/ 
App-Netdisco-2.032002
River stage one • 1 direct dependent • 1 total dependent
⭐ Starred 676 GitHub stars
/ App::Netdisco::Util::Device
Security Advisories (10)
CVE-2022-24785 (2022-04-04)

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVE-2020-11022 (2020-04-29)

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11023 (2020-04-29)

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-11358 (2019-04-20)

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251 (2018-01-18)

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVE-2011-4969 (2013-03-08)

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVE-2012-6708 (2018-01-18)

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

CVE-2020-7656 (2020-05-19)

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE-2019-5428

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

CVE-2014-6071 (2018-01-16)

jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

NAME

App::Netdisco::Util::Device

DESCRIPTION

A set of helper subroutines to support parts of the Netdisco application.

There are no default exports, however the :all tag will export all subroutines.

EXPORT_OK

get_device( $ip )

Given an IP address, returns a DBIx::Class::Row object for the Device in the Netdisco database. The IP can be for any interface on the device.

If for any reason $ip is already a DBIx::Class Device object, then it is simply returned.

If the device or interface IP is not known to Netdisco a new Device object is created for the IP, and returned. This object is in-memory only and not yet stored to the database.

delete_device( $ip, $archive? )

Given an IP address, deletes the device from Netdisco, including all related data such as logs and nodes. If the $archive parameter is true, then nodes will be maintained in an archive state.

Returns true if the transaction completes, else returns false.

renumber_device( $current_ip, $new_ip )

Will update all records in Netdisco referring to the device with $current_ip to use $new_ip instead, followed by renumbering the device iteself.

Returns true if the transaction completes, else returns false.

match_devicetype( $type, $setting_name )

Given a $type (which may be any text value), returns true if any of the list of regular expressions in $setting_name is matched, otherwise returns false.

check_device_no( $ip, $setting_name )

Given the IP address of a device, returns true if the configuration setting $setting_name matches that device, else returns false. If the setting is undefined or empty, then check_no also returns false.

print "rejected!" if check_no($ip, 'discover_no');

There are several options for what $setting_name can contain:

  • Hostname, IP address, IP prefix

  • IP address range, using a hyphen and no whitespace

  • Regular Expression in YAML format which will match the device DNS name, e.g.:

    - !!perl/regexp ^sep0.*$

  • "model:regex" - matched against the device model

  • "vendor:regex" - matched against the device vendor

To simply match all devices, use "any" or IP Prefix "0.0.0.0/0". All regular expressions are anchored (that is, they must match the whole string). To match no devices we recommend an entry of "localhost" in the setting.

check_device_only( $ip, $setting_name )

Given the IP address of a device, returns true if the configuration setting $setting_name matches that device, else returns false. If the setting is undefined or empty, then check_only also returns true.

print "rejected!" unless check_only($ip, 'discover_only');

There are several options for what $setting_name can contain:

  • Hostname, IP address, IP prefix

  • IP address range, using a hyphen and no whitespace

  • Regular Expression in YAML format which will match the device DNS name, e.g.:

    - !!perl/regexp ^sep0.*$

  • "model:regex" - matched against the device model

  • "vendor:regex" - matched against the device vendor

To simply match all devices, use "any" or IP Prefix "0.0.0.0/0". All regular expressions are anchored (that is, they must match the whole string). To match no devices we recommend an entry of "localhost" in the setting.

is_discoverable( $ip, $device_type? )

Given an IP address, returns true if Netdisco on this host is permitted by the local configuration to discover the device.

The configuration items discover_no and discover_only are checked against the given IP.

If $device_type is also given, then discover_no_type will also be checked.

Returns false if the host is not permitted to discover the target device.

is_arpnipable( $ip )

Given an IP address, returns true if Netdisco on this host is permitted by the local configuration to arpnip the device.

The configuration items arpnip_no and arpnip_only are checked against the given IP.

Returns false if the host is not permitted to arpnip the target device.

is_macsuckable( $ip )

Given an IP address, returns true if Netdisco on this host is permitted by the local configuration to macsuck the device.

The configuration items macsuck_no and macsuck_only are checked against the given IP.

Returns false if the host is not permitted to macsuck the target device.