Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

VSCode | Upgrade js-wrapper version (AST-41951) #849

Merged
merged 1 commit into from
May 8, 2024
Merged

VSCode | Upgrade js-wrapper version (AST-41951) #849

merged 1 commit into from
May 8, 2024

Conversation

AlvoBen
Copy link
Contributor

@AlvoBen AlvoBen commented May 8, 2024

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Upgrade js-wrapper version

References

https://checkmarx.atlassian.net/browse/AST-41951

Testing

Describe how this change was tested. Be specific about anything not tested and reasons why. If this solution has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Checklist

  • I have added documentation for new/changed functionality in this PR (if applicable).
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used

@pedrompflopes pedrompflopes requested review from a team, margaritalm and tiagobcx and removed request for a team May 8, 2024 07:57
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented May 8, 2024

Logo
Checkmarx One – Scan Summary & Details – 9eb48199-cba8-4f73-8a20-24904114f929

Policy Management Violations

Policy Name Rule(s) Break Build
[SAST-ML0] Not allowed NEW Sast vulnerabilities true

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2024-4067 Npm-micromatch-4.0.5 Vulnerable Package
HIGH CVE-2024-4068 Npm-braces-3.0.2 Vulnerable Package
HIGH Client_DOM_XSS /media/main.js: 70 Attack Vector
HIGH Client_DOM_XSS /media/main.js: 70 Attack Vector
HIGH Client_DOM_XSS /media/view.js: 236 Attack Vector
HIGH Client_DOM_XSS /media/view.js: 236 Attack Vector
HIGH Client_DOM_XSS /media/view.js: 236 Attack Vector
MEDIUM Missing_HSTS_Header /src/resources/testProj/insecure.php: 24 Attack Vector

Fixed Issues

Severity Issue Source File / Package
HIGH Cxab55612e-3a56 Npm-braces-3.0.2
HIGH Cxca84a1c2-1f12 Npm-micromatch-4.0.5
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/flat/cli.js: 9
MEDIUM Absolute_Path_Traversal /node_modules/acorn/dist/bin.js: 37
MEDIUM Absolute_Path_Traversal /node_modules/acorn/dist/bin.js: 40
MEDIUM Absolute_Path_Traversal /node_modules/node-addon-api/tools/conversion.js: 8
MEDIUM Absolute_Path_Traversal /node_modules/node-addon-api/tools/conversion.js: 8
MEDIUM Absolute_Path_Traversal /node_modules/acorn/dist/bin.js: 37
MEDIUM Absolute_Path_Traversal /node_modules/acorn/dist/bin.js: 40
MEDIUM Absolute_Path_Traversal /node_modules/flat/cli.js: 9
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/mocha/lib/cli/init.js: 23
MEDIUM Absolute_Path_Traversal /node_modules/node-addon-api/tools/check-napi.js: 100
MEDIUM Client_Privacy_Violation /media/view.js: 474
MEDIUM Client_Privacy_Violation /media/view.js: 474
MEDIUM Client_Privacy_Violation /media/view.js: 474
MEDIUM Missing_Encryption_of_Sensitive_Data /node_modules/browserslist/cli.js: 85
MEDIUM Missing_Encryption_of_Sensitive_Data /node_modules/browserslist/cli.js: 85
MEDIUM Missing_HSTS_Header /node_modules/hpagent/test/got.test.js: 18
MEDIUM SSL_Verification_Bypass /node_modules/typed-rest-client/HttpClient.js: 446
MEDIUM Unpinned Actions Full Length Commit SHA /release-please.yml: 10
MEDIUM Unpinned Actions Full Length Commit SHA /lint-pr.yaml: 15
MEDIUM Unpinned Actions Full Length Commit SHA /pr.yaml: 49
MEDIUM Unpinned Actions Full Length Commit SHA /node.js.yml: 29
MEDIUM Unpinned Actions Full Length Commit SHA /needs-more-info-closer.yaml: 21
LOW Client_DOM_Open_Redirect /node_modules/mocha/mocha.js: 11257
LOW Client_DOM_Open_Redirect /node_modules/mocha/lib/utils.js: 444
LOW Client_DOM_Open_Redirect /node_modules/got/dist/source/core/options.js: 699
LOW Client_JQuery_Deprecated_Symbols /node_modules/neo-async/async.min.js: 1005
LOW Client_JQuery_Deprecated_Symbols /node_modules/ajv/dist/ajv.min.js: 292
LOW Client_JQuery_Deprecated_Symbols /node_modules/ajv/dist/ajv.min.js: 292
LOW Client_JQuery_Deprecated_Symbols /node_modules/ajv/dist/ajv.min.js: 292
LOW Client_JQuery_Deprecated_Symbols /node_modules/neo-async/async.min.js: 1005
LOW Client_Password_In_Comment /node_modules/webpack-cli/node_modules/commander/lib/command.js: 2055
LOW Client_Password_In_Comment /node_modules/webpack-cli/node_modules/commander/lib/command.js: 1997
LOW Client_Password_In_Comment /node_modules/webpack-cli/node_modules/commander/lib/command.js: 1962
LOW Client_Password_In_Comment /node_modules/vscode-extension-tester/node_modules/commander/lib/command.js: 2189
LOW Client_Password_In_Comment /node_modules/vscode-extension-tester/node_modules/commander/lib/command.js: 2095
LOW Client_Password_In_Comment /node_modules/vscode-extension-tester/node_modules/commander/lib/command.js: 2060
LOW Client_Password_In_Comment /node_modules/chai/lib/chai/interface/assert.js: 107
LOW Client_Password_In_Comment /node_modules/chai/chai.js: 4333
LOW Client_Password_In_Comment /node_modules/@types/node/url.d.ts: 538
LOW Client_Password_In_Comment /node_modules/@types/node/tls.d.ts: 619
LOW Client_Password_In_Comment /node_modules/@types/node/tls.d.ts: 568
LOW Client_Password_In_Comment /node_modules/@types/node/tls.d.ts: 262
LOW Client_Password_In_Comment /node_modules/@types/node/process.d.ts: 507
LOW Client_Password_In_Comment /node_modules/@types/node/http2.d.ts: 1581
LOW Client_Password_In_Comment /node_modules/@types/node/http.d.ts: 1323
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 2865
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 2693
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 2158
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 2111
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 1828
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 1785
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 1153
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 1129
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 1086
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 941
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 895
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 885
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 863
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 853
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 820
LOW Client_Password_In_Comment /node_modules/@types/node/crypto.d.ts: 809
LOW Client_Password_In_Comment /node_modules/@types/node/assert.d.ts: 951
LOW Client_Password_In_Comment /node_modules/@types/node/assert.d.ts: 928
LOW Client_Password_In_Comment /node_modules/@types/node/assert.d.ts: 951
LOW Client_Password_In_Comment /node_modules/@types/node/tls.d.ts: 262
LOW Client_Password_In_Comment /node_modules/@types/node/tls.d.ts: 568
LOW Client_Password_In_Comment /node_modules/@types/node/tls.d.ts: 619
LOW Client_Password_In_Comment /node_modules/@types/node/process.d.ts: 507
LOW Client_Password_In_Comment /node_modules/@types/node/assert.d.ts: 928
LOW Client_Weak_Cryptographic_Hash /node_modules/file-entry-cache/cache.js: 47
LOW Client_Weak_Cryptographic_Hash /node_modules/cacheable-request/dist/index.js: 60
LOW Client_Weak_Cryptographic_Hash /node_modules/prebuild-install/node_modules/bl/test/test.js: 512
LOW Client_Weak_Cryptographic_Hash /node_modules/ws/lib/websocket.js: 920
LOW Client_Weak_Cryptographic_Hash /node_modules/file-entry-cache/cache.js: 47
LOW Client_Weak_Cryptographic_Hash /node_modules/ws/lib/websocket-server.js: 367
LOW Client_Weak_Cryptographic_Hash /node_modules/prebuild-install/node_modules/bl/test/test.js: 511
LOW Client_Weak_Cryptographic_Hash /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 373
LOW Client_Weak_Cryptographic_Hash /node_modules/bl/test/test.js: 403
LOW Client_Weak_Cryptographic_Hash /node_modules/prebuild-install/util.js: 77
LOW Heap_Inspection /node_modules/keytar/src/keytar_posix.cc: 164
LOW Heap_Inspection /node_modules/keytar/src/keytar_posix.cc: 107
LOW Heap_Inspection /node_modules/keytar/src/keytar_posix.cc: 55
LOW Heap_Inspection /node_modules/keytar/src/keytar_mac.cc: 226
LOW Heap_Inspection /node_modules/keytar/src/keytar_mac.cc: 223
LOW Heap_Inspection /node_modules/keytar/src/main.cc: 31
LOW Heap_Inspection /node_modules/keytar/src/async.cc: 216
LOW Heap_Inspection /node_modules/keytar/src/async.h: 24
LOW Log_Forging /node_modules/ajv/scripts/bundle.js: 8
LOW Log_Forging /node_modules/acorn/dist/bin.js: 37
LOW Log_Forging /node_modules/acorn/dist/bin.js: 40
LOW Log_Forging /node_modules/rimraf/bin.js: 21
LOW Log_Forging /node_modules/eslint-config-prettier/bin/cli.js: 34
LOW Log_Forging /node_modules/eslint-config-prettier/bin/cli.js: 34
LOW Log_Forging /node_modules/ajv/scripts/bundle.js: 8
LOW Log_Forging /node_modules/node-addon-api/tools/check-napi.js: 100
LOW Log_Forging /node_modules/semver/bin/semver.js: 6
LOW Log_Forging /node_modules/eslint-plugin-node/node_modules/semver/bin/semver.js: 6
LOW Log_Forging /node_modules/acorn/dist/bin.js: 37
LOW Log_Forging /node_modules/acorn/dist/bin.js: 40
LOW Log_Forging /node_modules/rimraf/bin.js: 21
LOW Log_Forging /node_modules/mkdirp/bin/cmd.js: 30
LOW Log_Forging /node_modules/minimist/example/parse.js: 1
LOW Log_Forging /node_modules/rc/cli.js: 4
LOW Missing_CSP_Header /node_modules/hpagent/test/got.test.js: 18
LOW Unprotected_Cookie /node_modules/selenium-webdriver/lib/webdriver.js: 2030
LOW Unprotected_Cookie /node_modules/got/dist/source/core/index.js: 934
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 318
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 317
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 316
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 315
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 314
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 313
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 318
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 317
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 316
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 315
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 314
LOW Use_Of_Hardcoded_Password /node_modules/azure-devops-node-api/opensource/node-http-ntlm/ntlm.js: 313
LOW Use_Of_Hardcoded_Password /node_modules/webpack/lib/sharing/utils.js: 260
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 201
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 212
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 151
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 140
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 48
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 201
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 212
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 151
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 140
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 48
LOW Use_Of_Hardcoded_Password /node_modules/hosted-git-info/index.js: 201
LOW

More results are available on AST platform

@AlvoBen AlvoBen changed the title Upgrade js-wrapper version (AST-41951) VSCode | Upgrade js-wrapper version (AST-41951) May 8, 2024
@AlvoBen AlvoBen merged commit 0a507c2 into main May 8, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@checkmarx-kobi-hagmi checkmarx-kobi-hagmi checkmarx-kobi-hagmi approved these changes

@margaritalm margaritalm Awaiting requested review from margaritalm margaritalm was automatically assigned from Checkmarx/ast-galactica-team

@tiagobcx tiagobcx Awaiting requested review from tiagobcx tiagobcx was automatically assigned from Checkmarx/ast-galactica-team

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@AlvoBen @checkmarx-kobi-hagmi @BenAlvo1