Enatega is a fully realized and customizable food delivery application that can be used to set up your own order/delivery management system. For more information, visit the Enatega product page: 🚀🛒📦🌐
RFC 3447 and RFC 8017 allow for optional DigestAlgorithmNULL parameters
for sha* algorithms and require NULL paramters for md2 and md5
algorithms.
1.3.0 - 2022-03-17
Security
Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa
Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
HIGH: Leniency in checking digestAlgorithm structure can lead to
signature forgery.
The code is lenient in checking the digest algorithm structure. This can
allow a crafted structure that steals padding bytes and uses unchecked
portion of the PKCS#1 encoded message to forge a signature when a low
public exponent is being used. For more information, please see
"Bleichenbacher's RSA signature forgery based on implementation
error"
by Hal Finney.
HIGH: Failing to check tailing garbage bytes can lead to signature
forgery.
The code does not check for tailing garbage bytes after decoding a
DigestInfo ASN.1 structure. This can allow padding bytes to be removed
and garbage data added to forge a signature when a low public exponent is
being used. For more information, please see "Bleichenbacher's RSA
signature forgery based on implementation
error"
by Hal Finney.
DigestInfo is not properly checked for proper ASN.1 structure. This can
lead to successful verification with signatures that contain invalid
structures but a valid digest.
[asn1] Add fallback to pretty print invalid UTF8 data.
[asn1] fromDer is now more strict and will default to ensuring all input
bytes are parsed or throw an error. A new option parseAllBytes can disable
this behavior.
NOTE: The previous behavior is being changed since it can lead to
security issues with crafted inputs. It is possible that code doing custom
DER parsing may need to adapt to this new behavior and optional flag.
[rsa] Add and use a validator to check for proper structure of parsed ASN.1
To trigger a single review, invoke the @coderabbitai review command.
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
Share
- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)
- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)
Tips
### Chat
There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai):
- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- `I pushed a fix in commit .`
- `Generate unit testing code for this file.`
- `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
- `@coderabbitai generate unit testing code for this file.`
- `@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- `@coderabbitai generate interesting stats about this repository and render them as a table.`
- `@coderabbitai show all the console.log statements in this repository.`
- `@coderabbitai read src/utils.ts and generate unit testing code.`
- `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
- `@coderabbitai help me debug CodeRabbit configuration file.`
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.
### CodeRabbit Commands (invoked as PR comments)
- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.
Additionally, you can add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
### CodeRabbit Configration File (`.coderabbit.yaml`)
- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`
### Documentation and Community
- Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.
Bumps the npm_and_yarn group in /enatega-multivendor-web with 15 updates:
3.1.93.1.104.0.35.0.10.0.70.0.91.4.22.0.42.3.23.0.24.14.24.23.04.18.24.19.23.0.43.1.21.15.51.15.63.1.05.1.28.0.19.0.210.10.01.3.17.0.367.0.391.7.21.8.13.7.35.3.4Updates
ejsfrom 3.1.9 to 3.1.10Release notes
Sourced from ejs's releases.
Commits
d3f807dVersion 3.1.109ee26ddMocha TDDe469741Basic pollution protection715e950Merge pull request #756 from Jeffrey-mu/maincabe314Include advanced usage examples29b076cAdded header11503c7Merge branch 'main' of github.com:mde/ejs into main7690404Added security banner to READMEf47d7aeUpdate SECURITY.md828cea1Update SECURITY.mdUpdates
react-scriptsfrom 4.0.3 to 5.0.1Commits
19fa58dPublish9802941fix: webpack noise printed only if error or warning (#12245)2eef1d0Update templates to use React 18createRoot(#12220)221e511Publish5614c87Add support for Tailwind (#11717)20edab4fix(webpackDevServer): disable overlay for warnings (#11413)3afbbc0Update all dependencies (#11624)f5467d5feat(eslint-config-react-app): support ESLint 8.x (#11375)c7627ceUpdate webpack and dev server (#11646)544befeUpdate package.json (#11597)Updates
ansi-htmlfrom 0.0.7 to 0.0.9Commits
Updates
loader-utilsfrom 1.4.2 to 2.0.4Release notes
Sourced from loader-utils's releases.
Changelog
Sourced from loader-utils's changelog.
... (truncated)
Commits
6688b50chore(release): 2.0.4ac09944fix: ReDoS problem (#225)7162619chore(release): 2.0.3a93cf6ffix(security): prototype polution exploit (#217)90c7c4bchore(release): 2.0.28c2d24efix: base64 generation and unicode characters (#197)5fb5562chore(release): 2.0.11069f61fix: md4 support on Node.js v17 (#193)d9f4e23chore(release): 2.0.0865dc03refactor: switch tomd4by default (#168)Updates
bracesfrom 2.3.2 to 3.0.2Changelog
Sourced from braces's changelog.
Commits
Updates
browserslistfrom 4.14.2 to 4.23.0Release notes
Sourced from browserslist's releases.
Changelog
Sourced from browserslist's changelog.
... (truncated)
Commits
a23d971Release 4.23 version61e7712Update dependencies2c313aaAdd Github release workflow3caf908Update CIb58ae05feat: add BROWSERSLIST_ROOT_PATH (#819)8ddc4d8Update grammar definition file (#817)65ad382Release 4.22.3 version0efec9bAdd Node.js 21 to CIaaf5f2bUpdate dependenciesa3ba90bUpdated regex to have the option of adding an extension after@companyNamebu...Updates
expressfrom 4.18.2 to 4.19.2Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
Commits
04bc6274.19.2da4d763Improved fix for open redirect allow list bypass4f0f6cc4.19.1a003cfaAllow passing non-strings to res.location with new encoding handling checks f...a1fa90ffixed un-edited version in history.md for 4.19.011f2b1dbuild: fix build due to inconsistent supertest behavior in older versions084e3654.19.00867302Prevent open redirect allow list bypass due to encodeurl567c9c6Add note on how to update docs for new release (#5541)69a4cf2deps: cookie@0.6.0Maintainer changes
This version was pushed to npm by wesleytodd, a new releaser for express since your current version.
Updates
minimatchfrom 3.0.4 to 3.1.2Commits
699c4593.1.22f2b5fffix: trim pattern25d7c0d3.1.155dda29fix: treat nocase:true as always having magic5e1fb8d3.1.0f8145c5Add 'allowWindowsEscape' option570e8b1add publishConfig for v3 publishes5b7cd333.0.620b4b56[fix] revert all breaking syntax changes2ff0388document, expose, and test 'partial:true' optionUpdates
follow-redirectsfrom 1.15.5 to 1.15.6Commits
35a517cRelease version 1.15.6 of the npm package.c4f847fDrop Proxy-Authorization across hosts.8526b4aUse GitHub for disclosure.Updates
glob-parentfrom 3.1.0 to 5.1.2Release notes
Sourced from glob-parent's releases.
Changelog
Sourced from glob-parent's changelog.
... (truncated)
Commits
eb2c439chore: update changelog12bcb6cchore: release 5.1.2f923116fix: eliminate ReDoS (#36)0b014a7chore: add JSDoc returns information (#33)2b24ebdchore: generate initial changelog9b6e874chore: release 5.1.1749c35eci: try wrapping the JOB_ID in a string5d39defci: attempt to switch to published coveralls0b5b37fci: put the npm step back in for only Windows473f5d8ci: update azure build imagesMaintainer changes
This version was pushed to npm by phated, a new releaser for glob-parent since your current version.
Updates
immerfrom 8.0.1 to 9.0.21Release notes
Sourced from immer's releases.
... (truncated)
Commits
7c15339chore(deps): bump loader-utils from 2.0.0 to 2.0.4 in /website (#1026)f07ec9dchore(deps): bump@sideway/formulafrom 3.0.0 to 3.0.1 in /website (#1027)b6ccd0ffix: ensure type exports is first in package.json export declaration (#1018)385837dchore(deps): bump http-cache-semantics from 4.1.0 to 4.1.1 in /website (#1017)e1696b7chore(deps): bump webpack from 5.75.0 to 5.76.1 in /website (#1024)dd83e2efix: patching maps failed when using number keys (#1025)082eecdfix: Upgrade Github actions to Node 16 attempt 29d4ea93fix: Upgrade Github actions to Node 16 attempt 182acc40fix: release and publish from 'main' rather than 'master' branch3eeb331fix: revert earlier fix (#990) for recursive types (#1014)Updates
node-forgefrom 0.10.0 to 1.3.1Changelog
Sourced from node-forge's changelog.
... (truncated)
Commits
a0a4a42Release 1.3.1.a33830fUpdate changelog.740954dAllow optional DigestAlgorithm parameters.56f4316Allow DigestInfo.DigestAlgorith.parameters to be optionalcbf0bd5Start 1.3.1-0.6c5b901Release 1.3.0.0f3972aUpdate changelog.dc77b39Fix error checking.bb822c0Add advisory links.d4395feUpdate changelog.Updates
postcssfrom 7.0.36 to 7.0.39Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
e17c1efRelease 7.0.39 version6791bd3Reduce npm package44c581aReplace nanocolors with picocolors8ba21fdRemove eslint-ci3994c4aRelease 7.0.38 version6944e1dRemove development keys from package.json4dd0af0Release 7.0.37 version8408eb4Add compilation step0c68063Move tests to GitHub Actions98b61baReplace chalk to nanocolorsUpdates
shell-quotefrom 1.7.2 to 1.8.1Changelog
Sourced from shell-quote's changelog.
... (truncated)
Commits
da8a3abv1.8.1a66de94[Tests] increase coverageb42ac73[Refactor]parse: hoistgetVarto module levelfcb2e1a[Refactor]parse: usesliceoversubstr, cache some valuesecf2a60[Fix]parse: preserve whitespace in comments1d58679[Refactor]parse: avoid shadowing a function arg6780ec5[Refactor]parse: a bit of cleanup227d474[Refactor]parse: tweak the regex to not match nothing7bcd90e[Fix] properly support theescapeoption8f0c5c3[Refactor] hoist some vars to module levelMaintainer changes
This version was pushed to npm by ljharb, a new releaser for shell-quote since your current version.
Updates
webpack-dev-middlewarefrom 3.7.3 to 5.3.4Release notes
Sourced from webpack-dev-middleware's releases.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
Share
- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)Tips
### Chat There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai): - Review comments: Directly reply to a review comment made by CodeRabbit. Example: - `I pushed a fix in commit✅ Deploy Preview for cheery-zabaione-34f12e canceled.
✅ Deploy Preview for polite-fairy-234917 ready!
Toggle QR Code...
Use your smartphone camera to open QR code link.
To edit notification comments on pull requests, go to your Netlify site configuration.
Superseded by #597.