rifflearning / zenhub

This is the master repository for the Riff Projects in our ZenHub Workspace
0 stars 0 forks source link

Security Issues for Riff Server and Riff RTC #205

Open adonahue opened 5 years ago

adonahue commented 5 years ago

This came up in the context of the security audit. Ask Mike what the server issues are. SHould be addressed in the Riff Server Refactor.

mlippert commented 5 years ago

Hmm actually it looks like the last changes we (Jordan) made to riff-server cleaned up the errors that were being reported. Today I get this:

$ npm install
npm WARN deprecated @types/graphql@14.5.0: This is a stub types definition. graphql provides its own type definitions, so you do not need this installed.
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN feathers-mongoose@8.1.0 requires a peer of mongoose@^5.7.3 but none is installed. You must install peer dependencies yourself.
npm WARN jsdom@15.2.0 requires a peer of canvas@^2.5.0 but none is installed. You must install peer dependencies yourself.

added 474 packages from 822 contributors and audited 1173 packages in 8.645s
$ npm install
npm WARN deprecated @types/graphql@14.5.0: This is a stub types definition. graphql provides its own type definitions, so you do not need this installed.
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN feathers-mongoose@8.1.0 requires a peer of mongoose@^5.7.3 but none is installed. You must install peer dependencies yourself.
npm WARN jsdom@15.2.0 requires a peer of canvas@^2.5.0 but none is installed. You must install peer dependencies yourself.

added 474 packages from 822 contributors and audited 1173 packages in 8.645s
found 0 vulnerabilities

riff-rtc gives me this:

$ npm install
npm WARN deprecated postcss-cssnext@3.1.0: 'postcss-cssnext' has been deprecated in favor of 'postcss-preset-env'. Read more at https://moox.io/blog/deprecating-cssnext/
npm WARN deprecated node-uuid@1.4.8: Use uuid module instead
npm WARN deprecated browserslist@2.11.3: Browserslist 2 could fail on reading Browserslist >3.0 config used in other tools.
npm WARN deprecated lodash-node@2.4.1: This package is discontinued. Use lodash@^4.0.0.
npm WARN deprecated flatten@1.0.2: I wrote this module a very long time ago; you should use something else.

> dtrace-provider@0.8.8 install /home/mjl/Projects/riff/riff-rtc/node_modules/dtrace-provider
> node-gyp rebuild || node suppress-error.js

make: Entering directory '/home/mjl/Projects/riff/riff-rtc/node_modules/dtrace-provider/build'
  TOUCH Release/obj.target/DTraceProviderStub.stamp
make: Leaving directory '/home/mjl/Projects/riff/riff-rtc/node_modules/dtrace-provider/build'

> grpc@1.23.3 install /home/mjl/Projects/riff/riff-rtc/node_modules/grpc
> node-pre-gyp install --fallback-to-build --library=static_library

node-pre-gyp WARN Using request for node-pre-gyp https download 
[grpc] Success: "/home/mjl/Projects/riff/riff-rtc/node_modules/grpc/src/node/extension_binary/node-v64-linux-x64-glibc/grpc_node.node" is installed via remote

> node-sass@4.12.0 install /home/mjl/Projects/riff/riff-rtc/node_modules/node-sass
> node scripts/install.js

Cached binary found at /home/mjl/.npm/node-sass/4.12.0/linux-x64-64_binding.node

> core-js@3.2.1 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/@firebase/polyfill/node_modules/core-js
> node scripts/postinstall || echo "ignore"

Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!

The project needs your help! Please consider supporting of core-js on Open Collective or Patreon: 
> https://opencollective.com/core-js 
> https://www.patreon.com/zloirock 

Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)

> core-js@2.6.10 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/babel-runtime/node_modules/core-js
> node postinstall || echo "ignore"

Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!

The project needs your help! Please consider supporting of core-js on Open Collective or Patreon: 
> https://opencollective.com/core-js 
> https://www.patreon.com/zloirock 

Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)

> core-js@3.3.2 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/core-js
> node postinstall || echo "ignore"

> protobufjs@6.8.8 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/protobufjs
> node scripts/postinstall

> styled-components@4.4.0 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/styled-components
> node ./scripts/postinstall.js || exit 0

Use styled-components at work? Consider supporting our development efforts at https://opencollective.com/styled-components

> node-sass@4.12.0 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/node-sass
> node scripts/build.js

Binary found at /home/mjl/Projects/riff/riff-rtc/node_modules/node-sass/vendor/linux-x64-64/binding.node
Testing binary
Binary is fine

> nodemon@1.19.4 postinstall /home/mjl/Projects/riff/riff-rtc/node_modules/nodemon
> node bin/postinstall || exit 0

Love nodemon? You can now support the project via the open collective:
 > https://opencollective.com/nodemon/donate

npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN notsup Unsupported engine for xmlbuilder@2.4.6: wanted: {"node":"0.8.x || 0.10.x || 0.11.x  || 1.0.x"} (current: {"node":"10.16.3","npm":"6.12.0"})
npm WARN notsup Not compatible with your version of node/npm: xmlbuilder@2.4.6
npm WARN notsup Unsupported engine for webrtc-adapter@2.1.0: wanted: {"npm":"^3.10.0"} (current: {"node":"10.16.3","npm":"6.12.0"})
npm WARN notsup Not compatible with your version of node/npm: webrtc-adapter@2.1.0
npm WARN notsup Unsupported engine for webrtc-adapter@2.1.0: wanted: {"npm":"^3.10.0"} (current: {"node":"10.16.3","npm":"6.12.0"})
npm WARN notsup Not compatible with your version of node/npm: webrtc-adapter@2.1.0
npm WARN attachmediastream@2.1.0 requires a peer of webrtc-adapter@^4.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN sass-loader@8.0.0 requires a peer of sass@^1.3.0 but none is installed. You must install peer dependencies yourself.
npm WARN sass-loader@8.0.0 requires a peer of fibers@>= 3.1.0 but none is installed. You must install peer dependencies yourself.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.9 (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.9: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})

added 1865 packages from 1109 contributors and audited 18018 packages in 58.679s
found 4 vulnerabilities (3 low, 1 high)
  run `npm audit fix` to fix them, or `npm audit` for details