New vulns #2 #10

PavelLinearB · 2023-06-06T10:34:44Z

Description

A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.

Resolved or fixed issue:

Affirmation

My code follows the CONTRIBUTING.md guidelines

jit-ci

❌ Jit has detected 10 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

jit-ci · 2023-06-06T10:36:40Z

package.json

    "express-rate-limit": "^5.3.0",
    "express-robots-txt": "^0.4.1",
    "express-security.txt": "^2.0.0",
    "feature-policy": "^0.5.0",
    "file-stream-rotator": "^0.5.7",
    "file-type": "^16.1.0",
    "filesniffer": "^1.0.3",
+    "finale-rest": "^1.1.1",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service (Redos) In Lodash

Description: finale-rest>lodash

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:40Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service

Description: download>got>cacheable-request>http-cache-semantics

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:40Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage

Description: express-jwt>jsonwebtoken

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:40Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Authorization Bypass In Express-Jwt

Description: express-jwt

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:40Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Forgeable Public/Private Tokens In Jws

Description: express-jwt>jsonwebtoken>jws

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:40Z

package.json

    "express-rate-limit": "^5.3.0",
    "express-robots-txt": "^0.4.1",
    "express-security.txt": "^2.0.0",
    "feature-policy": "^0.5.0",
    "file-stream-rotator": "^0.5.7",
    "file-type": "^16.1.0",
    "filesniffer": "^1.0.3",
+    "finale-rest": "^1.1.1",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service In Moment

Description: finale-rest>moment

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:41Z

routes/updateProductReviews.ts

+      { _id: req.body.id }, // vuln-code-snippet vuln-line noSqlReviewsChallenge forgedReviewChallenge
+      { $set: { message: req.body.message } },
+      { multi: true } // vuln-code-snippet vuln-line noSqlReviewsChallenge
+    ).then(


Security control: Static Code Analysis Js

Type: Codsec.Javascriptnosql-Injection.Nosql-Injection

Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:41Z

lib/insecurity.ts

@@ -20,6 +20,7 @@ import * as utils from './utils'
 import * as z85 from 'z85'

 export const publicKey = fs ? fs.readFileSync('encryptionkeys/jwt.pub', 'utf8') : 'placeholder-public-key'
+const privateKey = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----'


Security control: Secret Detection

Type: Private-Key

Description: Private Key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:41Z

data/static/users.yml

@@ -147,6 +147,8 @@
  email: wurstbrot
  username: wurstbrot
  password: 'EinBelegtesBrotMitSchinkenSCHINKEN!'
+  totpSecret: IFTXE3SPOEYVURT2MRYGI52TKJ4HC3KH
+  key: timo


Security control: Secret Detection

Type: Generic-Api-Key

Description: Generic API Key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:36:41Z

test/smoke/Dockerfile

@@ -1,3 +1,4 @@
+FROM alpine


Security control: Docker Scan

Type: Image User Should Not Be 'Root'

Description: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: docker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:

If a non-root user already exists in your container, consider using it.

If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.

Suggested change

FROM alpine

FROM alpine

RUN addgroup --system <group>

RUN adduser --system <user> --ingroup <group>

USER <user>:<group>

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci

❌ Jit has detected 13 important findings in this PR that you should review.
The findings are detailed as separate comments.
It’s highly recommended that you fix these security issues before merge.

Until now, you ignored/fixed 10 findings.

jit-ci · 2023-06-06T10:54:20Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service

Description: download>got>cacheable-request>http-cache-semantics

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:20Z

package.json

    "express-rate-limit": "^5.3.0",
    "express-robots-txt": "^0.4.1",
    "express-security.txt": "^2.0.0",
    "feature-policy": "^0.5.0",
    "file-stream-rotator": "^0.5.7",
    "file-type": "^16.1.0",
    "filesniffer": "^1.0.3",
+    "finale-rest": "^1.1.1",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service In Moment

Description: finale-rest>moment

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:20Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Got Allows A Redirect To A Unix Socket

Description: download>got

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:20Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage

Description: express-jwt>jsonwebtoken

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:20Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Authorization Bypass In Express-Jwt

Description: express-jwt

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:21Z

lib/insecurity.ts

@@ -20,6 +20,7 @@ import * as utils from './utils'
 import * as z85 from 'z85'

 export const publicKey = fs ? fs.readFileSync('encryptionkeys/jwt.pub', 'utf8') : 'placeholder-public-key'
+const privateKey = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----'


Security control: Secret Detection

Type: Private-Key

Description: Private Key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:21Z

data/static/users.yml

@@ -147,6 +147,8 @@
  email: wurstbrot
  username: wurstbrot
  password: 'EinBelegtesBrotMitSchinkenSCHINKEN!'
+  totpSecret: IFTXE3SPOEYVURT2MRYGI52TKJ4HC3KH
+  key: timo


Security control: Secret Detection

Type: Generic-Api-Key

Description: Generic API Key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:21Z

routes/updateProductReviews.ts

+      { _id: req.body.id }, // vuln-code-snippet vuln-line noSqlReviewsChallenge forgedReviewChallenge
+      { $set: { message: req.body.message } },
+      { multi: true } // vuln-code-snippet vuln-line noSqlReviewsChallenge
+    ).then(


Security control: Static Code Analysis Js

Type: Codsec.Javascriptnosql-Injection.Nosql-Injection

Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:22Z

routes/likeProductReviews.ts

@@ -15,7 +15,7 @@ module.exports = function productReviews () {
  return (req: Request, res: Response, next: NextFunction) => {
    const id = req.body.id
    const user = security.authenticatedUsers.from(req)
-    db.reviews.findOne({ _id: "a" }).then((review: Review) => {
+    db.reviews.findOne({ _id: id }).then((review: Review) => {


Security control: Static Code Analysis Js

Type: Codsec.Javascriptnosql-Injection.Nosql-Injection

Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T10:54:22Z

test/smoke/Dockerfile

@@ -1,3 +1,4 @@
+FROM alpine


Security control: Docker Scan

Type: Image User Should Not Be 'Root'

Description: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: docker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:

If a non-root user already exists in your container, consider using it.

If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.

Suggested change

FROM alpine

FROM alpine

RUN addgroup --system <group>

RUN adduser --system <user> --ingroup <group>

USER <user>:<group>

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md

jit-ci

❌ Jit has detected 5 important findings in this PR that you should review.
The findings are detailed as separate comments.
It’s highly recommended that you fix these security issues before merge.

Until now, you ignored/fixed 18 findings.

jit-ci

❌ Jit has detected 8 important findings in this PR that you should review.
The findings are detailed as separate comments.
It’s highly recommended that you fix these security issues before merge.

Until now, you ignored/fixed 23 findings.

jit-ci · 2023-06-06T11:29:03Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service

Description: download>got>cacheable-request>http-cache-semantics

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:03Z

package.json

    "express-rate-limit": "^5.3.0",
    "express-robots-txt": "^0.4.1",
    "express-security.txt": "^2.0.0",
    "feature-policy": "^0.5.0",
    "file-stream-rotator": "^0.5.7",
    "file-type": "^16.1.0",
    "filesniffer": "^1.0.3",
+    "finale-rest": "^1.1.1",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service In Moment

Description: finale-rest>moment

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:03Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Got Allows A Redirect To A Unix Socket

Description: download>got

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:03Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage

Description: express-jwt>jsonwebtoken

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:03Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Authorization Bypass In Express-Jwt

Description: express-jwt

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:04Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service In Moment

Description: express-jwt>jsonwebtoken>moment

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:04Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Forgeable Public/Private Tokens In Jws

Description: express-jwt>jsonwebtoken>jws

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-06-06T11:29:04Z

package.json

    "express-rate-limit": "^5.3.0",
    "express-robots-txt": "^0.4.1",
    "express-security.txt": "^2.0.0",
    "feature-policy": "^0.5.0",
    "file-stream-rotator": "^0.5.7",
    "file-type": "^16.1.0",
    "filesniffer": "^1.0.3",
+    "finale-rest": "^1.1.1",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service (Redos) In Lodash

Description: finale-rest>lodash

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

sonarcloud · 2023-06-06T11:29:39Z

Please retry analysis of this Pull-Request directly on SonarCloud.

jit-ci bot reviewed Jun 6, 2023

View reviewed changes

vulnerabilities

95169dc

PavelLinearB force-pushed the new-vulns-#2 branch from 7b0161a to 0e68d16 Compare June 6, 2023 10:51

jit-ci bot reviewed Jun 6, 2023

View reviewed changes

PavelLinearB force-pushed the new-vulns-#2 branch from 4d9c8e2 to 327b2b8 Compare June 6, 2023 11:21

PavelLinearB added 2 commits June 6, 2023 14:23

Update README.md

04efc67

Update README.md

169dd50

jit-ci bot reviewed Jun 6, 2023

View reviewed changes

PavelLinearB closed this Sep 22, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New vulns #2 #10

New vulns #2 #10

PavelLinearB commented Jun 6, 2023

jit-ci bot left a comment

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot left a comment

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot left a comment

jit-ci bot left a comment

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

jit-ci bot Jun 6, 2023

sonarcloud bot commented Jun 6, 2023

-FROM alpine
+FROM alpine
+RUN addgroup --system <group>
+RUN adduser --system <user> --ingroup <group>
+USER <user>:<group>

New vulns #2 #10

New vulns #2 #10

Conversation

PavelLinearB commented Jun 6, 2023

Description

Affirmation

jit-ci bot left a comment

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot left a comment

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot left a comment

Choose a reason for hiding this comment

jit-ci bot left a comment

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

jit-ci bot Jun 6, 2023

Choose a reason for hiding this comment

sonarcloud bot commented Jun 6, 2023