Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade open from 7.0.4 to 8.0.2 #15

Closed
wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to upgrade open from 7.0.4 to 8.0.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 11 versions ahead of your current version.
  • The recommended version was released 25 days ago, on 2021-03-03.
Release notes
Package name: open from open GitHub release notes
Commit messages
Package name: open

Compare


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@mistaken-pull-closer
Copy link

Thanks for your submission.

It appears that you've created a pull request using one of our repository's branches. Since this is
almost always a mistake, we're going to go ahead and close this. If it was intentional, please
let us know what you were intending and we can see about reopening it.

Thanks again!

@pull-dog
Copy link

pull-dog bot commented Mar 28, 2021

*Ruff* 🐶 I wasn't able to find any Docker Compose files in your repository at any of the given paths in the pull-dog.json configuration file, or the default docker-compose.yml file 😩 Make sure the given paths are correct.

Files checked:

  • docker-compose.yml
What is this?

Pull Dog is a GitHub app that makes test environments for your pull requests using Docker, from a docker-compose.yml file you specify. It takes 19 seconds to set up (we counted!) and there's a free plan available.

Visit our website to learn more.

Commands
  • @pull-dog up to reprovision or provision the server.
  • @pull-dog down to delete the provisioned server.
Troubleshooting

Need help? Don't hesitate to file an issue in our repository

Configuration

{
  "isLazy": false,
  "dockerComposeYmlFilePaths": [
    "docker-compose.yml"
  ],
  "expiry": "00:00:00",
  "conversationMode": "singleComment"
}

Trace ID
831256c0-8f68-11eb-8863-75aaf597fbc0

@mistaken-pull-closer mistaken-pull-closer bot added the invalid This doesn't seem right label Mar 28, 2021
@guardrails
Copy link

guardrails bot commented Mar 28, 2021

⚠️ We detected security issues in this pull request:
Mode: paranoid | Total findings: 274 | Considered vulnerability: 0

Hard-Coded Secrets (10)

ApiRows(:which="tab", :apiKey="category", :api="filteredApi[tab]")


xhr.setRequestHeader('X-Meili-API-Key', 'a7c3283824a29d1b0e8042f0266690670b00f7c81d92021b80117563577d2106')

.fa-user-secret:before {

.la-user-secret:before {

.mdi-textbox-password:before {

.mdi-textbox-password::before {

.mdi-onepassword::before {


<q-icon slot="append" :name="password ? 'visibility_off' : 'visibility'" @click="password = !password" class="cursor-pointer" />

More info on how to fix Hard-Coded Secrets in General.


Insecure File Management (142)

if (overwritePrompt === true && fs.existsSync(targetPath)) {

const rawContent = fs.readFileSync(sourcePath, 'utf-8')

fs.writeFileSync(targetPath, template(scope), 'utf-8')

if (overwrite !== 'overwriteAll' && fs.existsSync(targetPath)) {

if (!fs.existsSync(source)) {

if (fs.lstatSync(source).isDirectory()) {

fs.writeFileSync(

const data = merge(fs.existsSync(filePath) ? require(filePath) : {}, newData)

fs.writeFileSync(

if (!fs.existsSync(source)) {

if (!fs.lstatSync(source).isDirectory()) {

if (!fs.existsSync(sourcePath)) {

if (fs.lstatSync(sourcePath).isDirectory()) {

if (!fs.existsSync(extensionPath)) {


if (fs.existsSync(join(dir, 'quasar.conf.js'))) {

return fs.existsSync(filePath)

fs.writeFileSync(filePath, JSON.stringify(content), 'utf-8')

if (fs.existsSync(distFolder)) {

this.watcher = compiler.watch({}, (err, stats) => {

fs.writeFileSync(file.path, file.content, 'utf8')

fs.writeFileSync(capPkgPath, JSON.stringify(capPkg, null, 2), 'utf-8')

if (fs.existsSync(file)) {

const originalContent = fs.readFileSync(file, 'utf-8')

fs.writeFileSync(file, newContent, 'utf-8')

const originalContent = fs.readFileSync(file, 'utf-8')

fs.writeFileSync(file, newContent, 'utf-8')

if (fs.existsSync(mainActivityPath)) {

let mainActivity = fs.readFileSync(mainActivityPath, 'utf8')

if (!fs.existsSync(enableHttpsSelfSignedPath)) {


if (fs.existsSync(enableHttpsSelfSignedPath)) {

fs.unlinkSync(enableHttpsSelfSignedPath)

fs.writeFileSync(mainActivityPath, mainActivity, 'utf-8')

if (!fs.existsSync(www)) {

if (fs.existsSync(appPaths.resolve.capacitor('node_modules'))) {

const doc = et.parse(fs.readFileSync(filePath, 'utf-8'))

const doc = et.parse(fs.readFileSync(filePath, 'utf-8'))

fs.writeFileSync(filePath, content, 'utf8')

fs.writeFileSync(file.path, file.content, 'utf8')

if (!fs.existsSync(appDelegatePath)) {

tamperedFile.originalContent = fs.readFileSync(appDelegatePath, 'utf-8')

if (fs.existsSync(wkWebViewEnginePath)) {

tamperedFile.originalContent = fs.readFileSync(wkWebViewEnginePath, 'utf-8')

if (!fs.existsSync(www)) {

if (fs.existsSync(appPaths.resolve.cordova('node_modules'))) {

return getIndexHtml(fs.readFileSync(templatePath, 'utf-8'), cfg)

const htmlWatcher = chokidar.watch(templatePath).on('change', () => {

const serverCompilerWatcher = serverCompiler.watch({}, () => {})

if (fs.existsSync(appPaths.resolve.electron('icons/linux-256x256.png'))) {

this.watcher = compiler.watch({}, async (err, stats) => {

if (fs.existsSync(preloadFile)) {

this.preloadWatcher = chokidar

const content = fs.readFileSync(

template: compileTemplate(fs.readFileSync(ssrFile, 'utf-8')),

if (!fs.existsSync(quasarFolder)) {

fs.mkdirSync(quasarFolder)

else if (!fs.lstatSync(quasarFolder).isDirectory()) {

fs.mkdirSync(quasarFolder)

fs.writeFileSync(file.dest, file.template(templateData), 'utf-8')

fs.utimes(file.dest, then, then, function (err) { if (err) throw err })

content = fs.readFileSync(file, 'utf-8')

content = fs.readFileSync(file, 'utf-8')

styl: fs.existsSync(appPaths.resolve.src('css/quasar.variables.styl')),

scss: fs.existsSync(appPaths.resolve.src('css/quasar.variables.scss')),

sass: fs.existsSync(appPaths.resolve.src('css/quasar.variables.sass'))

if (fs.existsSync(androidManifestPath)) {

let androidManifest = fs.readFileSync(androidManifestPath, 'utf8')

fs.writeFileSync(androidManifestPath, androidManifest, 'utf-8')

if (!fs.existsSync(file)) {

if (fs.existsSync(appPaths.resolve.app('yarn.lock'))) {

if (fs.existsSync(appPaths.resolve.app('package-lock.json'))) {

const root = fs.readdirSync(folder)

if (fs.existsSync(studioPath)) {

if (bin.windowsAndroidStudio && fs.existsSync(bin.windowsAndroidStudio)) {

if (fs.existsSync(studioPath)) {

if (fs.existsSync(asPath)) {

if (isFeatureInstalled && !fs.existsSync(destFlagPath)) {

return fs.existsSync(appPaths.bexDir)

return fs.existsSync(appPaths.capacitorDir)

const content = fs.readFileSync(appPaths.resolve.cli('templates/capacitor/' + filePath))

fs.writeFileSync(dest, compileTemplate(content)(scope), 'utf-8')

return fs.existsSync(appPaths.resolve.capacitor(target))

return fs.existsSync(appPaths.cordovaDir)

return fs.existsSync(appPaths.resolve.cordova(`platforms/${target}`))

return fs.existsSync(appPaths.electronDir)

return fs.existsSync(appPaths.pwaDir)

return fs.existsSync(appPaths.ssrDir)



if (fs.existsSync(this.filename)) {

fs.existsSync(storePath) ||

fs.existsSync(storePath + '.js') ||

fs.existsSync(storePath + '.ts')

if (!fs.existsSync(ssrExtensionFile)) {

if (fse.existsSync(manifestFilePath)) {

const manifestFileData = fse.readFileSync(manifestFilePath)

fse.writeFileSync(manifestFilePath, newValue, 'utf-8')

let output = fse.createWriteStream(path.join(dest, fileName + '.zip'))

const file = this.fs.readFileSync(this.resource, 'utf-8').toString()

const file = this.fs.readFileSync(this.resource, 'utf-8').toString()

const htmlTemplate = getIndexHtml(fs.readFileSync(htmlFile, 'utf-8'), this.cfg)

require('fs').unlinkSync(require('path').join(app.getPath('userData'), 'DevTools Extensions'))

if (fs.existsSync(join(root, 'yarn.lock'))) {

if (fs.existsSync(join(root, 'package-lock.json'))) {

if (!fs.existsSync(dir)) {

fs.mkdirSync(dir)

return fs.readFileSync(page, {

fs.writeFileSync(fileName, content, () => {})

this.getDiv(h, 6, 'External link', prop.link)

if (!fs.existsSync(mixinFile)) {

const definition = fs.readFileSync(file.replace('.json', '.js'), {

const content = fs.readFileSync(file, 'utf-8')

oldLangJson = fs.readFileSync(langFile, 'utf-8')

const original = fs.readFileSync(resolve(`icon-set/${type.name}.js`), 'utf-8')

oldContent = fs.readFileSync(iconFile, 'utf-8')

? buildUtils.writeFile(iconFile, content, 'utf-8')

fs.readdirSync(dir)

const stats = fs.lstatSync(fullPath)

fs.readFileSync(fullPath)

if (!fs.existsSync(p)) {

fs.mkdirSync(p)

if (!fs.existsSync(dir)) {

fs.mkdirSync(dir)

fs.writeFile(dest, code, err => {

return fs.readFileSync(file, 'utf-8')

if (!fs.existsSync(webTypesPath)) {

fs.mkdirSync(webTypesPath)

.then(code => buildUtils.writeFile(dest, code))

const deps = stylus(buildUtils.readFile(src))

if (styl) { return buildUtils.writeFile(`dist/quasar${name}.styl`, code) }

return buildUtils.writeFile(`dist/quasar${name}${ext}.css`, code, true)

.then(code => buildUtils.writeFile(`dist/quasar${name}${ext}.min.css`, code.css, true))

code += buildUtils.readFile(file) + '\n'

const files = fs.readdirSync(resolve(type))

? buildUtils.writeFile(config.rollup.output.file, code)

return buildUtils.writeFile(

if (!fs.existsSync(src)) {

fs.symlinkSync(src, dest, 'dir')

if (!fs.existsSync(folder)) {

fs.mkdirSync(folder)

More info on how to fix Insecure File Management in Javascript.


Insecure Use of Dangerous Function (72)

return require(script)

extPkg = require(source)

const pkg = merge(require(filePath), extPkg)

const data = merge(fs.existsSync(filePath) ? require(filePath) : {}, newData)

this.extensions = require(extensionPath)

? require(filePath)

this.pkg = require(appPaths.resolve.app('package.json'))

const capJson = require(capJsonPath)

const capPkg = require(capPkgPath)

this.pkg = require(appPaths.resolve.app('package.json'))

const appPkg = require(appPaths.resolve.app('package.json'))

const api = require(

api: require(file),





const { execSync } = require('child_process')

const QuasarMode = require(`./mode-${mode}`)

const pkg = require(pkgPath)

const pkg = require(appPaths.resolve.app('package.json'))

this.pkg = require(appPaths.resolve.app('package.json'))

quasarConfigFunction = require(this.filename)

return require(ssrExtensionFile)

name: require(appPaths.resolve.app('package.json')).name

const { dependencies:appDeps = {} } = require(appPaths.resolve.app('package.json'))

const { dependencies:cliDeps = {} } = require(appPaths.resolve.cli('package.json'))

const pkg = require(appPaths.resolve.app('package.json'))

const postCssConfig = require(appPaths.resolve.app('.postcssrc.js'))

const pkg = require(appPaths.resolve.app('package.json'))

const appPkg = require(appPaths.resolve.app('package.json'))

const cliPkg = require(appPaths.resolve.cli('package.json'))

const { dependencies:appDeps = {} } = require(appPaths.resolve.app('package.json'))

const { dependencies:cliDeps = {} } = require(appPaths.resolve.cli('package.json'))

return require(

const exec = require('child_process').execSync

const req = require(path.resolve(js))

const run = parallel ? require('child_process').fork : require

: 'v' + require(resolve(__dirname, `../../node_modules/${versionOrPackageName}/package.json`)).version

const pkg = require(pkgPath)


extendApi = require(resolvePath('src/api.extends.json')),

const content = require(mixinFile)

let api = require(file)

const m = extractMatcher[i].exec(str)

const match = /(edge|edga|edgios)\/([\w.]+)/.exec(userAgent) ||

/(opr)[\/]([\w.]+)/.exec(userAgent) ||

/(vivaldi)[\/]([\w.]+)/.exec(userAgent) ||

/(chrome|crios)[\/]([\w.]+)/.exec(userAgent) ||

/(iemobile)[\/]([\w.]+)/.exec(userAgent) ||

/(version)(applewebkit)[\/]([\w.]+).*(safari)[\/]([\w.]+)/.exec(userAgent) ||

/(webkit)[\/]([\w.]+).*(version)[\/]([\w.]+).*(safari)[\/]([\w.]+)/.exec(userAgent) ||

/(firefox|fxios)[\/]([\w.]+)/.exec(userAgent) ||

/(webkit)[\/]([\w.]+)/.exec(userAgent) ||

/(opera)(?:.*version|)[\/]([\w.]+)/.exec(userAgent) ||

/(msie) ([\w.]+)/.exec(userAgent) ||

(userAgent.indexOf('trident') >= 0 && /(rv)(?::| )([\w.]+)/.exec(userAgent)) ||

(userAgent.indexOf('compatible') < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec(userAgent)) ||

return /(ipad)/.exec(userAgent) ||

/(ipod)/.exec(userAgent) ||

/(windows phone)/.exec(userAgent) ||

/(iphone)/.exec(userAgent) ||

/(kindle)/.exec(userAgent) ||

/(silk)/.exec(userAgent) ||

/(android)/.exec(userAgent) ||

/(win)/.exec(userAgent) ||

/(mac)/.exec(userAgent) ||

/(linux)/.exec(userAgent) ||

/(cros)/.exec(userAgent) ||

/(playbook)/.exec(userAgent) ||

/(bb)/.exec(userAgent) ||

/(blackberry)/.exec(userAgent) ||

More info on how to fix Insecure Use of Dangerous Function in Javascript.


Insecure Use of Regular Expressions (41)

const match = publicPath.match(/^(https?\:)\/\/(([^:\/?#]*)(?:\:([0-9]+))?)([\/]{0,1}[^?#]*)(\?[^#]*|)(#.*|)$/)

? new RegExp(cfg.vendor.add.filter(v => v).join('|'))

? new RegExp(cfg.vendor.remove.filter(v => v).join('|'))

test: new RegExp('\\.(' + ext.join('|') + ')$'),

return new RegExp(deps.join('|'))

.test(/\.(png|jpe?g|gif|svg|webp|avif)(\?.*)?$/)

.test(/\.(woff2?|eot|ttf|otf)(\?.*)?$/)

.test(/\.(mp4|webm|ogg|mp3|wav|flac|aac)(\?.*)?$/)

'?kebab': new RegExp(data.regex.kebabComponents || data.regex.components, 'g'),

'?pascal': new RegExp(data.regex.pascalComponents || data.regex.components, 'g'),

'?combined': new RegExp(data.regex.components, 'g')

const funcCompRegex = new RegExp(

const dirRegex = new RegExp(data.regex.directives, 'g')

'?kebab': new RegExp(data.regex.kebabComponents || data.regex.components, 'g'),

'?pascal': new RegExp(data.regex.pascalComponents || data.regex.components, 'g'),

'?combined': new RegExp(data.regex.components, 'g')

const funcCompRegex = new RegExp(

const dirRegex = new RegExp(data.regex.directives, 'g')

const iosIconRegex = /AppIcon-(\d+\.?\d?)x?(\d+\.?\d?)?@?(\d+)?x?-?\d?\.png/

const iosIconRegex = /icon-(\d+\.?\d?)@?(\d+)?x?\.png/

const iosIconRegex = /AppIcon-(\d+\.?\d?)x?(\d+\.?\d?)?@?(\d+)?x?-?\d?\.png/

const iosIconRegex = /icon-(\d+\.?\d?)@?(\d+)?x?\.png/

const colorPattern = Joi.string().pattern(new RegExp(`^${requireHash ? '#' : ''}[0-9A-Fa-f]{3}([0-9A-Fa-f]{3})?$`))

const SEMANTIC_REGEX = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/

const searchRe = new RegExp('^' + this.searchBuffer.split('').map(l => reEscapeList.indexOf(l) > -1 ? '\\' + l : l).join('.*'), 'i')

keyRegex = new RegExp(`^([\\d+]+|${Object.keys(keyCodes).join('|')})$`, 'i')

new RegExp('(\\s|^)'.concat(className, '(\\s|$)'), 'g'),

const isChinese = /[\u4e00-\u9fff\u3400-\u4dbf\u{20000}-\u{2a6df}\u{2a700}-\u{2b73f}\u{2b740}-\u{2b81f}\u{2b820}-\u{2ceaf}\uf900-\ufaff\u3300-\u33ff\ufe30-\ufe4f\uf900-\ufaff\u{2f800}-\u{2fa1f}]/u

TOKENS[key].regex = new RegExp(TOKENS[key].pattern)

tokenRegexMask = new RegExp('\\\\([^.*+?^${}()|([\\]])|([.*+?^${}()|[\\]])|([' + KEYS.join('') + '])|(.)', 'g'),

unmaskMatcher = new RegExp(

return new RegExp('^' + fillCharEscaped + '*' + re)

return new RegExp(

return new RegExp('^' + re)

const reRGBA = /^rgb(a)?\((\d{1,3}),(\d{1,3}),(\d{1,3}),?([01]?\.?\d*?)?\)$/

const res = { map, regex: new RegExp('^' + regexText) }

hex = /^#[0-9a-fA-F]{3}([0-9a-fA-F]{3})?$/,

hexa = /^#[0-9a-fA-F]{4}([0-9a-fA-F]{4})?$/,

rgb = /^rgb\(((0|[1-9][\d]?|1[\d]{0,2}|2[\d]?|2[0-4][\d]|25[0-5]),){2}(0|[1-9][\d]?|1[\d]{0,2}|2[\d]?|2[0-4][\d]|25[0-5])\)$/,

rgba = /^rgba\(((0|[1-9][\d]?|1[\d]{0,2}|2[\d]?|2[0-4][\d]|25[0-5]),){2}(0|[1-9][\d]?|1[\d]{0,2}|2[\d]?|2[0-4][\d]|25[0-5]),(0|0\.[0-9]+[1-9]|0\.[1-9]+|1)\)$/

return new RegExp(source)

More info on how to fix Insecure Use of Regular Expressions in Javascript.


Information Disclosure (6)

const settings = <%= opts %>

<% if (__vueDevtools !== false) { %>

<% if (__supportsIE) { %>

<% if (__loadingBar) { %>


<% extras.length > 0 && extras.filter(asset => asset).forEach(asset => { %>

More info on how to fix Information Disclosure in Javascript.


Insecure Use of Crypto (2)

if (token !== void 0) {

if (Api !== void 0) {

More info on how to fix Insecure Use of Crypto in Javascript.


Insecure Configuration (1)

noEscape: true

More info on how to fix Insecure Configuration in Javascript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
invalid This doesn't seem right
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant