Documentation

[MiguelFerreira18]

📝 Description

Please include a summary of the changes.

• Principal change 1 - added documentation about the pipeline, tools for analysis and security tests

📦 Type of change

What types of changes does your code introduce? Put an x in all the boxes that apply:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

🗓️ Milestone

• milestone 1
• milestone 2
• milestone 3

[github-actions]

🔍 Vulnerabilities of 1230199/desofs2024_m1b_2-desof-web:latest

📦 Image Reference 1230199/desofs2024_m1b_2-desof-web:latest

digest	sha256:19251a37d7987814e9253121ce93afd41a1facabba30ee6cecd523b9c768498e
vulnerabilities
size	467 MB
packages	1054

📦 Base Image node:22

also known as	22-bookworm 22.2 22.2-bookworm 22.2.0 22.2.0-bookworm bookworm current current-bookworm latest
digest	sha256:e3f159a4782d8b73c271461c92e6eeac2393a6de70db7d8d9a7f8e5bf3ddf4b7
vulnerabilities

vite 5.2.3 (npm) pkg:npm/[email protected] OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range >=5.2.0 <5.2.6 Fixed version 2.9.18, 3.2.10, 4.5.3, 5.0.13, 5.1.7, 5.2.6 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Description Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*. Exposure of Sensitive Information to an Unauthorized Actor Affected range >=5.2.0 <=5.2.5 Fixed version 5.2.6 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.04% EPSS Percentile 10th percentile Description Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Patches Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] Details server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (micromatch/picomatch#89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined. Reproduction Set fs.deny to ['**/.git/**'] and then curl for /.git/config. with matchBase: true, you can get any file under .git/ (config, HEAD, etc). with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).

stdlib 1.20.12 (golang) pkg:golang/[email protected] Affected range <1.21.8 Fixed version 1.21.8 EPSS Score 0.04% EPSS Percentile 10th percentile Description If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates. Affected range <1.21.8 Fixed version 1.21.8 EPSS Score 0.04% EPSS Percentile 10th percentile Description The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers. Affected range <1.21.8 Fixed version 1.21.8 EPSS Score 0.04% EPSS Percentile 10th percentile Description Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates. Affected range <1.21.8 Fixed version 1.21.8 EPSS Score 0.04% EPSS Percentile 10th percentile Description When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines. Affected range <1.21.8 Fixed version 1.21.8 EPSS Score 0.04% EPSS Percentile 10th percentile Description When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded. Affected range <1.21.9 Fixed version 1.21.9 EPSS Score 0.04% EPSS Percentile 13th percentile Description An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

[github-actions]

Recommended fixes for image 1230199/desofs2024_m1b_2-desof-web:latest

Base image is node:22

Name	current
Digest	sha256:e3f159a4782d8b73c271461c92e6eeac2393a6de70db7d8d9a7f8e5bf3ddf4b7
Vulnerabilities
Pushed	3 days ago
Size	402 MB
Packages	747
Runtime	22

The base image is also available under the supported tag(s): 22-bookworm, 22.2, 22.2-bookworm, 22.2.0, 22.2.0-bookworm, bookworm, current, current-bookworm, latest

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
22-slim Tag is preferred tag Also known as: 22.2.0-slim 22.2-slim current-slim slim bookworm-slim 22-bookworm-slim 22.2-bookworm-slim 22.2.0-bookworm-slim current-bookworm-slim	Benefits: Image is smaller by 312 MB Image contains 423 fewer packages Tag is preferred tag Tag was pushed more recently Image introduces no new vulnerability but removes 89 Tag is using slim variant Image details: Size: 76 MB Runtime: 22	3 days ago

[github-actions]

Your image	1230199/desofs2024_m1b_2-desof-web:latest
Current base image	node:22
Updated base image	node:22-slim

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[SuzukeBount]

⏳