Skip to content

Commit d94d91b

Browse files
eoftedaleoftedal
committedJan 12, 2024
Some improved extractors and adding some more libraries (lodash, c3, blueimp-file-upload)
1 parent e3cfd80 commit d94d91b

File tree

4 files changed

+605
-17
lines changed

4 files changed

+605
-17
lines changed
 

‎repository/jsrepository-master.json

+297-8
Original file line numberDiff line numberDiff line change
@@ -472,7 +472,10 @@
472472
"func": ["jQuery.mobile.version"],
473473
"filename": ["jquery.mobile-(§§version§§)(.min)?\\.js"],
474474
"uri": ["/(§§version§§)/jquery.mobile(\\.min)?\\.js"],
475-
"filecontent": ["/\\*!?(?:\n \\*)? jQuery Mobile(?: -)? v(§§version§§)"],
475+
"filecontent": [
476+
"/\\*!?[\\s*]*jQuery Mobile(?: -)? v?(§§version§§)",
477+
"// Version of the jQuery Mobile Framework[\\s]+version: *[\"'](§§version§§)[\"'],"
478+
],
476479
"hashes": {}
477480
}
478481
},
@@ -1811,7 +1814,8 @@
18111814
"meta\\.revision=\"Ember@(§§version§§)\"",
18121815
"e\\(\"ember/version\",\\[\"exports\"\\],function\\(e\\)\\{\"use strict\";?[\\s]*e(?:\\.|\\[\")default(?:\"\\])?=\"(§§version§§)\"",
18131816
"\\(\"ember/version\",\\[\"exports\"\\],function\\(e\\)\\{\"use strict\";.{1,70}\\.default=\"(§§version§§)\"",
1814-
"/\\*![\\s]+\\* @overview Ember - JavaScript Application Framework[\\s\\S]{0,400}\\* @version (§§version§§)"
1817+
"/\\*![\\s]+\\* @overview Ember - JavaScript Application Framework[\\s\\S]{0,400}\\* @version (§§version§§)",
1818+
"// Version: (§§version§§)[\\s]+\\(function\\(\\) *\\{[\\s]*/\\*\\*[\\s]+@module ember[\\s]"
18151819
],
18161820
"hashes": {}
18171821
}
@@ -2371,7 +2375,8 @@
23712375
"filename": ["backbone(?:js)?-(§§version§§)(.min)?\\.js"],
23722376
"filecontent": [
23732377
"//[ ]+Backbone.js (§§version§§)",
2374-
"a=t.Backbone=\\{\\}\\}a.VERSION=\"(§§version§§)\""
2378+
"a=t.Backbone=\\{\\}\\}a.VERSION=\"(§§version§§)\"",
2379+
"Backbone\\.VERSION *= *[\"'](§§version§§)[\"']"
23752380
],
23762381
"hashes": {}
23772382
}
@@ -2704,7 +2709,7 @@
27042709
"Handlebars=\\{VERSION:(?:'|\")(§§version§§)(?:'|\")",
27052710
"this.Handlebars=\\{\\};[\n\r \t]+\\(function\\([a-z]\\)\\{[a-z].VERSION=(?:'|\")(§§version§§)(?:'|\")",
27062711
"exports.HandlebarsEnvironment=[\\s\\S]{70,120}exports.VERSION=(?:'|\")(§§version§§)(?:'|\")",
2707-
"/\\*+![\\s]+(?:@license)?[\\s]+handlebars v(§§version§§)"
2712+
"/\\*+![\\s]+(?:@license)?[\\s]+handlebars v+(§§version§§)"
27082713
],
27092714
"hashes": {}
27102715
}
@@ -3457,7 +3462,8 @@
34573462
"\\.version=\"(§§version§§)\".{20,60}\"isBefore\".{20,60}\"isAfter\".{200,500}\\.isMoment=",
34583463
"\\.version=\"(§§version§§)\".{20,300}duration.{2,100}\\.isMoment=",
34593464
"\\.isMoment\\(.{50,400}_isUTC.{50,400}=\"(§§version§§)\"",
3460-
"=\"(§§version§§)\".{300,1000}Years:31536e6.{60,80}\\.isMoment"
3465+
"=\"(§§version§§)\".{300,1000}Years:31536e6.{60,80}\\.isMoment",
3466+
"// Moment.js is freely distributable under the terms of the MIT license.[\\s]+//[\\s]+// Version (§§version§§)"
34613467
]
34623468
}
34633469
},
@@ -3485,7 +3491,10 @@
34853491
"extractors": {
34863492
"uri": ["/underscore\\.js/(§§version§§)/underscore(-min)?\\.js"],
34873493
"func": ["underscore.version"],
3488-
"filecontent": ["//[\\s]*Underscore.js (§§version§§)"]
3494+
"filecontent": [
3495+
"//[\\s]*Underscore.js (§§version§§)",
3496+
"// *Underscore\\.js[\\s\\S]{1,2500}_\\.VERSION *= *['\"](§§version§§)['\"]"
3497+
]
34893498
}
34903499
},
34913500
"bootstrap": {
@@ -4179,7 +4188,11 @@
41794188
"/ext-all-debug-(§§version§§)(\\.min)?\\.js",
41804189
"/ext-base-(§§version§§)(\\.min)?\\.js"
41814190
],
4182-
"filecontent": ["/*!\n * Ext JS Library (§§version§§)"],
4191+
"filecontent": [
4192+
"/*!\n * Ext JS Library (§§version§§)",
4193+
"Ext = \\{[\\s]*/\\*[^/]+/[\\s]*version *: *['\"](§§version§§)['\"]",
4194+
"var version *= *['\"](§§version§§)['\"], *Version;[\\s]*Ext.Version *= *Version *= *Ext.extend"
4195+
],
41834196
"func": [
41844197
"Ext && Ext.versions && Ext.versions.extjs.version",
41854198
"Ext && Ext.version"
@@ -5113,11 +5126,287 @@
51135126
"extractors": {
51145127
"filecontent": [
51155128
"/\\*!(?:[\\s]+\\*)? Select2 (§§version§§)",
5116-
"/\\*[\\s]+Copyright 20[0-9]{2} [I]gor V[a]ynberg[\\s]+Version: (§§version§§)[\\s\\S]{1,4000}(\\.attr\\(\"class\",\"select2-sizer\"|\\.data\\(document,\"select2-lastpos\"|document\\)\\.data\\(\"select2-lastpos\")"
5129+
"/\\*[\\s]+Copyright 20[0-9]{2} [I]gor V[a]ynberg[\\s]+Version: (§§version§§)[\\s\\S]{1,5000}(\\.attr\\(\"class\",\"select2-sizer\"|\\.data\\(document, *\"select2-lastpos\"|document\\)\\.data\\(\"select2-lastpos\"|SingleSelect2, *MultiSelect2|window.Select2 *!== *undefined)"
51175130
],
51185131
"uri": ["(§§version§§)/(js/)?select2(.min)?\\.js"]
51195132
}
51205133
},
5134+
"blueimp-file-upload": {
5135+
"vulnerabilities": [
5136+
{
5137+
"ranges": [
5138+
{
5139+
"below": "9.22.1"
5140+
}
5141+
],
5142+
"summary": "Unrestricted Upload of File with Dangerous Type in blueimp-file-upload",
5143+
"cwe": ["CWE-434"],
5144+
"severity": "high",
5145+
"identifiers": {
5146+
"CVE": ["CVE-2018-9206"],
5147+
"githubID": "GHSA-4cj8-g9cp-v5wr"
5148+
},
5149+
"info": [
5150+
"https://github.com/advisories/GHSA-4cj8-g9cp-v5wr",
5151+
"https://nvd.nist.gov/vuln/detail/CVE-2018-9206",
5152+
"https://github.com/advisories/GHSA-4cj8-g9cp-v5wr",
5153+
"https://wpvulndb.com/vulnerabilities/9136",
5154+
"https://www.exploit-db.com/exploits/45790/",
5155+
"https://www.exploit-db.com/exploits/46182/",
5156+
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
5157+
"http://www.securityfocus.com/bid/105679",
5158+
"http://www.securityfocus.com/bid/106629",
5159+
"http://www.vapidlabs.com/advisory.php?v=204"
5160+
]
5161+
}
5162+
],
5163+
"extractors": {
5164+
"filecontent": [
5165+
"/\\*[\\s*]+jQuery File Upload User Interface Plugin (§§version§§)[\\s*]+https://github.com/blueimp"
5166+
],
5167+
"uri": [
5168+
"/blueimp-file-upload/(§§version§§)/jquery.fileupload(-ui)?(\\.min)?\\.js"
5169+
]
5170+
}
5171+
},
5172+
"c3": {
5173+
"vulnerabilities": [
5174+
{
5175+
"ranges": [
5176+
{
5177+
"below": "0.4.11"
5178+
}
5179+
],
5180+
"summary": "Cross-Site Scripting in c3",
5181+
"cwe": ["CWE-79"],
5182+
"severity": "medium",
5183+
"identifiers": {
5184+
"CVE": ["CVE-2016-1000240"],
5185+
"githubID": "GHSA-gvg7-pp82-cff3"
5186+
},
5187+
"info": [
5188+
"https://github.com/advisories/GHSA-gvg7-pp82-cff3",
5189+
"https://nvd.nist.gov/vuln/detail/CVE-2016-1000240",
5190+
"https://github.com/c3js/c3/issues/1536",
5191+
"https://github.com/c3js/c3/pull/1675",
5192+
"https://github.com/c3js/c3/commit/de3864650300488a63d0541620e9828b00e94b42",
5193+
"https://github.com/c3js/c3",
5194+
"https://www.npmjs.com/advisories/138"
5195+
]
5196+
}
5197+
],
5198+
"extractors": {
5199+
"uri": ["/(§§version§§)/c3(\\.min)?\\.js"],
5200+
"filecontent": [
5201+
"[\\s]+var c3 ?= ?\\{ ?version: ?['\"](§§version§§)['\"] ?\\};[\\s]+var c3_chart_fn,"
5202+
]
5203+
}
5204+
},
5205+
"lodash": {
5206+
"vulnerabilities": [
5207+
{
5208+
"ranges": [
5209+
{
5210+
"below": "4.17.11"
5211+
}
5212+
],
5213+
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
5214+
"cwe": ["CWE-400"],
5215+
"severity": "medium",
5216+
"identifiers": {
5217+
"CVE": ["CVE-2019-1010266"],
5218+
"githubID": "GHSA-x5rq-j2xg-h7qm"
5219+
},
5220+
"info": [
5221+
"https://github.com/advisories/GHSA-x5rq-j2xg-h7qm",
5222+
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010266",
5223+
"https://github.com/lodash/lodash/issues/3359",
5224+
"https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347",
5225+
"https://github.com/lodash/lodash/wiki/Changelog",
5226+
"https://security.netapp.com/advisory/ntap-20190919-0004/",
5227+
"https://snyk.io/vuln/SNYK-JS-LODASH-73639"
5228+
]
5229+
},
5230+
{
5231+
"ranges": [
5232+
{
5233+
"atOrAbove": "3.7.0",
5234+
"below": "4.17.19"
5235+
}
5236+
],
5237+
"summary": "Prototype Pollution in lodash",
5238+
"cwe": ["CWE-1321", "CWE-770"],
5239+
"severity": "high",
5240+
"identifiers": {
5241+
"CVE": ["CVE-2020-8203"],
5242+
"githubID": "GHSA-p6mc-m468-83gw"
5243+
},
5244+
"info": [
5245+
"https://github.com/advisories/GHSA-p6mc-m468-83gw",
5246+
"https://nvd.nist.gov/vuln/detail/CVE-2020-8203",
5247+
"https://github.com/lodash/lodash/issues/4744",
5248+
"https://github.com/lodash/lodash/issues/4874",
5249+
"https://github.com/github/advisory-database/pull/2884",
5250+
"https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12",
5251+
"https://hackerone.com/reports/712065",
5252+
"https://hackerone.com/reports/864701",
5253+
"https://github.com/lodash/lodash",
5254+
"https://github.com/lodash/lodash/wiki/Changelog#v41719",
5255+
"https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744"
5256+
]
5257+
},
5258+
{
5259+
"ranges": [
5260+
{
5261+
"below": "4.17.12"
5262+
}
5263+
],
5264+
"summary": "Prototype Pollution in lodash",
5265+
"cwe": ["CWE-20"],
5266+
"severity": "high",
5267+
"identifiers": {
5268+
"CVE": ["CVE-2019-10744"],
5269+
"githubID": "GHSA-jf85-cpcp-j695"
5270+
},
5271+
"info": [
5272+
"https://github.com/advisories/GHSA-jf85-cpcp-j695",
5273+
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
5274+
"https://github.com/lodash/lodash/pull/4336",
5275+
"https://access.redhat.com/errata/RHSA-2019:3024",
5276+
"https://security.netapp.com/advisory/ntap-20191004-0005/",
5277+
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
5278+
"https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS",
5279+
"https://www.npmjs.com/advisories/1065",
5280+
"https://www.oracle.com/security-alerts/cpujan2021.html",
5281+
"https://www.oracle.com/security-alerts/cpuoct2020.html"
5282+
]
5283+
},
5284+
{
5285+
"ranges": [
5286+
{
5287+
"below": "4.17.5"
5288+
}
5289+
],
5290+
"summary": "Prototype Pollution in lodash",
5291+
"cwe": ["CWE-471"],
5292+
"severity": "low",
5293+
"identifiers": {
5294+
"CVE": ["CVE-2018-3721"],
5295+
"githubID": "GHSA-fvqr-27wr-82fm"
5296+
},
5297+
"info": [
5298+
"https://github.com/advisories/GHSA-fvqr-27wr-82fm",
5299+
"https://nvd.nist.gov/vuln/detail/CVE-2018-3721",
5300+
"https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a",
5301+
"https://hackerone.com/reports/310443",
5302+
"https://github.com/advisories/GHSA-fvqr-27wr-82fm",
5303+
"https://security.netapp.com/advisory/ntap-20190919-0004/",
5304+
"https://www.npmjs.com/advisories/577"
5305+
]
5306+
},
5307+
{
5308+
"ranges": [
5309+
{
5310+
"below": "4.17.11"
5311+
}
5312+
],
5313+
"summary": "Prototype Pollution in lodash",
5314+
"cwe": ["CWE-400"],
5315+
"severity": "high",
5316+
"identifiers": {
5317+
"CVE": ["CVE-2018-16487"],
5318+
"githubID": "GHSA-4xc9-xhrj-v574"
5319+
},
5320+
"info": [
5321+
"https://github.com/advisories/GHSA-4xc9-xhrj-v574",
5322+
"https://nvd.nist.gov/vuln/detail/CVE-2018-16487",
5323+
"https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad",
5324+
"https://hackerone.com/reports/380873",
5325+
"https://github.com/advisories/GHSA-4xc9-xhrj-v574",
5326+
"https://security.netapp.com/advisory/ntap-20190919-0004/",
5327+
"https://www.npmjs.com/advisories/782"
5328+
]
5329+
},
5330+
{
5331+
"ranges": [
5332+
{
5333+
"below": "4.17.21"
5334+
}
5335+
],
5336+
"summary": "Command Injection in lodash",
5337+
"cwe": ["CWE-77", "CWE-94"],
5338+
"severity": "high",
5339+
"identifiers": {
5340+
"CVE": ["CVE-2021-23337"],
5341+
"githubID": "GHSA-35jh-r3h4-6jhm"
5342+
},
5343+
"info": [
5344+
"https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
5345+
"https://nvd.nist.gov/vuln/detail/CVE-2021-23337",
5346+
"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
5347+
"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
5348+
"https://github.com/lodash/lodash",
5349+
"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851",
5350+
"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851",
5351+
"https://security.netapp.com/advisory/ntap-20210312-0006/",
5352+
"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932",
5353+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930",
5354+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928",
5355+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931",
5356+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929",
5357+
"https://snyk.io/vuln/SNYK-JS-LODASH-1040724",
5358+
"https://www.oracle.com//security-alerts/cpujul2021.html",
5359+
"https://www.oracle.com/security-alerts/cpujan2022.html",
5360+
"https://www.oracle.com/security-alerts/cpujul2022.html",
5361+
"https://www.oracle.com/security-alerts/cpuoct2021.html"
5362+
]
5363+
},
5364+
{
5365+
"ranges": [
5366+
{
5367+
"below": "4.17.21"
5368+
}
5369+
],
5370+
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
5371+
"cwe": ["CWE-1333", "CWE-400"],
5372+
"severity": "medium",
5373+
"identifiers": {
5374+
"CVE": ["CVE-2020-28500"],
5375+
"githubID": "GHSA-29mw-wpgm-hmr9"
5376+
},
5377+
"info": [
5378+
"https://github.com/advisories/GHSA-29mw-wpgm-hmr9",
5379+
"https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
5380+
"https://github.com/lodash/lodash/pull/5065",
5381+
"https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7",
5382+
"https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a",
5383+
"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
5384+
"https://github.com/lodash/lodash",
5385+
"https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8",
5386+
"https://security.netapp.com/advisory/ntap-20210312-0006/",
5387+
"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896",
5388+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894",
5389+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892",
5390+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895",
5391+
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893",
5392+
"https://snyk.io/vuln/SNYK-JS-LODASH-1018905",
5393+
"https://www.oracle.com//security-alerts/cpujul2021.html",
5394+
"https://www.oracle.com/security-alerts/cpujan2022.html",
5395+
"https://www.oracle.com/security-alerts/cpujul2022.html",
5396+
"https://www.oracle.com/security-alerts/cpuoct2021.html"
5397+
]
5398+
}
5399+
],
5400+
"extractors": {
5401+
"filecontent": [
5402+
"/\\*[\\s*!]+(?:@license)?[\\s*]+(?:Lo-Dash|lodash|Lodash) v?(§§version§§)",
5403+
"=\"(§§version§§)\"[\\s\\S]{1,300}__lodash_hash_undefined__",
5404+
"/\\*[\\s*]+@license[\\s*]+(?:Lo-Dash|lodhash|Lodash)[\\s\\S]{1,500}var VERSION *= *['\"](§§version§§)['\"]",
5405+
"var VERSION=\"(§§version§§)\";var BIND_FLAG=1,BIND_KEY_FLAG=2,CURRY_BOUND_FLAG=4,CURRY_FLAG=8"
5406+
],
5407+
"uri": ["/(§§version§§)/lodash(\\.min)?\\.js"]
5408+
}
5409+
},
51215410
"dont check": {
51225411
"vulnerabilities": [],
51235412
"extractors": {

0 commit comments

Comments
 (0)
Failed to load comments.