opentok / opentok-archive-transcription-demo Goto Github PK

View Code? Open in Web Editor NEW

5.0 25.0 6.0 797 KB

Sample code for transcribing OpenTok video archives to text

Home Page: https://tokbox.com/

License: MIT License

JavaScript 91.09% HTML 7.19% Shell 1.72%

opentok webrtc js opentok-labs aws google-api

opentok-archive-transcription-demo's Introduction

OpenTok Archive Transcript demo

This sample application shows how you can transcribe archives recorded with OpenTok using Google Speech API. It integrates with AWS S3 and Google Speech API. It will work with any OpenTok application that is auto-configured to push to S3.

You can easily deploy this demo to Heroku using the deploy button below. Or, read on if you want to deploy it to anywhere else.

This application includes the server to transcribe the archives, a HTTP JSON API to fetch the transcripts and a web client to access the transcripts.

Workflow

Configure OpenTok project:
1. auto-upload archives to AWS S3
2. archive monitoring callback URL in OpenTok project set to /ot_callback of this application.
When a new archive is created:
1. OpenTok uploads the archive file to S3
2. OpenTok posts a callback to this application via the URL configured for archive monitoring
The application then starts processing the archive files based on archive's outputMode
1. If archive mode is composed:
  - fetches the archive's .mp4 file from S3 as a stream
  - extracts audio from MP4 to FLAC using FFmpeg.
  - uploads the audio as .flac to a bucket in Google Cloud storage.(This needs to be done because Google Speech API needs you to upload audio files larger than 1 minute to Google Cloud Storage instead of sending the audio data through the API)
  - performs async speech recognition using Google Speech API for that uploaded .flac file
  - parses transcription results from Google Speech API into a text file
  - uploads text file and transcription metadata back to the same bucket in AWS S3.
2. If archive outputMode is individual, it does a few extra steps:
  - downloads the archive's .zip file from S3 and extracts its contents
  - parses the manifest JSON file OpenTok added in the zip
  - for each stream's .webm file in the zip it does these in sequence:
    - extracts audio from WebM to FLAC using FFmpeg.
    - uploads the audio as .flac to a bucket in Google Cloud storage.
    - performs async speech recognition using Google Speech API for that file.
    - parses transcription results from Google Speech API into a text file
    - uploads text file to the same bucket in S3, naming it using stream ID
  - when all .webm files have been processed, it uploads a grouped metadata file to S3.

What you will need

Setting this application up needs a few things:

Get an OpenTok account.
Create a new "Standard Project" in your OpenTok account. Note the API key for that project.
Set up an AWS S3 bucket. Connect your OpenTok project to that S3 bucket using these instructions.
Set up a Google Cloud account and configure it:
1. create a GCP console project and enable Google Speech API. See the setup instructions here. Download the private key of the service account as JSON.
2. Under the same project, create a new Google Cloud storage bucket. Note its ID.

When you deploy to Heroku, it will ask you for these information. Put them in the required fields and deploy.

Post installation: Once deployed, configure the OpenTok project's archive monitoring callback to point to /ot_callback of the deployed instance. For example, if your application URL is https://foo.herokuapp.com/, then the callback URL will be https://foo.herokuapp.com/ot_callback.

Code walk-through

This is a NodeJS application. It uses AWS's NodeJS SDK for accessing S3 and Google Cloud's NodeJS SDK for accessing Google Speech API and Google Cloud Storage. It does not need access to the OpenTok's credentials because it depends on OpenTok to POST to the callback URL when an archive is ready to be processed.

The main logic triggers when OpenTok posts a callback with new archive information to /ot_callback. This code is present in server.js:

app.post('/ot_callback', (req, res) => {
  if (req.body.status === 'uploaded') {
    archive.processArchive(req.body)
      .catch(err => {
        console.log(`Error processing new archive upload. Reason: ${err}`)
      })
  }
  res.status(200).send()
})

archive.processArchive() is called whenever Opentok says notifies that an archive has been uploaded to S3. Rest of the processing happens in archive.js and transcribe.js.

Internally, archive.processArchive() switches based on whether the new archive is created in composed or individual output mode. It calls archive.processIndividualOutput() or archive.processComposedOutput() depending on the output mode. (See here for information on the two types of outputs for OpenTok archiving.)

In both cases, they call transcribe.transcribeAudio(). This function handles the actual transcription process with Google Speech API.

The server also exposes a HTTP JSON API to fetch transcripts and their metadata stored in S3 and to list the APIs. Code for the minimal frontend is present in the client directory.

Development and Contributing

Interested in contributing? We ❤️ pull requests! See the Contribution guidelines.

Getting Help

We love to hear from you so if you have questions, comments or find a bug in the project, let us know! You can either:

Open an issue on this repository
See https://support.tokbox.com/ for support options
Tweet at us! We're @VonageDev on Twitter
Or join the Vonage Developer Community Slack

opentok-archive-transcription-demo's People

Contributors

Stargazers

Watchers

Forkers

kaustavdm ponraj-mavjay matiaslopezd lovejaco seerahulsingh

opentok-archive-transcription-demo's Issues

aws-sdk-2.783.0.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - aws-sdk-2.783.0.tgz

AWS SDK for JavaScript

Library home page: https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.783.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/aws-sdk/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (aws-sdk version)	Remediation Available
CVE-2020-28472	High	9.8	aws-sdk-2.783.0.tgz	Direct	2.814.0	✅

Details

CVE-2020-28472

Vulnerable Library - aws-sdk-2.783.0.tgz

AWS SDK for JavaScript

Library home page: https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.783.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/aws-sdk/package.json

Dependency Hierarchy:

❌ aws-sdk-2.783.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2021-01-19

URL: CVE-2020-28472

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28472

Release Date: 2021-01-19

Fix Resolution: 2.814.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

opentok-2.10.0.tgz: 8 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - opentok-2.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (opentok version)	Remediation Available
CVE-2021-3918	High	9.8	json-schema-0.2.3.tgz	Transitive	2.11.0	✅
CVE-2022-23529	High	7.6	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌
CVE-2022-24999	High	7.5	qs-6.5.2.tgz	Transitive	2.11.0	✅
CVE-2021-23337	High	7.2	lodash-4.17.20.tgz	Transitive	2.11.0	✅
CVE-2022-23540	Medium	6.4	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌
CVE-2022-23539	Medium	5.9	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌
CVE-2020-28500	Medium	5.3	lodash-4.17.20.tgz	Transitive	2.11.0	✅
CVE-2022-23541	Medium	5.0	jsonwebtoken-8.5.1.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- request-2.88.2.tgz
  - http-signature-1.2.0.tgz
    - jsprim-1.4.1.tgz
      - ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (opentok): 2.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-23529

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control. This issue has been fixed, please update to version 9.0.0.

Publish Date: 2022-12-21

URL: CVE-2022-23529

CVSS 3 Score Details (7.6)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-27h2-hvpr-p74q

Release Date: 2022-12-21

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- request-2.88.2.tgz
  - ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (opentok): 2.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- ❌ lodash-4.17.20.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (opentok): 2.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (6.4)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (5.9)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2020-28500

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- ❌ lodash-4.17.20.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (opentok): 2.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

opentok-2.10.0.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (5.0)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

⛑️ Automatic Remediation is available for this issue.

body-parser-1.19.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - body-parser-1.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (body-parser version)	Remediation Available
CVE-2022-24999	High	7.5	qs-6.7.0.tgz	Transitive	1.19.1	✅

Details

CVE-2022-24999

Vulnerable Library - qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

body-parser-1.19.0.tgz (Root Library)
- ❌ qs-6.7.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (body-parser): 1.19.1

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

speech-4.1.3.tgz: 9 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - speech-4.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (speech version)	Remediation Available
CVE-2020-7774	High	9.8	y18n-4.0.0.tgz	Transitive	4.1.4	✅
CVE-2021-3807	High	7.5	ansi-regex-5.0.0.tgz	Transitive	4.1.4	✅
CVE-2022-25878	High	7.5	protobufjs-6.10.1.tgz	Transitive	4.1.4	✅
CVE-2022-24772	High	7.5	node-forge-0.10.0.tgz	Transitive	4.1.4	✅
CVE-2022-24771	High	7.5	node-forge-0.10.0.tgz	Transitive	4.1.4	✅
WS-2022-0008	Medium	6.6	node-forge-0.10.0.tgz	Transitive	4.1.4	✅
CVE-2022-0122	Medium	6.1	node-forge-0.10.0.tgz	Transitive	4.1.4	✅
CVE-2022-0235	Medium	6.1	node-fetch-2.6.1.tgz	Transitive	4.1.4	✅
CVE-2022-24773	Medium	5.3	node-forge-0.10.0.tgz	Transitive	4.1.4	✅

Details

CVE-2020-7774

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- google-gax-2.9.1.tgz
  - grpc-js-1.1.8.tgz
    - proto-loader-0.6.0-pre9.tgz
      - yargs-15.4.1.tgz
        
        ❌ y18n-4.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 4.0.1

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2021-3807

Vulnerable Library - ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-regex/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- google-gax-2.9.1.tgz
  - grpc-js-1.1.8.tgz
    - proto-loader-0.6.0-pre9.tgz
      - yargs-15.4.1.tgz
        
        string-width-4.2.0.tgz
        
        strip-ansi-6.0.0.tgz
        
        ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 5.0.1

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-25878

Vulnerable Library - protobufjs-6.10.1.tgz

Protocol Buffers for JavaScript (& TypeScript).

Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-6.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/protobufjs/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- ❌ protobufjs-6.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

Publish Date: 2022-05-27

URL: CVE-2022-25878

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25878

Release Date: 2022-05-27

Fix Resolution (protobufjs): 6.10.3

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-24772

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- common-3.4.1.tgz
  - google-auth-library-6.1.3.tgz
    - gtoken-5.0.5.tgz
      - google-p12-pem-3.0.3.tgz
        
        ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-24771

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- common-3.4.1.tgz
  - google-auth-library-6.1.3.tgz
    - gtoken-5.0.5.tgz
      - google-p12-pem-3.0.3.tgz
        
        ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

WS-2022-0008

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- common-3.4.1.tgz
  - google-auth-library-6.1.3.tgz
    - gtoken-5.0.5.tgz
      - google-p12-pem-3.0.3.tgz
        
        ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-0122

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- common-3.4.1.tgz
  - google-auth-library-6.1.3.tgz
    - gtoken-5.0.5.tgz
      - google-p12-pem-3.0.3.tgz
        
        ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- google-gax-2.9.1.tgz
  - ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-24773

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

speech-4.1.3.tgz (Root Library)
- common-3.4.1.tgz
  - google-auth-library-6.1.3.tgz
    - gtoken-5.0.5.tgz
      - google-p12-pem-3.0.3.tgz
        
        ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/speech): 4.1.4

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

storage-5.4.0.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - storage-5.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/date-and-time/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (storage version)	Remediation Available
CVE-2020-26289	High	7.5	date-and-time-0.14.1.tgz	Transitive	5.5.0	✅
WS-2020-0219	High	7.5	date-and-time-0.14.1.tgz	Transitive	5.5.0	✅

Details

CVE-2020-26289

Vulnerable Library - date-and-time-0.14.1.tgz

A Minimalist DateTime utility for Node.js and the browser

Library home page: https://registry.npmjs.org/date-and-time/-/date-and-time-0.14.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/date-and-time/package.json

Dependency Hierarchy:

storage-5.4.0.tgz (Root Library)
- ❌ date-and-time-0.14.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.

Publish Date: 2020-12-28

URL: CVE-2020-26289

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26289

Release Date: 2020-12-28

Fix Resolution (date-and-time): 0.14.2

Direct dependency fix Resolution (@google-cloud/storage): 5.5.0

⛑️ Automatic Remediation is available for this issue

WS-2020-0219

Vulnerable Library - date-and-time-0.14.1.tgz

A Minimalist DateTime utility for Node.js and the browser

Library home page: https://registry.npmjs.org/date-and-time/-/date-and-time-0.14.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/date-and-time/package.json

Dependency Hierarchy:

storage-5.4.0.tgz (Root Library)
- ❌ date-and-time-0.14.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Due to an overly permissive regular expression, the parsing of certain date strings may lead to a denial of service.

Publish Date: 2020-12-25

URL: WS-2020-0219

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-25

Fix Resolution (date-and-time): 0.14.2

Direct dependency fix Resolution (@google-cloud/storage): 5.5.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

jquery-3.0.0.min.js: 3 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.0.0.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.min.js

Path to dependency file: /client/index.html

Path to vulnerable library: /client/index.html

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jquery version)	Remediation Available
CVE-2020-11023	Medium	6.1	jquery-3.0.0.min.js	Direct	jquery - 3.5.0;jquery-rails - 4.4.0	❌
CVE-2020-11022	Medium	6.1	jquery-3.0.0.min.js	Direct	jQuery - 3.5.0	❌
CVE-2019-11358	Medium	6.1	jquery-3.0.0.min.js	Direct	jquery - 3.4.0	❌

Details

CVE-2020-11023

Vulnerable Library - jquery-3.0.0.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.min.js

Path to dependency file: /client/index.html

Path to vulnerable library: /client/index.html

Dependency Hierarchy:

❌ jquery-3.0.0.min.js (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

CVE-2020-11022

Vulnerable Library - jquery-3.0.0.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.min.js

Path to dependency file: /client/index.html

Path to vulnerable library: /client/index.html

Dependency Hierarchy:

❌ jquery-3.0.0.min.js (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2019-11358

Vulnerable Library - jquery-3.0.0.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.min.js

Path to dependency file: /client/index.html

Path to vulnerable library: /client/index.html

Dependency Hierarchy:

❌ jquery-3.0.0.min.js (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

Node version not specified in package.json

Hi,
I followed all the step and got my secret keys and buckets. I tried deploying the demo application in heroku, it asked for all credentials and once i entered everything i got this error.

-----> Building dependencies
Installing node modules (package.json + package-lock)

   > [email protected] install /tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc
   > node-pre-gyp install --fallback-to-build --library=static_library
   
   node-pre-gyp ERR! Tried to download(403): https://storage.googleapis.com/grpc-precompiled-binaries/node/grpc/v1.7.3/node-v64-linux-x64-glibc.tar.gz 
   node-pre-gyp ERR! Pre-built binaries not found for [email protected] and [email protected] (node-v64 ABI, glibc) (falling back to source compile with node-gyp) 
   node-pre-gyp ERR! Tried to download(undefined): https://storage.googleapis.com/grpc-precompiled-binaries/node/grpc/v1.7.3/node-v64-linux-x64-glibc.tar.gz 
   node-pre-gyp ERR! Pre-built binaries not found for [email protected] and [email protected] (node-v64 ABI, glibc) (falling back to source compile with node-gyp) 
   make: Entering directory '/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/build'
   make: Entering directory '/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/build'
     CC(target) Release/obj.target/grpc/deps/grpc/src/core/lib/surface/init.o
     CC(target) Release/obj.target/grpc/deps/grpc/src/core/lib/surface/init.o
   rm: cannot remove './Release/.deps/Release/obj.target/grpc/deps/grpc/src/core/lib/surface/init.o.d.raw': No such file or directory
   grpc.target.mk:405: recipe for target 'Release/obj.target/grpc/deps/grpc/src/core/lib/surface/init.o' failed
   make: *** [Release/obj.target/grpc/deps/grpc/src/core/lib/surface/init.o] Error 1
   make: Leaving directory '/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/build'
   gyp ERR! build error 
   gyp ERR! stack Error: `make` failed with exit code: 2
   gyp ERR! stack     at ChildProcess.onExit (/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:262:23)
   gyp ERR! stack     at ChildProcess.emit (events.js:182:13)
   gyp ERR! stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:240:12)
   gyp ERR! System Linux 4.4.0-1031-aws
   gyp ERR! command "/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/bin/node" "/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "build" "--fallback-to-build" "--library=static_library" "--module=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc/grpc_node.node" "--module_name=grpc_node" "--module_path=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc"
   gyp ERR! cwd /tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc
   gyp ERR! node -v v10.13.0
   gyp ERR! node-gyp -v v3.8.0
   gyp ERR! not ok 
     CC(target) Release/obj.target/grpc/deps/grpc/src/core/lib/channel/channel_args.o
   node-pre-gyp ERR! build error 
   node-pre-gyp ERR! stack Error: Failed to execute '/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/bin/node /tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --library=static_library --module=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc/grpc_node.node --module_name=grpc_node --module_path=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc' (1)
   node-pre-gyp ERR! stack     at ChildProcess.<anonymous> (/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/node_modules/node-pre-gyp/lib/util/compile.js:83:29)
   node-pre-gyp ERR! stack     at ChildProcess.emit (events.js:182:13)
   node-pre-gyp ERR! stack     at maybeClose (internal/child_process.js:962:16)
   node-pre-gyp ERR! stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:251:5)
   node-pre-gyp ERR! System Linux 4.4.0-1031-aws
   node-pre-gyp ERR! command "/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/bin/node" "/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/node_modules/.bin/node-pre-gyp" "install" "--fallback-to-build" "--library=static_library"
   node-pre-gyp ERR! cwd /tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc
   node-pre-gyp ERR! node -v v10.13.0
   node-pre-gyp ERR! node-pre-gyp -v v0.6.39
   node-pre-gyp ERR! not ok 
   Failed to execute '/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/bin/node /tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js build --fallback-to-build --library=static_library --module=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc/grpc_node.node --module_name=grpc_node --module_path=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc' (1)
     CC(target) Release/obj.target/grpc/deps/grpc/src/core/lib/channel/channel_stack.o
     CC(target) Release/obj.target/grpc/deps/grpc/src/core/lib/channel/channel_stack_builder.o
   In file included from ../deps/grpc/src/core/lib/channel/channel_stack_builder.h:24:0,
                    from ../deps/grpc/src/core/lib/channel/channel_stack_builder.c:19:
   ../deps/grpc/src/core/lib/channel/channel_args.h:23:10: fatal error: grpc/grpc.h: No such file or directory
    #include <grpc/grpc.h>
             ^~~~~~~~~~~~~
   compilation terminated.
   grpc.target.mk:405: recipe for target 'Release/obj.target/grpc/deps/grpc/src/core/lib/channel/channel_stack_builder.o' failed
   make: *** [Release/obj.target/grpc/deps/grpc/src/core/lib/channel/channel_stack_builder.o] Error 1
   make: Leaving directory '/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/build'
   gyp ERR! build error 
   gyp ERR! stack Error: `make` failed with exit code: 2
   gyp ERR! stack     at ChildProcess.onExit (/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:262:23)
   gyp ERR! stack     at ChildProcess.emit (events.js:182:13)
   gyp ERR! stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:240:12)
   gyp ERR! System Linux 4.4.0-1031-aws
   gyp ERR! command "/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/bin/node" "/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "build" "--fallback-to-build" "--library=static_library" "--module=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc/grpc_node.node" "--module_name=grpc_node" "--module_path=/tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc"
   gyp ERR! cwd /tmp/build_3f364b46aa3e58f83e49f75f5f1fdab2/node_modules/grpc
   gyp ERR! node -v v10.13.0
   gyp ERR! node-gyp -v v3.8.0
   gyp ERR! not ok 
   npm ERR! code ELIFECYCLE
   npm ERR! errno 1
   npm ERR! [email protected] install: `node-pre-gyp install --fallback-to-build --library=static_library`
   npm ERR! Exit status 1
   npm ERR! 
   npm ERR! Failed at the [email protected] install script.
   npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
   
   npm ERR! A complete log of this run can be found in:
   npm ERR!     /tmp/npmcache.aZ8xt/_logs/2018-11-26T09_40_16_293Z-debug.log

-----> Build failed

   We're sorry this build is failing! You can troubleshoot common issues here:
   https://devcenter.heroku.com/articles/troubleshooting-node-deploys
   
   Some possible problems:
   
   - Node version not specified in package.json
     https://devcenter.heroku.com/articles/nodejs-support#specifying-a-node-js-version
   
   Love,
   Heroku

! Push rejected, failed to compile Node.js app.
! Push failed

I don't how to proceed with this. Can you help me with this

fluent-ffmpeg-2.1.2.tgz: 1 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - fluent-ffmpeg-2.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (fluent-ffmpeg version)	Remediation Available
CVE-2021-43138	High	7.8	async-2.6.0.tgz	Transitive	N/A*	❌

Details

CVE-2021-43138

Vulnerable Library - async-2.6.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

fluent-ffmpeg-2.1.2.tgz (Root Library)
- ❌ async-2.6.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution: async - 2.6.4,3.2.2

error with opentok secret key

Hi,
i am followed your all steps but every time getting this error
every time it is asking secret_key ,where i want to put secret_key in my code
you are not mentioned about secret_key please help me
below error i am getting
throw new Error('Invalid arguments when initializing OpenTok: apiKey=' + apiKey + ', apiSecret=' + apiSecret);
^

Error: Invalid arguments when initializing OpenTok: apiKey=46223952, apiSecret=undefined
at new OpenTok (/var/www/html/opentok_kp/opentok23/node_modules/opentok/lib/opentok.js:77:11)
at Object. (/var/www/html/opentok_kp/opentok23/server.js:36:17)
at Module._compile (internal/modules/cjs/loader.js:689:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:700:10)
at Module.load (internal/modules/cjs/loader.js:599:32)
at tryModuleLoad (internal/modules/cjs/loader.js:538:12)
at Function.Module._load (internal/modules/cjs/loader.js:530:3)
at Function.Module.runMain (internal/modules/cjs/loader.js:742:12)
at startup (internal/bootstrap/node.js:266:19)
at bootstrapNodeJSCore (internal/bootstrap/node throw new Error('Invalid arguments when initializing OpenTok: apiKey=' + apiKey + ', apiSecret=' + apiSecret);
^

please give any solution
Thank you

opentok / opentok-archive-transcription-demo Goto Github PK

opentok-archive-transcription-demo's Introduction

OpenTok Archive Transcript demo

Workflow

What you will need

Code walk-through

Development and Contributing

Getting Help

Further Reading

opentok-archive-transcription-demo's People

Contributors

Stargazers

Watchers

Forkers

opentok-archive-transcription-demo's Issues

Vulnerabilities

Details

Vulnerable Library - aws-sdk-2.783.0.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - json-schema-0.2.3.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

CVSS 3 Score Details (7.6)

Suggested Fix

Vulnerable Library - qs-6.5.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - lodash-4.17.20.tgz

Vulnerability Details

CVSS 3 Score Details (7.2)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

CVSS 3 Score Details (6.4)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

CVSS 3 Score Details (5.9)

Suggested Fix

Vulnerable Library - lodash-4.17.20.tgz

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - jsonwebtoken-8.5.1.tgz

Vulnerability Details

CVSS 3 Score Details (5.0)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - qs-6.7.0.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - y18n-4.0.0.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - ansi-regex-5.0.0.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - protobufjs-6.10.1.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - node-forge-0.10.0.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - node-forge-0.10.0.tgz