henriquecarv/loopback-connector-google-cloud-datastore

Google Cloud Datastore connector for the LoopBack framework

Hello World!

About me

A Software Developer from Brazil, with a lot of passion for creating/architecting solutions with code, currently working at PortalOne

When not coding

• Hanging out with friends
• Playing guitar 🎸
• Travelling 🚀
• Trying to make a difference in my community

Facts⚡

To you, it is just a meal. To them, it is existence itself. 🌱

loopback-connector-google-cloud-datastore's Issues

WS-2019-0032 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0032 - Medium Severity Vulnerability

Vulnerable Library - js-yaml-3.12.0.tgz

YAML 1.2 parser and serializer

path: /tmp/git/loopback-connector-google-cloud-datastore/node_modules/mocha/node_modules/js-yaml/package.json

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz

Dependency Hierarchy:

• mocha-6.0.2.tgz (Root Library)
  • ❌ js-yaml-3.12.0.tgz (Vulnerable Library)

Found in HEAD commit: 6157746aad5ff63a57a12600923c44ff7de93721

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-26

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-26

Fix Resolution: 3.13.0

---

Step up your Open Source Security Game with WhiteSource here

Support POST with []

Describe the bug

Other connectors support multiple objects insertion by using [].

To Reproduce

POST /events
{"type":1, "comment": "NewEvent"}

and

POST /events
[ {"type":1, "comment": "NewEvent"}
{"type":1, "comment": "NewEvent1"}
{"type":1, "comment": "NewEvent2"}
]

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.merge:4.6.1

Vulnerabilities

DepShield reports that this application's usage of lodash.merge:4.6.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.merge:4.6.1 is a transitive dependency introduced by the following direct dependency(s):

• @google-cloud/datastore:3.1.2
        └─ lodash.merge:4.6.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clone:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clone:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clone:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @google-cloud/datastore:3.1.2
        └─ google-gax:0.25.4
              └─ grpc:1.19.0
                    └─ lodash.clone:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

REST Query between dates.

Describe the bug

REST Query does not support query between dates.

To Reproduce
Steps to reproduce the behavior:
Create a REST query using between dates.
http://localhost:3000/events?filter[where][eventDate][between][0]="2019-02-10"&filter[where][eventDate][between][1]="2019-02-14

Expected behavior
Return all events between two dates.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.camelcase:4.3.0

Vulnerabilities

DepShield reports that this application's usage of lodash.camelcase:4.3.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.camelcase:4.3.0 is a transitive dependency introduced by the following direct dependency(s):

• @google-cloud/datastore:3.1.2
        └─ google-gax:0.25.4
              └─ @grpc/proto-loader:0.4.0
                    └─ lodash.camelcase:4.3.0
              └─ grpc:1.19.0
                    └─ lodash.camelcase:4.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}