Giter Site home page Giter Site logo

valdisiljuconoks / optimizely-advanced-contentarea Goto Github PK

View Code? Open in Web Editor NEW
34.0 6.0 14.0 163.86 MB

Optimizely content area renderer on steroids

License: Apache License 2.0

C# 77.80% PowerShell 0.19% JavaScript 1.67% CSS 5.86% HTML 10.85% ASP.NET 3.63%
optimizely optimizely-cms optimizely-commerce bootstrap twitter

optimizely-advanced-contentarea's Introduction

Build status Platform

Optimizely Advanced Content Area Renderer

Provides easy way to register display options used to customize look and feel of the blocks inside your Optimizely content area (+ many more advanced features and whistles).

Optimizely versions Support

For Optimizely CMS v12 support please use master branch.

List of Points of Interest

Getting Started

You would need to install package from Optimizely's NuGet feed to start using Optimizely Advanced ContentArea renderer:

> dotnet add package TechFellow.Optimizely.AdvancedContentArea

Next you would need to configure renderer by adding it to the application and specifying display options:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAdvancedContentArea(o =>
        {
            o.DisplayOptions = DisplayOptions.Default;
        });
    }
}

Or you can add your own diplsay options:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAdvancedContentArea(o =>
        {
            o.DisplayOptions = new List<DisplayModeFallback>
            {
                new()
                {
                    Id = "three-fifth",
                    Name = "Three fifth (3/5)",
                    Tag = "displaymode-three-fifth",
                    ExtraExtraLargeScreenWidth = 7,
                    ExtraExtraLargeScreenCssClassPattern = "col-three-fifth-xxl-{0}",
                    ExtraLargeScreenWidth = 7,
                    ExtraLargeScreenCssClassPattern = "col-three-fifth-xl-{0}",
                    LargeScreenWidth = 7,
                    LargeScreenCssClassPattern = "col-three-fifth-lg-{0}",
                    MediumScreenWidth = 12,
                    MediumScreenCssClassPattern = "col-three-fifth-md-{0}",
                    SmallScreenWidth = 12,
                    SmallScreenCssClassPattern = "col-three-fifth-sm-{0}",
                    ExtraSmallScreenWidth = 12,
                    ExtraSmallScreenCssClassPattern = "col-three-fifth-xs-{0}",
                    Icon = "epi-icon__layout--three-fifth"
                }
            };
        });
    }
}

Configuration

Following configuration options are available:

Name Default Description
DisplayOptions Empty list Specify list of display options available for the renderer. Later editors will be able to choose any of these options while creating content and specifying dispay option for blocks.
RowSupportEnabled false Configure if advanced content area renderer should support row option.
AutoAddRow false Configure renderer to add automatically row CSS class to each new row div element.
ItemStartRenderCallback null Callback to use to modify start tag for the content area items.

Available Built-in Display Options

Following display options are available by default (via DisplayOptions.Default):

  • "Full width (1/1)" (displaymode-full).
  • "Half width (1/2)" (displaymode-half).
  • "One-third width (1/3)" (displaymode-one-third).
  • "Two-thirds width (2/3)" (displaymode-two-thirds).
  • "One-quarter width (1/4)" (displaymode-one-quarter).
  • "Three-quarter width (3/4)" (displaymode-three-quarters).

Display Option Fallbacks

For every display option there are 6 fallback width for various screen sizes based on Bootstrap grid system. According to Bootstrap specification following screen sizes are defined:

  • Extra extra large screen (>= 1400px, -xxl-)
  • Extra large screen (>= 1200px, -xl-)
  • Large screen (>= 992px, -lg-)
  • Medium devices (>= 768px, -md-)
  • Small devices (>= 576px, -sm-)
  • Extra small devices (< 576px, None)

These numbers are added at the end of Bootstrap grid system class (for instance 12 for Large screen -> 'col-lg-12')

Display Mode Name Extra small devices (xs) Small devices (sm) Medium devices (md) Large screen (lg) Extra large screen (xl) Extra extra large screen (xxl)
Full width 12 12 12 12 12 12
Half width 12 12 6 6 6 6
One third 12 12 6 4 4 4
Two thirds 12 12 6 8 8 8
One quarter 12 12 6 3 3 3
Three quarters 12 12 6 9 9 9

Eventually if you choose Half-width (1/2) display option for a block of type EditorialBlockWithHeader following markup will be generated:

<div class="block editorialblockwithheader col-lg-6 col-md-6 col-sm-12 col-xs-12 displaymode-half">
    ...
</div>

Breakdown of added classes:

  • block : generic class added to identify a block
  • {block-name} : name of the block type is added (in this case EditorialBlockWithHeader)
  • col-xs-12 : block will occupy whole width of the screen on extra small devices
  • col-sm-12 : block will occupy whole width of the screen on small devices
  • col-md-6 : block will occupy one half of the screen on medium devices
  • col-lg-6 : block will occupy one half of the screen on desktop
  • displaymode-half : chosen display option tag is added

Example

Let's take a look at One quarter width block. This is a block layout in Optimizely content area on-page edit mode (desktop view - large screen col-lg-3):

This is a block layout in Optimizely content area on medium devices - col-md-6:

This is a block layout in Optimizely content area on small and extra small devices - col-sm-12 and col-xs-12:

Advanced Features

Bootstrap Row Support

If you need to support Boostrap row elements in Content Area, you can just render that area with "rowsupport" parameter:

@Html.PropertyFor(m => m.MainContentArea, new { rowsupport = true })

For every collection of elements that fill up 12 columns - additional element (<div>) will be wrapped around with class="row".

If you need to add custom Css class to your row element, it's possible via ViewData object. Pass in rowcssclass parameter with desired class name:

    @Html.PropertyFor(x => x.CurrentPage.MainContentArea, 
                      new
                      {
                          rowsupport = true,
                          rowcssclass = "special-row"
                      })

Validate Item Count

Thanks to Jon Jones for copyright! If you have Content Area with single row and want to validate item count inside to match single Bootstrap row (12 columns), you just need to add [BootstrapRowValidation] attribute:

public class StartPage : SitePageData
{
    ...
    [BootstrapRowValidation]
    public virtual ContentArea MainContentArea { get; set; }

Example: you add 2 blocks to the content area with 1/2 and 2/3. In total it's 7/6 of the width - which exceeds full width columns 12/12.

Default DisplayOption for Block

You can specify which display option to use if block is dropped inside content area and editor did not specify display option explicitly:

using TechFellow.Optimizely.AdvancedContentArea;

public static Class ContentAreaTags  
{
    public const string HalfWidth = "half-width";
}

[DefaultDisplayOption(ContentAreaTags.HalfWidth)]
public class SomeBlock : BlockData  
{
    ...
}

This attribute will make sure that if block is dropped inside content area - display option registered with tag half-width is used.

Also "tagged" blocks are supported:

using TechFellow.Optimizely.AdvancedContentArea;

[DefaultDisplayOptionForTag("ca-tag", ContentAreaTags.OneThirdWidth)]
public class SomeBlock : BlockData
{
    ...
}

Default DisplayOption for Content Area

The same attribute can be used in ContentArea property definition:

using TechFellow.Optimizely.AdvancedContentArea;

[ContentType(DisplayName...]
public class StandardPage : PageData  
{
    [DefaultDisplayOption(ContentAreaTags.HalfWidth)]
    public virtual ContentArea MainContentArea { get; set; }
    ...
}

Get Block Index in the ContentArea

If you need to get index of the current block in the ContentArea, you are able to write just following line:

<div>
    Index: @Html.BlockIndex()
</div>

"None" Display Option

Sometimes you would like to set display option that does nothing - none of the CSS classes would be added that could mess up your site design. For this reason there is a new built-in display option - None.

You can find it in :

public void ConfigureServices(IServiceCollection services)
{
    services.AddAdvancedContentArea(o =>
    {
        o.DisplayOptions = new List<DisplayModeFallback>(DisplayOptions.Default)
        {
            DisplayModeFallback.None
        };
    });
}

If you set this display option on the block (in this example "Teaser Block" in Alloy sample site) only following classes will be added to the container element:

<div class="block teaserblock displaymode-none">
    <!-- block content -->
</div>

Additional Styles

Similar to Optimizely AlloyTech sample site it's possible to define custom styles for block. You have to implement EPiBootstrapArea.ICustomCssInContentArea interface.

using TechFellow.Optimizely.AdvancedContentArea;

[ContentType(GUID = "EED33EA7-D118-4D3D-BD7F-88C012DFA1F8", GroupName = SystemTabNames.Content)]
public class Divider : BaseBlockData, ICustomCssInContentArea
{
    ...

    public string ContentAreaCssClass => "block-with-round-borders";
}

Localized Display Option Names

You will need to add few localization resource entries in order to get localized DisplayOptions. Following entry has to be added to get localized names for default display options:

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<languages>
  <language name="English" id="en">
    <displayoptions>
      <displaymode-full>Full (1/1)</displaymode-full>
      <displaymode-half>Half (1/2)</displaymode-half>
      <displaymode-one-third>One third (1/3)</displaymode-one-third>
      <displaymode-two-thirds>Two thirds (2/3)</displaymode-two-thirds>
      <displaymode-one-quarter>One quarter (1/4)</displaymode-one-quarter>
      <displaymode-three-quarters>Three quarters (3/4)</displaymode-three-quarters>
    </displayoptions>
  </language>
</languages>

Modify Block Start Element

If there is a requirement to modify start element tag for the block (i.e. add id attribute to element as shown in this blog post) you can do so by providing element's start tag modification callback:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAdvancedContentArea(o =>
    {
        o.ItemStartRenderCallback = (node, item, content) =>
        {
            // modify start element (eg. add id attribute or some dynamic CSS classes)
        };
    });
}

This will make sure that your registered AnotherBootstrapAwareContentAreaRenderer renderer will be used instead of built-in one. And you will have chance to modify start element of the block before it's sent to the output writer.' NB! You have to use Intercept method to overwrite renderer (just registering new implementation for ContentAreaRenderer did not do the trick).

Skip Item Wrapper Element

By default Optimizely will generate wrapping element around content area (div tag name is actually controllable as well, more info here):

@Html.PropertyFor(m => m.PageHeaderArea)

Resulting in:

<div>                 <!-- CA wrapper element -->
    <div ...>         <!-- Block element -->
        <...>         <!-- Actual content of the block -->
    </div>
</div>

Optimizely gives you an option to skip wrapper element generation - resulting only in set of blocks added to the content area.

@Html.PropertyFor(m => m.PageHeaderArea, new { HasContainer = false })

Resulting in:

<div ...>         <!-- Block element -->
    <...>         <!-- Actual content of the block -->
</div>

However, we still see that wrapping <div> element is not desired in <head> area.

Looking for the best place to add feature to skip even further - not to generate block wrapping element, but just content of the block.. Content area renderer is perfect candidate for this functionality.

You can now write like this:

@Html.PropertyFor(m => m.PageHeaderArea,
                  new
                  {
                      HasContainer = false,
                      HasItemContainer = false
                  })

Resulting in:

<...>         <!-- Actual content of the block -->

If you use this approach to render elements for instance in head section, you might run into problems ending with invalid markup and Optimizely is adding edit container if property is rendered inside Edit Mode. To avoid this, you need to include additional parameter - HasEditContainer = false

@Html.PropertyFor(m => m.PageHeaderArea,
                  new
                  {
                      HasContainer = false,
                      HasItemContainer = false,
                      HasEditContainer = false
                  })

Forms Support

More info here: https://blog.tech-fellow.net/2023/02/11/optimizely-forms-advanced-contentarea-renderer-is-back/

optimizely-advanced-contentarea's People

Contributors

cjsharp1 avatar eric-maddox avatar ingusk avatar markeverard avatar mend-bolt-for-github[bot] avatar runnhagen avatar sebbe avatar valdisiljuconoks avatar whyleee avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

optimizely-advanced-contentarea's Issues

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/lodash/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • digdug-1.4.0.tgz
      • decompress-0.2.3.tgz
        • map-key-0.1.5.tgz
          • lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

WS-2018-0168 (Medium) detected in dojo-1.9.4.tgz

WS-2018-0168 - Medium Severity Vulnerability

Vulnerable Library - dojo-1.9.4.tgz

Dojo core is a powerful, lightweight library that makes common tasks quicker and easier. Animate elements, manipulate the DOM, and query with easy CSS syntax, all without sacrificing performance.

Library home page: https://registry.npmjs.org/dojo/-/dojo-1.9.4.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/intern-geezer/node_modules/dojo/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • dojo-1.9.4.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Fix potential XSS vulnerability. Since this is in a DOH test that isn't used anymore nor run automatically, the threat is minimal.

Publish Date: 2018-09-26

URL: WS-2018-0168

CVSS 2 Score Details (4.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: dojo/dojo@9117ffd

Release Date: 2018-08-10

Fix Resolution: Replace or update the following files: i18nExhaustive.js, unit.html, test-instructions.md


Step up your Open Source Security Game with WhiteSource here

Add custom class to "row" element

Add support for specifying custom CSS classes for row element.

@Html.PropertyFor(m => m.MainContentArea, new { rowsupport = true, rowclass = "extra-row-class" })

RegisterDisplayModesInitModule: System.InvalidOperationException: Collection was modified; enumeration operation may not execute

There is sometimes an invalidoperations exception inside the RegisterDisplayModesInitModule.

2015-04-08 11:27:58,614 [1] ERROR EPiServer.Framework.Initialization.InitializationEngine: Initialize action failed for Initialize on class EPiBootstrapArea.Initialization.RegisterDisplayModesInitModule, EPiBootstrapArea, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null
System.InvalidOperationException: Collection was modified; enumeration operation may not execute.
at System.Collections.Generic.List`1.Enumerator.MoveNextRare()
at EPiServer.Framework.Localization.ProviderBasedLocalizationService.LoadString(String[] normalizedKey, String originalKey, CultureInfo culture)
at EPiServer.Framework.Localization.LocalizationService.TryGetStringByCulture(String originalKey, String[] normalizedKey, CultureInfo culture, String& localizedString)
at EPiServer.Framework.Localization.LocalizationService.TryGetStringByCulture(String resourceKey, CultureInfo culture, String& localizedString)
at EPiBootstrapArea.Initialization.RegisterDisplayModesInitModule.RegisterDisplayOptions()
at EPiServer.Framework.Initialization.ModuleNode.Execute(Action a, String key)
at EPiServer.Framework.Initialization.InitializationEngine.InitializeModules()

I think its a matter of thread safety? The exception hits over and over again, until the site finally comes back to life.

foreach (var mode in modes)
{
// here is modes modified by other thread?
}

// Mathias

BootstrapAwareContentAreaRenderer is not thread safe

In the initialization the BootstrapAwareContentAreaRenderer is added as a Singleton. However multiple threads may be calling the Render() method. The Render method may change the class's properties such as the ContentAreaTag.
This becomes an intermittent error where sometimes the ContentArea items are displayed with the wrong template because the template controller uses the wrong tag.

To reproduce the error locally, I used JMeter to hit my site with multiple threads. I have a ContentArea that is sometimes rendered with a tag and sometimes without the tag.

Specify the default display option globally

I am looking for a simple way to set the display mode globally to a custom mode that disables the layout features. I have a need to do this since adding the current default messes up the design of our site, and it will take time to rework components to support it. In the meantime we want to opt-in to using the layout features one place at a time. The only way I could think of doing this was adding a "none" option that does not have any css class patterns, and I simply want to make it the default everywhere if possible. Any ideas how this can be done, or if a feature can be added?

CVE-2018-16487 (High) detected in lodash-2.4.2.tgz

CVE-2018-16487 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/lodash/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • digdug-1.4.0.tgz
      • decompress-0.2.3.tgz
        • map-key-0.1.5.tgz
          • lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

Custom registered displlay options are not available in content area renderer

these display modes are ignored in content area renderer:

ConfigurationContext.Setup(ctx =>
{
    ctx.CustomDisplayOptions.Add<One12thDisplayOption>()
        .Add<One6thDisplayOption>()
        .Add(new DisplayModeFallback
        {
            Name = "Full width (1/1)",
            Tag = ContentAreaTags.FullWidth,
            LargeScreenWidth = 12,
            MediumScreenWidth = 12,
            SmallScreenWidth = 12,
            ExtraSmallScreenWidth = 12,
            Icon = "epi-icon__layout--full"
        });
});

WS-2019-0103 (Medium) detected in handlebars-1.3.0.tgz

WS-2019-0103 - Medium Severity Vulnerability

Vulnerable Library - handlebars-1.3.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-1.3.0.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_41c0e688-d421-4ea5-a1a5-8c862992cfd1/20190702203750_36821/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_41c0e688-d421-4ea5-a1a5-8c862992cfd1/20190702203750_36821/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/handlebars/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: bc457a9f9b325b3aac41f3b4fa094e51c068820b

Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-05-30

URL: WS-2019-0103

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: handlebars-lang/handlebars.js@edc6220

Release Date: 2019-05-30

Fix Resolution: 4.0.13


Step up your Open Source Security Game with WhiteSource here

CVE-2015-8858 (High) detected in uglify-js-2.3.6.tgz

CVE-2015-8858 - High Severity Vulnerability

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/uglify-js/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz
        • uglify-js-2.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

Publish Date: 2017-01-23

URL: CVE-2015-8858

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2018-12-15

Fix Resolution: v2.6.0


Step up your Open Source Security Game with WhiteSource here

Add support to only use on Forms (not override ContentAreaRenderer globally)

We used EPiBootstrapArea on an EPi 10-project.

I guess we have a special case that not plays well with this Nuget-package, at least on current version. We are using our custom renderer as ContentAreaRenderer in the Initialization, and EPiBootstrapArea-renderer was only used on Forms (overridden forms ascx in Views/Shared/ElementBlocks.

When we updated to EPi 11 and this Nuget-package the EPiBootstrapArea-renderer took over our instead of our custom renderer and messed rendering all over our site. So we had to override that, so our renderer was used as default ContentAreaRenderer.

But then the we couldn't get forms rendering to work, since @Html.RenderFormElements couldn't lookup and use the EPiBootstrapArea-renderer (the Exception about not correct renderer is thrown).

We would really appreciate if we could use this on forms only, so we don't need to override ContentAreaRenderer after EPiBootstrapArea has registered its renderer for ContentAreaRenderer and that @Html.RenderFormElements could be modified to lookup the EPiBootstrapArea:s renderer-instance differently if not registered as the implementation of ContentAreaRenderer.

Maybe register as a singleton for its own type and on RenderFormElements look up as you do, but instead of throw try to lookup the own type, and if that not working throwing an Exception that the EPiBootstrapArea isn't registered in known ways?

Backward compatibillity

Hey Valdis,
was runing on version 4.0.1, after upgrading to latest 4.3 make some init modules to fail.

missing objects:
DisplayModeFallbackProviderInitModule
SwapRendererInitModule
RowSupportEnabled
AutoAddRow

...For()
.Use()
.SetProperty(i => i.RowSupportEnabled = false)
.SetProperty(i => i.AutoAddRow = false));

Sorry, asking before looking for answers. Stressed

Also is any of this breaking changes?

Regards Luc

BlockIndex and GetDisplayOption helper does not return any value

I'm trying to get the block index and selected display option for a block, but the block index always returns -1 och GetDisplayOption() returns an empty string.

I'm using in the html helpers in the view, like so:
@Html.GetDisplayOption(Model)
@Html.BlockIndex()

Any idea why this is?

I'm using Episerver 11.13.2.

Add support to specify default display options from within the block

"Is it possible to set the default DisplayOption for Block from inside the Block model, like you can do with the Additional Styles? It would be handy when migrating from another renderer with DisplayOption already set into Block."

Q: what do you think - who would win if you are dropping block with display option (DO1) set via attribute, having also override in method (DO2) into the content area with default display option set to DO3?

A: Tough one. The most inner/specific setting (DO2) should be the winner?

multiselect for screen sizes

Would it be possible to have more selections for screen sizes? Something like:

Display on large screen as: Display options
Display on medium screen as: Display options
Display on small screen as: Display options
Display on extra small screen as: Display options

That way we could gain more control over how to fallback on smaller views. What do you think?

CVE-2015-8860 (High) detected in tar-0.1.20.tgz

CVE-2015-8860 - High Severity Vulnerability

Vulnerable Library - tar-0.1.20.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-0.1.20.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/tar/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • digdug-1.4.0.tgz
      • decompress-0.2.3.tgz
        • tar-0.1.20.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Publish Date: 2017-01-23

URL: CVE-2015-8860

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8860

Release Date: 2017-01-23

Fix Resolution: 2.0.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0064 (High) detected in handlebars-1.3.0.tgz

WS-2019-0064 - High Severity Vulnerability

Vulnerable Library - handlebars-1.3.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-1.3.0.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/handlebars/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Publish Date: 2019-04-30

URL: WS-2019-0064

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/755/versions

Release Date: 2019-04-30

Fix Resolution: 1.0.6-2,4.0.14,4.1.2


Step up your Open Source Security Game with WhiteSource here

WS-2015-0017 (Medium) detected in uglify-js-2.3.6.tgz

WS-2015-0017 - Medium Severity Vulnerability

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/uglify-js/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz
        • uglify-js-2.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Uglify-js is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into .parse().

Publish Date: 2015-10-24

URL: WS-2015-0017

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/48

Release Date: 2015-10-24

Fix Resolution: Update to version 2.6.0 or later


Step up your Open Source Security Game with WhiteSource here

Item container still gets rendered in CMS mode

I have something like this in the HTML head:

@Html.DisplayFor(x => x.HeadContentArea, new { HasContainer = false, HasItemContainer = false })

But the item container still gets rendered in CMS mode.

image

Since DIVs are invalid elements within the head element, it gets pushed to the body element.

Add rowsupport feature to form elements

When using your renderer in edit mode, all form elements are nicely wrapped in row elements and it works beautifully. Once not in edit mode, those rows are gone and I cannot find a way to enable them anymore. I tried applying rowsupport specifically on the field that contains the form:
@Html.PropertyFor(m => m.MainContentArea, new { rowsupport = true })
But that wraps the entire form in a row, breaking my layout. It does nothing with the form elements. I tried playing with the global settings to no success. Only use this feature on forms right now, so I cant turn it on everywhere yet because my blocks do not support bootstrap layouts. Any ideas?

CVE-2016-10540 (High) detected in minimatch-0.3.0.tgz, minimatch-0.4.0.tgz

CVE-2016-10540 - High Severity Vulnerability

Vulnerable Libraries - minimatch-0.3.0.tgz, minimatch-0.4.0.tgz

minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/fileset/node_modules/glob/node_modules/minimatch/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • fileset-0.1.8.tgz
        • glob-3.2.11.tgz
          • minimatch-0.3.0.tgz (Vulnerable Library)
minimatch-0.4.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.4.0.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/fileset/node_modules/minimatch/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • fileset-0.1.8.tgz
        • minimatch-0.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/118

Release Date: 2016-06-20

Fix Resolution: Update to version 3.0.2 or later.


Step up your Open Source Security Game with WhiteSource here

WS-2019-0047 (Medium) detected in tar-0.1.20.tgz

WS-2019-0047 - Medium Severity Vulnerability

Vulnerable Library - tar-0.1.20.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-0.1.20.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/tar/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • digdug-1.4.0.tgz
      • decompress-0.2.3.tgz
        • tar-0.1.20.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Publish Date: 2019-04-05

URL: WS-2019-0047

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/803

Release Date: 2019-04-05

Fix Resolution: 4.4.2


Step up your Open Source Security Game with WhiteSource here

WS-2015-0003 (Medium) detected in handlebars-1.3.0.tgz

WS-2015-0003 - Medium Severity Vulnerability

Vulnerable Library - handlebars-1.3.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-1.3.0.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/handlebars/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Quoteless Attributes in Templates can lead to Content Injection

Publish Date: 2015-12-14

URL: WS-2015-0003

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/61

Release Date: 2015-12-14

Fix Resolution: If you are unable to upgrade to version 4.0.0 or greater you can add quotes to your attributes in your handlebar templates.


Step up your Open Source Security Game with WhiteSource here

WS-2018-0590 (High) detected in diff-1.1.0.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.1.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.1.0.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/diff/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • diff-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2019-06-11

URL: WS-2018-0590

CVSS 2 Score Details (7.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: kpdecker/jsdiff@2aec429

Release Date: 2019-06-11

Fix Resolution: 3.5.0


Step up your Open Source Security Game with WhiteSource here

EditContainerClass does not seem to work with EPiBootstrapArea

We're having problems with specifying a class which should only be displayed on the container if in edit mode.

By default EPiServer offers the property EditContainerClass for this purpose:
`


@Html.PropertyFor(x => x.MainContentArea, new { EditContainerClass ="editor-overflow-hidden" })

`

However, it seems to me that this property is swallowed by EPiBootstrapArea. Workaround is to have an if statement in the view which checks if in edit mode, if so use CssClass. CssClass seems to flow through EPiBootstrapArea correctly.

Add default block display mode on content area

It would be great if default width of the block could be added for content area. The setting could be configured through attribute on content are property like:

[DefaultDisplayMode("one-third")
public virtual ContentArea ContentArea {get;set;}

If "one-third" does not exist, fallback to full width.

Missing translations

Missing translations for registered display options. Should display English ones does not exist in resources.

CVE-2015-8857 (High) detected in uglify-js-2.3.6.tgz

CVE-2015-8857 - High Severity Vulnerability

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/uglify-js/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz
        • uglify-js-2.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Publish Date: 2017-01-23

URL: CVE-2015-8857

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2018-12-15

Fix Resolution: v2.4.24


Step up your Open Source Security Game with WhiteSource here

push nuget

Can we push the latest and greatest to nuget feed?

WS-2019-0100 (Medium) detected in fstream-0.1.31.tgz

WS-2019-0100 - Medium Severity Vulnerability

Vulnerable Library - fstream-0.1.31.tgz

Advanced file system stream things

Library home page: https://registry.npmjs.org/fstream/-/fstream-0.1.31.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/fstream/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • digdug-1.4.0.tgz
      • decompress-0.2.3.tgz
        • tar-0.1.20.tgz
          • fstream-0.1.31.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

Versions of fstream prior to 1.0.12 are vulnerable to Arbitrary File Overwrite.

Publish Date: 2019-05-23

URL: WS-2019-0100

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/886

Release Date: 2019-05-23

Fix Resolution: 1.0.12


Step up your Open Source Security Game with WhiteSource here

WS-2015-0025 (High) detected in tar-0.1.20.tgz

WS-2015-0025 - High Severity Vulnerability

Vulnerable Library - tar-0.1.20.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-0.1.20.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/tar/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • digdug-1.4.0.tgz
      • decompress-0.2.3.tgz
        • tar-0.1.20.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

The tar module earlier than version 2.0.0 allow for archives to contain symbolic links that will overwrite targets outside the expected path for extraction.

Publish Date: 2015-11-03

URL: WS-2015-0025

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/57

Release Date: 2015-11-03

Fix Resolution: Update to a version 2.0.0 or greater


Step up your Open Source Security Game with WhiteSource here

WS-2015-0024 (High) detected in uglify-js-2.3.6.tgz

WS-2015-0024 - High Severity Vulnerability

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Path to dependency file: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/package.json

Path to vulnerable library: /tmp/WhiteSource-ArchiveExtractor_747f4581-142b-405b-87f3-701147633521/20190625174422_45091/git_depth_0/EPiBootstrapArea/src/EPiBootstrapArea.Forms/modules/_protected/Shell/Shell/11.1.0.0/ClientResources/lib/xstyle/node_modules/uglify-js/package.json

Dependency Hierarchy:

  • intern-geezer-2.2.3.tgz (Root Library)
    • istanbul-0.2.16.tgz
      • handlebars-1.3.0.tgz
        • uglify-js-2.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 52d4afe13ec5c110f32d28c464a838e35746114d

Vulnerability Details

UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification.

Publish Date: 2015-08-24

URL: WS-2015-0024

CVSS 2 Score Details (8.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: mishoo/UglifyJS@905b601

Release Date: 2017-01-31

Fix Resolution: v2.4.24


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.