search

mmisw / orr-portal

ORR Frontend component
Apache License 2.0
8 stars 5 forks source link

Angular16 #137

Closed carueda closed 5 years ago

carueda commented 5 years ago

Hi @lewismc, local tests (navigating through several of the UI sections) have been pretty satisfactory for me (screenshot below). Please give it a try to reverify:

git fetch origin
git checkout angular16
npm install

# check your src/app/js/local.config.js as indicated in development.md
# and then:
gulp dev

image

lewismc commented 5 years ago

@carueda when I run npm install I get the following

npm install

> fsevents@1.2.6 install /Users/lmcgibbn/Downloads/orr-portal/node_modules/fsevents
> node install

node-pre-gyp WARN Using request for node-pre-gyp https download
[fsevents] Success: "/Users/lmcgibbn/Downloads/orr-portal/node_modules/fsevents/lib/binding/Release/node-v64-darwin-x64/fse.node" is installed via remote

> phantomjs-prebuilt@2.1.16 install /Users/lmcgibbn/Downloads/orr-portal/node_modules/phantomjs-prebuilt
> node install.js

PhantomJS not found on PATH
Downloading https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-macosx.zip
Saving to /var/folders/3p/t0shq8j10q56q45ntm0skn00fv8362/T/phantomjs/phantomjs-2.1.1-macosx.zip
Receiving...
  [==================----------------------] 46%
Received 16746K total.
Extracting zip contents
Removing /Users/lmcgibbn/Downloads/orr-portal/node_modules/phantomjs-prebuilt/lib/phantom
Copying extracted folder /var/folders/3p/t0shq8j10q56q45ntm0skn00fv8362/T/phantomjs/phantomjs-2.1.1-macosx.zip-extract-1565153638589/phantomjs-2.1.1-macosx -> /Users/lmcgibbn/Downloads/orr-portal/node_modules/phantomjs-prebuilt/lib/phantom
Writing location.js file
Done. Phantomjs binary available at /Users/lmcgibbn/Downloads/orr-portal/node_modules/phantomjs-prebuilt/lib/phantom/bin/phantomjs
added 911 packages from 1317 contributors and audited 4585 packages in 15.06s
found 61 vulnerabilities (3 low, 57 high, 1 critical)
  run `npm audit fix` to fix them, or `npm audit` for details
lmcgibbn@MT-207576 ~/Downloads/orr-portal(angular16) $ npm audit fix
removed 2 packages and updated 6 packages in 5.093s
fixed 51 of 61 vulnerabilities in 4585 scanned packages
  2 vulnerabilities required manual review and could not be updated
  2 package updates for 8 vulns involved breaking changes
  (use `npm audit fix --force` to install breaking changes; or refer to `npm audit` for steps to fix these manually)
lmcgibbn@MT-207576 ~/Downloads/orr-portal(angular16) $ npm audit

                       === npm audit security report ===

# Run  npm install --save-dev gulp@4.0.2  to resolve 7 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-stream > glob > minimatch             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/118                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-stream > minimatch                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/118                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-watcher > gaze > globule > glob >     │
│               │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/118                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-watcher > gaze > globule > minimatch  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/118                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-watcher > gaze > globule > lodash     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/577                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-watcher > gaze > globule > lodash     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/782                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > vinyl-fs > glob-watcher > gaze > globule > lodash     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1065                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

# Run  npm install --save-dev karma@4.2.0  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ karma [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ karma > expand-braces > braces                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp-webserver [dev]                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp-webserver > tiny-lr > debug                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/534                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ open                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >0.0.5                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gulp-webserver [dev]                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp-webserver > open                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/663                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 10 vulnerabilities (3 low, 6 high, 1 critical) in 4633 scanned packages
  8 vulnerabilities require semver-major dependency updates.
  2 vulnerabilities require manual review. See the full report for details.
lewismc commented 5 years ago

@carueda do you have an example local.config.js I can use? Thanks

lewismc commented 5 years ago

Also, do any of the other angular deps need upgraded?

    "angular-clipboard": "~1.4.2",
    "angular-cookie": "~4.1.0",
    "angular-jwt": "0.1.9",
    "angular-local-storage": "0.2.7",
    "angular-mocks": "1.6.2",
    "angular-recaptcha": "3.2.1",
    "angular-sanitize": "1.4.7",
    "angular-ui-bootstrap": "1.3.3",
    "angular-ui-grid": "3.0.7",
    "angular-ui-router": "0.2.18",
"angular-xeditable": "^0.9.0",
carueda commented 5 years ago

hi @lewismc Thanks much for looking into this.

I just sent you my local.config.js via slack.

Re the vulnerabilities, we could probably address those (specially the critical one) in separate ticket(s)?

lewismc commented 5 years ago

Re this vulnerabilities, we could probably address those (specially the critical one) in separate ticket(s)?

ack +1