$ npm install
typeorm migration:create -n componentName
# development
$ npm run start
# watch mode
$ npm run start:dev
# production mode
$ npm run start:prod
$ npm run lint
Nest is MIT licensed.
HelloMunnar Api
Home Page: https://api.hellomunnar.in
License: MIT License
$ npm install
typeorm migration:create -n componentName
# development
$ npm run start
# watch mode
$ npm run start:dev
# production mode
$ npm run start:prod
$ npm run lint
Nest is MIT licensed.
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: hellomunnar-api/package.json
Path to vulnerable library: hellomunnar-api/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: c5bbe601b714363882a146cb0f556607ef567f9e
Found in base branch: develop
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require('lodash'); function build_blank (n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0) var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1) var time2 = Date.now(); lo.trimEnd(s) var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2)
Publish Date: 2021-02-15
URL: CVE-2020-28500
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
A high performance Redis client.
Library home page: https://registry.npmjs.org/redis/-/redis-3.0.2.tgz
Path to dependency file: hellomunnar-api/package.json
Path to vulnerable library: hellomunnar-api/node_modules/redis/package.json
Dependency Hierarchy:
Found in base branch: develop
Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.
Publish Date: 2021-04-23
URL: CVE-2021-29469
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-35q2-47q7-3pc3
Release Date: 2021-04-23
Fix Resolution: redis - 3.1.1
Step up your Open Source Security Game with WhiteSource here
https://tinypng.com/developers/reference/nodejs
so the workflow should be
user uploads -> tinypng -> downloads -> uploads to s3 -> stores cdn url i-> db.
Easy as cake e-mail sending from your Node.js applications
Library home page: https://registry.npmjs.org/nodemailer/-/nodemailer-6.4.11.tgz
Path to dependency file: hellomunnar-api/package.json
Path to vulnerable library: hellomunnar-api/node_modules/mailparser/node_modules/nodemailer/package.json
Dependency Hierarchy:
Found in HEAD commit: 9615db119bbf2eeadbfeea4303c4f38c80c3793c
Found in base branch: develop
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Publish Date: 2020-11-12
URL: CVE-2020-7769
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7769
Release Date: 2020-11-12
Fix Resolution: v6.4.16
Step up your Open Source Security Game with WhiteSource here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Path to dependency file: hellomunnar-api/node_modules/superagent/docs/tail.html
Path to vulnerable library: hellomunnar-api/node_modules/superagent/docs/tail.html
Dependency Hierarchy:
Found in HEAD commit: 9615db119bbf2eeadbfeea4303c4f38c80c3793c
Found in base branch: develop
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
Base Score Metrics:
Type: Upgrade version
Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
Release Date: 2020-04-29
Fix Resolution: jQuery - 3.5.0
Step up your Open Source Security Game with WhiteSource here
implement role based acccess and auth guards
This API should accept the following parameters:
This API should provide a list of reviews with the following keys:
create-review API requires a type field to sort reviews based on different categories such as Destinations, Activities, or Amenities.
Schema
{ "userId": "asdaly12hbldahbsdl21bekd", "type": "destinations", "Id": "D-047", "title": "Very GOod Experience", "rating": 5, "content": "Very good experience", "status": "pending", "profileImgUrl": "Image Urls as a json : https://cdn.hellomunnar.in/userContent/image.png" }
generate jwt tokens after social login and validate jwt tokens instead of google auth token
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Path to dependency file: hellomunnar-api/node_modules/superagent/docs/tail.html
Path to vulnerable library: hellomunnar-api/node_modules/superagent/docs/tail.html
Dependency Hierarchy:
Found in HEAD commit: 9615db119bbf2eeadbfeea4303c4f38c80c3793c
Found in base branch: develop
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Publish Date: 2019-04-20
URL: CVE-2019-11358
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358
Release Date: 2019-04-20
Fix Resolution: 3.4.0
Step up your Open Source Security Game with WhiteSource here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Path to dependency file: hellomunnar-api/node_modules/superagent/docs/tail.html
Path to vulnerable library: hellomunnar-api/node_modules/superagent/docs/tail.html
Dependency Hierarchy:
Found in HEAD commit: 9615db119bbf2eeadbfeea4303c4f38c80c3793c
Found in base branch: develop
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0
Step up your Open Source Security Game with WhiteSource here
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: hellomunnar-api/package.json
Path to vulnerable library: hellomunnar-api/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: c5bbe601b714363882a146cb0f556607ef567f9e
Found in base branch: develop
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template.
Publish Date: 2021-02-15
URL: CVE-2021-23337
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
Default code-generator for pug. It generates HTML via a JavaScript template function.
Library home page: https://registry.npmjs.org/pug-code-gen/-/pug-code-gen-2.0.2.tgz
Path to dependency file: hellomunnar-api/package.json
Path to vulnerable library: hellomunnar-api/node_modules/pug-code-gen/package.json
Dependency Hierarchy:
A clean, whitespace-sensitive template language for writing HTML
Library home page: https://registry.npmjs.org/pug/-/pug-2.0.4.tgz
Path to dependency file: hellomunnar-api/package.json
Path to vulnerable library: hellomunnar-api/node_modules/pug/package.json
Dependency Hierarchy:
Found in base branch: develop
Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty
option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the pretty
option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.
Publish Date: 2021-03-03
URL: CVE-2021-21353
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-p493-635q-r6gr
Release Date: 2020-12-23
Fix Resolution: pug -3.0.1, pug-code-gen-2.0.3, pug-code-gen-3.0.2
Step up your Open Source Security Game with WhiteSource here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.