Comments (3)
Hello @RobotnickIsrael! 👋 we're sorry you found a bug... so first of all, thank you very much for reporting it.
However, your report doesn't follow the issue template, so it is being automatically closed. We are really sorry for that, but we need all reports to follow the template, or else it won't be possible to understand and help with all issues.
Please, create a new issue following the template, or reopen this same issue to edit and provide all required information.
from bugtracker.
Kurento-utils js client, for some reason has jar files in it.
I don't see that kurento-utils-js (NPM package kurento-utils) has any jar file itself. Can you please point to what you mean?
But yes, it does depend on sdp-translator, a package that, apart from its JavaScript code, seems to bundle a complete Maven artifact too. sdp-translator is itself actually a renamed build of sdp-interop, an old Jitsi package. The fact that it includes both JS and Java modules leads me to think that its developers thought of making a single package that could be used for both platforms, albeit it seems to me a pretty arguable decision.
I do not think the vulnerability applies here, because as you mentioned, JS code will not end up invoking the vulnerable Java dependency. And in any case, there is not much that can be done. This is a summary of the situation:
- sdp-translator is a derived, renamed version of sdp-interop, an old Jitsi package that has since been moved.
- The source repository for sdp-translator was https://github.com/Kurento/sdp-translator-js, which doesn't exist any more, and there is no documentation at all about the reasons (very helpful, thanks guys).
- Currently, kurento-utils depends on sdp-translator
^0.1.15
. But in NPM, the latest version is0.1.24
. I could update the dependency in kurento-utils, if that helps anything. But in any case, that's just delaying the inevitable, sooner or later a new security issue will affect it and then no more up to date versions will exist for this package. - kurento-utils-js was these past years a source of distractions because there was nobody maintaining it, in a period of time where a lot was happening regarding the WebRTC API. Users would constantly find that the code was missing important new functionality (Transceivers-based API) or ancient methodology (like callbacks everywhere instead of async/await).
For all these reasons, kurento-utils was considered deprecated and it is currently marked as unmaintained, with a big warning on the README page: https://github.com/Kurento/kurento-utils-js. The Kurento JS tutorials still depend on it because they just work, and because there are not enough hands to do the bulk work of removing this dependency and replacing it with adequate calls directly to the WebRTC API. Otherwise, for actual apps, the strong recommendation is to avoid using it.
from bugtracker.
Hi Juan,
The problematic jar files are in
node_modules/sdp-translator/m2/repository/com/thoughworks/xstream/xstream/1.4.3
node_modules/sdp-translator/m2/repository/com/thoughworks/xstream/xstream-parent/1.4.3
Anyway, I checked what you said and you are right, I have imported kurento-utils since thats how it was in the examples, but I never actually used it, and I don't seem to need it at all to work.
Thanks you very much (:
Israel
from bugtracker.
Related Issues (20)
- Kurento overwrites PPID of data channel packets as type "String" even when sent as "Binary" HOT 6
- SNAPSHOT github maven package repository not working HOT 2
- PlayerEndpoint failure when stopping and starting again HOT 2
- security: kurento-client depends on vulnerable version of ws package HOT 2
- One way audio on webrtcendpoint HOT 1
- PlayEndpoint file:///path/to/file Error HOT 1
- Surely not a bug - but a problem HOT 1
- neilyoung HOT 2
- Not a bug, a question HOT 31
- KMS is using insecure protocols and ciphers (TLS1.0, TLS1.1, RC4, CBC) HOT 5
- KMS 6.61, GST 1.18.4 - RecorderEndpoint refuses to record H.264 to MP4 or MKV HOT 7
- KMS 6.61, GST 1.18.4 - RecorderEndpoint periodic intra frames in output when transcoding HOT 6
- WebRtcPeer.js:230 TypeError HOT 1
- KMS 7, kurento-client (npm). Missing support for 7.0.0
- KMS 7 missing kurento-client lib HOT 2
- Test
- KMS 7 release install not going to work HOT 1
- Vulnerability CVE-2022-46871
- Bug tracker moved -> github.com/Kurento/kurento/issues
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bugtracker.