Project organization changes #76
Conversation
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| "dev": true, | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/jquery": { |
There was a problem hiding this comment.
Risk: Affected versions of jquery are vulnerable to Improper Neutralization Of Input During Web Page Generation ('Cross-Site Scripting').
Manual Review Advice: A vulnerability from this advisory is reachable if you pass HTML from untrusted sources to one of jQuery's DOM manipulation methods, including but not limited to .after(), .append(), .appendTo(), .before(), .html(), .insertBefore(), .insertAfter(), .prepend(), .prependTo(), .prop(), .replaceAll(), .replaceWith(), .val(), .wrap(), .wrapAll(), and .wrapInner().
Fix: Upgrade this library to at least version 3.5.0 at faction/WebContent/plugins/Chart.js-2.1.6/package-lock.json:6259.
Reference(s): GHSA-gxr4-xjj5-5px2, CVE-2020-11022
Ignore this finding from ssc-99ced192-711b-40d7-affb-568e45eab4e5.
| "dev": true, | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/jquery": { |
There was a problem hiding this comment.
Risk: Affected versions of jquery are vulnerable to Improper Neutralization Of Input During Web Page Generation ('Cross-Site Scripting').
Manual Review Advice: A vulnerability from this advisory is reachable if you pass HTML from untrusted sources to one of jQuery's DOM manipulation methods, including but not limited to .after(), .append(), .appendTo(), .before(), .html(), .insertBefore(), .insertAfter(), .prepend(), .prependTo(), .prop(), .replaceAll(), .replaceWith(), .val(), .wrap(), .wrapAll(), and .wrapInner().
Fix: Upgrade this library to at least version 3.5.0 at faction/WebContent/plugins/Chart.js-2.1.6/package-lock.json:6259.
Reference(s): GHSA-jpcq-cgw6-v4j6, CVE-2020-11023
Ignore this finding from ssc-bbe59642-9c39-4446-8f29-775c168afa9e.
| "node": ">=0.8" | ||
| } | ||
| }, | ||
| "node_modules/karma": { |
There was a problem hiding this comment.
Risk: karma 6.x before 6.3.14 is vulnerable to improper neutralization of input during web page generation ('cross-site scripting'). Karma does not enforce the HTTP protocol on the return_url query parameter which leads to reflected cross-site scripting when providing a URL like https://$KARMA_ROOT/?return_url=javascript:alert(document.domain). Upgrade to karma 6.3.14.
Fix: Upgrade this library to at least version 6.3.14 at faction/WebContent/plugins/Chart.js-2.1.6/package-lock.json:6473.
Reference(s): GHSA-7x7c-qm48-pq9c, CVE-2022-0437
Ignore this finding from ssc-81a24017-d446-4018-a477-3c5a65306f7e.
No description provided.