roncli/descentdsnclient

The client portion of the Descent Dedicated Server Network.

Hi, I'm roncli, a software developer from Pittsburg, California. I specialize in node.js applications and websites, as well as game and modding development.

Project Contributions

I have made major contributions to a number of open source projects.

Project	Description
dxx-rebirth	Descent-Rebirth and Descent II-Rebirth.
DXX-Retro	A source port of Descent 1 and 2, focused on quality competitive play. Uncompromising commitment to original gameplay (except where the original sucked). Based on the Rebirth project.
olmod	A mod for the game Overload that enhances the multiplayer experience.
quadra	An addictive action puzzle game with single player and multiplayer capabilities (Internet or LAN). This is the fork that maintains a working Windows version.
PyTracker	Website at retro-tracker.game-server.cc. PyTracker is a reverse-engineered version of the DXX Rebirth Tracker, written in python.

Websites

I have designed and created a number of websites.

Project	URL	Status	Description
nnn	n/a	Awaiting Release	The Noita Nemesis Nation, a website for competitors of the Noita mod Noita Nemesis.
tracker.otl.gg	tracker.otl.gg	Released	An Overload game tracker for servers running olmod.
otl-bot	otl.gg	Released	The Discord bot and website used for the Overload Teams League.
roncli.com	roncli.com	Released	The roncli.com website.
six.gg	six.gg	Released	The website and bot for Six Gaming, a community of gamers.
tis.roncli.com	tis.roncli.com	Released	The site that allows users to search old Trax in Space 1 files.

Applications

Desktop applications I've created.

Project	Status	Description
ChatterGrid	Released	An application to easily create and share custom soundboards.
descentDSNclient	In Development	The client portion of the Descent Dedicated Server Network.
HyperdriveToolkit	In Development	A collection of tools designed to empower streamers to easily create advanced content for their streams and better manage their community.
StreamlinkTwitchLoader	Archived	A simple C# desktop application that will load an arbitrary number of Twitch streams into VLC using Streamlink.

Personal Projects

Projects I've made for my own use, but have the source on GitHub.

Project	Status	Description
dcltwitter	Archived	The Twitter bot for the Descent Champions Ladder. Retired in December 2021.
FusionBot	Deprecated	A Discord bot used by The Observatory to regulate matches.
ol-azure-manager	Archived	Manager for roncli's Overload dedicated servers on Azure. Merged into otl.gg.
olmod-stable-binaries	Released	A repository of olmod binary releases, intended for use by servers to automatically update olmod.
obs-webserver	Released	My homemade node.js webserver that I use for streaming.
tracker-log-archive	Released	A monthly archive of logs from the Overload game tracker.

JavaScript Libraries

These libraries are intended for use on the web.

Project	Status	Description
jquery-default-button	Released	A jQuery plugin to allow setting a default element that is sent the click event when the enter key is pushed inside of an element.
spritefont-js	Released	A library that allows you to easily use a sprite sheet of characters as a font.

npm Modules

I have authored several npm modules.

Project	npm Module	Description
descent3console	descent3console	A cross-platform utility for managing a Descent 3 server via remote console implemented in node.js.
descent3launcher	descent3launcher	A cross-platform launcher for Descent 3 dedicated servers implemented in node.js.
descent3mn3tools	descent3mn3tools	A cross-platform Descent 3 mission parser implemented in node.js.
full-text-search-query	full-text-search-query	full-text-search-query is a JavaScript library that converts a user-friendly search term into a valid Microsoft SQL Server full-text-search query.
hot-router	hot-router	A router for Express that lets you setup route classes to easily create routes. You can hot swap the code inside your classes while your application is running.

Personal node.js Modules

I have created some node.js modules that I use for personal projects. These are modules I don't consider to be ground-breaking enough to be public npm modules, but I use them in multiple projects, so it's a good way to reuse the code.

Project	Description
node-application-insights-logger	A simple reusable class that can log to Azure Application Insights.
node-database	A simple reusable class to query a MS SQL Server database.
node-minify	A simple library that provides combination and minification services for JavaScript and CSS files when using Express.
node-redis	A simple library to make redis calls without having to worry about connections and command syntax.

descentdsnclient's Issues

CVE-2017-16119 High Severity Vulnerability detected by WhiteSource

CVE-2017-16119 - High Severity Vulnerability

Vulnerable Library - fresh-0.3.0.tgz

HTTP response freshness testing

path: null

Library home page: http://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz

Dependency Hierarchy:

• ❌ fresh-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here

WS-2017-0107 Medium Severity Vulnerability detected by WhiteSource

WS-2017-0107 - Medium Severity Vulnerability

Vulnerable Library - ws-1.0.1.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: null

Library home page: http://registry.npmjs.org/ws/-/ws-1.0.1.tgz

Dependency Hierarchy:

• ❌ ws-1.0.1.tgz (Vulnerable Library)

Vulnerability Details

Depending on the JavaScript engine, Math.random can be anywhere between extremely insecure and cryptographically pseudo-random.
Versions which use Math.random can produce predictable values, thus shall not be used.

Publish Date: 2016-09-20

URL: WS-2017-0107

CVSS 2 Score Details (5.9)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: websockets/ws@7253f06

Release Date: 2016-11-25

Fix Resolution: Replace or update the following file: Sender.js

---

Step up your Open Source Security Game with WhiteSource here

CVE-2016-10539 High Severity Vulnerability detected by WhiteSource

CVE-2016-10539 - High Severity Vulnerability

Vulnerable Library - negotiator-0.5.3.tgz

HTTP content negotiation

path: null

Library home page: http://registry.npmjs.org/negotiator/-/negotiator-0.5.3.tgz

Dependency Hierarchy:

• ❌ negotiator-0.5.3.tgz (Vulnerable Library)

Vulnerability Details

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

Publish Date: 2018-05-31

URL: CVE-2016-10539

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/106

Release Date: 2016-06-16

Fix Resolution: Upgrade to at least version 0.6.1

Express users should update to Express 4.14.0 or greater. If you want to see if you are using a vulnerable call, a quick grep for the acceptsLanguages function call in your application will tell you if you are using this functionality.

---

Step up your Open Source Security Game with WhiteSource here

WS-2017-0421 High Severity Vulnerability detected by WhiteSource

WS-2017-0421 - High Severity Vulnerability

Vulnerable Library - ws-1.0.1.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: null

Library home page: http://registry.npmjs.org/ws/-/ws-1.0.1.tgz

Dependency Hierarchy:

• ❌ ws-1.0.1.tgz (Vulnerable Library)

Vulnerability Details

Affected version of ws (0.2.6--3.3.0) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.

Publish Date: 2017-11-08

URL: WS-2017-0421

CVSS 2 Score Details (7.5)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here

WS-2017-0247 Low Severity Vulnerability detected by WhiteSource

WS-2017-0247 - Low Severity Vulnerability

Vulnerable Library - ms-0.7.1.tgz

Tiny ms conversion utility

path: null

Library home page: http://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Dependency Hierarchy:

• ❌ ms-0.7.1.tgz (Vulnerable Library)

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-05-15

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: vercel/ms@305f2dd

Release Date: 2017-04-12

Fix Resolution: Replace or update the following file: index.js

---

Step up your Open Source Security Game with WhiteSource here

WS-2017-0330 Low Severity Vulnerability detected by WhiteSource

WS-2017-0330 - Low Severity Vulnerability

Vulnerable Library - mime-1.3.4.tgz

A comprehensive library for mime-type mapping

path: null

Library home page: http://registry.npmjs.org/mime/-/mime-1.3.4.tgz

Dependency Hierarchy:

• ❌ mime-1.3.4.tgz (Vulnerable Library)

Vulnerability Details

Affected version of mime (1.0.0 throw 1.4.0 and 2.0.0 throw 2.0.2), are vulnerable to regular expression denial of service.

Publish Date: 2017-09-27

URL: WS-2017-0330

CVSS 2 Score Details (5.0)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here

CVE-2017-16137 Medium Severity Vulnerability detected by WhiteSource

CVE-2017-16137 - Medium Severity Vulnerability

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

path: null

Library home page: http://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Dependency Hierarchy:

• ❌ debug-2.2.0.tgz (Vulnerable Library)

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/534

Release Date: 2017-09-27

Fix Resolution: Version 2.x.x: Update to version 2.6.9 or later. Version 3.x.x: Update to version 3.1.0 or later.

---

Step up your Open Source Security Game with WhiteSource here

WS-2016-0031 High Severity Vulnerability detected by WhiteSource

WS-2016-0031 - High Severity Vulnerability

Vulnerable Library - ws-1.0.1.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: null

Library home page: http://registry.npmjs.org/ws/-/ws-1.0.1.tgz

Dependency Hierarchy:

• ❌ ws-1.0.1.tgz (Vulnerable Library)

Vulnerability Details

DoS in ws module due to excessively large websocket message.

Publish Date: 2016-06-24

URL: WS-2016-0031

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/120

Release Date: 2016-06-24

Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.

---

Step up your Open Source Security Game with WhiteSource here

WS-2016-0040 High Severity Vulnerability detected by WhiteSource

WS-2016-0040 - High Severity Vulnerability

Vulnerable Library - ws-1.0.1.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: null

Library home page: http://registry.npmjs.org/ws/-/ws-1.0.1.tgz

Dependency Hierarchy:

• ❌ ws-1.0.1.tgz (Vulnerable Library)

Vulnerability Details

By sending an overly long websocket payload to a ws server, it is possible to crash the node process.

Publish Date: 2016-06-24

URL: WS-2016-0040

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/120

Release Date: 2016-06-24

Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.

---

Step up your Open Source Security Game with WhiteSource here