nexmo / nexmo-nodered Goto Github PK
View Code? Open in Web Editor NEWNode Red Nodes for The Nexmo APIs
License: MIT License
Node Red Nodes for The Nexmo APIs
License: MIT License
Same as createCall node
Create a package.json
file with requirements, and add node_modules
to .gitignore
Update the field to use the JSON editor/validator
There doesn't seem to be a naming convention for what the subdirectory should be called (I've seen red
, nodes
, and src
used) but moving the .html
and .js
files into a subdirectory would clean up the repo.
Update: the main Node RED repo uses nodes
.
Need to add the selective audio controls to the conversation block,
https://www.nexmo.com/blog/2018/12/13/call-whisper-with-selective-audio-controls-dr/
https://developer.nexmo.com/voice/voice-api/ncco-reference#conversation
Unable to create a new application in node-red. providing valid API Key and Secret. after pressing Create new Application button nothing happens.
Turns out you need to run it with Admin elevation and not through Task Scheduler.
Initial look through:
https://github.com/Nexmo/nexmo-nodered/blob/master/README.md
Is any installation required?
Are there any other prerequisites?
Should “voice API” be Voice API?
Should the “Account setup” section actually be called “Application setup”?
After “Account setup” what is the next step?
In the video you actually use answer URL for both Answer and Event. Event URL should probably be different.
https://github.com/Nexmo/nexmo-nodered/blob/master/auth.html
Line 63 typo “Creates a new Nexmo Voice Applicaiton”
Sometimes API is upper and sometimes lower case. Should generally be API for consistency.
https://github.com/Nexmo/nexmo-nodered/blob/master/insight.html
Consistency. For example “nexmo api” should probably be Nexmo API.
Line 68 use 'apos' entity to avoid GitHub marking text as error.
https://github.com/Nexmo/nexmo-nodered/blob/master/ncco.html
Placeholder typo “Kimblerly” probably should be Kimberley?
“By default, the talk action is synchronous.” - which means what?
“a synthesized speech message to a Conversation or Call” - do we explain the difference anywhere?
“you will need to use the full url including the hostname here of your webhook here.” could probably be worded better.
“Conferance” -> “Conference” spelling, check throughout.
https://github.com/Nexmo/nexmo-nodered/blob/master/sms_rest.html
nexmo api -> Nexmo API
“Set the Unicode flag if the message text contains unicode parameters” Use consistent case for Unicode.
https://github.com/Nexmo/nexmo-nodered/blob/master/vapi_rest.html
“nexmo api” -> Nexmo API
The Details section for Hangup include a description for Earmuff a call - probably copy and paste error.
Ditto Transfer a call
<script type="text/x-red" data-help-name="createcall"><p>Transfer a Call to a new NCCO</p> - Description should be Create a call not transfer a call.
<p>PLay audio into a call</p> Typo on play.
<p>PLay text to speech into a call</p> - ditto.
<p>PLay DTMF into a call</p> - ditto
https://github.com/Nexmo/nexmo-nodered/blob/master/verify.html
nexmo api -> Nexmo API
https://github.com/Nexmo/nexmo-nodered/blob/master/webhooks.html
TODO Add Help Here
11 chars max
If you try and use a value from within an array within a template it returns empty eg {{msg.payload.data[1]}}
Sample flow for testing:
[{"id":"cc47d83a.989508","type":"tab","label":"Flow 2","disabled":false,"info":""},{"id":"9a0c5904.44feb8","type":"inject","z":"cc47d83a.989508","name":"","topic":"","payload":"{\"data\":[\"a\",\"b\",\"c\"]}","payloadType":"json","repeat":"","crontab":"","once":false,"onceDelay":0.1,"x":376,"y":188,"wires":[["3157bc33.e9e0a4","46cbeda8.8d54fc"]]},{"id":"3157bc33.e9e0a4","type":"stream","z":"cc47d83a.989508","streamurl":"{{msg.payload.data[1]}}","bargein":false,"loop":"","level":"","x":656,"y":156,"wires":[["3de5705e.1be04"]]},{"id":"3de5705e.1be04","type":"debug","z":"cc47d83a.989508","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"ncco","targetType":"msg","x":891,"y":203,"wires":[]},{"id":"46cbeda8.8d54fc","type":"talk","z":"cc47d83a.989508","text":"{{msg.payload.data[1]}}","voicename":"","bargein":false,"loop":"","level":"","x":654,"y":236,"wires":[["3de5705e.1be04"]]}]
Using this method https://developer.nexmo.com/api/application#update-an-application
create a node that can update properties of the applicaiton such as the callback URLs
This could then be wired to the output of the ngrok node (https://www.npmjs.com/package/node-red-contrib-ngrok) to auto update the webhooks for an applicaiton
IN the create call and connect nodes there is a requirement for a from
number to use as the CLI, if this is missed it can cause calls to be rejected, we should make this a dropdown to offer any of the numbers on the linked account
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dicer/package.json
Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9
CVE | Severity | CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (multer version) | Remediation Possible** | Reachability |
---|---|---|---|---|---|---|---|---|---|
CVE-2022-24434 | High | 7.5 | Not Defined | 0.2% | dicer-0.2.5.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
A very fast streaming multipart parser for node.js
Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dicer/package.json
Dependency Hierarchy:
Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9
Found in base branch: main
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
Publish Date: 2022-05-20
URL: CVE-2022-24434
Exploit Maturity: Not Defined
EPSS: 0.2%
Base Score Metrics:
If you are adding custom params to the querystring of the webhook, for example with an input you need to add the from number but you set the method to POST the current node only looks at the body.
Values in the query string should also be added to the msg output of the node
For this to be considered an official GA product we should have test coverage.
This means they won't be exported with a flow and will be secured in node-red
Make the user-agent version auto populate from the package.json as I keep forgetting to update that when I bump the version in a release!
check if NCCO actions eg conversation emit a message.payload and if that can trigger a createCall node.
either in the UI form or in the Node Help screen
Add option to set the vbc capability
Investigate rtc capabilities
Need to add the workflow_id param to a send verify node
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semver/package.json
CVE | Severity | CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (nexmo version) | Remediation Possible** | Reachability |
---|---|---|---|---|---|---|---|---|---|
CVE-2023-26136 | Critical | 9.8 | Not Defined | 0.1% | tough-cookie-2.5.0.tgz | Transitive | N/A* | ❌ | |
CVE-2022-23539 | High | 8.1 | Not Defined | 0.1% | jsonwebtoken-8.5.1.tgz | Transitive | N/A* | ❌ | |
CVE-2022-23540 | High | 7.6 | Not Defined | 0.1% | jsonwebtoken-8.5.1.tgz | Transitive | N/A* | ❌ | |
CVE-2022-25883 | High | 7.5 | Not Defined | 0.1% | semver-5.7.1.tgz | Transitive | N/A* | ❌ | |
CVE-2022-23541 | Medium | 6.3 | Not Defined | 0.1% | jsonwebtoken-8.5.1.tgz | Transitive | N/A* | ❌ | |
CVE-2023-28155 | Medium | 6.1 | Not Defined | 0.1% | request-2.88.2.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
RFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/tough-cookie/package.json
Dependency Hierarchy:
Found in base branch: main
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Publish Date: 2023-07-01
URL: CVE-2023-26136
Exploit Maturity: Not Defined
EPSS: 0.1%
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136
Release Date: 2023-07-01
Fix Resolution: tough-cookie - 4.1.3
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in base branch: main
Versions <=8.5.1
of jsonwebtoken
library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes
option to true
in the sign()
and/or verify()
functions.
Publish Date: 2022-12-23
URL: CVE-2022-23539
Exploit Maturity: Not Defined
EPSS: 0.1%
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-8cf7-32gw-wr33
Release Date: 2022-12-23
Fix Resolution: jsonwebtoken - 9.0.0
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in base branch: main
In versions <=8.5.1
of jsonwebtoken
library, lack of algorithm definition in the jwt.verify()
function can lead to signature validation bypass due to defaulting to the none
algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify()
function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify()
method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none
algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify()
options.
Publish Date: 2022-12-22
URL: CVE-2022-23540
Exploit Maturity: Not Defined
EPSS: 0.1%
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540
Release Date: 2022-12-22
Fix Resolution: jsonwebtoken - 9.0.0
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semver/package.json
Dependency Hierarchy:
Found in base branch: main
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Exploit Maturity: Not Defined
EPSS: 0.1%
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in base branch: main
jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1
of jsonwebtoken
library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey
argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
Publish Date: 2022-12-22
URL: CVE-2022-23541
Exploit Maturity: Not Defined
EPSS: 0.1%
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-hjrf-2m68-5959
Release Date: 2022-12-22
Fix Resolution: jsonwebtoken - 9.0.0
Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/request/package.json
Dependency Hierarchy:
Found in base branch: main
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
Exploit Maturity: Not Defined
EPSS: 0.1%
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-p8p7-x288-28g6
Release Date: 2023-03-16
Fix Resolution: @cypress/request - 3.0.0
As seen on the image above, the installation of the module fails on IBM's bluemix node-red. No descriptive message is shown in the console.
To reproduce click on the hamburguer menu in the top right corner, click on "Manage Palette". On the "Install" tab search for the nexmo module and just click "install"
Currently says "Transfer a Call to a new NCCO"
This is only an idea, so feel free to close this issue right away. After reading your testing.md
file, I realized that you're doing the same thing I am with docker-compose. The added benefit of using docker-compose is that the docker commands can be easily shared via a docker-compose.yml
file, and you can easily mount your local dev copy into the container. This allows you to both test and develop the nodes at the same time from your host.
version: '3'
services:
nodered:
image: nodered/node-red-docker:0.19.5-v8
ports:
- 1880:1880
volumes:
- .:/local # Your local working copy
- ./data:/data # Persist configuration between sessions
The following commands accompany this setup:
docker-compose up -d
- Bring up the dev environmentdocker-compose exec nodered sh -c "cd /data && npm i /local"
- Install your local working copy as nodesdocker-compose restart
- Restart NodeRED (after npm i
and any source code changes)docker-compose exec nodered bash
- Get a shell into the container/data
should probably be added to .gitignore
, since its just your local NodeRED installation.
Edit: Corrected "install local copy" command.
Hello,
here is my setup:
In Node-RED:
[Inject]
[Talk]
[Talk] outputs the JSON object
[Create Call] doesn't output anything
In the Noed-RED logs I can see I get an 500
error in response
Currently the template takes the msg
object but it should be able to read all params such as global
and flow
too
I like to specify my application-level configuration by injecting into a change node once on start that sets variables on the flow. This way, I can utilize the mustache syntax feature for specifying things like answer and webhook urls like so: {{{ flow.baseUrl }}}/some-endpoint
.
Seeing as our application contains many "Talk" and "Play TTS" nodes, I'd like to specify the voice once. I currently cannot because the "voice" field doesn't allow for the mustache syntax.
I'll try to submit a PR tomorrow.
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/qs/package.json
Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9
CVE | Severity | CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (body-parser version) | Remediation Possible** | Reachability |
---|---|---|---|---|---|---|---|---|---|
CVE-2022-24999 | High | 7.5 | Not Defined | 0.9% | qs-6.5.2.tgz | Transitive | 1.19.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/qs/package.json
Dependency Hierarchy:
Found in HEAD commit: 95a39d35b389e007dd39f96758c98b6aeef3fec9
Found in base branch: main
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
Publish Date: 2022-11-26
URL: CVE-2022-24999
Exploit Maturity: Not Defined
EPSS: 0.9%
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999
Release Date: 2022-11-26
Fix Resolution (qs): 6.5.3
Direct dependency fix Resolution (body-parser): 1.19.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The syntax for listening to an incoming message and sending a message is changing in Node-RED v1.
The post about this from the official Node-RED blog explains why it's changing, what's the new syntax, and how to maintain backward compatibility:
https://nodered.org/blog/2019/09/20/node-done
Thanks.
Each node needs to be filled in with help text and descriptions to help the users out.
change the base object for template to msg not msg.payload
Add the new ringback parameter and also ringback tone to OnAnswer
Would be nice to have docs on installing/updating the module in Node-red.
(I can't find a way to add latest 3.0 version)
Stream node info under Details refers to the Talk action:
The talk action sends synthesized speech to a Conversation. The text provided in the talk action can either be plain, or formatted using SSML. SSML tags provide further instructions to the text-to-speech synthesiser which allow you to set pitch, pronunciation and to combine together text in multiple languages. SSML tags are XML-based and sent inline in the JSON string.
accept a file path in the getrecording module with mustache,
set this as msg.filename
Details on how to use the nodes and other general documentation in a readme.
Right now in the connect and createCall nodes we only support basic functionality for endpoints eg type and address.
Expand this to support:
Select Media Format on Websockets (currently hard coded to 16Khz)
Allow metadata/headers on websockets, with templating
dtmfAnswer for number endpoints with templating
onAnswer for number endpoints with tempating
Make the address label clearer depending on which endpoint type is selected
Before publishing 3.0 this should be removed so the app creation commands go direct to the nexmo API, this means fixing the CORS issue
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.