diff --git a/.github/workflows/monorepo-validate.yaml b/.github/workflows/monorepo-validate.yaml index 10a73f9a3..d2c3c1615 100644 --- a/.github/workflows/monorepo-validate.yaml +++ b/.github/workflows/monorepo-validate.yaml @@ -19,23 +19,6 @@ jobs: if: steps.cache.outputs.cache-hit != 'true' - run: yarn run compliance:licenses - audit: - name: Security Audit - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: actions/cache@v2 - id: cache - with: - path: '**/node_modules' - key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }} - - uses: actions/setup-node@v1 - with: - node-version: '12.x' - - run: yarn install - if: steps.cache.outputs.cache-hit != 'true' - - run: yarn run compliance:audit - lint: name: Lint runs-on: ubuntu-latest diff --git a/addons/api/addon/initializers/fragment-string.js b/addons/api/addon/initializers/fragment-string.js new file mode 100644 index 000000000..4ed82346a --- /dev/null +++ b/addons/api/addon/initializers/fragment-string.js @@ -0,0 +1,12 @@ +// app/initializers/fragment-serializer.js +import FragmentStringSerializer from '../serializers/fragment-string'; + +export function initialize(application) { + application.register('serializer:fragment-string', FragmentStringSerializer); +} + +// Fragment serializers must be manually registered +export default { + name: 'fragment-string', + initialize: initialize, +}; diff --git a/addons/api/addon/models/auth-method.js b/addons/api/addon/models/auth-method.js index 699f5137e..dc03abc0d 100644 --- a/addons/api/addon/models/auth-method.js +++ b/addons/api/addon/models/auth-method.js @@ -7,7 +7,7 @@ import { equal } from '@ember/object/computed'; */ export const options = { oidc: { - signing_algorithm: [ + signing_algorithms: [ 'RS256', 'RS384', 'RS512', diff --git a/addons/api/addon/models/fragment-auth-method-attributes.js b/addons/api/addon/models/fragment-auth-method-attributes.js index b023401f2..3fdcb8e47 100644 --- a/addons/api/addon/models/fragment-auth-method-attributes.js +++ b/addons/api/addon/models/fragment-auth-method-attributes.js @@ -9,10 +9,10 @@ export default class FragmentAuthMethodAttributesModel extends Fragment { @attr('string') issuer; @attr('string') client_id; @attr('string') client_secret; - @attr('string') client_secret_hmac; + @attr('string', { readOnly: true }) client_secret_hmac; @attr('number') max_age; @attr('string') api_url_prefix; - @attr('string') callback_url; + @attr('string', { readOnly: true }) callback_url; @attr('boolean') disable_discovered_config_validation; @attr('boolean') dry_run; @@ -20,4 +20,21 @@ export default class FragmentAuthMethodAttributesModel extends Fragment { emptyArrayIfMissing: true, }) account_claim_maps; + + @fragmentArray('fragment-string', { + emptyArrayIfMissing: true, + }) + claims_scopes; + + @fragmentArray('fragment-string', { + emptyArrayIfMissing: true, + }) + signing_algorithms; + + @fragmentArray('fragment-string', { + emptyArrayIfMissing: true, + }) + allowed_audiences; + + @fragmentArray('fragment-string', { emptyArrayIfMissing: true }) idp_ca_certs; } diff --git a/addons/api/addon/serializers/fragment-auth-method-attributes.js b/addons/api/addon/serializers/fragment-auth-method-attributes.js new file mode 100644 index 000000000..1abc73573 --- /dev/null +++ b/addons/api/addon/serializers/fragment-auth-method-attributes.js @@ -0,0 +1,26 @@ +import JSONSerializer from '@ember-data/serializer/json'; + +export default class FragmentAuthMethodAttributesSerializer extends JSONSerializer { + /** + * If an attribute is annotated as readOnly in the model, don't serialize it. + * Otherwise delegate to default attribute serializer. + * + * @override + * @method serializeAttribute + * @param {Snapshot} snapshot + * @param {Object} json + * @param {String} key + * @param {Object} attribute + */ + serializeAttribute(snapshot, json, key, attribute) { + const { type, options } = attribute; + let value = super.serializeAttribute(...arguments); + // Convert empty strings to null. + if (type === 'string' && json[key] === '') json[key] = null; + // Do not serialize read-only attributes. + if (options.readOnly) delete json[key]; + // Client secret cannot be unset. If it's falsy, it must be removed. + if (key === 'client_secret' && !json[key]) delete json[key]; + return value; + } +} diff --git a/addons/api/addon/serializers/fragment-string.js b/addons/api/addon/serializers/fragment-string.js new file mode 100644 index 000000000..9b10f74d1 --- /dev/null +++ b/addons/api/addon/serializers/fragment-string.js @@ -0,0 +1,24 @@ +import JSONSerializer from '@ember-data/serializer/json'; + +export default class FragmentStringSerializer extends JSONSerializer { + // =methods + + /** + * Serializes a to string. + * @param {Snapshot} snapshot + * @return {string} + */ + serialize(snapshot) { + return snapshot.attr('value'); + } + + /** + * Normalizes from strings. + * @param {Model} typeClass + * @param {string} value + * @return {object} + */ + normalize(typeClass, value) { + return super.normalize(typeClass, { value }); + } +} diff --git a/addons/api/addon/serializers/host-set.js b/addons/api/addon/serializers/host-set.js index 5bdb2d028..f0e0c25ad 100644 --- a/addons/api/addon/serializers/host-set.js +++ b/addons/api/addon/serializers/host-set.js @@ -37,21 +37,4 @@ export default class HostSetSerializer extends ApplicationSerializer { host_ids: hostIDs, }; } - - /** - * Converts string arrays to object arrays for use with `fragment-string`. - * E.g. `"foo"` -> `{value: "foo"}` - * @override - * @param {Model} modelClass - * @param {Object} resourceHash - * @return {Object} - */ - normalize(modelClass, resourceHash) { - // TODO: can fragment string normalization be handled generically? - // TODO: host_ids might actually be attributes.host_ids - if (resourceHash.host_ids) { - resourceHash.host_ids = resourceHash.host_ids.map((value) => ({ value })); - } - return super.normalize(modelClass, resourceHash); - } } diff --git a/addons/api/app/initializers/fragment-string.js b/addons/api/app/initializers/fragment-string.js new file mode 100644 index 000000000..813fb5c5a --- /dev/null +++ b/addons/api/app/initializers/fragment-string.js @@ -0,0 +1 @@ +export { default, initialize } from 'api/initializers/fragment-string'; diff --git a/addons/api/app/serializers/fragment-auth-method-attributes.js b/addons/api/app/serializers/fragment-auth-method-attributes.js new file mode 100644 index 000000000..031baf9e3 --- /dev/null +++ b/addons/api/app/serializers/fragment-auth-method-attributes.js @@ -0,0 +1 @@ +export { default } from 'api/serializers/fragment-auth-method-attributes'; diff --git a/addons/api/app/serializers/fragment-string.js b/addons/api/app/serializers/fragment-string.js new file mode 100644 index 000000000..8e61ed28e --- /dev/null +++ b/addons/api/app/serializers/fragment-string.js @@ -0,0 +1 @@ +export { default } from 'api/serializers/fragment-string'; diff --git a/addons/api/mirage/generated/factories/auth-method.js b/addons/api/mirage/generated/factories/auth-method.js index 8fd338a53..89df46c74 100644 --- a/addons/api/mirage/generated/factories/auth-method.js +++ b/addons/api/mirage/generated/factories/auth-method.js @@ -23,7 +23,14 @@ export default Factory.extend({ client_id: 'YTwdJBB55LpKnuXb9n65', client_secret_hmac: 'GY7blb4ynM5TEPNi_qnphJ9aDWhW8FpmN3D-eP_L7Zk', issuer: 'http://127.0.0.1:57070', + max_age: 1800, + disable_discovered_config_validation: false, state: 'active-public', + account_claim_maps: ['oid=sub', 'full_name=name'], + claims_scopes: ['profile', 'email'], + signing_algorithms: ['RS256', 'RS384'], + allowed_audiences: ['www.alice.com', 'www.alice.com/admin'], + idp_ca_certs: ['certificate-1234', 'certificate-5678'], }; break; } diff --git a/addons/api/package.json b/addons/api/package.json index e96dd09f7..d5e59aa63 100644 --- a/addons/api/package.json +++ b/addons/api/package.json @@ -28,7 +28,7 @@ "ember-cli-htmlbars": "^5.3.1", "ember-cli-mirage": "^1.1.8", "ember-data": "^3.20.0", - "ember-data-model-fragments": "5.0.0-beta.0", + "ember-data-model-fragments": "5.0.0-beta.2", "ember-fetch": "^8.0.1" }, "devDependencies": { diff --git a/addons/api/tests/unit/initializers/fragment-string-test.js b/addons/api/tests/unit/initializers/fragment-string-test.js new file mode 100644 index 000000000..6779bb9ff --- /dev/null +++ b/addons/api/tests/unit/initializers/fragment-string-test.js @@ -0,0 +1,32 @@ +import Application from '@ember/application'; + +import { initialize } from 'dummy/initializers/fragment-string'; +import { module, test } from 'qunit'; +import Resolver from 'ember-resolver'; +import { run } from '@ember/runloop'; + +module('Unit | Initializer | fragment-string', function (hooks) { + hooks.beforeEach(function () { + this.TestApplication = class TestApplication extends Application {}; + this.TestApplication.initializer({ + name: 'initializer under test', + initialize, + }); + + this.application = this.TestApplication.create({ + autoboot: false, + Resolver, + }); + }); + + hooks.afterEach(function () { + run(this.application, 'destroy'); + }); + + // TODO: Replace this with your real tests. + test('it works', async function (assert) { + await this.application.boot(); + + assert.ok(true); + }); +}); diff --git a/addons/api/tests/unit/serializers/auth-method-test.js b/addons/api/tests/unit/serializers/auth-method-test.js index 95706c401..c28338b8e 100644 --- a/addons/api/tests/unit/serializers/auth-method-test.js +++ b/addons/api/tests/unit/serializers/auth-method-test.js @@ -36,6 +36,23 @@ module('Unit | Serializer | auth method', function (hooks) { attributes: { state: 'foo', account_claim_maps: [{ from: 'foo', to: 'bar' }], + claims_scopes: [{ value: 'profile' }, { value: 'email' }], + signing_algorithms: [{ value: 'RS256' }, { value: 'RS384' }], + allowed_audiences: [ + { value: 'www.alice.com' }, + { value: 'www.alice.com/admin' }, + ], + idp_ca_certs: [ + { value: 'certificate-1234' }, + { value: 'certificate-5678' }, + ], + api_url_prefix: 'protocol://host:port/foo', + client_id: 'id123', + client_secret: 'secret456', + disable_discovered_config_validation: true, + dry_run: true, + issuer: 'http://www.example.net', + max_age: 500, }, }); @@ -47,15 +64,17 @@ module('Unit | Serializer | auth method', function (hooks) { description: null, attributes: { account_claim_maps: ['foo=bar'], - api_url_prefix: null, - callback_url: null, - client_id: null, - client_secret: null, - client_secret_hmac: null, - disable_discovered_config_validation: false, - dry_run: false, - issuer: null, - max_age: null, + claims_scopes: ['profile', 'email'], + signing_algorithms: ['RS256', 'RS384'], + allowed_audiences: ['www.alice.com', 'www.alice.com/admin'], + idp_ca_certs: ['certificate-1234', 'certificate-5678'], + api_url_prefix: 'protocol://host:port/foo', + client_id: 'id123', + client_secret: 'secret456', + disable_discovered_config_validation: true, + dry_run: true, + issuer: 'http://www.example.net', + max_age: 500, }, }); }); diff --git a/addons/api/tests/unit/serializers/fragment-auth-method-attributes-test.js b/addons/api/tests/unit/serializers/fragment-auth-method-attributes-test.js new file mode 100644 index 000000000..a099c1944 --- /dev/null +++ b/addons/api/tests/unit/serializers/fragment-auth-method-attributes-test.js @@ -0,0 +1,37 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module('Unit | Serializer | fragment auth method attributes', function (hooks) { + setupTest(hooks); + + test('it serializes empty strings to null', function (assert) { + assert.expect(1); + const store = this.owner.lookup('service:store'); + const record = store.createRecord('user', { + name: '', + description: '', + version: null, + }); + let serializedRecord = record.serialize(); + assert.deepEqual(serializedRecord, { + name: null, + description: null, + }); + }); + + test('it does not serialize client_secret if present but falsy', function (assert) { + assert.expect(1); + const store = this.owner.lookup('service:store'); + const record = store.createRecord('user', { + name: '', + description: '', + version: null, + client_secret: false, + }); + let serializedRecord = record.serialize(); + assert.deepEqual(serializedRecord, { + name: null, + description: null, + }); + }); +}); diff --git a/addons/api/tests/unit/serializers/fragment-string-test.js b/addons/api/tests/unit/serializers/fragment-string-test.js new file mode 100644 index 000000000..0dac16e71 --- /dev/null +++ b/addons/api/tests/unit/serializers/fragment-string-test.js @@ -0,0 +1,49 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module('Unit | Serializer | fragment string', function (hooks) { + setupTest(hooks); + + // Replace this with your real tests. + test('it exists', function (assert) { + let store = this.owner.lookup('service:store'); + let serializer = store.serializerFor('fragment-string'); + + assert.ok(serializer); + }); + + test('it serializes records', function (assert) { + let store = this.owner.lookup('service:store'); + let record = store.createRecord('fragment-string', { + value: 'string value', + }); + + let serializedRecord = record.serialize(); + + assert.equal(serializedRecord, 'string value'); + }); + + test('it normalizes records', function (assert) { + assert.expect(1); + const store = this.owner.lookup('service:store'); + const serializer = store.serializerFor('fragment-string'); + const modelClass = store.createRecord('fragment-string').constructor; + const payload = 'string value'; + const normalized = serializer.normalizeSingleResponse( + store, + modelClass, + payload + ); + assert.deepEqual(normalized, { + included: [], + data: { + id: null, + type: 'fragment-string', + attributes: { + value: 'string value', + }, + relationships: {}, + }, + }); + }); +}); diff --git a/addons/core/translations/form/en-us.yaml b/addons/core/translations/form/en-us.yaml index dfd2362a4..974b2d313 100644 --- a/addons/core/translations/form/en-us.yaml +++ b/addons/core/translations/form/en-us.yaml @@ -51,3 +51,22 @@ origin: description: The Boundary URL to which to connect (e.g. protocol://host:port) proxy: label: Proxy +issuer: + label: Issuer + help: The issuer URL. Boundary expects only the schema, host, and port and will strip off ".well-known/openid-configuration" if present. This will be used for configuration discovery as well as for validation of the "iss" claim. +client_id: + label: Client ID + help: An OAuth 2.0 Client Identifier valid at the Authorization Server. +client_secret: + label: Client Secret + description: The client secret is set-only, may not be unset, and will not appear after a successful save. +max_age: + label: Maximum Age + help: The OIDC "max_age" parameter sent to the Authorization Server indicating a maximum acceptable time in seconds since the user's last authentication before requiring the user to reauthenticate. 0 indicates an immediate need to reauthenticate. +api_url_prefix: + label: API URL Prefix + help: The prefix that should be used for any URLs needed during the authentication flow. This includes the callback URL, the token retrieval URL, and the redirection URL used by the OIDC Authorization Server. +disable_discovered_config_validation: + label: Disable discovered config validation + help: > + If the Authorization Server's discovered configuration contains values that do not match the configuration set on this auth method, this can be set to force the local configuration to override the discovered values. This is useful in the case of slow-changing or incorrect values announced by the Authorization Server. NOTE: For safety, not providing this value will be treated the same as "false"; that is, every time the method is updated or the state is changed, this value must be set to "true" or it will be disabled. diff --git a/addons/rose/addon/components/rose/form/checkbox/index.hbs b/addons/rose/addon/components/rose/form/checkbox/index.hbs index eed07f19d..a660c270d 100644 --- a/addons/rose/addon/components/rose/form/checkbox/index.hbs +++ b/addons/rose/addon/components/rose/form/checkbox/index.hbs @@ -8,7 +8,7 @@ disabled={{@disabled}} @type="checkbox" @checked={{if @checked true false}} - aria-describedby="{{if @error (concat 'errors-' this.id)}}" /> + aria-describedby="{{if @helperText (concat 'helper-text-' this.id)}} {{if @error (concat 'errors-' this.id)}}" /> + {{#if @helperText}} + + {{@helperText}} + + {{/if}} + {{yield (hash errors=(component 'rose/form/errors' id=(concat 'errors-' this.id)) )}} diff --git a/addons/rose/addon/components/rose/form/checkbox/index.stories.mdx b/addons/rose/addon/components/rose/form/checkbox/index.stories.mdx index 539f531c0..4f98fed53 100644 --- a/addons/rose/addon/components/rose/form/checkbox/index.stories.mdx +++ b/addons/rose/addon/components/rose/form/checkbox/index.stories.mdx @@ -26,6 +26,7 @@ Renders a form input checkbox. @name={{name}} @label={{label}} @description={{description}} + @helperText={{helperText}} @checked={{checked}} @error={{error}} @disabled={{disabled}} @@ -33,7 +34,8 @@ Renders a form input checkbox. `, context: { label: text('text', 'Checkbox 🛎'), - description: text('description', 'This is an optional description paragraph.'), + description: text('description', 'Short description in label'), + helperText: text('helperText', 'This is an optional help text.'), name: text('name', 'checkbox-1'), checked: boolean('checked', false), error: boolean('error', false), diff --git a/addons/rose/addon/components/rose/table/row/cell/index.js b/addons/rose/addon/components/rose/table/row/cell/index.js index 588c072cf..a19a38c27 100644 --- a/addons/rose/addon/components/rose/table/row/cell/index.js +++ b/addons/rose/addon/components/rose/table/row/cell/index.js @@ -13,16 +13,16 @@ export default Component.extend({ }), cellShrink: computed(function () { if (this.shrink) { - return 'rose-table-cell-shrink' + return 'rose-table-cell-shrink'; } }), cellAlignmentStyle: computed(function () { if (this.alignRight) { return 'align-right'; } - + if (this.alignCenter) { return 'align-center'; } - }) + }), }); diff --git a/addons/rose/addon/styles/rose/components/form/_checkbox.scss b/addons/rose/addon/styles/rose/components/form/_checkbox.scss index 2b5008a0b..ec86a0367 100644 --- a/addons/rose/addon/styles/rose/components/form/_checkbox.scss +++ b/addons/rose/addon/styles/rose/components/form/_checkbox.scss @@ -4,14 +4,17 @@ .rose-form-checkbox { @include type.type(m); position: relative; - margin-bottom: sizing.rems(xs); - color: var(--ui-gray); + margin-bottom: sizing.rems(m); .rose-form-errors { margin-top: sizing.rems(xs); margin-bottom: sizing.rems(xs); } + .rose-form-helper-text { + padding-left: sizing.rems(l); + } + .rose-form-checkbox-label { // label styles @include type.type(s, semibold); @@ -23,6 +26,7 @@ } .rose-form-checkbox-label-description { + margin-bottom: 0; margin-top: sizing.rems(xs); } @@ -54,6 +58,10 @@ } } + .rose-form-helper-text { + margin-top: sizing.rems(xs); + } + .rose-form-checkbox-field { // mostly this just visually hides the native checkbox position: absolute; diff --git a/addons/rose/addon/styles/rose/components/table/_table.scss b/addons/rose/addon/styles/rose/components/table/_table.scss index f9b7b9daf..81a815a24 100644 --- a/addons/rose/addon/styles/rose/components/table/_table.scss +++ b/addons/rose/addon/styles/rose/components/table/_table.scss @@ -12,9 +12,9 @@ // This styles are add to stop the input to apply extra margin (default on forms) .rose-form-input-field, - .rose-form-select, - .rose-form-input { - margin: 0; + .rose-form-select, + .rose-form-input { + margin: 0; width: 100%; } @@ -22,8 +22,12 @@ .rose-table-header-cell { vertical-align: middle; - &.align-right { text-align: right; } - &.align-center { text-align: center; } + &.align-right { + text-align: right; + } + &.align-center { + text-align: center; + } } .rose-table-header-cell { @@ -62,7 +66,6 @@ line-height: $lineHeight; padding: (sizing.rems(s) / 2) sizing.rems(s); } - } .rose-table-row-visually-hidden { diff --git a/addons/rose/tests/integration/components/rose/form/checkbox-test.js b/addons/rose/tests/integration/components/rose/form/checkbox-test.js index 12597d3af..594704918 100644 --- a/addons/rose/tests/integration/components/rose/form/checkbox-test.js +++ b/addons/rose/tests/integration/components/rose/form/checkbox-test.js @@ -9,9 +9,9 @@ module('Integration | Component | rose/form/checkbox', function (hooks) { test('it renders', async function (assert) { assert.expect(3); await render(hbs``); - assert.equal(await find('label').textContent.trim(), 'Label'); - assert.ok(await find('input')); - assert.notOk(await find('.rose-form-checkbox-label-description')); + assert.equal(find('label').textContent.trim(), 'Label'); + assert.ok(find('input')); + assert.notOk(find('.rose-form-checkbox-label-description')); }); test('it renders optional description paragraph', async function (assert) { @@ -20,14 +20,25 @@ module('Integration | Component | rose/form/checkbox', function (hooks) { hbs`` ); assert.equal( - await find('.rose-form-checkbox-label-text').textContent.trim(), + find('.rose-form-checkbox-label-text').textContent.trim(), 'Label' ); assert.equal( - await find('.rose-form-checkbox-label-description').textContent.trim(), + find('.rose-form-checkbox-label-description').textContent.trim(), + 'Hello world' + ); + assert.ok(find('input')); + }); + + test('it renders optional helper text', async function (assert) { + assert.expect(1); + await render( + hbs`` + ); + assert.equal( + find('.rose-form-helper-text').textContent.trim(), 'Hello world' ); - assert.ok(await find('input')); }); test('it displays optional errors', async function (assert) { @@ -49,26 +60,26 @@ module('Integration | Component | rose/form/checkbox', function (hooks) { test('it is not checked by default', async function (assert) { await render(hbs``); - assert.equal(await find('input').checked, false); + assert.equal(find('input').checked, false); }); test('it is not disabled by default', async function (assert) { await render(hbs``); - assert.equal(await find('input').disabled, false); + assert.equal(find('input').disabled, false); }); test('it is checked when @checked={{true}}', async function (assert) { await render(hbs``); - assert.equal(await find('input').checked, true); + assert.equal(find('input').checked, true); }); test('it marks error when @error={{true}}', async function (assert) { await render(hbs``); - assert.ok(await find('.error')); + assert.ok(find('.error')); }); test('it is disabled when @disabled={{true}}', async function (assert) { await render(hbs``); - assert.equal(await find('input').disabled, true); + assert.equal(find('input').disabled, true); }); }); diff --git a/package.json b/package.json index 267a13692..29f13e814 100644 --- a/package.json +++ b/package.json @@ -30,8 +30,7 @@ "test:addons-rose": "cd addons/rose && yarn test", "test:ui-admin": "cd ui/admin && yarn test", "test:ui-desktop": "cd ui/desktop && yarn test", - "compliance:audit": "bash ./scripts/yarn-audit.sh", - "precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test", + "precommit": "yarn compliance:licenses && yarn lint && yarn test", "commit": "git-cz", "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Python-2.0;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2;cycle@1.0.3'", "doc:toc": "doctoc README.md" diff --git a/scripts/yarn-audit.sh b/scripts/yarn-audit.sh deleted file mode 100644 index 4b5bd702c..000000000 --- a/scripts/yarn-audit.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/usr/bin/env bash - -# Workaround to suppress yarn audit report for issues without known resolutions. -# Audit level: Moderate -# https://github.com/yarnpkg/yarn/issues/6669 - -set -u - -set +e -output=$(yarn audit --level=moderate --json) -result=$? -set -e - -if [ $result -eq 0 ]; then - # everything is fine - exit 0 -fi - -if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then - echo - echo Ignorning known vulnerabilities - exit 0 -fi - -echo -echo Security vulnerabilities were found that were not ignored -echo -echo Check to see if these vulnerabilities apply to production -echo and/or if they have fixes available. If they do not have -echo fixes and they do not apply to production, you may ignore them -echo -echo To ignore these vulnerabilities, run: -echo -echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues" -echo -echo and commit the yarn-audit-known-issues file - -exit "$result" diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs new file mode 100644 index 000000000..f157e5090 --- /dev/null +++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs @@ -0,0 +1,168 @@ + + + + + {{#if @model.errors.name}} + + {{#each @model.errors.name as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + {{#if @model.errors.description}} + + {{#each @model.errors.description as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + {{#if @model.errors.attributes.issuer}} + + {{#each @model.errors.attributes.issuer as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + + + {{#if @model.errors.attributes.client_id}} + + {{#each @model.errors.attributes.client_id as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + {{#if @model.errors.attributes.client_secret}} + + {{#each @model.errors.attributes.client_secret as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + {{#if @model.errors.attributes.max_age}} + + {{#each @model.errors.attributes.max_age as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + {{#if @model.errors.attributes.api_url_prefix}} + + {{#each @model.errors.attributes.api_url_prefix as |error|}} + {{error.message}} + {{/each}} + + {{/if}} + + + + \ No newline at end of file diff --git a/ui/admin/config/environment.js b/ui/admin/config/environment.js index 14982afa1..21d1e3da6 100644 --- a/ui/admin/config/environment.js +++ b/ui/admin/config/environment.js @@ -86,9 +86,9 @@ module.exports = function (environment) { }, featureFlags: { + 'primary-auth-method': true, oidc: true, 'oidc-crud': false, - 'primary-auth-method': true, search: false, filter: false, capabilities: false, @@ -130,7 +130,7 @@ module.exports = function (environment) { // Enable features in development ENV.featureFlags['primary-auth-method'] = true; ENV.featureFlags['oidc'] = true; - //ENV.featureFlags['oidc-crud'] = true; + ENV.featureFlags['oidc-crud'] = true; } if (environment === 'test') { diff --git a/ui/desktop/electron-app/src/helpers/app-updater.js b/ui/desktop/electron-app/src/helpers/app-updater.js index 1898c6ac6..c27ee75e5 100644 --- a/ui/desktop/electron-app/src/helpers/app-updater.js +++ b/ui/desktop/electron-app/src/helpers/app-updater.js @@ -33,12 +33,12 @@ const findLatestVersion = (url) => { // Find zip archive for update const findUpdateArchive = (version) => { - const url = `${releasesUrl}boundary-desktop_${version}/boundary-desktop_${version}_darwin_amd64.zip`; + const url = `${releasesUrl}${version}/boundary-desktop_${version}_darwin_amd64.zip`; return new Promise((resolve, reject) => { https.get(url, (response) => { if (response.statusCode === 403) reject({ message: 'Archive not available' }); - response.on('end', () => resolve(url)); + if (response.statusCode === 200) resolve(url); response.on('error', (err) => reject(err)); }); }); @@ -136,7 +136,10 @@ module.exports = { latestVersion = semver.coerce(latestVersion); } - // Update not available - do nothing + /** + * Update not available - do nothing + * lte(v1, v2): v1 <= v2 + **/ if (semver.lte(latestVersion, currentVersion)) { if (!suppressNoUpdatePrompt) displayInfoPrompt(); return; diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues deleted file mode 100644 index 74ce49273..000000000 --- a/yarn-audit-known-issues +++ /dev/null @@ -1,14 +0,0 @@ -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} diff --git a/yarn.lock b/yarn.lock index 497898c23..d89874aa1 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8278,39 +8278,6 @@ ember-cli-babel-plugin-helpers@^1.0.0, ember-cli-babel-plugin-helpers@^1.1.0, em resolved "https://registry.yarnpkg.com/ember-cli-babel-plugin-helpers/-/ember-cli-babel-plugin-helpers-1.1.1.tgz#5016b80cdef37036c4282eef2d863e1d73576879" integrity sha512-sKvOiPNHr5F/60NLd7SFzMpYPte/nnGkq/tMIfXejfKHIhaiIkYFqX8Z9UFTKWLLn+V7NOaby6niNPZUdvKCRw== -ember-cli-babel@7, ember-cli-babel@^7.0.0, ember-cli-babel@^7.1.0, ember-cli-babel@^7.1.2, ember-cli-babel@^7.10.0, ember-cli-babel@^7.11.1, ember-cli-babel@^7.13.0, ember-cli-babel@^7.13.2, ember-cli-babel@^7.18.0, ember-cli-babel@^7.19.0, ember-cli-babel@^7.20.5, ember-cli-babel@^7.21.0, ember-cli-babel@^7.22.1, ember-cli-babel@^7.23.0, ember-cli-babel@^7.23.1, ember-cli-babel@^7.26.2, ember-cli-babel@^7.26.3, ember-cli-babel@^7.4.0, ember-cli-babel@^7.5.0, ember-cli-babel@^7.7.3: - version "7.26.3" - resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.26.3.tgz#e93ce7ec458208894d10844cf76e41cc06fdbeb6" - integrity sha512-ZCs0g99d3kYaHs1+HT33oMY7/K+nLCAAv7dCLxsMzg7cQf55O6Pq4ZKnWEr3IHVs33xbJFnEb9prt1up36QVnw== - dependencies: - "@babel/core" "^7.12.0" - "@babel/helper-compilation-targets" "^7.12.0" - "@babel/plugin-proposal-class-properties" "^7.13.0" - "@babel/plugin-proposal-decorators" "^7.13.5" - "@babel/plugin-transform-modules-amd" "^7.13.0" - "@babel/plugin-transform-runtime" "^7.13.9" - "@babel/plugin-transform-typescript" "^7.13.0" - "@babel/polyfill" "^7.11.5" - "@babel/preset-env" "^7.12.0" - "@babel/runtime" "7.12.18" - amd-name-resolver "^1.3.1" - babel-plugin-debug-macros "^0.3.4" - babel-plugin-ember-data-packages-polyfill "^0.1.2" - babel-plugin-ember-modules-api-polyfill "^3.5.0" - babel-plugin-module-resolver "^3.2.0" - broccoli-babel-transpiler "^7.8.0" - broccoli-debug "^0.6.4" - broccoli-funnel "^2.0.2" - broccoli-source "^2.1.2" - clone "^2.1.2" - ember-cli-babel-plugin-helpers "^1.1.1" - ember-cli-version-checker "^4.1.0" - ensure-posix-path "^1.0.2" - fixturify-project "^1.10.0" - resolve-package-path "^3.1.0" - rimraf "^3.0.1" - semver "^5.5.0" - ember-cli-babel@7.21.0: version "7.21.0" resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.21.0.tgz#c79e888876aee87dfc3260aee7cb580b74264bbc" @@ -8362,6 +8329,39 @@ ember-cli-babel@^6.0.0-beta.4, ember-cli-babel@^6.16.0, ember-cli-babel@^6.3.0, ember-cli-version-checker "^2.1.2" semver "^5.5.0" +ember-cli-babel@^7.0.0, ember-cli-babel@^7.1.0, ember-cli-babel@^7.1.2, ember-cli-babel@^7.10.0, ember-cli-babel@^7.11.1, ember-cli-babel@^7.13.0, ember-cli-babel@^7.13.2, ember-cli-babel@^7.18.0, ember-cli-babel@^7.19.0, ember-cli-babel@^7.20.5, ember-cli-babel@^7.21.0, ember-cli-babel@^7.22.1, ember-cli-babel@^7.23.0, ember-cli-babel@^7.23.1, ember-cli-babel@^7.26.2, ember-cli-babel@^7.26.3, ember-cli-babel@^7.4.0, ember-cli-babel@^7.5.0, ember-cli-babel@^7.7.3: + version "7.26.3" + resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.26.3.tgz#e93ce7ec458208894d10844cf76e41cc06fdbeb6" + integrity sha512-ZCs0g99d3kYaHs1+HT33oMY7/K+nLCAAv7dCLxsMzg7cQf55O6Pq4ZKnWEr3IHVs33xbJFnEb9prt1up36QVnw== + dependencies: + "@babel/core" "^7.12.0" + "@babel/helper-compilation-targets" "^7.12.0" + "@babel/plugin-proposal-class-properties" "^7.13.0" + "@babel/plugin-proposal-decorators" "^7.13.5" + "@babel/plugin-transform-modules-amd" "^7.13.0" + "@babel/plugin-transform-runtime" "^7.13.9" + "@babel/plugin-transform-typescript" "^7.13.0" + "@babel/polyfill" "^7.11.5" + "@babel/preset-env" "^7.12.0" + "@babel/runtime" "7.12.18" + amd-name-resolver "^1.3.1" + babel-plugin-debug-macros "^0.3.4" + babel-plugin-ember-data-packages-polyfill "^0.1.2" + babel-plugin-ember-modules-api-polyfill "^3.5.0" + babel-plugin-module-resolver "^3.2.0" + broccoli-babel-transpiler "^7.8.0" + broccoli-debug "^0.6.4" + broccoli-funnel "^2.0.2" + broccoli-source "^2.1.2" + clone "^2.1.2" + ember-cli-babel-plugin-helpers "^1.1.1" + ember-cli-version-checker "^4.1.0" + ensure-posix-path "^1.0.2" + fixturify-project "^1.10.0" + resolve-package-path "^3.1.0" + rimraf "^3.0.1" + semver "^5.5.0" + ember-cli-babel@^7.24.0: version "7.26.4" resolved "https://registry.yarnpkg.com/ember-cli-babel/-/ember-cli-babel-7.26.4.tgz#b73d53592c05479814ca1770b3b849d4e01a87f0" @@ -8884,25 +8884,32 @@ ember-cookies@^0.5.0, ember-cookies@^0.5.2: ember-cli-babel "^7.1.0" ember-getowner-polyfill "^1.1.0 || ^2.0.0" -ember-copy@1.0.0, ember-copy@^1.0.0: +ember-copy@2.0.1: + version "2.0.1" + resolved "https://registry.yarnpkg.com/ember-copy/-/ember-copy-2.0.1.tgz#13192b12a250324bb4a8b4547a680b113f4e3041" + integrity sha512-N/XFvZszrzyyX4IcNoeK4mJvIItNuONumhPLqi64T8NDjJkxBj4Pq61rvMkJx/9eZ8alzE4I8vYKOLxT0FvRuQ== + dependencies: + ember-cli-babel "^7.22.1" + +ember-copy@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/ember-copy/-/ember-copy-1.0.0.tgz#426554ba6cf65920f31d24d0a3ca2cb1be16e4aa" integrity sha512-aiZNAvOmdemHdvZNn0b5b/0d9g3JFpcOsrDgfhYEbfd7SzE0b69YiaVK2y3wjqfjuuiA54vOllGN4pjSzECNSw== dependencies: ember-cli-babel "^6.6.0" -ember-data-model-fragments@5.0.0-beta.0: - version "5.0.0-beta.0" - resolved "https://registry.yarnpkg.com/ember-data-model-fragments/-/ember-data-model-fragments-5.0.0-beta.0.tgz#da90799970317ca852f96b2ea1548ca70094a5bb" - integrity sha512-vjApz3ZWSiLyUUU2IRi/ArKVBJe+iW+BvKkiQ6an/e7ln4Jt06P9xXm1Fu3hfqkQOQlfn7QkUnlzm4XxRtlMfg== +ember-data-model-fragments@5.0.0-beta.2: + version "5.0.0-beta.2" + resolved "https://registry.yarnpkg.com/ember-data-model-fragments/-/ember-data-model-fragments-5.0.0-beta.2.tgz#cc5f6e37363216a227394b31beb8eecc4c267a3e" + integrity sha512-LMObs51btOpHFX0DABReU68hpzkZp/yCKCh5w6CSGEm7MM5Bcj8p7Wb4GQIPZANKidVSvdCOT4qnyCREyUatBg== dependencies: broccoli-file-creator "^2.1.1" broccoli-merge-trees "^3.0.0" calculate-cache-key-for-tree "^1.1.0" - ember-cli-babel "7" + ember-cli-babel "^7.23.0" ember-compatibility-helpers "^1.2.1" - ember-copy "1.0.0" - git-repo-info "^2.0.0" + ember-copy "2.0.1" + git-repo-info "^2.1.1" npm-git-info "^1.0.3" ember-data@^3.20.0: @@ -11307,7 +11314,7 @@ git-read-pkt-line@0.0.8: bops "0.0.3" through "~2.2.7" -git-repo-info@^2.0.0, git-repo-info@^2.1.1: +git-repo-info@^2.1.1: version "2.1.1" resolved "https://registry.yarnpkg.com/git-repo-info/-/git-repo-info-2.1.1.tgz#220ffed8cbae74ef8a80e3052f2ccb5179aed058" integrity sha512-8aCohiDo4jwjOwma4FmYFd3i97urZulL8XL24nIPxuE+GZnfsAyy/g2Shqx6OjUiFKUXZM+Yy+KHnOmmA3FVcg==