sonatype-nexus-community/nexus-iq-chrome-extension

Chrome extension for use with Sonatype Nexus Lifecycle - IQ server

Chrome Extension for Sonatype Nexus IQ

Warning The Nexus IQ Chrome Extension is now deprecated and will not be receiving updates.

See the new Sonatype Platform Browser Extension for our latest browser extension.

Table of Contents

• Purpose
• Documentation
• Data
• Usage
• Examples
• Installation
• Contributing
• Fine Print

Purpose

To allow you to inspect a package before you download it. The plugin requires a valid Sonatype Nexus Lifecycle instance, which means you must be licensed to use this plugin.

The plugin can scan packages at the following repositories:

1. .Net – NuGet – https://www.nuget.org/
2. Alpine – Linux – https://pkgs.alpinelinux.org/
3. Chocolatey – Windows – https://community.chocolatey.org/
4. Clojars – Clojure – https://clojars.org/
5. CocoaPods – iOS – https://cocoapods.org/
6. Conan – C/C++ – https://conan.io/center/
7. Conda – Python – https://anaconda.org/anaconda/
8. Debian – Linux – https://packages.debian.org/
9. Debian – Linux – https://tracker.debian.org/pkg/
10. Golang – Go – https://pkg.go.dev/
11. Java – Maven – https://mvnrepository.com/
12. Java – Maven – https://repo.maven.apache.org/
13. Java – Maven – https://repo.spring.io/list/
14. Java – Maven – https://repo1.maven.org/
15. Java – Maven – https://search.maven.org/
16. JavaScript/Node – npm – https://www.npmjs.com/
17. PHP – Packagist/composer – https://packagist.org/
18. Python – PyPI – https://pypi.org/
19. R – CRAN – https://cran.r–project.org/
20. Ruby – RubyGems – https://rubygems.org/
21. Rust – Crates – https://crates.io/
22. Nexus Proxy Repos – supported repository formats are maven2, npm, rubygems and nuget e.g. http://nexus:8081/#browse/browse:maven–central:commons–collections%2Fcommons–collections%2F3.2.1
23. Artifactory Proxy Repos – supported repository formats are maven2 and npm e.g. https://artifactory-server/webapp/#/artifacts/browse/tree/General/npmjs–cache/parseurl/–/parseurl–1.0.1.tgz
24. Artifactory Repo lists – e.g. https://repo.spring.io/list/jcenter–cache/org/cloudfoundry/cf–maven–plugin/1.1.3/

Documentation

Sonatype Nexus Lifecycle nexus-iq-chrome-extension

Data

The data is sourced from Sonatype Nexus Lifecycle's IQ Server, which accesses the Sonatype Data Services for those supported ecosystems. For some repositories e.g. Chocolatey, the extension gets its data from Sonatype OSSIndex ( https://ossindex.sonatype.org/ ).

Usage

When you browse to a website that is covered by the tool, such as Maven Central and click on the plugin, it will open with the Sonatype Lifecycle data relevant to that library.

Main icon

Remediation Guidance

1. The install will create a new icon in your Chrome Browser next to the location box.
   
2. The plugin will work on any page that matches the URL list above.
   
3. Navigate to one of the pages that the extension is compatible with (see the detailed list below).
   
4. Click on the blue Sonatype logo...
   
   4.1 ...The solution will think for a second and show the Sonatype hexagon logo while it retrieves the data...Then show the Data.
   
   
5. Component Information
   
   
6. Security Information
   The security data is presented in a list with clickable sections for each vulnerability.
   
   
7. Security Details
   The security details for each vulnerability is available. Click on the reference to display the security details.
   
   
8. Remediation
   The version history is available for each component.
   
   
9. Remediation Guidance
   The remediation guidance API has been added. The recommended fix version will be listed at the top of the screen.
   
10. License Information
    
    
11. Unsupported Page
    If you click on an unsupported page then the following screen will appear.
    

Examples

The list of pages that are supported are here:

1. Alpine – Linux – https://pkgs.alpinelinux.org/
2. Chocolatey – Windows – https://community.chocolatey.org/
3. Clojars – Clojure – https://clojars.org/
4. Cocoa pods – iOS – https://cocoapods.org/
5. Conan – C/C++ – https://conan.io/center/
6. Conda – Python – https://anaconda.org/anaconda/
7. Debian – Linux – https://packages.debian.org/
8. Debian – Linux – https://tracker.debian.org/pkg/

dotNet - nuget

Pattern - https://www.nuget.org/packages/<package>/<version>
e.g. https://www.nuget.org/packages/LibGit2Sharp/0.20.1

Golang - https://pkg.go.dev/

https://pkg.go.dev/
e.g. https://pkg.go.dev/github.com/etcd-io/[email protected]

Java - Maven

Pattern - https://search.maven.org/artifact/<group>/<artifact>/<version>/<extension>
e.g. https://search.maven.org/artifact/org.apache.struts/struts2-core/2.3.30/jar

Pattern -https://mvnrepository.com/artifact/<group>/<artifact>/<version>
e.g. https://mvnrepository.com/artifact/commons-collections/commons-collections/3.2.1

Pattern - https://repo1.maven.org/maven2/<group>/<artifact>/<version>/
e.g. https://repo1.maven.org/maven2/commons-collections/commons-collections/3.2.1/

Pattern - https://repo.maven.apache.org/maven2/<group>/<artifact>/<version>/
e.g. https://repo.maven.apache.org/maven2/commons-collections/commons-collections/3.2.1/

JS/Node - npm

Pattern - https://www.npmjs.com/package/<package>
e.g. https://www.npmjs.com/package/lodash/
and
Pattern - https://www.npmjs.com/package/<package>/v/<version>
e.g. https://www.npmjs.com/package/lodash/v/4.17.9

PHP - Packagist/Composer

Pattern - https://packagist.org/
e.g. https://packagist.org/packages/drupal/drupal

Ruby - rubygems

Pattern - https://rubygems.org/gems/<package>
e.g. https://rubygems.org/gems/bundler

Python - pypi

Pattern - https://pypi.org/<package>/
e.g. https://pypi.org/project/Django/
or Pattern - https://pypi.org/<package>/<version>/
e.g. https://pypi.org/project/Django/1.6/

R - CRAN

Pattern - https://cran.r-project.org/
e.g. https://cran.r-project.org/web/packages/A3/index.html

21. Ruby – RubyGems – https://rubygems.org/

Rust - Crates

Pattern - https://crates.io/
e.g. https://crates.io/crates/random

NexusRepo - npm, Maven and rubygems

e.g. http://nexus:8081/#browse/browse:rubygems-proxy:nexus%2F1.4.0%2Fnexus-1.4.0.gem

Installation

Production

1. Install from Chrome Store
2. Click Add to Chrome

Note: You will be asked to "Add Sonatype Nexus IQ Extension". Click "Add extension"

3. You will be prompted to enter your login details. (Important: Please note that this version stores your details in plain text in Chrome Storage. We are investigated secure storage but at this time we do not support it. You can use a token for your password though. https://help.sonatype.com/iqserver/managing/user-management/user-tokens)
   
   
4. Select an Application to link to this plugin. The application is required to perform the advanced history and remediation scanning now available.
   
   
5. Click Save to save your credentials.
   
6. You will be advised that your details are saved. Click Close when you are done and You will be taken back to the Extensions Install screen in Chrome. Close the screen and begin using.
7. The installer will have created a new icon in your Chrome Menu Bar.
   
   

Developer mode

1. Download the plugin from GitHub git clone https://github.com/sonatype-nexus-community/nexus-iq-chrome-extension.git
2. Open Chrome Browser.
3. Click on the three dots, then More Tools, then Extensions.
   
   
4. Click on load unpacked (requires "Developer Mode" to be enabled).
   
   
5. Navigate to the folder where you downloaded the plugin from GitHub onto your local machine. Select the src subdirectory and then click select
   
   
6. Configure the plugin like in the Production mode...

Uninstall

If you do not want to use the extension then you can right click on the icon and choose Remove from Chrome

Version History

Go to the changelog

Contributing

Please read the Contributing guide

The Fine Print

Supported by Sonatype

nexus-iq-chrome-extension's Issues

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._cacheindexof:3.0.2

Vulnerabilities

DepShield reports that this application's usage of lodash._cacheindexof:3.0.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._cacheindexof:3.0.2 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash._cacheindexof:3.0.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._baseindexof:3.1.0

Vulnerabilities

DepShield reports that this application's usage of lodash._baseindexof:3.1.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._baseindexof:3.1.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash._baseindexof:3.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[FEATURE] make the extension compatible with Firefox

did a first try using about:debugging as explained on https://developer.mozilla.org/fr/docs/Mozilla/Add-ons/WebExtensions/Your_first_WebExtension

got issues with:

• "declarativeContent" permission: https://stackoverflow.com/questions/39252384/is-there-a-ff-equivalent-to-chrome-declarativecontent-onpagechanged
• "background": https://developer.mozilla.org/fr/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#Compatibilit%C3%A9_du_navigateur
• "options_page": deprecated, replaced with "options_ui" https://developer.mozilla.org/fr/docs/Mozilla/Add-ons/WebExtensions/manifest.json/options_page

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.sortby:4.7.0

Vulnerabilities

DepShield reports that this application's usage of lodash.sortby:4.7.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.sortby:4.7.0 is a transitive dependency introduced by the following direct dependency(s):

• jest:24.5.0
        └─ jest-cli:24.5.0
              └─ jest-config:24.5.0
                    └─ jest-environment-jsdom:24.5.0
                          └─ jsdom:11.12.0
                                └─ data-urls:1.1.0
                                      └─ whatwg-url:7.0.0
                                            └─ lodash.sortby:4.7.0
                                └─ whatwg-url:6.5.0
                                      └─ lodash.sortby:4.7.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.uniq:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.uniq:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.uniq:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ @octokit/rest:16.35.2
                    └─ lodash.uniq:4.5.0
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash.uniq:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of q:1.5.1

Vulnerabilities

DepShield reports that this application's usage of q:1.5.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

q:1.5.1 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/commit-analyzer:6.3.3
              └─ conventional-changelog-angular:5.0.6
                    └─ q:1.5.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.defaults:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.defaults:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.defaults:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release-chrome:1.1.3
        └─ archiver:3.0.0
              └─ archiver-utils:2.1.0
                    └─ lodash.defaults:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

crxcavator.io/report - Excessive Permissions

Report found here https://crxcavator.io/report/mjehedmoboadebjmbmobpedkdgenmlhd/1.7.16

• Permissions: :///*, cookies, webRequest, tabs, storage, background, webRequestBlocking, activeTab

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isplainobject:4.0.6

Vulnerabilities

DepShield reports that this application's usage of lodash.isplainobject:4.0.6 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.isplainobject:4.0.6 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ issue-parser:5.0.0
                    └─ lodash.isplainobject:4.0.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of mem:1.1.0

Vulnerabilities

DepShield reports that this application's usage of mem:1.1.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mem:1.1.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ libnpx:10.2.0
                          └─ yargs:11.0.0
                                └─ os-locale:2.1.0
                                      └─ mem:1.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

add a "test" button on options page to test configuration

without this test opportunity in the options page, testing that the url and the credentials are ok is really cumbersome

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• jest:24.5.0
        └─ jest-cli:24.5.0
              └─ @jest/core:24.5.0
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
                          └─ snapdragon:0.8.2
                                └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.restparam:3.6.1

Vulnerabilities

DepShield reports that this application's usage of lodash.restparam:3.6.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.restparam:3.6.1 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash.restparam:3.6.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Browser is not defined

When loading the plugin, you get an error "Browser is not defined"

AllVersions Version History is broken in 83

When you upgrade to 83, the version history is not displayed. You will get a blank screen or a wait cursor. The reason is that in 83 the versions are now inside of a new tag "allVersions"

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.toarray:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.toarray:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.toarray:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ marked-terminal:3.3.0
              └─ node-emoji:1.10.0
                    └─ lodash.toarray:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Request failed with status code 402

When trying to connect the chrome plugin to iq-server instance, we get a 402 error (Payment Required). Note that we use a valid IQ-server Lifecycle licence and that we could connect the jenkins plugin with no error.

This happens right after setting login credentials on the plugin settings page. We got a 'Login successful when clicking on 'Login' button but we cannot select any application.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clonedeep:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ libnpm:3.0.1
                          └─ libnpmpublish:1.1.2
                                └─ lodash.clonedeep:4.5.0
                    └─ lodash.clonedeep:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Publish the extension in Chrome Store

Currently the extension has to be installed in developer mode. We would prefer the extension to be published in the Chrome Extension store. This would allow the extension to be installed like any other extension.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.escaperegexp:4.1.2

Vulnerabilities

DepShield reports that this application's usage of lodash.escaperegexp:4.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.escaperegexp:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ issue-parser:5.0.0
                    └─ lodash.escaperegexp:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

search Maven org does not handle ajax rewrite

The new Search.Maven.Org website uses ajax to rewrite the content of the page when you choose a different version. This does not rewrite the URL. So you have a different version in the URL from the body of the document. So my plugin picks up the wrong version. It reads the data from the URL first before I pick the data from the body. So you will get the data for the URL not from the body of the Ajax panel.
Probably never fix. Just navigate to the true URL using the top selector and search and not the sub search drop box.
e.g.
https://search.maven.org/artifact/io.springfox/springfox-swagger-ui/2.6.1/jar

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._root:3.0.1

Vulnerabilities

DepShield reports that this application's usage of lodash._root:3.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._root:3.0.1 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash._baseuniq:4.6.0
                          └─ lodash._root:3.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.get:4.4.2

Vulnerabilities

DepShield reports that this application's usage of lodash.get:4.4.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.get:4.4.2 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ @octokit/rest:16.35.2
                    └─ lodash.get:4.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flatten:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flatten:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.flatten:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release-chrome:1.1.3
        └─ archiver:3.0.0
              └─ archiver-utils:2.1.0
                    └─ lodash.flatten:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Security Report crxcavator.io - RetireJS

https://crxcavator.io/report/mjehedmoboadebjmbmobpedkdgenmlhd/1.7.16
RetireJS Vulnerability Scan
Scripts/jquery-ui-1.12.1/external/jquery/jquery.js
MediumparseHTML() executes scripts in event handlers
jquery v1.12.4
Medium3rd party CORS request may execute
jquery v1.12.4
Scripts/jquery-3.3.1.min.js
LowjQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution
jquery v3.3.1.min

Prevent package-lock.json from getting renamed to npm-shrinkwrap.json

When the plugin executes npm shrinkwrap, the package-lock.json file in the project is renamed to npm-shrinkwrap.json. That causes inconveniences to our build pipeline.
In your future release, would you consider keeping the package-lock.json file?

The preferred behaviour of the plugin would be not changing the original files in my project.

Continuously evaluate visited artifacts.

Analyse the artifact / library currently being visited without the need of clicking on the extension icon and update the icon based on the analysis.

We can perhaps have some sort of a green flag / indicator when the artifact is healthy or a red otherwise.

When using Chrome Extension it logs you out of IQ server

If you are logged in to NexusIQ and then launch the Chrome Extension, the NexusIQ session is terminated.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.difference:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.difference:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.difference:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release-chrome:1.1.3
        └─ archiver:3.0.0
              └─ archiver-utils:2.1.0
                    └─ lodash.difference:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

OSSIndex when IQ isn't available

might be nice and more community friendly if we could redirect all request to OSSIndex if an IQ Server hasn't been configured.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._getnative:3.9.1

Vulnerabilities

DepShield reports that this application's usage of lodash._getnative:3.9.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._getnative:3.9.1 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash._createcache:3.1.2
                          └─ lodash._getnative:3.9.1
                    └─ lodash._getnative:3.9.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[BUG] Wait cursor on evaluation does not go away and never comes back

Sometime when you run the plugin on a page the wait cursor comes up and the response never comes back. You should expect to see a response within a few seconds all things being equal. I have not fully worked out this bug. From what I can gather it is often to do with content refresh not working on the target page. One work around that seems to work most of the time is to refresh the page within the external repository that you are looking at in your browser. This seems to wake up the plugin. I will do some more work to see if I can make a more complete fix.

Prospect issue, hanging on hexagon load screen

@ctownshend had a POC where we attempted to install the plugin w/ @lennykean

We installed it from the chrome marketplace and all other functionality with IQ was interfacing fine, but we were getting nothing but a continually spinning hexagon

Was wondering what the best debugging steps are, if there are any logs or network traffic we should look at, or anything like that to determine the root cause of the issue that Lenny could pass over to us

Security Issues from https://crxcavator.io - CSP

Report found here https://crxcavator.io/report/mjehedmoboadebjmbmobpedkdgenmlhd/1.7.16

• Content Security Policy - excessive permissions. Will need to look in to reducing surface area from CSP. Currently "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.set:4.3.2

Vulnerabilities

DepShield reports that this application's usage of lodash.set:4.3.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.set:4.3.2 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ @octokit/rest:16.35.2
                    └─ lodash.set:4.3.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[FEATURE] Provide better error handling when server is unavailable

When IQ server is unavailable the Chrome plugin should tell us it is timed out. Currently it is crashing.
Error in event handler: TypeError: Cannot read property '0' of undefined
at renderComponentData (chrome-extension://mcmljcafoblbjfojgkldcpajcohcloee/Scripts/popup.js:253:66)
at createHTML (chrome-extension://mcmljcafoblbjfojgkldcpajcohcloee/Scripts/popup.js:179:13)
at gotMessage (chrome-extension://mcmljcafoblbjfojgkldcpajcohcloee/Scripts/popup.js:141:35)

[FEATURE] Collect telemetry data to understand usage of this extension

It would be good to know how many people use the chrome extension and what urls they browse. We need to add the tracking instrumentation to know usage.

DepShield encountered errors while building your project

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled within 24 hours. If the build is successful this issue will be closed, otherwise the error message will be updated.

_{This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.}

Hitting login multiple times on the config screen adds to app list each time

Every time I hit 'login' the list gets bigger here and appends the list of apps to the previously populated list

[DepShield] (CVSS 8.2) Vulnerability due to usage of handlebars:4.1.2

Vulnerabilities

DepShield reports that this application's usage of handlebars:4.1.2 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation

---

Occurrences

handlebars:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• jest:24.8.0
        └─ jest-cli:24.8.0
              └─ @jest/core:24.8.0
                    └─ @jest/reporters:24.8.0
                          └─ istanbul-reports:2.2.6
                                └─ handlebars:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.union:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.union:4.6.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.union:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash.union:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Use Version History Graph

When viewing a component and you want to see its remediation and version history, use the version history graph that is in the Component Information Panel (CIP) inside Eclipse IDE.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._createcache:3.1.2

Vulnerabilities

DepShield reports that this application's usage of lodash._createcache:3.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._createcache:3.1.2 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash._createcache:3.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Information panel never loads, spinning hexagon is all you see

If the domain name contains a trailing '/', then the Information Panel will never load. e.g 'https://nexus.prd.systems/'

An error occurred: Invalid cross-site request forgery token

Message "An error occurred: Invalid cross-site request forgery token" occurs after initial install. If you use the extension a second time the message goes away and works correctly. Still trying to determine the cause and fix.

can't search for @angular/animations NPM package

when browsing https://www.npmjs.com/package/@angular/animations/v/6.1.10 , component name and version are not recognized

[ISSUE] User Credentials stored in local browser storage

The initial release 1.7.5 stores your username and password in plain text in Chrome storage. This is a known issue at this time. We are investigating solutions.

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.uniqby:4.7.0

Vulnerabilities

DepShield reports that this application's usage of lodash.uniqby:4.7.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.uniqby:4.7.0 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ issue-parser:5.0.0
                    └─ lodash.uniqby:4.7.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isstring:4.0.1

Vulnerabilities

DepShield reports that this application's usage of lodash.isstring:4.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.isstring:4.0.1 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/github:5.5.5
              └─ issue-parser:5.0.0
                    └─ lodash.isstring:4.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._bindcallback:3.0.1

Vulnerabilities

DepShield reports that this application's usage of lodash._bindcallback:3.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._bindcallback:3.0.1 is a transitive dependency introduced by the following direct dependency(s):

• semantic-release:15.13.31
        └─ @semantic-release/npm:5.3.4
              └─ npm:6.13.4
                    └─ lodash._bindcallback:3.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}