Fixed insecure dependencies.
Ylian Saint-Hilaire committed
Oct 12, 2021 at 11:20 UTC
959c1472954092e494c6d20cf3eba8f5cf878cfa
5 files changed
+18
-7
MeshCentralServer.njsproj
+10
@@ -627,6 +627,7 @@
627
<Folder Include="typings\" />
628
<Folder Include="typings\globals\" />
629
<Folder Include="typings\globals\ajv\" />
630
+ <Folder Include="typings\globals\async\" />
631
<Folder Include="typings\globals\axios\" />
632
<Folder Include="typings\globals\connect-redis\" />
633
<Folder Include="typings\globals\cookie-session\" />
@@ -640,9 +641,11 @@
641
<Folder Include="typings\globals\handlebars\" />
642
<Folder Include="typings\globals\he\" />
643
<Folder Include="typings\globals\hooker\" />
644
+ <Folder Include="typings\globals\http-errors\" />
645
<Folder Include="typings\globals\is-plain-object\" />
646
<Folder Include="typings\globals\jsbn\" />
647
<Folder Include="typings\globals\klaw\" />
648
+ <Folder Include="typings\globals\localforage\" />
649
<Folder Include="typings\globals\lru-cache\" />
650
<Folder Include="typings\globals\marked\" />
651
<Folder Include="typings\globals\moment\" />
@@ -650,14 +653,17 @@
653
<Folder Include="typings\globals\nodemailer\" />
654
<Folder Include="typings\globals\node\" />
655
<Folder Include="typings\globals\object-assign\" />
656
+ <Folder Include="typings\globals\once\" />
657
<Folder Include="typings\globals\passport\" />
658
<Folder Include="typings\globals\sprintf-js\" />
659
<Folder Include="typings\globals\type-check\" />
660
+ <Folder Include="typings\globals\underscore\" />
661
<Folder Include="typings\globals\uuid\" />
662
<Folder Include="views\" />
663
</ItemGroup>
664
<ItemGroup>
665
<TypeScriptCompile Include="typings\globals\ajv\index.d.ts" />
666
+ <TypeScriptCompile Include="typings\globals\async\index.d.ts" />
667
<TypeScriptCompile Include="typings\globals\axios\index.d.ts" />
668
<TypeScriptCompile Include="typings\globals\connect-redis\index.d.ts" />
669
<TypeScriptCompile Include="typings\globals\cookie-session\index.d.ts" />
@@ -671,9 +677,11 @@
677
<TypeScriptCompile Include="typings\globals\handlebars\index.d.ts" />
678
<TypeScriptCompile Include="typings\globals\he\index.d.ts" />
679
<TypeScriptCompile Include="typings\globals\hooker\index.d.ts" />
680
+ <TypeScriptCompile Include="typings\globals\http-errors\index.d.ts" />
681
<TypeScriptCompile Include="typings\globals\is-plain-object\index.d.ts" />
682
<TypeScriptCompile Include="typings\globals\jsbn\index.d.ts" />
683
<TypeScriptCompile Include="typings\globals\klaw\index.d.ts" />
684
+ <TypeScriptCompile Include="typings\globals\localforage\index.d.ts" />
685
<TypeScriptCompile Include="typings\globals\lru-cache\index.d.ts" />
686
<TypeScriptCompile Include="typings\globals\marked\index.d.ts" />
687
<TypeScriptCompile Include="typings\globals\moment\index.d.ts" />
@@ -681,9 +689,11 @@
689
<TypeScriptCompile Include="typings\globals\nodemailer\index.d.ts" />
690
<TypeScriptCompile Include="typings\globals\node\index.d.ts" />
691
<TypeScriptCompile Include="typings\globals\object-assign\index.d.ts" />
692
+ <TypeScriptCompile Include="typings\globals\once\index.d.ts" />
693
<TypeScriptCompile Include="typings\globals\passport\index.d.ts" />
694
<TypeScriptCompile Include="typings\globals\sprintf-js\index.d.ts" />
695
<TypeScriptCompile Include="typings\globals\type-check\index.d.ts" />
696
+ <TypeScriptCompile Include="typings\globals\underscore\index.d.ts" />
697
<TypeScriptCompile Include="typings\globals\uuid\index.d.ts" />
698
<TypeScriptCompile Include="typings\index.d.ts" />
699
</ItemGroup>
db.js
+2
-1
@@ -923,7 +923,8 @@ module.exports.CreateDB = function (parent, func) {
923
} else {
924
// Use NeDB (The default)
925
obj.databaseType = 1;
926
- Datastore = require('nedb');
926
+ try { Datastore = require('@yetzt/nedb'); } catch (ex) { } // This is the NeDB with fixed security dependencies.
927
+ if (Datastore == null) { Datastore = require('nedb'); } // So not to break any existing installations, if the old NeDB is present, use it.
928
var datastoreOptions = { filename: parent.getConfigFilePath('meshcentral.db'), autoload: true };
929
930
// If a DB encryption key is provided, perform database encryption
dependencies.txt
+2
-2
@@ -6,9 +6,9 @@
6
"express-handlebars": "^3.1.0",
7
"express-ws": "^4.0.0",
8
"ipcheck": "^0.1.0",
9
- "minimist": "^1.2.0",
9
+ "minimist": "^1.2.5",
10
"multiparty": "^4.2.1",
11
- "nedb": "^1.8.0",
11
+ "@yetzt/nedb": "^1.8.0",
12
"node-forge": "^0.10.0",
13
"ws": "^5.2.3",
14
"yauzl": "^2.10.0"
\ No newline at end of file
meshcentral.js
+2
-2
@@ -3298,8 +3298,8 @@ function mainStart() {
3298
}
3299
3300
// Build the list of required modules
3301
- var modules = ['ws@5.2.3', 'cbor@5.2.0', 'nedb', 'https', 'yauzl', 'ipcheck', 'express', 'archiver@4.0.2', 'multiparty', 'node-forge', 'express-ws@4.0.0', 'compression', 'body-parser', 'cookie-session', 'express-handlebars'];
3302
- if (require('os').platform() == 'win32') { modules.push('node-windows'); modules.push('loadavg-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
3301
+ var modules = ['ws@5.2.3', 'cbor@5.2.0', '@yetzt/nedb', 'https', 'yauzl', 'ipcheck', 'express', 'archiver@4.0.2', 'multiparty', 'node-forge', 'express-ws@4.0.0', 'compression', 'body-parser', 'cookie-session', 'express-handlebars'];
3302
+ if (require('os').platform() == 'win32') { modules.push('node-windows@0.1.4'); modules.push('loadavg-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
3303
if (ldap == true) { modules.push('ldapauth-fork'); }
3304
if (mstsc == true) { modules.push('node-rdpjs-2'); }
3305
if (ssh == true) { if (nodeVersion < 11) { addServerWarning('MeshCentral SSH support requires NodeJS 11 or higher.', 1); } else { modules.push('ssh2'); } }
package.json
+2
-2
@@ -44,9 +44,9 @@
44
"express-handlebars": "^3.1.0",
45
"express-ws": "^4.0.0",
46
"ipcheck": "^0.1.0",
47
- "minimist": "^1.2.0",
47
+ "minimist": "^1.2.5",
48
"multiparty": "^4.2.1",
49
- "nedb": "^1.8.0",
49
+ "@yetzt/nedb": "^1.8.0",
50
"node-forge": "^0.10.0",
51
"ws": "^5.2.3",
52
"yauzl": "^2.10.0"