Vulnerabilities

DepShield reports that this application's usage of lodash.once:4.1.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.once:4.1.1 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.once:4.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.isboolean:3.0.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.isboolean:3.0.3 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.isboolean:3.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.merge:4.6.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.merge:4.6.1 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ @google-cloud/firestore:1.1.0
              └─ lodash.merge:4.6.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.isplainobject:4.0.6 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.isplainobject:4.0.6 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.isplainobject:4.0.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Describe the bug

Unable to create firebase instances with a specific ID.

A clear and concise description of what the bug is.
Loopback v4 doesn't seem to have to 'replaceOrCrate' CRUD method anymore. The related function in loopback-connector-realtime-database is never called

Vulnerabilities

DepShield reports that this application's usage of lodash.isstring:4.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.isstring:4.0.1 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.isstring:4.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

WS-2019-0032 - Medium Severity Vulnerability

Vulnerable Library - js-yaml-3.12.0.tgz

YAML 1.2 parser and serializer

path: /tmp/git/loopback-connector-realtime-database/node_modules/mocha/node_modules/js-yaml/package.json

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz

Dependency Hierarchy:

• mocha-6.0.2.tgz (Root Library)
  • ❌ js-yaml-3.12.0.tgz (Vulnerable Library)

Found in HEAD commit: c03190cfe3fa19e9ac5709de28b5ebd48cd504d4

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-26

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-26

Fix Resolution: 3.13.0

Step up your Open Source Security Game with WhiteSource here

Vulnerabilities

DepShield reports that this application's usage of lodash.clone:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.clone:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ @google-cloud/firestore:1.1.0
              └─ google-gax:0.25.4
                    └─ grpc:1.19.0
                          └─ lodash.clone:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Describe the bug

Do not know if is a feature request or a bug, but queries with filters like where: { and: [ { item: 'somestring' }, { deleted: false } ] } do not works.

error Error: Query: First argument passed to startAt(), endAt(), or equalTo() cannot be an object.
    at Function.Query.validateQueryEndpoints_ (C:\myproject\node_modules\@firebase\database\src\api\Query.ts:138:15)
    at Query.startAt (C:\myproject\node_modules\@firebase\database\src\api\Query.ts:509:11)
    at Query.equalTo (C:\myproject\node_modules\@firebase\database\src\api\Query.ts:574:17)
    at RealtimeDatabase.queryData (C:\myproject\node_modules\loopback-connector-realtime-database\lib\realtime-database.js:81:10)
    at RealtimeDatabase.all (C:\myproject\node_modules\loopback-connector-realtime-database\lib\realtime-database.js:57:33)
    at invokeConnectorMethod (C:\myproject\node_modules\loopback-datasource-juggler\lib\dao.js:172:21)
    at C:\myproject\node_modules\loopback-datasource-juggler\lib\dao.js:1730:7
    at doNotify (C:\myproject\node_modules\loopback-datasource-juggler\lib\observer.js:157:49)
    at doNotify (C:\myproject\node_modules\loopback-datasource-juggler\lib\observer.js:157:49)
    at Function.ObserverMixin._notifyBaseObservers (C:\myproject\node_modules\loopback-datasource-juggler\lib\observer.js:180:5)
    at Function.ObserverMixin.notifyObserversOf (C:\myproject\node_modules\loopback-datasource-juggler\lib\observer.js:155:8)
    at Function.ObserverMixin._notifyBaseObservers (C:\myproject\node_modules\loopback-datasource-juggler\lib\observer.js:178:15)
    at Function.ObserverMixin.notifyObserversOf (C:\myproject\node_modules\loopback-datasource-juggler\lib\observer.js:155:8)
    at Function.find (C:\myproject\node_modules\loopback-datasource-juggler\lib\dao.js:1728:10)
    at Function.findOne (C:\myproject\node_modules\loopback-datasource-juggler\lib\dao.js:1775:8)
    at UserRepository.findOne (C:\myproject\node_modules\@loopback\repository\src\repositories\legacy-juggler-bridge.ts:405:23)
    at UserController.register (C:\myproject\src\controllers\user.controller.ts:236:53)

Vulnerabilities

DepShield reports that this application's usage of lodash.isinteger:4.0.4 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.isinteger:4.0.4 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.isinteger:4.0.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

1. I create collection
2. I run the GET (to return all collections), and it returns:

[
  {
    "id": "-LwU90TtYEcnFCmworbQ",
    "cnpj": "saease",
    "name": "esaes",
    "qty_spots": 1
  },
  {
    "id": "-LwUAxrOD3p3jOOEuU2d",
    "cnpj": "esasea",
    "name": "esaesa",
    "qty_spots": 1
  },
  {
    "id": "-LwUG_rxD2UX0B1snn81",
    "cnpj": "test",
    "name": "xjxjx",
    "qty_spots": 2
  }
]

3. I run the endpoint GET /{id}:
   curl -X GET "http://localhost:3000/testing/-LwUG_rxD2UX0B1snn81" -H "accept: application/json"

4. And is not possible to find the entity: "ENTITY_NOT_FOUND"

What can I do to fix that?

Vulnerabilities

DepShield reports that this application's usage of lodash.isnumber:3.0.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.isnumber:3.0.3 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.isnumber:3.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.includes:4.3.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.includes:4.3.0 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ jsonwebtoken:8.1.0
              └─ lodash.includes:4.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.camelcase:4.3.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.camelcase:4.3.0 is a transitive dependency introduced by the following direct dependency(s):

• firebase-admin:7.1.0
        └─ @google-cloud/firestore:1.1.0
              └─ google-gax:0.25.4
                    └─ @grpc/proto-loader:0.4.0
                          └─ lodash.camelcase:4.3.0
                    └─ grpc:1.19.0
                          └─ lodash.camelcase:4.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}