Giter Site home page Giter Site logo

capitalone / oas-nodegen Goto Github PK

View Code? Open in Web Editor NEW
28.0 10.0 12.0 190 KB

A library for generating completely customizable code from the Open API Specification (FKA Swagger) RESTful API documentation using the scripting power of Node.js.

License: Apache License 2.0

JavaScript 94.88% Shell 0.13% Handlebars 4.99%
oas open-api swagger-codegen api code-generator swagger-specification swagger-spec

oas-nodegen's Introduction

Due to changes in the priorities, this project is currently not being supported. The project is archived as of 9/17/21 and will be available in a read-only state. Please note, since archival, the project is not maintained or reviewed.

oas-nodegen

A library for generating completely customizable code from the Open API Specification (FKA Swagger) RESTful API documentation using the scripting power of Node.js.

Installation

Install oas-nodegen through npm

$ npm install oas-nodegen

Overview

This library is used to compose scripts that produce customizable output using the simple components depicted below. Most of the customization occurs in the various callbacks that the library exposes. Phase callbacks are used to modify the specification data prior to being sent to templates. The Write callbacks are used to route processed portions of the specification to their target template and location in the filesystem.

Components of oas-nodegen

Features:

  • 100% scriptable and customizable code generation.
  • Loader handles loading the API specification as well as any referenced external specification.
  • Modules registers and loads out of the box or custom code generation modules.
  • Templates registers new template engines and compiles template source into functions.
  • Generator takes a "composition over inheritance" approach that allows you to register any number of modules for model decoration.
  • Writer handles cleaning the target directory, recursively creating directories, and writing files with content that is usually generated by templates.

Usage

Require the module before using

var nodgen = require('oas-nodegen');

var loader = nodegen.createLoader();
var modules = nodegen.createModules();
var templates = nodegen.createTemplates();
var writer = nodegen.createWriter(baseDir);
var generator = nodegen.createGenerator(config);
var utils = nodegen.Utilities;

Roadmap

Currently, this library contains several modules for generating Java-based producers and consumers. We'll likely add modules for other popular and emerging languages (e.g. Scala and Golang). That doesn't stop you from creating a module for your favorite language or framework now! The Java module is a good starting point for understanding the handling type translation and language features such as annotations, etc. If you think it would help the community, please contribute it back!

API

Loader

View the JSDoc

  • load( pathOrUri ).then( function onSuccess ).fail( function onFailure );

Modules

View the JSDoc

  • registerLibrary( library );
  • registerModuleDirectory( [ path ] );
  • registerModule( path );
  • get( [ names ] );

Templates

View the JSDoc

  • setDefaultOptions( defaultOptions );
  • registerLibrary( library );
  • registerEngineDirectory( path );
  • registerEngine( pathOrObject );
  • registerTemplateDirectory( path )
  • compileFromSource( engineName, source, options );
  • compileFromFile( templateFile, options );

Writer

View the JSDoc

  • setLeadingFileComments( comments );
  • setTrailingFileComments( comments );
  • preventDeletionOf( pathNames... );
  • clean();
  • write( [ path ], filename, content );

Generator

View the JSDoc

  • configure( config );
  • addIgnoredOperations( operationNames );
  • addIgnoredParameters( parameterNames );
  • setModules( parameters );
  • use( moduleNamesOrObjects );
  • emit( phase, event, data );
  • on( phase, event, data );
  • onPrepare( event, listener );
  • onDecorate( event, listener );
  • onFinalize( event, listener );
  • write( event, data );
  • onWrite( event, listener );
  • process( spec, references );
  • groupOperation( operation );
  • groupSort( group );
  • operationSort( operation );

Utilities

View the JSDoc

  • getSuccessResponse( operation );
  • translate( obj, spec, references );
  • resolveReference( obj, spec, references );
  • getReferenceName( $ref );
  • extractModelName( $ref );
  • getMimeType( array );
  • sortKeys( object );
  • capitalize( string );
  • uncapitalize( string );
  • random( low, high );

Modules

The modules below are designed to enrich the API specification with information to be used by templates. The best approach is to try to keep templates as generic and simple as possible and let the addition of modules change the generated output. For example, most of the Java-based modules below deal with annotations. The provided templates simply render the list of annotations and the modules handle the heavy lifting.

Helpers

  • Operations:

    • fullPath - Concatenated base path and operation path
    • accepts - Most preferred mime type for the Accepts header
    • contentType - Most preferred mime type for the ContentType header
    • operationId - If null, set based on HTTP method and path (however, its recommended to explicitly specify operationId in the specification)
    • resolvedConsumes - Resolved consumes mimetypes for this operation or base specification
    • resolvedProduces - Resolved produces mimetypes for this operation or base specification
    • Response helpers:
      • successResponse - Property that reflects the 200 or 201 response
      • hasReturn - Boolean flag that denotes of a response body is returned
    • parameters - Updates the parameters array for filter out ignored parameters
    • isQuery - Boolean flag that denotes if the query string parameters comprise are all optional (e.g. collection query)
    • Parameter grouping by type:
      • bodyParam - The body parameter, if applicable
      • pathParams - List of path parameters
      • queryParams - List of query parameters
      • headerParams - List of header parameters
      • formParams - List of form parameters
      • requiredParams - List of all required parameters
  • Models:

    • name - The model name pulled from the definitions map key
    • references - The list of models that this model references
    • referencedBy - The list of models this model is referenced by
    • recursiveReferencedBy - The recursive list of models this model is referenced by
    • required - Updated with a materialized list from other entities refereced by $allOf
    • properties - Updated with a materialized map from other entities refereced by $allOf
    • vars - The model's properties represented as a list instead of a map
    • Materialized information from other models that reference this model
      • allReferences - A recursive list of models referenced by this model
      • allProperties - All properties from this model and models that reference this model
      • allRequired - All required property names from this model and models that reference this model
      • allVars - All vars from this model and models that reference this model
  • Properties:

    • name - The property name pull from the properties map key
    • required - Boolean flag indicated if the property is required - pulled from the model's required list

Java

  • General:
    • annotations:
      • List of annotations for operations, parameters, models, and properties
      • Added by generator.addAnnotation(annotation, operation|parameter|model|property);
    • imports
      • List of imports for resources and models
      • Added by generator.addImport(className, resource|model);
      • Generator utility methods:
        • addKnownImports(imports...) - Adds a known import that can be added via a simple class name
        • findImport(simpleName) - Finds an import using its simple name
    • classname - Java-friendly class name for resources and models
    • Type translation methods:
      • translateType(schema, resource|model, spec, references) - Converts a schema into a Java type
      • addTypeTranslator(function(schema, resource|model)) - Adds a hook used by translateType to allow for custom types
      • overrideModelPackage($ref, model) - Hook method that can be replaced in order to override model package name (returning null defaults to config.modelPackage)
      • variableName(value) - Produces a Java-friendly variable name from a string value
    • Other utility / helper methods:
      • escapeJavaString(value) - Converts a value into a Java string literal
      • joinStrings(values) - Escapes and joins a set of values - useful for declaring arrays
  • Operations:
    • methodName - Java-friendle method name
    • returnType - The class name of the return type
    • returnDescription - The description from the success response
  • Parameters:
    • varname - Java-friendly variable name
    • dataType - The data type of the parameter - can be a generic collection
    • itemType - The item type if the data type is a collection
    • method - The method to use to set the parameter from a client's perspective
  • Models:
    • allImports - Materialized list of imports from the model and property scopes
    • parent - The class name of the parent which is based on the first reference under $allOf
    • serialVersionUID - The long value to use for serialVersionUID for implementing Serializable
  • Properties:
    • varname - Java-friendly variable name
    • dataType - The data type of the property - can be a generic collection
    • getter - The getter accessor method name
    • setter - The setter accessor method name
    • defaultValue - The property's default value expression

Java8

  • Properties:
    • dataType
      • Uses java.util.Optional* types when fields are not required
      • Replaces Integer, Long, and Double with OptionalInt, OptionalLong, and OptionalDouble respectively
      • Wraps other classes with Optional
    • empty - The expression to create an empty optional instance
    • assign - The expression to convert and assign a value to an optional instance

JavaBeanValidation

  • Parameters & Properties:
    • Adds @Min/DecimalMin, @Max/DecimalMax, @Size, @Pattern, @Valid and @NotNull

JaxB

  • Models:
    • Adds @XmlRootElement, @XmlType, @XmlAccessorType, @XmlSeeAlso
  • Properties:
    • Adds @XmlElementWrapper, @XmlElement based on defined xml objects

JaxRS

  • Resources:
    • Adds @Path, @Consumes, @Produces
  • Operations:
    • Adds @Path, @Consumes, @Produces
    • Adds @GET, @POST, @PUT, @DELETE, @HttpMethod("PATCH")
  • Parameters:
    • Adds @PathParam, @QueryParam, @HeaderParam, @FormParam, @DefaultValue

Example

To try an example, use the commands below to build and run a Java/Spring Boot API (assumes MongoDB is running and listening on 27017 - authentication disabled):

$ git clone https://github.com/capitalone/oas-nodegen-example.git
$ cd oas-nodegen-example
$ gradle bootRun

Tests

To run the test suite, first install the dependencies, then run npm test:

$ npm install
$ npm test

Contributors

We welcome your interest in Capital One’s Open Source Projects (the “Project”). Any Contributor to the project must accept and sign a CLA indicating agreement to the license terms. Except for the license granted in this CLA to Capital One and to recipients of software distributed by Capital One, you reserve all right, title, and interest in and to your contributions; this CLA does not impact your rights to use your own contributions for any other purpose.

Link to CLA

This project adheres to the Open Source Code of Conduct. By participating, you are expected to honor this code.

oas-nodegen's People

Contributors

kmudrick avatar mend-bolt-for-github[bot] avatar ospo-capitalone avatar pkedy avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

oas-nodegen's Issues

CVE-2017-16137 (Medium) detected in debug-2.2.0.tgz

CVE-2017-16137 - Medium Severity Vulnerability

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/debug/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution: 2.6.9


Step up your Open Source Security Game with WhiteSource here

WS-2018-0590 (High) detected in diff-1.4.0.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.4.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/diff/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • diff-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

CVSS 2 Score Details (7.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: kpdecker/jsdiff@2aec429

Release Date: 2019-06-11

Fix Resolution: 3.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.11.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.11.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.11.0.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/underscore/package.json

Dependency Hierarchy:

  • underscore-1.11.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

WS-2020-0070 (High) detected in lodash-4.17.15.tgz

WS-2020-0070 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /tmp/ws-scm/oas-nodegen/package.json

Path to vulnerable library: /oas-nodegen/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Vulnerability Details

a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2021-21353 (High) detected in pug-code-gen-2.0.2.tgz, pug-2.0.4.tgz

CVE-2021-21353 - High Severity Vulnerability

Vulnerable Libraries - pug-code-gen-2.0.2.tgz, pug-2.0.4.tgz

pug-code-gen-2.0.2.tgz

Default code-generator for pug. It generates HTML via a JavaScript template function.

Library home page: https://registry.npmjs.org/pug-code-gen/-/pug-code-gen-2.0.2.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/pug-code-gen/package.json

Dependency Hierarchy:

  • pug-2.0.4.tgz (Root Library)
    • pug-code-gen-2.0.2.tgz (Vulnerable Library)
pug-2.0.4.tgz

A clean, whitespace-sensitive template language for writing HTML

Library home page: https://registry.npmjs.org/pug/-/pug-2.0.4.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/pug/package.json

Dependency Hierarchy:

  • pug-2.0.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the pretty option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Publish Date: 2021-03-03

URL: CVE-2021-21353

CVSS 3 Score Details (9.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p493-635q-r6gr

Release Date: 2020-12-23

Fix Resolution: pug -3.0.1, pug-code-gen-2.0.3, pug-code-gen-3.0.2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7598 (Medium) detected in minimist-0.0.8.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/mocha/node_modules/minimist/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • mkdirp-0.5.1.tgz
      • minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3


Step up your Open Source Security Game with WhiteSource here

CVE-2017-16042 (High) detected in growl-1.9.2.tgz

CVE-2017-16042 - High Severity Vulnerability

Vulnerable Library - growl-1.9.2.tgz

Growl unobtrusive notifications

Library home page: https://registry.npmjs.org/growl/-/growl-1.9.2.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/growl/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • growl-1.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

Publish Date: 2018-06-04

URL: CVE-2017-16042

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-16042

Release Date: 2018-06-04

Fix Resolution: 1.10.2


Step up your Open Source Security Game with WhiteSource here

Codeowners file

Please be sure to add a codeowners file with the appropriate trusted reviewers added to it. This is a requirement for all projects in this organization. Thanks!

WS-2017-0236 (Medium) detected in growl-1.9.2.tgz

WS-2017-0236 - Medium Severity Vulnerability

Vulnerable Library - growl-1.9.2.tgz

Growl unobtrusive notifications

Library home page: https://registry.npmjs.org/growl/-/growl-1.9.2.tgz

Path to dependency file: /tmp/ws-scm/oas-nodegen/package.json

Path to vulnerable library: /tmp/ws-scm/oas-nodegen/node_modules/growl/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • growl-1.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Vulnerability Details

Affected versions of the package are vulnerable to Arbitrary Code Injection.

Publish Date: 2016-09-05

URL: WS-2017-0236

CVSS 2 Score Details (5.6)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: tj/node-growl@d9f6ea2

Release Date: 2016-09-05

Fix Resolution: Replace or update the following files: package.json, growl.js


Step up your Open Source Security Game with WhiteSource here

Please add SPDX lines in license headers.

Include the following lines in the license headers within the scripts. This is to ensure that the automated license scanning tools can identify the license.

SPDX-Copyright: Copyright (c) Capital One Services, LLC
SPDX-License-Identifier: Apache-2.0

WS-2019-0425 (Medium) detected in mocha-2.5.3.tgz

WS-2019-0425 - Medium Severity Vulnerability

Vulnerable Library - mocha-2.5.3.tgz

simple, flexible, fun test framework

Library home page: https://registry.npmjs.org/mocha/-/mocha-2.5.3.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/mocha/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

Mocha is vulnerable to ReDoS attack. If the stack trace in utils.js begins with a large error message, and full-trace is not enabled, utils.stackTraceFilter() will take exponential run time.

Publish Date: 2019-01-24

URL: WS-2019-0425

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: v6.0.0

Release Date: 2020-05-07

Fix Resolution: https://github.com/mochajs/mocha/commit/1a43d8b11a64e4e85fe2a61aed91c259bbbac559


Step up your Open Source Security Game with WhiteSource here

CVE-2016-10540 (High) detected in minimatch-0.3.0.tgz

CVE-2016-10540 - High Severity Vulnerability

Vulnerable Library - minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/minimatch/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • glob-3.2.11.tgz
      • minimatch-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/118

Release Date: 2016-06-20

Fix Resolution: Update to version 3.0.2 or later.


Step up your Open Source Security Game with WhiteSource here

WS-2017-0247 (Low) detected in ms-0.7.1.tgz

WS-2017-0247 - Low Severity Vulnerability

Vulnerable Library - ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: oas-nodegen/package.json

Path to vulnerable library: oas-nodegen/node_modules/ms/package.json

Dependency Hierarchy:

  • mocha-2.5.3.tgz (Root Library)
    • debug-2.2.0.tgz
      • ms-0.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 68d751bdae4e5002c9a62b3c3b3e2371120cff95

Found in base branch: master

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-04-12

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: vercel/ms#89

Release Date: 2017-04-12

Fix Resolution: 2.1.1


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.