dereknex/vscode-openapi-viewer

OpenAPI or swagger document Preview for vscode

vscode-openapi-viewer's Issues

[DepShield] (CVSS 7.5) Vulnerability due to usage of q:1.5.1

Vulnerabilities

DepShield reports that this application's usage of q:1.5.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

q:1.5.1 is a transitive dependency introduced by the following direct dependency(s):

• vsce:1.36.1
        └─ vso-node-api:6.1.2-preview
              └─ q:1.5.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• nunjucks:3.1.3
        └─ chokidar:2.0.3
              └─ anymatch:2.0.0
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
              └─ braces:2.3.2
                    └─ snapdragon:0.8.2
                          └─ debug:2.6.9
              └─ fsevents:1.2.4
                    └─ node-pre-gyp:0.10.0
                          └─ needle:2.2.0
                                └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of fstream:1.0.11

Vulnerabilities

DepShield reports that this application's usage of fstream:1.0.11 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2019-13173] Improper Input Validation
• (CVSS 7.5) CWE-62: UNIX Hard Link

---

Occurrences

fstream:1.0.11 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ gulp-untar:0.0.7
              └─ tar:2.2.1
                    └─ fstream:1.0.11

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 8.8) Vulnerability due to usage of js-yaml:3.11.0

Vulnerabilities

DepShield reports that this application's usage of js-yaml:3.11.0 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

js-yaml:3.11.0 is a transitive dependency introduced by the following direct dependency(s):

• eslint:4.19.1
        └─ js-yaml:3.11.0

• js-yaml:3.11.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of extend:3.0.1

Vulnerabilities

DepShield reports that this application's usage of extend:3.0.1 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

extend:3.0.1 is a transitive dependency introduced by the following direct dependency(s):

• request:2.87.0
        └─ extend:3.0.1

• vscode:1.1.18
        └─ gulp-symdest:1.1.0
              └─ vinyl-fs:2.4.4
                    └─ glob-stream:5.3.5
                          └─ extend:3.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 6.1) Vulnerability due to usage of url-parse:1.4.0

Vulnerabilities

DepShield reports that this application's usage of url-parse:1.4.0 results in the following vulnerability(s):

• (CVSS 6.1) CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

---

Occurrences

url-parse:1.4.0 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ url-parse:1.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Support refresh partial document

Fix `Unable to open 'OpenAPI Preview': resource is not available.` error

[DepShield] (CVSS 9.8) Vulnerability due to usage of mixin-deep:1.3.1

Vulnerabilities

DepShield reports that this application's usage of mixin-deep:1.3.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10746] mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and ver...
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mixin-deep:1.3.1 is a transitive dependency introduced by the following direct dependency(s):

• nunjucks:3.1.3
        └─ chokidar:2.0.3
              └─ braces:2.3.2
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ mixin-deep:1.3.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of tar:2.2.1

Vulnerabilities

DepShield reports that this application's usage of tar:2.2.1 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-20834] Improper Link Resolution Before File Access ("Link Following")
• (CVSS 7.5) CWE-62: UNIX Hard Link

---

Occurrences

tar:2.2.1 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ gulp-untar:0.0.7
              └─ tar:2.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of mocha:4.1.0

Vulnerabilities

DepShield reports that this application's usage of mocha:4.1.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mocha:4.1.0 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ mocha:4.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of set-value:0.4.3

Vulnerabilities

DepShield reports that this application's usage of set-value:0.4.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

set-value:0.4.3 is a transitive dependency introduced by the following direct dependency(s):

• nunjucks:3.1.3
        └─ chokidar:2.0.3
              └─ braces:2.3.2
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ cache-base:1.0.1
                                      └─ union-value:1.0.0
                                            └─ set-value:0.4.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isequal:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.isequal:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.isequal:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ gulp-symdest:1.1.0
              └─ vinyl-fs:2.4.4
                    └─ lodash.isequal:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of lodash:4.17.10

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.10 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...

---

Occurrences

lodash:4.17.10 is a transitive dependency introduced by the following direct dependency(s):

• eslint:4.19.1
        └─ inquirer:3.3.0
              └─ lodash:4.17.10
        └─ lodash:4.17.10
        └─ table:4.0.2
              └─ lodash:4.17.10

• vsce:1.36.1
        └─ cheerio:1.0.0-rc.2
              └─ lodash:4.17.10
        └─ lodash:4.17.10

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Some images are missing

First. Your plug-in is really helpful.

The padlock icon that state that a path need authorization ins't showing.

Also the close image when you are in the authorization pop-up isn't showing either

Other images may also be missing.

[DepShield] (CVSS 7.5) Vulnerability due to usage of braces:1.8.5

Vulnerabilities

DepShield reports that this application's usage of braces:1.8.5 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

braces:1.8.5 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ gulp-symdest:1.1.0
              └─ vinyl-fs:2.4.4
                    └─ glob-stream:5.3.5
                          └─ micromatch:2.3.11
                                └─ braces:1.8.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of set-value:2.0.0

Vulnerabilities

DepShield reports that this application's usage of set-value:2.0.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

set-value:2.0.0 is a transitive dependency introduced by the following direct dependency(s):

• nunjucks:3.1.3
        └─ chokidar:2.0.3
              └─ braces:2.3.2
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ cache-base:1.0.1
                                      └─ set-value:2.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of node.extend:1.1.6

Vulnerabilities

DepShield reports that this application's usage of node.extend:1.1.6 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-16491] Improper Neutralization of Special Elements in Output Used by a Downstream Component ("Injection")

---

Occurrences

node.extend:1.1.6 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.18
        └─ gulp-remote-src-vscode:0.5.0
              └─ node.extend:1.1.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Don't steal focus from editor

When the preview window is open, after the user stops any input for about 2 seconds, the preview reloads and steals focus from the editor.

DepShield encountered errors while building your project

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled within 24 hours. If the build is successful this issue will be closed, otherwise the error message will be updated.

_{This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of tar:4.4.1

Vulnerabilities

DepShield reports that this application's usage of tar:4.4.1 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-20834] Improper Link Resolution Before File Access ("Link Following")
• (CVSS 7.5) CWE-62: UNIX Hard Link

---

Occurrences

tar:4.4.1 is a transitive dependency introduced by the following direct dependency(s):

• nunjucks:3.1.3
        └─ chokidar:2.0.3
              └─ fsevents:1.2.4
                    └─ node-pre-gyp:0.10.0
                          └─ tar:4.4.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of mocha:5.2.0

Vulnerabilities

DepShield reports that this application's usage of mocha:5.2.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mocha:5.2.0 is a transitive dependency introduced by the following direct dependency(s):

• vscode:1.1.36
        └─ mocha:5.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}