Open flatfile-nullify[bot] opened 1 month ago
New code security updates for commit c3fe5b746b30f424797f68d15c4c61aa0c570fca
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
New code security updates for commit bf76cb0be6140799bedb8740900f9510035b532b
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
New code security updates for commit feeaa80bafd4e31cfa157ea2ed03889da9aefff1
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
New code security updates for commit 8aea3364a682c91cbf6157892b5bd3ee3aa585af
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
New code security updates for commit 9f5664d2be1525b0bf35f6a669db2012ad7b3e3b
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
New code security updates for commit 4e48f4d34bb27f4be7757af898507684baeb2b34
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
New code security updates for commit 44774e6c714afff55d3b053a7f5957c7f632d614
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
7 | 0 | 0 | 0 |
Severity Threshold: π΅ MEDIUM
85 Potential vulnerability sources found within this repo
π΄ CRITICAL
π‘ HIGH
π΅ MEDIUM
βͺ LOW
ID: 01J53YX5GD6N7C19BNJ0F6PYVP
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/testing/src/test.listener.ts#L35 #
ID: 01J53YX5GD6N7C19BNEN6MCKEB
Language: TypeScript
Severity: π‘ HIGH
CWE-918
Rules lgpl javascript ssrf rule node ssrf
This application allows user-controlled URLs to be passed directly to HTTP client libraries. This can result in Server-Side Request Forgery (SSRF). SSRF refers to an attack where the attacker can abuse functionality on the server to force it to make requests to other internal systems within your infrastructure that are not directly exposed to the internet. This allows the attacker to access internal resources they do not have direct access to. Some risks of SSRF are:
var whitelist = [ "https://example.com", "https://example.com/sample" ] app.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) { if(whitelist.includes(req.query.url)){ axios.get(url, {}) .then(function (response) { console.log(response); }) .catch(function (response) { console.log(response); }) } });
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.htmlhttps://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/foreign-db-extractor/src/s3.upload.ts#L8-L20 #
ID: 01J53YX5GD6N7C19BNG75P8GA9
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/xlsx-extractor/src/utils.ts#L9 #
ID: 01J53YX5GD6N7C19BNE8VTHDX6
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/export-workbook/src/utils.ts#L9 #
ID: 01J53YX5GD6N7C19BNHFEFMYZV
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/extractor/src/index.ts#L204 #
ID: 01J53YX5GD6N7C19BNHZJP0J74
Language: TypeScript
Severity: π‘ HIGH
CWE-918
Rules lgpl javascript ssrf rule node ssrf
This application allows user-controlled URLs to be passed directly to HTTP client libraries. This can result in Server-Side Request Forgery (SSRF). SSRF refers to an attack where the attacker can abuse functionality on the server to force it to make requests to other internal systems within your infrastructure that are not directly exposed to the internet. This allows the attacker to access internal resources they do not have direct access to. Some risks of SSRF are:
var whitelist = [ "https://example.com", "https://example.com/sample" ] app.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) { if(whitelist.includes(req.query.url)){ axios.get(url, {}) .then(function (response) { console.log(response); }) .catch(function (response) { console.log(response); }) } });
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.htmlhttps://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/testing/src/test.helpers.ts#L139-L147 #
ID: 01J53YX5GD6N7C19BNH467C8HT
Language: TypeScript
Severity: π‘ HIGH
CWE-918
Rules lgpl javascript ssrf rule node ssrf
This application allows user-controlled URLs to be passed directly to HTTP client libraries. This can result in Server-Side Request Forgery (SSRF). SSRF refers to an attack where the attacker can abuse functionality on the server to force it to make requests to other internal systems within your infrastructure that are not directly exposed to the internet. This allows the attacker to access internal resources they do not have direct access to. Some risks of SSRF are:
var whitelist = [ "https://example.com", "https://example.com/sample" ] app.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) { if(whitelist.includes(req.query.url)){ axios.get(url, {}) .then(function (response) { console.log(response); }) .catch(function (response) { console.log(response); }) } });
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.htmlhttps://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/common/src/all.records.ts#L137-L145 #
ID: 01J53YX5GD6N7C19BNHSYWKMKC
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/response-rejection/src/index.ts#L111 #
ID: 01J53YX5GD6N7C19BNH2J23A7F
Language: TypeScript
Severity: π‘ HIGH
CWE-918
Rules lgpl javascript ssrf rule node ssrf
This application allows user-controlled URLs to be passed directly to HTTP client libraries. This can result in Server-Side Request Forgery (SSRF). SSRF refers to an attack where the attacker can abuse functionality on the server to force it to make requests to other internal systems within your infrastructure that are not directly exposed to the internet. This allows the attacker to access internal resources they do not have direct access to. Some risks of SSRF are:
var whitelist = [ "https://example.com", "https://example.com/sample" ] app.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) { if(whitelist.includes(req.query.url)){ axios.get(url, {}) .then(function (response) { console.log(response); }) .catch(function (response) { console.log(response); }) } });
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.htmlhttps://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/common/src/all.records.ts#L110-L118 #
ID: 01J53YX5GD6N7C19BNDQ726C7P
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/delimiter-extractor/src/parser.ts#L104 #
ID: 01J53YX5GD6N7C19BNH6DCNGXP
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/common/src/async.batch.spec.ts#L98-L100 #
ID: 01J53YX5GD6N7C19BND4KCZX7E
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/autocast/src/autocast.plugin.ts#L88 #
ID: 01J53YX5GD6N7C19BNF2ZD121V
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/merge-connection/src/create.workbook.ts#L82 #
ID: 01J53YX5GD6N7C19BNEFGZR3MB
Language: TypeScript
Severity: π‘ HIGH
CWE-918
Rules lgpl javascript ssrf rule node ssrf
This application allows user-controlled URLs to be passed directly to HTTP client libraries. This can result in Server-Side Request Forgery (SSRF). SSRF refers to an attack where the attacker can abuse functionality on the server to force it to make requests to other internal systems within your infrastructure that are not directly exposed to the internet. This allows the attacker to access internal resources they do not have direct access to. Some risks of SSRF are:
var whitelist = [ "https://example.com", "https://example.com/sample" ] app.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) { if(whitelist.includes(req.query.url)){ axios.get(url, {}) .then(function (response) { console.log(response); }) .catch(function (response) { console.log(response); }) } });
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.htmlhttps://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/foreign-db-extractor/src/database.restore.ts#L18-L30 #
ID: 01J53YX5GD6N7C19BNG0BKPTZA
Language: TypeScript
Severity: π‘ HIGH
CWE-918
Rules lgpl javascript ssrf rule node ssrf
This application allows user-controlled URLs to be passed directly to HTTP client libraries. This can result in Server-Side Request Forgery (SSRF). SSRF refers to an attack where the attacker can abuse functionality on the server to force it to make requests to other internal systems within your infrastructure that are not directly exposed to the internet. This allows the attacker to access internal resources they do not have direct access to. Some risks of SSRF are:
var whitelist = [ "https://example.com", "https://example.com/sample" ] app.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) { if(whitelist.includes(req.query.url)){ axios.get(url, {}) .then(function (response) { console.log(response); }) .catch(function (response) { console.log(response); }) } });
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.htmlhttps://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/webhook-event-forwarder/src/forward.webhook.ts#L19-L25 #
ID: 01J53YX5GD6N7C19BNEK86X0BG
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/foreign-db-extractor/src/database.user.ts#L55 #
ID: 01J53YX5GD6N7C19BNE9W1A09M
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/export-workbook/src/utils.ts#L19 #
ID: 01J53YX5GD6N7C19BNEDQSE6NV
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/foreign-db-extractor/src/database.poll.status.ts#L20 #
ID: 01J53YX5GD6N7C19BNFWGMSKSH
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/plugins/sql-ddl-converter/src/setup.factory.ts#L53 #
ID: 01J53YX5GD6N7C19BNGS1RS0YJ
Language: TypeScript
Severity: π‘ HIGH
dom-xss-finder
Dom xss finder
A potential user-input controlled parameter passing in a JavaScript sink was found.
Read more: https://owasp.org/www-community/attacks/DOM_Based_XSS https://github.com/FlatFilers/flatfile-plugins/blob/b9e18394e23beb32411607428180f03f02c730b9/utils/common/src/all.records.ts#L21 #
βΉοΈ Note: 85 vulnerabilities were detected. This dashboard prioritises and showcases the top 20 most critical findings.
Reply with
/nullify
to interact with me like another developer