Skip to content

Commit 32ac240

Browse files
rmohan20rmohan20
authored
Merge pull request #799 from forcedotcom/rm/release3.4.0-updates
@W-11606553@ 3.4.0 Release updates
2 parents 79faf1f + 805a8d2 commit 32ac240

File tree

3 files changed

+844
-260
lines changed

3 files changed

+844
-260
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "3.3.0",
4+
"version": "3.4.0",
55
"author": "ISV SWAT",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {

‎retire-js/RetireJsVulns.json‎

Lines changed: 235 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -287,10 +287,12 @@
287287
"jquery.validat(?:ion|e)-(§§version§§)(.min)?\\.js"
288288
],
289289
"uri": [
290-
"/(§§version§§)/jquery.validat(ion|e)(\\.min)?\\.js"
290+
"/(§§version§§)/jquery.validat(ion|e)(\\.min)?\\.js",
291+
"/jquery-validation@(§§version§§)/dist/.*\\.js"
291292
],
292293
"filecontent": [
293-
"/\\*!?(?:\n \\*)? jQuery Validation Plugin v(§§version§§)"
294+
"/\\*!?(?:\n \\*)?[\\s]*jQuery Validation Plugin -? ?v(§§version§§)",
295+
"Original file: /npm/jquery-validation@(§§version§§)/dist/jquery.validate.js"
294296
],
295297
"hashes": {}
296298
}
@@ -444,9 +446,26 @@
444446
"https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc",
445447
"https://nvd.nist.gov/vuln/detail/CVE-2021-41182"
446448
]
449+
},
450+
{
451+
"below": "1.13.2",
452+
"severity": "medium",
453+
"identifiers": {
454+
"CVE": [
455+
"CVE-2022-31160"
456+
],
457+
"summary": "XSS when refreshing a checkboxradio with an HTML-like initial text label "
458+
},
459+
"info": [
460+
"https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9",
461+
"https://nvd.nist.gov/vuln/detail/CVE-2022-31160"
462+
]
447463
}
448464
],
449465
"extractors": {
466+
"uri": [
467+
"/(§§version§§)/jquery-ui(\\.min)?\\.js"
468+
],
450469
"filecontent": [
451470
"/\\*!? jQuery UI - v(§§version§§)",
452471
"/\\*!?[\n *]+jQuery UI (§§version§§)"
@@ -578,6 +597,10 @@
578597
}
579598
],
580599
"extractors": {
600+
"uri": [
601+
"/prettyPhoto/(§§version§§)/js/jquery\\.prettyPhoto(\\.min?)\\.js",
602+
"/prettyphoto@(§§version§§)/js/jquery\\.prettyPhoto\\.js"
603+
],
581604
"filecontent": [
582605
"/\\*[\r\n -]+Class: prettyPhoto(?:.*\n){1,3}[ ]*Version: (§§version§§)",
583606
"\\.prettyPhoto[ ]?=[ ]?\\{version:[ ]?(?:'|\")(§§version§§)(?:'|\")\\}"
@@ -661,8 +684,11 @@
661684
"filename": [
662685
"knockout-(§§version§§)(.min)?\\.js"
663686
],
687+
"uri": [
688+
"/knockout/(§§version§§)/knockout(-[a-z.]+)?\\.js"
689+
],
664690
"filecontent": [
665-
"\\* Knockout JavaScript library v(§§version§§)"
691+
"(?:\\*|//) Knockout JavaScript library v(§§version§§)"
666692
],
667693
"hashes": {}
668694
}
@@ -850,8 +876,12 @@
850876
}
851877
],
852878
"extractors": {
879+
"uri": [
880+
"/tinymce/(§§version§§)/tinymce(\\.min)?\\.js"
881+
],
853882
"filecontent": [
854-
"// (§§version§§) \\([0-9\\-]+\\)[\n\r]+.{0,1200}l=.tinymce/geom/Rect."
883+
"// (§§version§§) \\([0-9\\-]+\\)[\n\r]+.{0,1200}l=.tinymce/geom/Rect.",
884+
"/\\*\\*[\\s]*\\* TinyMCE version (§§version§§)"
855885
],
856886
"filecontentreplace": [
857887
"/tinyMCEPreInit.*majorVersion:.([0-9]+).,minorVersion:.([0-9.]+)./$1.$2/",
@@ -1360,15 +1390,20 @@
13601390
],
13611391
"extractors": {
13621392
"uri": [
1363-
"/(?:v)?(§§version§§)/ember(\\.min)?\\.js"
1393+
"/(?:v)?(§§version§§)/ember(\\.min)?\\.js",
1394+
"/ember\\.?js/(§§version§§)/ember((\\.|-)[a-z\\-.]+)?\\.js"
13641395
],
13651396
"filename": [
13661397
"ember-(§§version§§)(\\.min)?\\.js"
13671398
],
13681399
"filecontent": [
13691400
"Project: Ember -(?:.*\n){9,11}// Version: v(§§version§§)",
13701401
"// Version: v(§§version§§)(.*\n){10,15}(Ember Debug|@module ember|@class ember)",
1371-
"Ember.VERSION[ ]?=[ ]?(?:'|\")(§§version§§)(?:'|\")"
1402+
"Ember.VERSION[ ]?=[ ]?(?:'|\")(§§version§§)(?:'|\")",
1403+
"meta\\.revision=\"Ember@(§§version§§)\"",
1404+
"e\\(\"ember/version\",\\[\"exports\"\\],function\\(e\\)\\{\"use strict\";?[\\s]*e(?:\\.|\\[\")default(?:\"\\])?=\"(§§version§§)\"",
1405+
"\\(\"ember/version\",\\[\"exports\"\\],function\\(e\\)\\{\"use strict\";.{1,70}\\.default=\"(§§version§§)\"",
1406+
"/\\*![\\s]+\\* @overview Ember - JavaScript Application Framework[\\s\\S]{0,400}\\* @version (§§version§§)"
13721407
],
13731408
"hashes": {}
13741409
}
@@ -1733,6 +1768,20 @@
17331768
"https://vulnerabledoma.in/ngSanitize1.6.8_bypass.html"
17341769
]
17351770
},
1771+
{
1772+
"below": "1.5.0-beta.1",
1773+
"severity": "medium",
1774+
"identifiers": {
1775+
"summary": "XSS through xlink:href attributes",
1776+
"CVE": [
1777+
"CVE-2019-14863"
1778+
]
1779+
},
1780+
"info": [
1781+
"https://github.com/angular/angular.js/blob/master/CHANGELOG.md#150-beta1-dense-dispersion-2015-09-29",
1782+
"https://github.com/advisories/GHSA-r5fx-8r73-v86c"
1783+
]
1784+
},
17361785
{
17371786
"atOrAbove": "1.3.0",
17381787
"below": "1.5.0-rc2",
@@ -1786,6 +1835,16 @@
17861835
"info": [
17871836
"https://github.com/angular/angular.js/commit/8f31f1ff43b673a24f84422d5c13d6312b2c4d94"
17881837
]
1838+
},
1839+
{
1840+
"below": "1.999",
1841+
"severity": "low",
1842+
"identifiers": {
1843+
"summary": "End-of-Life: Long term support for AngularJS has been discontinued"
1844+
},
1845+
"info": [
1846+
"https://blog.angular.io/discontinued-long-term-support-for-angularjs-cc066b82e65a?gi=9d3103b5445c"
1847+
]
17891848
}
17901849
],
17911850
"extractors": {
@@ -1829,7 +1888,7 @@
18291888
],
18301889
"filecontent": [
18311890
"//[ ]+Backbone.js (§§version§§)",
1832-
"a=t.Backbone={}}a.VERSION=\"(§§version§§)\""
1891+
"a=t.Backbone=\\{\\}\\}a.VERSION=\"(§§version§§)\""
18331892
],
18341893
"hashes": {}
18351894
}
@@ -2283,7 +2342,9 @@
22832342
"filecontent": [
22842343
"DOMPurify.version = '(§§version§§)';",
22852344
"DOMPurify.version=\"(§§version§§)\"",
2286-
"DOMPurify=.[^\\r\\n]{10,500}\\.version=\"(§§version§§)\""
2345+
"DOMPurify=.[^\\r\\n]{10,850}?\\.version=\"(§§version§§)\"",
2346+
"/\\*! @license DOMPurify (§§version§§)",
2347+
"var .=\"dompurify\"+.{10,550}?\\.version=\"(§§version§§)\""
22872348
],
22882349
"hashes": {}
22892350
}
@@ -2718,7 +2779,7 @@
27182779
"/\\*!? Bootstrap v(§§version§§)",
27192780
"\\* Bootstrap v(§§version§§)",
27202781
"/\\*! Bootstrap v(§§version§§)",
2721-
"this\\.close\\)};.\\.VERSION=\"(§§version§§)\"(?:,.\\.TRANSITION_DURATION=150)?,.\\.prototype\\.close"
2782+
"this\\.close\\)\\};.\\.VERSION=\"(§§version§§)\"(?:,.\\.TRANSITION_DURATION=150)?,.\\.prototype\\.close"
27222783
],
27232784
"hashes": {}
27242785
}
@@ -2992,15 +3053,20 @@
29923053
],
29933054
"extractors": {
29943055
"uri": [
2995-
"/vue@(§§version§§)/dist/vue\\.js"
3056+
"/vue@(§§version§§)/dist/vue\\.js",
3057+
"/vue/(§§version§§)/vue\\..*\\.js",
3058+
"/npm/vue@(§§version§§)"
29963059
],
29973060
"filename": [
29983061
"vue-(§§version§§)(\\.min)?\\.js"
29993062
],
30003063
"filecontent": [
30013064
"/\\*!\\n \\* Vue.js v(§§version§§)",
30023065
"Vue.version = '(§§version§§)';",
3003-
"'(§§version§§)'[^\\n]{0,8000}Vue compiler"
3066+
"'(§§version§§)'[^\\n]{0,8000}Vue compiler",
3067+
"\\* Original file: /npm/vue@(§§version§§)/dist/vue.(global|common).js",
3068+
"const version[ ]*=[ ]*\"(§§version§§)\";[\\s]*/\\*\\*[\\s]*\\* SSR utils for \\\\@vue/server-renderer",
3069+
"\\.__vue_app__=.{0,8000}?const [a-z]+=\"(§§version§§)\","
30043070
]
30053071
}
30063072
},
@@ -3263,9 +3329,6 @@
32633329
"below": "0.7.0",
32643330
"severity": "high",
32653331
"identifiers": {
3266-
"CVE": [
3267-
"CVE-XXXX-XXXX"
3268-
],
32693332
"bug": "SNYK-JS-ALASQL-1082932",
32703333
"summary": "An arbitrary code execution exists as AlaSQL doesn't sanitize input when characters are placed between square brackets [] or preceded with a backtik (accent grave) ` character. Versions older that 0.7.0 were deprecated in March of 2021 and should no longer be used."
32713334
},
@@ -3286,6 +3349,164 @@
32863349
]
32873350
}
32883351
},
3352+
"jquery.datatables": {
3353+
"vulnerabilities": [
3354+
{
3355+
"below": "1.10.10",
3356+
"identifiers": {
3357+
"summary": "possible XSS"
3358+
},
3359+
"info": [
3360+
"https://github.com/DataTables/DataTables/commit/6f67df2d21f9858ec40a6e9565c3a653cdb691a6"
3361+
]
3362+
},
3363+
{
3364+
"below": "1.10.8",
3365+
"identifiers": {
3366+
"CVE": [
3367+
"CVE-2015-6584"
3368+
],
3369+
"summary": "XSS"
3370+
},
3371+
"info": [
3372+
"https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d",
3373+
"https://www.invicti.com/web-applications-advisories/cve-2015-6384-xss-vulnerability-identified-in-datatables/"
3374+
]
3375+
}
3376+
],
3377+
"extractors": {
3378+
"uri": [
3379+
"/(§§version§§)/(js/)?jquery.dataTables(.min)?.js"
3380+
],
3381+
"filename": [
3382+
"jquery.dataTables-(§§version§§)(\\.min)?\\.js"
3383+
],
3384+
"filecontent": [
3385+
"http://www.datatables.net\n +DataTables (§§version§§)",
3386+
"/\\*! DataTables (§§version§§)",
3387+
"u.version=\"(§§version§§)\";u.settings=\\[\\];u.models=\\{\\};u.models.oSearch"
3388+
]
3389+
}
3390+
},
3391+
"nextjs": {
3392+
"vulnerabilities": [
3393+
{
3394+
"atOrAbove": "10.0.0",
3395+
"below": "12.1.0",
3396+
"severity": "medium",
3397+
"identifiers": {
3398+
"summary": "Improper CSP in Image Optimization API",
3399+
"CVE": [
3400+
"CVE-2022-23646"
3401+
]
3402+
},
3403+
"info": [
3404+
"https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mj"
3405+
]
3406+
},
3407+
{
3408+
"atOrAbove": "12.0.0",
3409+
"below": "12.0.9",
3410+
"severity": "medium",
3411+
"identifiers": {
3412+
"summary": "DOS Vulnerability for self-hosted next.js apps",
3413+
"CVE": [
3414+
"CVE-2022-21721"
3415+
]
3416+
},
3417+
"info": [
3418+
"https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x"
3419+
]
3420+
},
3421+
{
3422+
"below": "11.1.3",
3423+
"severity": "high",
3424+
"identifiers": {
3425+
"summary": "Unexpected server crash in Next.js versions",
3426+
"CVE": [
3427+
"CVE-2021-43803"
3428+
]
3429+
},
3430+
"info": [
3431+
"https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx"
3432+
]
3433+
},
3434+
{
3435+
"atOrAbove": "12.0.0",
3436+
"below": "12.0.5",
3437+
"severity": "high",
3438+
"identifiers": {
3439+
"summary": "Unexpected server crash in Next.js versions",
3440+
"CVE": [
3441+
"CVE-2021-43803"
3442+
]
3443+
},
3444+
"info": [
3445+
"https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx"
3446+
]
3447+
},
3448+
{
3449+
"atOrAbove": "10.0.0",
3450+
"below": "11.1.1",
3451+
"severity": "medium",
3452+
"identifiers": {
3453+
"summary": "XSS in Image Optimization API",
3454+
"CVE": [
3455+
"CVE-2021-39178"
3456+
]
3457+
},
3458+
"info": [
3459+
"https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m"
3460+
]
3461+
},
3462+
{
3463+
"below": "11.1.0",
3464+
"severity": "medium",
3465+
"identifiers": {
3466+
"summary": "Open Redirect in Next.js",
3467+
"CVE": [
3468+
"CVE-2021-37699"
3469+
]
3470+
},
3471+
"info": [
3472+
"https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9"
3473+
]
3474+
},
3475+
{
3476+
"atOrAbove": "9.5.0",
3477+
"below": "9.5.4",
3478+
"severity": "medium",
3479+
"identifiers": {
3480+
"summary": "Open Redirect in Next.js",
3481+
"CVE": [
3482+
"CVE-2020-15242"
3483+
]
3484+
},
3485+
"info": [
3486+
"https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435"
3487+
]
3488+
},
3489+
{
3490+
"below": "9.3.2",
3491+
"severity": "medium",
3492+
"identifiers": {
3493+
"summary": "Directory Traversal in Next.js",
3494+
"CVE": [
3495+
"CVE-2020-5284"
3496+
]
3497+
},
3498+
"info": [
3499+
"https://github.com/vercel/next.js/security/advisories/GHSA-fq77-7p7r-83rj"
3500+
]
3501+
}
3502+
],
3503+
"extractors": {
3504+
"filecontent": [
3505+
"version=\"(§§version§§)\".{1,1500}document\\.getElementById\\(\"__NEXT_DATA__\"\\)\\.textContent",
3506+
"document\\.getElementById\\(\"__NEXT_DATA__\"\\)\\.textContent\\);window\\.__NEXT_DATA__=.;.\\.version=\"(§§version§§)\""
3507+
]
3508+
}
3509+
},
32893510
"dont check": {
32903511
"extractors": {
32913512
"uri": [

0 commit comments

Comments
 (0)