veritem/rf-app

Handle transactions on an embedded software!

rfid transaction web app

The web app that works with rfid card reader used for embeded systems experiment project!

Tech stack

• Api: Rust with Rocket and PostgreSQL
• Fronted: Next.js with typescript

rf-app's Issues

Dependency Dashboard

This issue provides visibility into Renovate updates and their statuses. Learn more

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update dependency @types/react to v17.0.24
• chore(deps): update dependency postcss to v8.3.8
• fix(deps): update dependency swr to v1.0.1
• fix(deps): update dependency next to v11 [security]
• fix(deps): update rust crate diesel to 1.4.8
• fix(deps): update rust crate serde to 1.0.130
• fix(deps): update rust crate serde_derive to 1.0.130
• fix(deps): update rust crate serde_json to 1.0.68
• chore(deps): update dependency autoprefixer to v10.3.6
• chore(deps): update dependency tailwindcss to v2.2.16
• chore(deps): update dependency typescript to v4.4.3
• fix(deps): update dependency @headlessui/react to v1.4.1
• fix(deps): update rust crate env_logger to 0.9.0
• fix(deps): update rust crate rust-embed to v6
• Click on this checkbox to rebase all open PRs at once

---

• Check this box to trigger a request for Renovate to run again on this repository

CVE-2021-23382 (Medium) detected in postcss-6.0.23.tgz

CVE-2021-23382 - Medium Severity Vulnerability

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: rfid_transaction/frontend/package.json

Path to vulnerable library: rfid_transaction/frontend/node_modules/postcss-functions/node_modules/postcss/package.json

Dependency Hierarchy:

• tailwindcss-2.1.4.tgz (Root Library)
  • postcss-functions-3.0.0.tgz
    • ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in HEAD commit: 3647288a2edd1c830ab127bf57ab0a0ba7e93f4f

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-35863 (High) detected in hyper-0.10.16.crate

CVE-2020-35863 - High Severity Vulnerability

Vulnerable Library - hyper-0.10.16.crate

A fast and correct HTTP library.

Library home page: https://crates.io/api/v1/crates/hyper/0.10.16/download

Dependency Hierarchy:

• rocket_contrib-0.4.7.crate (Root Library)
  • rocket-0.4.10.crate
    • rocket_http-0.4.10.crate
      • ❌ hyper-0.10.16.crate (Vulnerable Library)

Found in HEAD commit: 3647288a2edd1c830ab127bf57ab0a0ba7e93f4f

Found in base branch: main

Vulnerability Details

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.

Publish Date: 2020-12-31

URL: CVE-2020-35863

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/hyperium/hyper/releases/tag/v0.12.34

Release Date: 2020-12-31

Fix Resolution: v0.12.34

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23364 (Medium) detected in browserslist-4.16.1.tgz - autoclosed

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Library - browserslist-4.16.1.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz

Path to dependency file: rfid_transaction/frontend/package.json

Path to vulnerable library: rfid_transaction/frontend/node_modules/browserslist/package.json

Dependency Hierarchy:

• next-10.2.0.tgz (Root Library)
  • ❌ browserslist-4.16.1.tgz (Vulnerable Library)

Found in HEAD commit: 3647288a2edd1c830ab127bf57ab0a0ba7e93f4f

Found in base branch: main

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-35881 (High) detected in traitobject-0.1.0.crate

CVE-2020-35881 - High Severity Vulnerability

Vulnerable Library - traitobject-0.1.0.crate

Unsafe helpers for working with raw trait objects.

Library home page: https://crates.io/api/v1/crates/traitobject/0.1.0/download

Dependency Hierarchy:

• rocket_contrib-0.4.7.crate (Root Library)
  • rocket-0.4.10.crate
    • rocket_http-0.4.10.crate
      • hyper-0.10.16.crate
        • ❌ traitobject-0.1.0.crate (Vulnerable Library)

Found in HEAD commit: 3647288a2edd1c830ab127bf57ab0a0ba7e93f4f

Found in base branch: main

Vulnerability Details

An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.

Publish Date: 2020-12-31

URL: CVE-2020-35881

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469 (High) detected in glob-parent-2.0.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: rfid_transaction/frontend/package.json

Path to vulnerable library: rfid_transaction/frontend/node_modules/glob-base/node_modules/glob-parent/package.json

Dependency Hierarchy:

• tailwindcss-2.1.4.tgz (Root Library)
  • parse-glob-3.0.4.tgz
    • glob-base-0.3.0.tgz
      • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 3647288a2edd1c830ab127bf57ab0a0ba7e93f4f

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-35922 (Medium) detected in mio-0.6.23.crate

CVE-2020-35922 - Medium Severity Vulnerability

Vulnerable Library - mio-0.6.23.crate

Lightweight non-blocking IO

Library home page: https://crates.io/api/v1/crates/mio/0.6.23/download

Dependency Hierarchy:

• rocket_contrib-0.4.7.crate (Root Library)
  • notify-4.0.16.crate
    • mio-extras-2.0.6.crate
      • ❌ mio-0.6.23.crate (Vulnerable Library)

Found in HEAD commit: 3647288a2edd1c830ab127bf57ab0a0ba7e93f4f

Found in base branch: main

Vulnerability Details

An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.

Publish Date: 2020-12-31

URL: CVE-2020-35922

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2020-0081.html

Release Date: 2020-12-31

Fix Resolution: 0.7.6

---

Step up your Open Source Security Game with WhiteSource here

WS-2021-0154 (Medium) detected in glob-parent-2.0.0.tgz

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: rfid_transaction/frontend/package.json

Path to vulnerable library: rfid_transaction/frontend/node_modules/glob-base/node_modules/glob-parent/package.json

Dependency Hierarchy:

• tailwindcss-2.1.4.tgz (Root Library)
  • parse-glob-3.0.4.tgz
    • glob-base-0.3.0.tgz
      • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2

---

Step up your Open Source Security Game with WhiteSource here