug-here )
  • Delete article button (only shown to article's author)
  • Render markdown from server client side
  • Comments section at bottom of page
  • Delete comment button (only shown to comment's author)
• Profile page (URL: /#/profile/:username, /#/profile/:username/favorites )
  • Show basic user info
  • List of articles populated from author's created articles or author's favorited articles

sonarqube-test-angular-app's Issues

[DepShield] (CVSS 7.5) Vulnerability due to usage of yargs-parser:7.0.0

Vulnerabilities

DepShield reports that this application's usage of yargs-parser:7.0.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2020-7608] yargs-parser could be tricked into adding or modifying properties of Object.prot...

---

Occurrences

yargs-parser:7.0.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/compiler-cli:7.2.4
        └─ yargs:9.0.1
              └─ yargs-parser:7.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.3.3

Vulnerabilities

DepShield reports that this application's usage of debug:2.3.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.3.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ engine.io:1.8.3
                    └─ debug:2.3.3
              └─ socket.io-adapter:0.5.0
                    └─ debug:2.3.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ debug:2.3.3
                    └─ debug:2.3.3
              └─ debug:2.3.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of lodash:3.10.1

Vulnerabilities

DepShield reports that this application's usage of lodash:3.10.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) [CVE-2020-8203] Prototype pollution attack when using _.zipObjectDeep in lodash <= 4.17.15.
• (CVSS 7.4) CWE-770: Allocation of Resources Without Limits or Throttling
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:3.10.1 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ lodash:3.10.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of mem:1.1.0

Vulnerabilities

DepShield reports that this application's usage of mem:1.1.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mem:1.1.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/compiler-cli:7.2.4
        └─ yargs:9.0.1
              └─ os-locale:2.1.0
                    └─ mem:1.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of yargs-parser:5.0.0-security.0

Vulnerabilities

DepShield reports that this application's usage of yargs-parser:5.0.0-security.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2020-7608] yargs-parser could be tricked into adding or modifying properties of Object.prot...

---

Occurrences

yargs-parser:5.0.0-security.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ node-sass:4.13.1
              └─ sass-graph:2.2.6
                    └─ yargs:7.1.1
                          └─ yargs-parser:5.0.0-security.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of engine.io-client:1.8.3

Vulnerabilities

DepShield reports that this application's usage of engine.io-client:1.8.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

engine.io-client:1.8.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of ws:1.1.2

Vulnerabilities

DepShield reports that this application's usage of ws:1.1.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-20: Improper Input Validation
• (CVSS 6.5) CWE-331: Insufficient Entropy

---

Occurrences

ws:1.1.2 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ engine.io:1.8.3
                    └─ ws:1.1.2
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ ws:1.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of parsejson:0.0.3

Vulnerabilities

DepShield reports that this application's usage of parsejson:0.0.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

parsejson:0.0.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ parsejson:0.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:4.0.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ webpack:4.29.0
              └─ micromatch:3.1.10
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ cache-base:1.0.1
                                      └─ has-value:1.0.0
                                            └─ has-values:1.0.0
                                                  └─ kind-of:4.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.0) Vulnerability due to usage of serialize-javascript:2.1.2

Vulnerabilities

DepShield reports that this application's usage of serialize-javascript:2.1.2 results in the following vulnerability(s):

• (CVSS 9.0) CWE-502: Deserialization of Untrusted Data

---

Occurrences

serialize-javascript:2.1.2 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ copy-webpack-plugin:5.1.1
              └─ serialize-javascript:2.1.2
        └─ terser-webpack-plugin:1.4.3
              └─ serialize-javascript:2.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of yargs-parser:10.1.0

Vulnerabilities

DepShield reports that this application's usage of yargs-parser:10.1.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2020-7608] yargs-parser could be tricked into adding or modifying properties of Object.prot...

---

Occurrences

yargs-parser:10.1.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ webpack-dev-server:3.1.14
              └─ yargs:12.0.2
                    └─ yargs-parser:10.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:3.2.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ @angular-devkit/core:7.3.10
              └─ chokidar:2.0.4
                    └─ braces:2.3.2
                          └─ fill-range:4.0.0
                                └─ is-number:3.0.0
                                      └─ kind-of:3.2.2
                          └─ snapdragon-node:2.1.1
                                └─ snapdragon-util:3.0.1
                                      └─ kind-of:3.2.2
        └─ webpack:4.29.0
              └─ micromatch:3.1.10
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ cache-base:1.0.1
                                      └─ to-object-path:0.3.0
                                            └─ kind-of:3.2.2
                                └─ class-utils:0.3.6
                                      └─ static-extend:0.1.2
                                            └─ object-copy:0.1.0
                                                  └─ kind-of:3.2.2
                          └─ define-property:0.2.5
                                └─ is-descriptor:0.1.6
                                      └─ is-accessor-descriptor:0.1.6
                                            └─ kind-of:3.2.2
                                      └─ is-data-descriptor:0.1.4
                                            └─ kind-of:3.2.2

• @angular/compiler-cli:7.2.4
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ braces:1.8.5
                                └─ expand-range:1.8.2
                                      └─ fill-range:2.2.4
                                            └─ is-number:2.1.0
                                                  └─ kind-of:3.2.2
                          └─ kind-of:3.2.2

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ kind-of:3.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 8.8) Vulnerability due to usage of minimist:0.0.10

Vulnerabilities

DepShield reports that this application's usage of minimist:0.0.10 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')

---

Occurrences

minimist:0.0.10 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ optimist:0.6.1
              └─ minimist:0.0.10

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clonedeep:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ stylus-loader:3.0.2
              └─ lodash.clonedeep:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of braces:1.8.5

Vulnerabilities

DepShield reports that this application's usage of braces:1.8.5 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

braces:1.8.5 is a transitive dependency introduced by the following direct dependency(s):

• @angular/compiler-cli:7.2.4
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ braces:1.8.5

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ braces:1.8.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.tail:4.1.1

Vulnerabilities

DepShield reports that this application's usage of lodash.tail:4.1.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.tail:4.1.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ sass-loader:7.1.0
              └─ lodash.tail:4.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.debounce:4.0.8

Vulnerabilities

DepShield reports that this application's usage of lodash.debounce:4.0.8 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.debounce:4.0.8 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ @angular-devkit/core:7.3.10
              └─ chokidar:2.0.4
                    └─ lodash.debounce:4.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.2.0

Vulnerabilities

DepShield reports that this application's usage of debug:2.2.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.2.0 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-parser:2.3.1
                    └─ debug:2.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of braces:0.1.5

Vulnerabilities

DepShield reports that this application's usage of braces:0.1.5 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

braces:0.1.5 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ expand-braces:0.1.2
              └─ braces:0.1.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ istanbul-instrumenter-loader:3.0.1
              └─ istanbul-lib-instrument:1.10.2
                    └─ babel-traverse:6.26.0
                          └─ debug:2.6.9
        └─ stylus:0.54.5
              └─ debug:2.6.9
        └─ webpack:4.29.0
              └─ micromatch:3.1.10
                    └─ extglob:2.0.4
                          └─ expand-brackets:2.1.4
                                └─ debug:2.6.9
                    └─ snapdragon:0.8.2
                          └─ debug:2.6.9
        └─ webpack-dev-server:3.1.14
              └─ compression:1.7.4
                    └─ debug:2.6.9
              └─ express:4.17.1
                    └─ debug:2.6.9
                    └─ send:0.17.1
                          └─ debug:2.6.9
              └─ serve-index:1.9.1
                    └─ debug:2.6.9

• karma:1.7.1
        └─ body-parser:1.19.0
              └─ debug:2.6.9
        └─ connect:3.7.0
              └─ debug:2.6.9
              └─ finalhandler:1.1.2
                    └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:5.1.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ sass-loader:7.1.0
              └─ clone-deep:2.0.2
                    └─ shallow-clone:1.0.0
                          └─ kind-of:5.1.0
        └─ webpack:4.29.0
              └─ micromatch:3.1.10
                    └─ snapdragon:0.8.2
                          └─ define-property:0.2.5
                                └─ is-descriptor:0.1.6
                                      └─ kind-of:5.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of acorn:6.4.1

Vulnerabilities

DepShield reports that this application's usage of acorn:6.4.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

acorn:6.4.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ webpack:4.29.0
              └─ acorn:6.4.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of marked:0.3.19

Vulnerabilities

DepShield reports that this application's usage of marked:0.3.19 results in the following vulnerability(s):

• (CVSS 7.5) CWE-185: Incorrect Regular Expression
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of express:4.17.1

Vulnerabilities

DepShield reports that this application's usage of express:4.17.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

express:4.17.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ webpack-dev-server:3.1.14
              └─ express:4.17.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of yargs-parser:11.1.1

Vulnerabilities

DepShield reports that this application's usage of yargs-parser:11.1.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2020-7608] yargs-parser could be tricked into adding or modifying properties of Object.prot...

---

Occurrences

yargs-parser:11.1.1 is a transitive dependency introduced by the following direct dependency(s):

• protractor:5.4.4
        └─ yargs:12.0.5
              └─ yargs-parser:11.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of node-sass:4.13.1

Vulnerabilities

DepShield reports that this application's usage of node-sass:4.13.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

node-sass:4.13.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ node-sass:4.13.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

DepShield Deprecation Notice

Depshield will be deprecated on Monday December 12th

Please install our new product, Sonatype Lift with advanced features

[DepShield] (CVSS 4.3) Vulnerability due to usage of npm-registry-fetch:3.9.1

Vulnerabilities

DepShield reports that this application's usage of npm-registry-fetch:3.9.1 results in the following vulnerability(s):

• (CVSS 4.3) CWE-200: Information Exposure

---

Occurrences

npm-registry-fetch:3.9.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:7.3.10
        └─ pacote:9.4.0
              └─ npm-registry-fetch:3.9.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of q:1.4.1

Vulnerabilities

DepShield reports that this application's usage of q:1.4.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

q:1.4.1 is a transitive dependency introduced by the following direct dependency(s):

• protractor:5.4.4
        └─ webdriver-manager:12.1.7
              └─ q:1.4.1
        └─ q:1.4.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of http-proxy:1.18.1

Vulnerabilities

DepShield reports that this application's usage of http-proxy:1.18.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

http-proxy:1.18.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular-devkit/build-angular:0.13.10
        └─ webpack-dev-server:3.1.14
              └─ http-proxy-middleware:0.18.0
                    └─ http-proxy:1.18.1

• karma:1.7.1
        └─ http-proxy:1.18.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}