Skip to content

feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
achrinza wants to merge 1 commit into
base:main
Choose a base branch
from
Draft

feat: update last 3 advisories #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .vscode/settings.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
"json.schemas": [
{
"fileMatch": [
"advisories/lbsa-*.csaf.json"
"advisories/*/lbsec-*.csaf.json"
],
"url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
},
{
"fileMatch": [
"advisories/lbsa-*.osv.json"
"advisories/*/lbsec-*.osv.json"
],
"url": "./vendors/osv-schema/validation/schema.json"
}
]
],
"yaml.schemas": {
"./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
}
}
9 changes: 2 additions & 7 deletions advisories/README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |
1,028 changes: 1,028 additions & 0 deletions advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json
View file
Open in desktop

Large diffs are not rendered by default.

0 advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license
View file
Open in desktop
File renamed without changes.
167 changes: 167 additions & 0 deletions advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "loopback-connector-mongodb",
"purl": "pkg:npm/loopback-connector-mongodb"
},
"ranges": [
{
"events": [
{
"introduced": ""
},
{
"fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
}
],
"repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.0"
}
],
"type": "SEMVER"
}
],
"versions": [
"1.0.0",
"1.1.0",
"1.1.3",
"1.1.4",
"1.1.5",
"1.1.6",
"1.1.7",
"1.1.8",
"1.2.0",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.3.0",
"1.4.0",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.5.0",
"1.6.0",
"1.7.0",
"1.8.0",
"1.9.0",
"1.9.1",
"1.9.2",
"1.10.0",
"1.10.1",
"1.11.0",
"1.11.1",
"1.11.2",
"1.11.3",
"1.12.0",
"1.13.0",
"1.13.1",
"1.13.2",
"1.13.3",
"1.14.0",
"1.15.0",
"1.15.1",
"1.15.2",
"1.17.0",
"1.18.0",
"1.18.1",
"3.0.0",
"3.0.1",
"3.1.0",
"3.2.0",
"3.2.1",
"3.3.0",
"3.3.1",
"3.4.0",
"3.4.1",
"3.4.2",
"3.4.3",
"3.4.4",
"3.5.0"
]
}
],
"aliases": [
"GHSA-hxwc-5vw9-2w4w",
"GHSA-m734-r4g6-34f9",
"GMS-2019-37",
"GMS-2020-360",
"SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
],
"credits": [
{
"name": "Nelson Brandão",
"urls": ["https://github.com/NelsonBrandao"]
}
],
"database_specific": {
"CWE": "CWE-89"
},
"details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
"id": "LBSEC-20180815-1",
"modified": "1970-01-01T00:00:00.000Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
},
{
"type": "ADVISORY",
"url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
},
{
"type": "ADVISORY",
"url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
},
{
"type": "ADVISORY",
"url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
},
{
"type": "ADVISORY",
"url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
},
{
"type": "PACKAGE",
"url": "https://loopback.io"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/loopback-connector-mongodb"
},
{
"type": "REPORT",
"url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
},
{
"type": "WEB",
"url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
},
{
"type": "WEB",
"url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
}
],
"schema_version": "1.2.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}
0 advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license
View file
Open in desktop
File renamed without changes.
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
feat: update last 3 advisories by achrinza · Pull Request #13 · loopbackio/security · GitHub
Skip to content
feat: update last 3 advisories#13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Draft

achrinza
wants to merge
1
commit into

base:main
Choose a base branch

from

 Draft


feat: update last 3 advisories
#13
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 6 additions & 3 deletions
.vscode/settings.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,15 +5,18 @@
 "json.schemas": [
 {
 "fileMatch": [
 "advisories/lbsa-*.csaf.json"
 "advisories/*/lbsec-*.csaf.json"
 ],
 "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
 },
 {
 "fileMatch": [
 "advisories/lbsa-*.osv.json"
 "advisories/*/lbsec-*.osv.json"
 ],
 "url": "./vendors/osv-schema/validation/schema.json"
 }
 ]
 ],
 "yaml.schemas": {
 "./vendors/local-gemnasium/schema.json": "advisories/*/lbsec-*.gemnasium.yaml"
 }
}

9 changes: 2 additions & 7 deletions
advisories/README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,12 +46,8 @@ CSAF 2.0 document must also be reflected back in the CSAF 2.0 document itself.

## Vendors

This section depends on [Secvisogram](../vendors/README.md#submodules) for
validation, its ports of JSON Schemas from Draft-04 (No first-class AJV support)
to Draft-2019, and for a strict variant of CSAF 2.0 JSON Schema. There are plans
to utilise the other parts of the codebase for more thorough validation.

It also depends on
This section depends on [Secvisogram](../vendors/README.md#submodules) for CSAF
2.0 validation and the
[Open Source Vulnerability schema](../vendors/README.md#submodules) for JSON
Schema-based OSV validation.

Expand All@@ -64,5 +60,4 @@ are future plans to add integration:
| ----------------------------------------------------------------------------------------------------- | ------- |
| Generation of security advisories on [loopback.io website](https://loopback.io/doc/en/sec/index.html) | Planned |
| Publishing as a CSAF Provider through csaf.data.loopback.io | Planned |
| Down-conversion and publication of CVRF 1.2 | Planned |
| Sync with Gitlab Advisory Database | Planned |

1,028 changes: 1,028 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.csaf.json

View file


Open in desktop


Large diffs are not rendered by default.


0
advisories/lbsa-20201130.csaf.json.license → ...0815-1/lbsec-20180815-1.csaf.json.license

View file


Open in desktop


File renamed without changes.


167 changes: 167 additions & 0 deletions
advisories/lbsec-20180815-1/lbsec-20180815-1.osv.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
{
 "affected": [
 {
 "package": {
 "ecosystem": "npm",
 "name": "loopback-connector-mongodb",
 "purl": "pkg:npm/loopback-connector-mongodb"
 },
 "ranges": [
 {
 "events": [
 {
 "introduced": ""
 },
 {
 "fixed": "ee24cd08b8ccc32711264831c71b1da628df357b"
 }
 ],
 "repo": "https://github.com/strongloop/loopback-connector-mongodb.git",
 "type": "GIT"
 },
 {
 "events": [
 {
 "introduced": "0"
 },
 {
 "fixed": "3.6.0"
 }
 ],
 "type": "SEMVER"
 }
 ],
 "versions": [
 "1.0.0",
 "1.1.0",
 "1.1.3",
 "1.1.4",
 "1.1.5",
 "1.1.6",
 "1.1.7",
 "1.1.8",
 "1.2.0",
 "1.2.1",
 "1.2.2",
 "1.2.3",
 "1.2.4",
 "1.2.5",
 "1.2.6",
 "1.3.0",
 "1.4.0",
 "1.4.1",
 "1.4.2",
 "1.4.3",
 "1.4.4",
 "1.4.5",
 "1.5.0",
 "1.6.0",
 "1.7.0",
 "1.8.0",
 "1.9.0",
 "1.9.1",
 "1.9.2",
 "1.10.0",
 "1.10.1",
 "1.11.0",
 "1.11.1",
 "1.11.2",
 "1.11.3",
 "1.12.0",
 "1.13.0",
 "1.13.1",
 "1.13.2",
 "1.13.3",
 "1.14.0",
 "1.15.0",
 "1.15.1",
 "1.15.2",
 "1.17.0",
 "1.18.0",
 "1.18.1",
 "3.0.0",
 "3.0.1",
 "3.1.0",
 "3.2.0",
 "3.2.1",
 "3.3.0",
 "3.3.1",
 "3.4.0",
 "3.4.1",
 "3.4.2",
 "3.4.3",
 "3.4.4",
 "3.5.0"
 ]
 }
 ],
 "aliases": [
 "GHSA-hxwc-5vw9-2w4w",
 "GHSA-m734-r4g6-34f9",
 "GMS-2019-37",
 "GMS-2020-360",
 "SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 ],
 "credits": [
 {
 "name": "Nelson Brandão",
 "urls": ["https://github.com/NelsonBrandao"]
 }
 ],
 "database_specific": {
 "CWE": "CWE-89"
 },
 "details": "MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless [disabled (instructions here)](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js).\n\nAn example malicious query:\n\n```\nGET /POST filter={\"where\": {\"$where\": \"function(){sleep(5000); return this.title.contains('Hello');}\"}}\n```\n\nThe above makes the database sleep for 5 seconds and then returns all \"Posts\" with the title containing the word `Hello`.\n\nThe connector now sanitizes all queries passed to the MongoDB Driver by default and deletes the `$where` and `mapReduce` properties. If you need to use these properties from within LoopBack programatically, you can disable the sanitization by passing in an `options` object with `disableSanitization` property set to `true`:\n\n```js\nPost.find(\n { where: { $where: \"function() { /*dangerous function here*/}\" } },\n { disableSanitization: true },\n (err, p) => {\n // code to handle results / error.\n }\n);\n```",
 "id": "LBSEC-20180815-1",
 "modified": "1970-01-01T00:00:00.000Z",
 "references": [
 {
 "type": "ADVISORY",
 "url": "https://github.com/advisories/GHSA-hxwc-5vw9-2w4w"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/csaf/lbsa-20180815-1.csaf.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/html/lbsa-20180815-1.html"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.loopback.io/en/advisories/osv/lbsa-20180815-1.osv.json"
 },
 {
 "type": "ADVISORY",
 "url": "https://security.snyk.io/vuln/SNYK-JS-LOOPBACKCONNECTORMONGODB-73555"
 },
 {
 "type": "PACKAGE",
 "url": "https://loopback.io"
 },
 {
 "type": "PACKAGE",
 "url": "https://www.npmjs.com/package/loopback-connector-mongodb"
 },
 {
 "type": "REPORT",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/issues/403"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b"
 },
 {
 "type": "WEB",
 "url": "https://github.com/loopbackio/loopback-connector-mongodb/pull/452"
 }
 ],
 "schema_version": "1.2.0",
 "severity": [
 {
 "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
 "type": "CVSS_V3"
 }
 ],
 "summary": "`loopback-connector-mongodb` version 3.5.0 and below allows NoSQL Injections."
}

0
advisories/lbsa-20201130.osv.json.license → ...80815-1/lbsec-20180815-1.osv.json.license

View file


Open in desktop


File renamed without changes.

Loading