Giter Site home page Giter Site logo

dof-dss / edd-pointerapi Goto Github PK

View Code? Open in Web Editor NEW
2.0 5.0 1.0 116 KB

Simple unambitious postcode lookup web Api for Northern Ireland Addresses

Home Page: https://edd-pointerapi-production.london.cloudapps.digital/index.html

C# 100.00%
postcode-lookup-service addresses northern-ireland address-lookup

edd-pointerapi's Introduction

EDD-PointerApi

Builds Branch Status
Circle CI main CircleCI
SonarCloud main Quality Gate Status

Description

This is a simple unambitious postcode address lookup Api for Northern Ireland addresses.

e.g. from a consuming application the user adds a postcode

lookup

And the api displays the results

lookupList

Contents of this file

Contributing

Contributions are welcomed! Read the Contributing Guide for more information.

Licensing

Unless stated otherwise, the codebase is released under the MIT License. This covers both the codebase and any sample code in the documentation. The documentation is © Crown copyright and available under the terms of the Open Government 3.0 licence.

Project Documentation

Why did we build this project?

We built this so applications can allow users to enter their postcode and recieve a list of addresses, in order to select their address. We built this api so the data and functionality can be shared by many applications.

What problem was it solving?

This solves having to create a pointer table in every single application and adding the same code over and over again. There are 3 main endpoints:

  • Search by postcode
  • Search by postcode and premises number
  • Search by x and y co-ordinates which is handy for plotting a point on a map for example

How did we do it?

This is a dotnet core application which uses Mysql to store the pointer data, Entity Framework for data access and JWT to authenticate applications to allow them to use the api. We have hosted this in the Gov UK PaaS Cloud foundry platform using Circle CI to deploy.

Future plans

We may introduce a more advanced search if needed.

Deployment guide

To run the databases you need mysql installed. Then run the below commands to set up the database:

  • update-database

Restore the nuget package. Then to build run "dotnet build" in command line then dotnet run to run the site.

Dataset

You can obtain the dataset which is around one million addresses from OSNI / LPS in csv format and manually input this into the database. Once you get the dataset you will need to import the dataset into MySql. I did this using the below mysql script (you may need to alter the date fields):


LOAD DATA INFILE 'C:/ProgramData/MySQL/MySQL Server 8.0/Uploads/ALLNI_20201222_F.csv'
INTO TABLE pointer.pointer
CHARACTER SET cp1250
FIELDS TERMINATED BY ',' ENCLOSED BY '"'
LINES TERMINATED BY '\r\n'

IGNORE 1 ROWS;

You will also want to create an index to make it super fast:


CREATE INDEX PostcodeIndex
ON pointer.pointer (Postcode(8));

Usage from consuming application

The consuming application will need a secret key and the api base address which they can obtain from DoF EDD. To acutally use the api from your application you will need a view (I did this as a partial view), a pointer model, an address model / interface, a javascript file to interact with the view and a controller to execute the search. Below are examples of how I did it:

Javascript for view

$('#SearchPostCode').on('keyup keypress', function (e)
{
    var keyCode = e.keyCode || e.which;
    if (keyCode === 13)
    {
        getAddresses();
        e.preventDefault();
        return false;
    }
});

function getAddresses()
{
    let postCode = $("#SearchPostCode").val();
    $("#addressError").hide();

    if (postCode != "")
    {
        $("#loadSpinner").show();
       
        $.get('/Pointer/GetAddresses/', { postCode: postCode }, function (data) {
            $("#SearchAddress").empty();
            $("#SearchAddress").append($("<option value=''>Select Address</option>"));

            $.each(data, function ()
            {
                $(".govuk-error-summary").hide();
                $("#loadSpinner").hide();
                $("#SearchAddressList").show();
                $("#addressError").hide();
                $("#SearchAddress").append($("<option></option>").val(this["building_Number"]).html(this["building_Number"] + ' ' + this["primary_Thorfare"] + ',' + this["town"] + ',' + this["postcode"]));
            });
        }).fail(function ()
        {
            $(".govuk-error-summary").show();

            if ($(".error-items").length === 0)
            {
                $(".govuk-error-summary__list").append("<li><a class='error-items' href='#SearchPostCode'>Not a real postcode. Address could not be found.</a></li>");
            }

            $("#PostCodeSearchComponent").addClass("govuk-form-group--error");
            $("#SearchPostCode").addClass("govuk-input--error");
            $("#SearchPostCode").val("Not a postcode")
            $("#addressError").show();
            $("#loadSpinner").hide();
            $("#SearchAddressList").hide();
        });
    }
}

function fillAddressTextBoxes() {
    let myText = $("#SearchAddress :selected").text();

    if (myText != "Select Address")
    {
        let addressArray = myText.split(',');

        $("#Address1").val("");
        $("#Address2").val("");
        $("#Address3").val("");
        $("#TownCity").val("");
        $("#PostCode").val("");

        $("#Address1").val(addressArray[0]);
        $("#TownCity").val(addressArray[1]);
        $("#PostCode").val(addressArray[2]);
    }
}

Controller to manage search

using JWT;
using JWT.Algorithms;
using JWT.Serializers;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Options;
using Newtonsoft.Json;
using probate.Config;
using probate.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Threading.Tasks;

namespace probate.Controllers
{
    public class PointerController : Controller
    {
        private readonly IHttpClientFactory _pointerClient;
        private readonly IOptions<PointerConfig> _pointerConfig;

        public PointerController(IHttpClientFactory pointerClient, IOptions<PointerConfig> pointerConfig)
        {
            _pointerClient = pointerClient;
            _pointerConfig = pointerConfig;
        }

        [HttpGet]
        public async Task<JsonResult> GetAddressesAsync(string postCode)
        {
            var client = _pointerClient.CreateClient("PointerClient");

            client.DefaultRequestHeaders.Accept.Clear();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

            client.DefaultRequestHeaders.Add("Authorization", "Bearer " + CreateJwtToken());

            var result = await client.GetAsync("PostCodeSearch/" + postCode);

            List<Pointer> pointerAddresses = new List<Pointer>();

            if (result.IsSuccessStatusCode)
            {
                using (HttpContent content = result.Content)
                {
                    var resp = content.ReadAsStringAsync();
                    pointerAddresses = JsonConvert.DeserializeObject<IEnumerable<Pointer>>(resp.Result).ToList();
                }
            }

            return Json(pointerAddresses);
        }

        private string CreateJwtToken()
        {
            var unixEpoch = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
            var iat = Math.Round((DateTime.UtcNow - unixEpoch).TotalSeconds);

            var payload = new Dictionary<string, object>
            {
                { "iat", iat },
                { "kid", _pointerConfig.Value.kid }
            };

            IJwtAlgorithm algorithm = new HMACSHA256Algorithm();
            IJsonSerializer serializer = new JsonNetSerializer();
            IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder();
            IJwtEncoder encoder = new JwtEncoder(algorithm, serializer, urlEncoder);

            var jwtToken = encoder.Encode(payload, _pointerConfig.Value.secret);
            return jwtToken;
        }
    }
}

Pointer model

    public class Pointer
    {
        public string Organisation_Name { get; set; }
        public string Sub_Building_Name { get; set; }
        public string Building_Name { get; set; }
        public string Building_Number { get; set; }
        public string Primary_Thorfare { get; set; }
        public string Alt_Thorfare_Name1 { get; set; }
        public string Secondary_Thorfare { get; set; }
        public string Locality { get; set; }
        public string Townland { get; set; }
        public string Town { get; set; }
        public string County { get; set; }
        public string Postcode { get; set; }
        public string BLPU { get; set; }
        public int Unique_Building_ID { get; set; }
        public int UPRN { get; set; }
        public int USRN { get; set; }
        public string Local_Council { get; set; }
        public int X_COR { get; set; }
        public int Y_COR { get; set; }
        public string Temp_Coords { get; set; }
        public string Building_Status { get; set; }
        public string Address_Status { get; set; }
        public string Classification { get; set; }
        public string Creation_Date { get; set; }
        public string Commencement_Date { get; set; }
        public string Archived_Date { get; set; }
        public string Action { get; set; }
        public string UDPRN { get; set; }
        public string Posttown { get; set; }
    }
    

This is my partial view which is reused in our applications

@model probate.Models.IAddress

<div class="govuk-form-group">
    <div class="govuk-hint">
        To find your address, enter a valid Northern Ireland postcode and select find address.
    </div>

    <div class="govuk-form-group" id="PostCodeSearchComponent">
        <label class="govuk-label" for="SearchPostCode">
            Postcode
        </label>
        <span id="addressError" class="govuk-error-message" style="display:none;">
            <span class="govuk-visually-hidden">Error:</span> Enter a real postcode
        </span>

        <input class="govuk-input govuk-input--width-10" asp-for="SearchPostCode" type="text" autocomplete="chrome-off">

        <button class="govuk-button govuk-button--secondary" type="button" data-module="govuk-button" id="btnSearch" onclick="getAddresses();">
            Find address
        </button>
       <div id="loadSpinner" class="govuk-box-highlight" style="display:none;" role="status">
          <span class="spinner-border"></span>
          Loading, please wait
       </div>
    </div>
 </div>
    <div class="govuk-form-group" id="SearchAddressList" style="display:none;">
        <label class="govuk-label" asp-for="SearchAddress">
            Select an address
        </label>
        <select class="govuk-select" asp-for="SearchAddress" onchange="fillAddressTextBoxes();">
        </select>
    </div>
    <div class="govuk-hint">
        If you cannot find your address, enter your details below.
    </div>
    <div class="govuk-form-group">
        <label asp-for="Address1" class="govuk-label"></label>
        <span asp-validation-for="Address1" class="govuk-error-message"></span>
        <input class="govuk-input govuk-!-width-two-thirds" type="text" asp-for="Address1" autocomplete="address-line1" />
    </div>
    <div class="govuk-form-group">
        <label asp-for="Address2" class="govuk-label">Address Line 2 (optional)</label>
        <input class="govuk-input govuk-!-width-two-thirds" type="text" asp-for="Address2" value="@Model.Address2" autocomplete="address-line2" />
    </div>
    <div class="govuk-form-group">
        <label asp-for="Address3" class="govuk-label">Address Line 3 (optional)</label>
        <input class="govuk-input govuk-!-width-two-thirds" type="text" asp-for="Address3" autocomplete="address-line3" />
    </div>
    <div class="govuk-form-group">
        <label asp-for="TownCity" class="govuk-label">Town or city</label>
        <span asp-validation-for="TownCity" class="govuk-error-message"></span>
        <input class="govuk-input govuk-!-width-two-thirds" type="text" asp-for="TownCity" value="@Model.TownCity" autocomplete="address-level2" />
    </div>
    <div class="govuk-form-group">
        <label asp-for="PostCode" class="govuk-label">Postcode</label>
        <span asp-validation-for="PostCode" class="govuk-error-message"></span>
        <input class="govuk-input govuk-!-width-two-thirds" type="text" asp-for="PostCode" value="@Model.PostCode" autocomplete="postal-code" />
    </div>
    <div class="govuk-form-group">
        <label asp-for="Country" class="govuk-label">Country (optional)</label>
        <input class="govuk-input govuk-!-width-two-thirds" type="text" asp-for="Country" value="@Model.Country" autocomplete="country" />
    </div>
   

IAddress interface used to capture the address

   public interface IAddress
   {
       public string SearchAddress { get; set; }
       public string SearchPostCode { get; set; }

       [DisplayName("Address line 1")]
       [Required(ErrorMessage = "Enter address line 1")]
       [StringLength(35, ErrorMessage = "{0} must be a string with a maximum length of {1}")]
       public string Address1 { get; set; }

       [DisplayName("Address line 2")]
       [StringLength(35, ErrorMessage = "{0} must be a string with a maximum length of {1}")]
       public string Address2 { get; set; }

       [DisplayName("Address line 3")]
       [StringLength(35, ErrorMessage = "{0} must be a string with a maximum length of {1}")]
       public string Address3 { get; set; }

       [DisplayName("Town or city")]
       [StringLength(35, ErrorMessage = "{0} must be a string with a maximum length of {1}")]
       [Required(ErrorMessage = "Enter town or city")]
       public string TownCity { get; set; }

       [DisplayName("Post code")]
       [Required(ErrorMessage = "Enter post code")]
       [StringLength(8, ErrorMessage = "{0} must be a string with a maximum length of {1}")]
       public string PostCode { get; set; }

       [DisplayName("Country")]
       [StringLength(35, ErrorMessage = "{0} must be a string with a maximum length of {1}")]
       public string Country { get; set; }
   }
   

edd-pointerapi's People

Contributors

dependabot[bot] avatar gary-wallace avatar mend-bolt-for-github[bot] avatar michaelstevenson2207 avatar

Stargazers

 avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

Forkers

mikeatronic

edd-pointerapi's Issues

CVE-2017-0248 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0248 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.1.4.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.1.4.nupkg
      • microsoft.visualstudio.web.codegeneration.3.1.4.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.1.4.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.1.4.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.1.4.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.1.4.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Publish Date: 2017-05-12

URL: CVE-2017-0248

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#239

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1, 4.3.1;System.Net.Http - 4.1.2, 4.3.2;System.Net.Http.WinHttpHandler - 4.0.2, 4.3.1;System.Net.Security - 4.0.1, 4.3.1;System.Net.WebSockets.Client - 4.0.1, 4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4, 1.1.3


Step up your Open Source Security Game with WhiteSource here

CVE-2017-0247 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0247 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.1.4.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.1.4.nupkg
      • microsoft.visualstudio.web.codegeneration.3.1.4.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.1.4.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.1.4.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.1.4.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.1.4.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Publish Date: 2017-05-12

URL: CVE-2017-0247

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#239

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.5.4;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-26701 (High) detected in system.text.encodings.web.4.5.0.nupkg

CVE-2021-26701 - High Severity Vulnerability

Vulnerable Library - system.text.encodings.web.4.5.0.nupkg

Provides types for encoding and escaping strings for use in JavaScript, HyperText Markup Language (H...

Library home page: https://api.nuget.org/packages/system.text.encodings.web.4.5.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.encodings.web/4.5.0/system.text.encodings.web.4.5.0.nupkg

Dependency Hierarchy:

  • PointerApi-1.0.0 (Root Library)
    • microsoft.visualstudio.web.codegeneration.design.3.1.4.nupkg
      • microsoft.visualstudio.web.codegenerators.mvc.3.1.4.nupkg
        • microsoft.visualstudio.web.codegeneration.3.1.4.nupkg
          • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.1.4.nupkg
            • microsoft.visualstudio.web.codegeneration.core.3.1.4.nupkg
              • microsoft.visualstudio.web.codegeneration.templating.3.1.4.nupkg
                • microsoft.aspnetcore.razor.runtime.2.2.0.nupkg
                  • microsoft.aspnetcore.html.abstractions.2.2.0.nupkg
                    • system.text.encodings.web.4.5.0.nupkg (Vulnerable Library)

Found in HEAD commit: adac8e4e8e6b7718d7ca0b91438b7841e521139e

Found in base branch: main

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Publish Date: 2021-02-25

URL: CVE-2021-26701

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-25

Fix Resolution: System.Text.Encodings.Web - 4.5.1,4.7.2,5.0.1


Step up your Open Source Security Game with Mend here

CVE-2018-8292 (High) detected in system.net.http.4.3.0.nupkg

CVE-2018-8292 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.1.4.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.1.4.nupkg
      • microsoft.visualstudio.web.codegeneration.3.1.4.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.1.4.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.1.4.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.1.4.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.1.4.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: adac8e4e8e6b7718d7ca0b91438b7841e521139e

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1


Step up your Open Source Security Game with Mend here

CVE-2017-0256 (Medium) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0256 - Medium Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.1.4.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.1.4.nupkg
      • microsoft.visualstudio.web.codegeneration.3.1.4.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.1.4.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.1.4.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.1.4.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.1.4.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0256

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-0256

Release Date: 2017-05-12

Fix Resolution: Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.1.3,1.0.4;System.Net.Http - 4.1.2,4.3.2;Microsoft.AspNetCore.Mvc.Razor - 1.1.3,1.0.4;System.Net.Http.WinHttpHandler - 4.0.2,4.3.0-preview1-24530-04;System.Net.Security - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;System.Text.Encodings.Web - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3;System.Net.WebSockets.Client - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-34532 (Medium) detected in microsoft.aspnetcore.authentication.jwtbearer.3.1.15.nupkg - autoclosed

CVE-2021-34532 - Medium Severity Vulnerability

Vulnerable Library - microsoft.aspnetcore.authentication.jwtbearer.3.1.15.nupkg

ASP.NET Core middleware that enables an application to receive an OpenID Connect bearer token.

This...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.authentication.jwtbearer.3.1.15.nupkg

Path to dependency file: EDD-PointerApi/PointerApi/PointerApi.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.authentication.jwtbearer/3.1.15/microsoft.aspnetcore.authentication.jwtbearer.3.1.15.nupkg,canner/.nuget/packages/microsoft.aspnetcore.authentication.jwtbearer/3.1.15/microsoft.aspnetcore.authentication.jwtbearer.3.1.15.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.authentication.jwtbearer.3.1.15.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ASP.NET Cor is vulnerable to adds JWT tokens into the logfile if those can't be parsed correctly.

Publish Date: 2021-08-12

URL: CVE-2021-34532

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q7cg-43mg-qp69

Release Date: 2021-08-12

Fix Resolution: Microsoft.AspNetCore.Authentication.JwtBearer - 2.1.30, 3.1.18, 5.0.9


Step up your Open Source Security Game with WhiteSource here

CVE-2017-0249 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0249 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.1.4.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.1.4.nupkg
      • microsoft.visualstudio.web.codegeneration.3.1.4.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.1.4.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.1.4.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.1.4.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.1.4.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0249

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#239

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.3.1;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-0820 (High) detected in system.text.regularexpressions.4.3.0.nupkg

CVE-2019-0820 - High Severity Vulnerability

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /PointerApi/PointerApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • PointerApi-1.0.0 (Root Library)
    • microsoft.entityframeworkcore.sqlserver.3.1.10.nupkg
      • microsoft.data.sqlclient.1.1.3.nupkg
        • microsoft.identity.client.3.0.8.nupkg
          • system.xml.xdocument.4.3.0.nupkg
            • system.xml.readerwriter.4.3.0.nupkg
              • system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: adac8e4e8e6b7718d7ca0b91438b7841e521139e

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.