nexmo / nexmo-nodered Goto Github PK

View Code? Open in Web Editor NEW

5.0 19.0 6.0 5.82 MB

Node Red Nodes for The Nexmo APIs

License: MIT License

HTML 60.31% JavaScript 39.69%

sms voice messaging node-red phone-verification

nexmo-nodered's Introduction

node-red-contrib-nexmo (beta)

Node-RED nodes for Nexmo APIs

Features

Voice API - Make and receive calls, use text to speech, recording, and DTMF input, forward calls to other destinations
SMS - Send and receive SMS globally
Verify - Verify a phone number with SMS and voice fallback
Number Insight - Get details and formatting of phone numbers

Account Setup

The first time you use a node you will need to create Nexmo authentication parameters. The SMS, Insight and Verify Nodes simply use your Nexmo API key and secret.

The voice API uses a concept of Applications that are authenticated with JWTs generated by a private key. This is a little more complex to setup but we've tried to make it as easy as possible in node-red.

Getting Started

In order to use the Nexmo Node-RED package you'll need to sign-up for a Nexmo account.

Once signed up, grab your API credentials (API key and secret) from the dashboard getting started page.

This video will then walk you through getting started with the Nexmo Node-RED package.

nexmo-nodered's People

Contributors

Stargazers

Watchers

Forkers

erkatta adamgoose klapperkopp juliacodez sammachin sithiks

nexmo-nodered's Issues

Update nodes to Node-RED v1's new `input` event callback

The syntax for listening to an incoming message and sending a message is changing in Node-RED v1.
The post about this from the official Node-RED blog explains why it's changing, what's the new syntax, and how to maintain backward compatibility:
https://nodered.org/blog/2019/09/20/node-done

Thanks.

Update to Applications V2

Add option to set the vbc capability
Investigate rtc capabilities

Review Verify options

Mustache Templates don't respect arrays

If you try and use a value from within an array within a template it returns empty eg {{msg.payload.data[1]}}

Sample flow for testing:

[{"id":"cc47d83a.989508","type":"tab","label":"Flow 2","disabled":false,"info":""},{"id":"9a0c5904.44feb8","type":"inject","z":"cc47d83a.989508","name":"","topic":"","payload":"{\"data\":[\"a\",\"b\",\"c\"]}","payloadType":"json","repeat":"","crontab":"","once":false,"onceDelay":0.1,"x":376,"y":188,"wires":[["3157bc33.e9e0a4","46cbeda8.8d54fc"]]},{"id":"3157bc33.e9e0a4","type":"stream","z":"cc47d83a.989508","streamurl":"{{msg.payload.data[1]}}","bargein":false,"loop":"","level":"","x":656,"y":156,"wires":[["3de5705e.1be04"]]},{"id":"3de5705e.1be04","type":"debug","z":"cc47d83a.989508","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"ncco","targetType":"msg","x":891,"y":203,"wires":[]},{"id":"46cbeda8.8d54fc","type":"talk","z":"cc47d83a.989508","text":"{{msg.payload.data[1]}}","voicename":"","bargein":false,"loop":"","level":"","x":654,"y":236,"wires":[["3de5705e.1be04"]]}]

Help files review

Initial look through:

https://github.com/Nexmo/nexmo-nodered/blob/master/README.md

Is any installation required?
Are there any other prerequisites?
Should “voice API” be Voice API?
Should the “Account setup” section actually be called “Application setup”?
After “Account setup” what is the next step?
In the video you actually use answer URL for both Answer and Event. Event URL should probably be different.

https://github.com/Nexmo/nexmo-nodered/blob/master/auth.html

Line 63 typo “Creates a new Nexmo Voice Applicaiton”
Sometimes API is upper and sometimes lower case. Should generally be API for consistency.

https://github.com/Nexmo/nexmo-nodered/blob/master/insight.html

Consistency. For example “nexmo api” should probably be Nexmo API.
Line 68 use 'apos' entity to avoid GitHub marking text as error.

https://github.com/Nexmo/nexmo-nodered/blob/master/ncco.html

Placeholder typo “Kimblerly” probably should be Kimberley?
“By default, the talk action is synchronous.” - which means what?
“a synthesized speech message to a Conversation or Call” - do we explain the difference anywhere?
“you will need to use the full url including the hostname here of your webhook here.” could probably be worded better.
“Conferance” -> “Conference” spelling, check throughout.

https://github.com/Nexmo/nexmo-nodered/blob/master/sms_rest.html

nexmo api -> Nexmo API
“Set the Unicode flag if the message text contains unicode parameters” Use consistent case for Unicode.

https://github.com/Nexmo/nexmo-nodered/blob/master/vapi_rest.html

“nexmo api” -> Nexmo API
The Details section for Hangup include a description for Earmuff a call - probably copy and paste error.
Ditto Transfer a call
<script type="text/x-red" data-help-name="createcall"><p>Transfer a Call to a new NCCO</p> - Description should be Create a call not transfer a call.
<p>PLay audio into a call</p> Typo on play.
<p>PLay text to speech into a call</p> - ditto.
<p>PLay DTMF into a call</p> - ditto

https://github.com/Nexmo/nexmo-nodered/blob/master/verify.html

nexmo api -> Nexmo API

https://github.com/Nexmo/nexmo-nodered/blob/master/webhooks.html

TODO Add Help Here

Configuration a bit confusing

First time looking at this screen, I was a bit confused what goes into the fields:

Would be nice to have recipient name and number closer imho, also maybe rename to "Sender #", "Recipient #"?

"Configuration" drops to second line with the icon:

nexmo-2.6.0.tgz: 6 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - nexmo-2.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (nexmo version)	Remediation Possible**
CVE-2023-26136	Critical	9.8	Not Defined	0.1%	tough-cookie-2.5.0.tgz	Transitive	N/A*	❌
CVE-2022-23539	High	8.1	Not Defined	0.1%	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌
CVE-2022-23540	High	7.6	Not Defined	0.1%	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌
CVE-2022-25883	High	7.5	Not Defined	0.1%	semver-5.7.1.tgz	Transitive	N/A*	❌
CVE-2022-23541	Medium	6.3	Not Defined	0.1%	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌
CVE-2023-28155	Medium	6.1	Not Defined	0.1%	request-2.88.2.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-26136

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Dependency Hierarchy:

nexmo-2.6.0.tgz (Root Library)
- request-2.88.2.tgz
  - ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution: tough-cookie - 4.1.3

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

nexmo-2.6.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

nexmo-2.6.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.6)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Dependency Hierarchy:

nexmo-2.6.0.tgz (Root Library)
- jsonwebtoken-8.5.1.tgz
  - ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

nexmo-2.6.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2023-28155

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy:

nexmo-2.6.0.tgz (Root Library)
- ❌ request-2.88.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0

add custom user agent header

https://github.com/Nexmo/nexmo-node#constructor

move all templates to msg

change the base object for template to msg not msg.payload

Voice webhook should handle GET and POST options together

If you are adding custom params to the querystring of the webhook, for example with an input you need to add the from number but you set the method to POST the current node only looks at the body.

Values in the query string should also be added to the msg output of the node

Highlight which fields support templated input

either in the UI form or in the Node Help screen

make other params availible to templates

Currently the template takes the msg object but it should be able to read all params such as global and flow too

Find a method of iterating over a list of addresses for multiple sms

Enhance support for Endpoints

Right now in the connect and createCall nodes we only support basic functionality for endpoints eg type and address.

Expand this to support:
Select Media Format on Websockets (currently hard coded to 16Khz)
Allow metadata/headers on websockets, with templating

dtmfAnswer for number endpoints with templating
onAnswer for number endpoints with tempating

Make the address label clearer depending on which endpoint type is selected

body-parser-1.18.3.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - body-parser-1.18.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (body-parser version)	Remediation Possible**	Reachability
CVE-2022-24999	High	7.5	Not Defined	0.9%	qs-6.5.2.tgz	Transitive	1.19.0	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

body-parser-1.18.3.tgz (Root Library)
- ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.9%

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (body-parser): 1.19.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

account credentials should be credentials objects

This means they won't be exported with a flow and will be secured in node-red

Make from number a dropdown

IN the create call and connect nodes there is a requirement for a from number to use as the CLI, if this is missed it can cause calls to be rejected, we should make this a dropdown to offer any of the numbers on the linked account

Add a node to `update application`

Using this method https://developer.nexmo.com/api/application#update-an-application
create a node that can update properties of the applicaiton such as the callback URLs

This could then be wired to the output of the ngrok node (https://www.npmjs.com/package/node-red-contrib-ngrok) to auto update the webhooks for an applicaiton

Websocket Headers on Connect Node

Update the field to use the JSON editor/validator

Talk description in Stream node

Stream node info under Details refers to the Talk action:
The talk action sends synthesized speech to a Conversation. The text provided in the talk action can either be plain, or formatted using SSML. SSML tags provide further instructions to the text-to-speech synthesiser which allow you to set pitch, pronunciation and to combine together text in multiple languages. SSML tags are XML-based and sent inline in the JSON string.

Can't make call

Hello,
here is my setup:

created an APP (voice permissions)

In Node-RED:

[Inject]
[Talk]

Text: some text
Voice name: Joey
[Create Call]
endpoint: phone
Number: 38***
From: 38***
Answer: msg.ncco

[Talk] outputs the JSON object
[Create Call] doesn't output anything

In the Noed-RED logs I can see I get an 500 error in response

After Installing Nexmo node-red module. Flows fail to deploy

![Uploading Screen Shot 2019-02-11 at 2.06.36 PM.png…](I am unable to deploy my flow after installing and deleting the flow associated with the Nexmo Voice App component. )

Allow Mustache Syntax in Voice fields

I like to specify my application-level configuration by injecting into a change node once on start that sets variables on the flow. This way, I can utilize the mustache syntax feature for specifying things like answer and webhook urls like so: {{{ flow.baseUrl }}}/some-endpoint.

Seeing as our application contains many "Talk" and "Play TTS" nodes, I'd like to specify the voice once. I currently cannot because the "voice" field doesn't allow for the mustache syntax.

I'll try to submit a PR tomorrow.

Add tests

For this to be considered an official GA product we should have test coverage.

Add inline NCCO to transfer

Same as createCall node

Add validation for alphanumeric sender ID

11 chars max

Error installing module in IBM's bluemix node-RED

As seen on the image above, the installation of the module fails on IBM's bluemix node-red. No descriptive message is shown in the console.

To reproduce click on the hamburguer menu in the top right corner, click on "Manage Palette". On the "Install" tab search for the nexmo module and just click "install"

Descriptions and Node Help

Each node needs to be filled in with help text and descriptions to help the users out.

Add REST Recording Nodes

Readme overview

Details on how to use the nodes and other general documentation in a readme.

Consider Using Docker Compose for Testing/Development

This is only an idea, so feel free to close this issue right away. After reading your testing.md file, I realized that you're doing the same thing I am with docker-compose. The added benefit of using docker-compose is that the docker commands can be easily shared via a docker-compose.yml file, and you can easily mount your local dev copy into the container. This allows you to both test and develop the nodes at the same time from your host.

version: '3'
services:
  nodered:
    image: nodered/node-red-docker:0.19.5-v8
    ports:
    - 1880:1880
    volumes:
    - .:/local # Your local working copy
    - ./data:/data # Persist configuration between sessions

The following commands accompany this setup:

docker-compose up -d - Bring up the dev environment
docker-compose exec nodered sh -c "cd /data && npm i /local" - Install your local working copy as nodes
docker-compose restart - Restart NodeRED (after npm i and any source code changes)
docker-compose exec nodered bash - Get a shell into the container

/data should probably be added to .gitignore, since its just your local NodeRED installation.

Edit: Corrected "install local copy" command.

Move nodes (HTML + JS) into sub directory

There doesn't seem to be a naming convention for what the subdirectory should be called (I've seen red, nodes, and src used) but moving the .html and .js files into a subdirectory would clean up the repo.

Update: the main Node RED repo uses nodes.

Remove node_modules folder

Create a package.json file with requirements, and add node_modules to .gitignore

Support for Verify Workflows

Need to add the workflow_id param to a send verify node

transfer and hangup nodes have "Earmuff a call leg" as details

NCCO action doesn't trigger create call

check if NCCO actions eg conversation emit a message.payload and if that can trigger a createCall node.

add NCCO Notify

https://developer.nexmo.com/voice/voice-api/ncco-reference#notify

Using new line in the textbox of the editor

Unable to create new application

Unable to create a new application in node-red. providing valid API Key and Secret. after pressing Create new Application button nothing happens.

Turns out you need to run it with Admin elevation and not through Task Scheduler.

Add .DS_Store to .gitignore

Remove 3rd party (lambda) service from app creation flow

Before publishing 3.0 this should be removed so the app creation commands go direct to the nexmo API, this means fixing the CORS issue

Add ringback to connect

Add the new ringback parameter and also ringback tone to OnAnswer

Version in User agent

Make the user-agent version auto populate from the package.json as I keep forgetting to update that when I bump the version in a release!

canHear and canSpeak missing from Conversation node

Need to add the selective audio controls to the conversation block,

https://www.nexmo.com/blog/2018/12/13/call-whisper-with-selective-audio-controls-dr/

https://developer.nexmo.com/voice/voice-api/ncco-reference#conversation

Update Node Help description for createcall node

Currently says "Transfer a Call to a new NCCO"

Add file param to getrecording

accept a file path in the getrecording module with mustache,

set this as msg.filename

Installation/update docs

Would be nice to have docs on installing/updating the module in Node-red.
(I can't find a way to add latest 3.0 version)

multer-1.3.1.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - multer-1.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (multer version)	Remediation Possible**	Reachability
CVE-2022-24434	High	7.5	Not Defined	0.2%	dicer-0.2.5.tgz	Transitive	N/A*	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24434

Vulnerable Library - dicer-0.2.5.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

multer-1.3.1.tgz (Root Library)
- busboy-0.2.14.tgz
  - ❌ dicer-0.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9

Found in base branch: main

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

nexmo / nexmo-nodered Goto Github PK

nexmo-nodered's Introduction

node-red-contrib-nexmo (beta)

Features

Account Setup

Getting Started

nexmo-nodered's People

Contributors

Stargazers

Watchers

Forkers

nexmo-nodered's Issues

Vulnerabilities

Details

Vulnerable Library - tough-cookie-2.5.0.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (8.1)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.6)

Suggested Fix

Vulnerable Library - semver-5.7.1.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (6.3)

Suggested Fix

Vulnerable Library - request-2.88.2.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (6.1)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - qs-6.5.2.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - dicer-0.2.5.tgz

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Recommend Projects

Recommend Topics

Recommend Org