Skip to content

[Snyk] Upgrade karma from 5.1.0 to 5.2.3 #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade karma from 5.1.0 to 5.2.3 #14

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to upgrade karma from 5.1.0 to 5.2.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 5 versions ahead of your current version.
  • The recommended version was released 7 months ago, on 2020-09-25.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-610226		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: karma from karma GitHub release notes
Commit messages
Package name: karma

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@mistaken-pull-closer
Copy link

Thanks for your submission.

It appears that you've created a pull request using one of our repository's branches. Since this is
almost always a mistake, we're going to go ahead and close this. If it was intentional, please
let us know what you were intending and we can see about reopening it.

Thanks again!

@pull-dog
Copy link

pull-dog bot commented Apr 10, 2021

*Ruff* 🐶 I wasn't able to find any Docker Compose files in your repository at any of the given paths in the pull-dog.json configuration file, or the default docker-compose.yml file 😩 Make sure the given paths are correct.

Files checked:

  • docker-compose.yml
What is this?

Pull Dog is a GitHub app that makes test environments for your pull requests using Docker, from a docker-compose.yml file you specify. It takes 19 seconds to set up (we counted!) and there's a free plan available.

Visit our website to learn more.

Commands
  • @pull-dog up to reprovision or provision the server.
  • @pull-dog down to delete the provisioned server.
Troubleshooting

Need help? Don't hesitate to file an issue in our repository

Configuration

{
  "isLazy": false,
  "dockerComposeYmlFilePaths": [
    "docker-compose.yml"
  ],
  "expiry": "00:00:00",
  "conversationMode": "singleComment"
}

Trace ID
a7e25bb0-9a46-11eb-854e-a1de1f4fd588

@mistaken-pull-closer mistaken-pull-closer bot added the invalid This doesn't seem right label Apr 10, 2021
@guardrails
Copy link

guardrails bot commented Apr 10, 2021

⚠️ We detected 118 security issues in this pull request:
Mode: paranoid | Total findings: 118 | Considered vulnerability: 0

Hard-Coded Secrets (2)

jquery/test/unit/event.js

Line 1182 in e672f2c

$child.trigger( { "type": "foo", "secret": "boo!" } );

jquery/test/unit/selector.js

Line 2115 in e672f2c

assert.equal( jQuery.escapeSelector( "a0123456789b" ), "a0123456789b",

More info on how to fix Hard-Coded Secrets in General.

Insecure File Management (41)

jquery/Gruntfile.js

Line 9 in e672f2c

fs.readFileSync( filepath, { encoding: "utf8" } )

jquery/build/release.js

Line 25 in e672f2c

var contents = fs.readFileSync( filepath, "utf8" );

jquery/build/release.js

Line 27 in e672f2c

fs.writeFileSync( filepath, contents, "utf8" );

jquery/build/release/cdn.js

Line 46 in e672f2c

text = fs.readFileSync( builtFile, "utf8" )

jquery/build/release/cdn.js

Line 51 in e672f2c

fs.writeFileSync( releaseFile, text );

jquery/build/release/cdn.js

Line 74 in e672f2c

output = fs.createWriteStream(

jquery/build/release/cdn.js

Line 93 in e672f2c

fs.writeFileSync( md5file, sum );

jquery/build/release/cdn.js

Line 97 in e672f2c

archiver.append( fs.createReadStream( file ),

jquery/build/release/dist.js

Line 8 in e672f2c

const pkg = require( `${ Release.dir.repo }/package.json` );

jquery/build/release/dist.js

Line 73 in e672f2c

const readme = await fs.readFile(

jquery/build/release/dist.js

Line 106 in e672f2c

await fs.writeFile( `${ Release.dir.dist }/bower.json`, generateBower() );

jquery/build/release/dist.js

Line 108 in e672f2c

await fs.writeFile( `${ Release.dir.dist }/README.md`,

jquery/build/tasks/build.js

Line 102 in e672f2c

fs.readdirSync( `${ srcFolder }/${ prepend }${ module }` ),

jquery/build/tasks/build.js

Line 154 in e672f2c

fs.readdirSync( `${ srcFolder }/${ module }` ),

jquery/build/tasks/dist.js

Line 33 in e672f2c

text = fs.readFileSync( filename, "utf8" );

jquery/build/tasks/node_smoke_tests.js

Line 15 in e672f2c

fs.readdirSync( testsDir )

jquery/build/tasks/node_smoke_tests.js

Line 17 in e672f2c

fs.statSync( testsDir + testFilePath ).isFile() &&

jquery/build/tasks/qunit_fixture.js

Line 8 in e672f2c

fs.writeFileSync(

jquery/build/tasks/sourcemap.js

Line 13 in e672f2c

var text = fs.readFileSync( minLoc, "utf8" )

jquery/build/tasks/sourcemap.js

Line 15 in e672f2c

fs.writeFileSync( minLoc, text );

jquery/src/ajax/xhr.js

Line 24 in e672f2c

xhr.open(

jquery/test/data/jquery-1.9.1.js

Line 8753 in e672f2c

xhr.open( s.type, s.url, s.async, s.username, s.password );

jquery/test/data/jquery-1.9.1.js

Line 8755 in e672f2c

xhr.open( s.type, s.url, s.async );

jquery/test/data/testinit.js

Line 329 in e672f2c

require( [ parentUrl + "test/data/testrunner.js" ], function() {

jquery/test/data/testinit.js

Line 366 in e672f2c

require( [ parentUrl + "test/" + dep ], loadDep );

jquery/test/data/testinit.js

Line 389 in e672f2c

require( [ "http://swarm.jquery.org/js/inject.js?" + ( new Date() ).getTime() ],

jquery/test/jquery.js

Line 89 in e672f2c

require( [ src ], loadTests );

jquery/test/jquery.js

Line 91 in e672f2c

require( [ src ] );

jquery/test/middleware-mockserver.js

Line 134 in e672f2c

var body = fs.readFileSync( __dirname + "/data/with_fries.xml" ).toString();

jquery/test/middleware-mockserver.js

Line 214 in e672f2c

var body = fs.readFileSync( __dirname + "/data/test.include.html" ).toString();

jquery/test/middleware-mockserver.js

Line 223 in e672f2c

var body = fs.readFileSync( __dirname + "/data/csp.include.html" ).toString();

jquery/test/middleware-mockserver.js

Line 232 in e672f2c

var body = fs.readFileSync(

jquery/test/middleware-mockserver.js

Line 241 in e672f2c

var body = fs.readFileSync(

jquery/test/data/mock.php

Line 117 in e672f2c

$text = json_encode( file_get_contents( __DIR__ . '/with_fries.xml' ) );

jquery/test/data/mock.php

Line 206 in e672f2c

$html = file_get_contents( __DIR__ . '/test.include.html' );

jquery/test/data/mock.php

Line 214 in e672f2c

echo file_get_contents( __DIR__ . '/csp.include.html' );

jquery/test/data/mock.php

Line 221 in e672f2c

echo file_get_contents( __DIR__ . '/csp-nonce' . $test . '.html' );

jquery/test/data/mock.php

Line 227 in e672f2c

echo file_get_contents( __DIR__ . '/csp-ajax-script.html' );

jquery/test/data/mock.php

Line 231 in e672f2c

file_put_contents( $this->cspFile, 'error' );

jquery/test/data/mock.php

Line 235 in e672f2c

file_put_contents( $this->cspFile, '' );

jquery/test/data/mock.php

Line 236 in e672f2c

unlink( $this->cspFile );

More info on how to fix Insecure File Management in Javascript and PHP.

Insecure Use of Regular Expressions (48)

jquery/build/tasks/build.js

Line 24 in e672f2c

.split( /[\x20\t]*\/\/ @CODE\n(?:[\x20\t]*\/\/[^\n]+\n)*/ );

jquery/src/css/var/rnumnonpx.js

Line 3 in e672f2c

export default new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" );

jquery/src/event.js

Line 244 in e672f2c

new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" );

jquery/src/event/trigger.js

Line 54 in e672f2c

new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) :

jquery/src/selector.js

Line 73 in e672f2c

rwhitespace = new RegExp( whitespace + "+", "g" ),

jquery/src/selector.js

Line 74 in e672f2c

rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + whitespace + "+$", "g" ),

jquery/src/selector.js

Line 76 in e672f2c

rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ),

jquery/src/selector.js

Line 77 in e672f2c

rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" +

jquery/src/selector.js

Line 79 in e672f2c

rdescend = new RegExp( whitespace + "|>" ),

jquery/src/selector.js

Line 81 in e672f2c

rpseudo = new RegExp( pseudos ),

jquery/src/selector.js

Line 82 in e672f2c

ridentifier = new RegExp( "^" + identifier + "$" ),

jquery/src/selector.js

Line 85 in e672f2c

ID: new RegExp( "^#(" + identifier + ")" ),

jquery/src/selector.js

Line 86 in e672f2c

CLASS: new RegExp( "^\\.(" + identifier + ")" ),

jquery/src/selector.js

Line 87 in e672f2c

TAG: new RegExp( "^(" + identifier + "|[*])" ),

jquery/src/selector.js

Line 88 in e672f2c

ATTR: new RegExp( "^" + attributes ),

jquery/src/selector.js

Line 89 in e672f2c

PSEUDO: new RegExp( "^" + pseudos ),

jquery/src/selector.js

Line 90 in e672f2c

CHILD: new RegExp(

jquery/src/selector.js

Line 94 in e672f2c

bool: new RegExp( "^(?:" + booleans + ")$", "i" ),

jquery/src/selector.js

Line 98 in e672f2c

needsContext: new RegExp( "^" + whitespace +

jquery/src/selector.js

Line 113 in e672f2c

runescape = new RegExp( "\\\\[\\da-fA-F]{1,6}" + whitespace +

jquery/src/selector.js

Line 616 in e672f2c

( pattern = new RegExp( "(^|" + whitespace + ")" + className +

jquery/src/selector/rbuggyQSA.js

Line 4 in e672f2c

var rbuggyQSA = isIE && new RegExp(

jquery/src/var/rcssNum.js

Line 3 in e672f2c

export default new RegExp( "^(?:([+-])=|)(" + pnum + ")([a-z%]*)$", "i" );

jquery/test/data/jquery-1.9.1.js

Line 86 in e672f2c

rvalidbraces = /(?:^|:|,)(?:\s*\[)+/g,

jquery/test/data/jquery-1.9.1.js

Line 2950 in e672f2c

tmp = tmp[ 2 ] && new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" );

jquery/test/data/jquery-1.9.1.js

Line 3029 in e672f2c

new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) :

jquery/test/data/jquery-1.9.1.js

Line 3894 in e672f2c

rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + whitespace + "+$", "g" ),

jquery/test/data/jquery-1.9.1.js

Line 3896 in e672f2c

rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ),

jquery/test/data/jquery-1.9.1.js

Line 3897 in e672f2c

rcombinators = new RegExp( "^" + whitespace + "*([\\x20\\t\\r\\n\\f>+~])" + whitespace + "*" ),

jquery/test/data/jquery-1.9.1.js

Line 3898 in e672f2c

rpseudo = new RegExp( pseudos ),

jquery/test/data/jquery-1.9.1.js

Line 3899 in e672f2c

ridentifier = new RegExp( "^" + identifier + "$" ),

jquery/test/data/jquery-1.9.1.js

Line 3902 in e672f2c

"ID": new RegExp( "^#(" + characterEncoding + ")" ),

jquery/test/data/jquery-1.9.1.js

Line 3903 in e672f2c

"CLASS": new RegExp( "^\\.(" + characterEncoding + ")" ),

jquery/test/data/jquery-1.9.1.js

Line 3904 in e672f2c

"NAME": new RegExp( "^\\[name=['\"]?(" + characterEncoding + ")['\"]?\\]" ),

jquery/test/data/jquery-1.9.1.js

Line 3905 in e672f2c

"TAG": new RegExp( "^(" + characterEncoding.replace( "w", "w*" ) + ")" ),

jquery/test/data/jquery-1.9.1.js

Line 3906 in e672f2c

"ATTR": new RegExp( "^" + attributes ),

jquery/test/data/jquery-1.9.1.js

Line 3907 in e672f2c

"PSEUDO": new RegExp( "^" + pseudos ),

jquery/test/data/jquery-1.9.1.js

Line 3908 in e672f2c

"CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" + whitespace +

jquery/test/data/jquery-1.9.1.js

Line 3914 in e672f2c

"needsContext": new RegExp( "^" + whitespace + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" +

jquery/test/data/jquery-1.9.1.js

Line 4390 in e672f2c

rbuggyQSA = new RegExp( rbuggyQSA.join( "|" ) );

jquery/test/data/jquery-1.9.1.js

Line 4391 in e672f2c

rbuggyMatches = new RegExp( rbuggyMatches.join( "|" ) );

jquery/test/data/jquery-1.9.1.js

Line 4805 in e672f2c

( pattern = new RegExp( "(^|" + whitespace + ")" + className + "(" + whitespace + "|$)" ) ) &&

jquery/test/data/jquery-1.9.1.js

Line 6023 in e672f2c

rnoshimcache = new RegExp( "<(?:" + nodeNames + ")[\\s/>]", "i" ),

jquery/test/data/jquery-1.9.1.js

Line 6818 in e672f2c

rnumsplit = new RegExp( "^(" + core_pnum + ")(.*)$", "i" ),

jquery/test/data/jquery-1.9.1.js

Line 6819 in e672f2c

rnumnonpx = new RegExp( "^(" + core_pnum + ")(?!px)[a-z%]+$", "i" ),

jquery/test/data/jquery-1.9.1.js

Line 6820 in e672f2c

rrelNum = new RegExp( "^([+-])=(" + core_pnum + ")", "i" ),

jquery/test/data/jquery-1.9.1.js

Line 8906 in e672f2c

rfxnum = new RegExp( "^(?:([+-])=|)(" + core_pnum + ")([a-z%]*)$", "i" ),

jquery/test/unit/support.js

Line 84 in e672f2c

} else if ( /\b\d+(\.\d+)+ safari/i.test( userAgent ) ) {

More info on how to fix Insecure Use of Regular Expressions in Javascript.

Insecure Use of Dangerous Function (2)

jquery/build/tasks/lib/spawn_test.js

Line 7 in e672f2c

var spawn = require( "child_process" ).spawn;

jquery/test/jquery.js

Line 78 in e672f2c

eval( dynamicImportSource );

More info on how to fix Insecure Use of Dangerous Function in Javascript.

Information Disclosure (1)

jquery/test/data/json_obj.js

Line 1 in e672f2c

{ "data": {"lang": "en", "length": 25} }

More info on how to fix Information Disclosure in Javascript.

Vulnerable Libraries (1)

More info on how to fix Vulnerable Libraries in Javascript.

Insecure Processing of Data (21)

jquery/test/data/mock.php

Line 9 in e672f2c

echo $req->query['response'];

jquery/test/data/mock.php

Line 68 in e672f2c

echo $req->query['callback'] . "(" . json_encode( [ 'headers' => $headers ] ) . ")";

jquery/test/data/mock.php

Line 109 in e672f2c

echo $callback . '([ {"name": "John", "age": 21}, {"name": "Peter", "age": 25 } ])';

jquery/test/data/mock.php

Line 111 in e672f2c

echo $callback . '({ "data": {"lang": "en", "length": 25} })';

jquery/test/data/mock.php

Line 118 in e672f2c

echo "$callback($text)\n";

jquery/test/data/mock.php

Line 142 in e672f2c

echo "$key: " . $req->headers[ strtoupper( $key ) ] . "\n";

jquery/test/data/mock.php

Line 149 in e672f2c

echo file_get_contents('php://input');

jquery/test/data/mock.php

Line 153 in e672f2c

echo $_SERVER['QUERY_STRING'];

jquery/test/data/mock.php

Line 157 in e672f2c

echo $req->method;

jquery/test/data/mock.php

Line 162 in e672f2c

echo '<div id="method">' . $req->method . '</div>';

jquery/test/data/mock.php

Line 163 in e672f2c

echo '<div id="query">' . $_SERVER['QUERY_STRING'] . '</div>';

jquery/test/data/mock.php

Line 164 in e672f2c

echo '<div id="data">' . file_get_contents('php://input') . '</div>';

jquery/test/data/mock.php

Line 178 in e672f2c

echo "ETag: $etag\n";

jquery/test/data/mock.php

Line 180 in e672f2c

echo "If-None-Match: $ifNoneMatch\n";

jquery/test/data/mock.php

Line 194 in e672f2c

echo "Last-Modified: $ts\n";

jquery/test/data/mock.php

Line 196 in e672f2c

echo "If-Modified-Since: $ims\n";

jquery/test/data/mock.php

Line 208 in e672f2c

echo $html;

jquery/test/data/mock.php

Line 214 in e672f2c

echo file_get_contents( __DIR__ . '/csp.include.html' );

jquery/test/data/mock.php

Line 221 in e672f2c

echo file_get_contents( __DIR__ . '/csp-nonce' . $test . '.html' );

jquery/test/data/mock.php

Line 227 in e672f2c

echo file_get_contents( __DIR__ . '/csp-ajax-script.html' );

jquery/test/data/mock.php

Line 246 in e672f2c

echo $callback . '( {"status": 404, "msg": "Not Found"} )';

More info on how to fix Insecure Processing of Data in PHP.

Insecure Use of Language/Framework API (1)

jquery/test/data/mock.php

Line 64 in e672f2c

array_map( 'strtolower', array_keys( $req->headers ) ),

More info on how to fix Insecure Use of Language/Framework API in PHP.

Insecure Use of Crypto (1)

jquery/test/data/mock.php

Line 168 in e672f2c

$hash = md5( $req->query['ts'] );

More info on how to fix Insecure Use of Crypto in PHP.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
invalid This doesn't seem right
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot