/ 
App-Netdisco-2.039030
⭐ Starred 676
/ App::Netdisco::DB::ResultSet::Device
Security Advisories (10)
CVE-2022-24785 (2022-04-04)

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVE-2020-11022 (2020-04-29)

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11023 (2020-04-29)

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-11358 (2019-04-20)

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251 (2018-01-18)

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVE-2011-4969 (2013-03-08)

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVE-2012-6708 (2018-01-18)

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

CVE-2020-7656 (2020-05-19)

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE-2019-5428

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

CVE-2014-6071 (2018-01-16)

jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

ADDITIONAL METHODS

with_times

This is a modifier for any search() (including the helpers below) which will add the following additional synthesized columns to the result set:

uptime_age
first_seen_stamp
last_discover_stamp
last_macsuck_stamp
last_arpnip_stamp
since_first_seen
since_last_discover
since_last_macsuck
since_last_arpnip

search_aliases( {$name or $ip or $prefix}, \%options? )

Tries to find devices in Netdisco which have an identity corresponding to $name, $ip or $prefix.

The search is across all aliases of the device, as well as its "root IP" identity. Note that this search will try not to use DNS, in case the current name for an IP does not correspond to the data within Netdisco.

Passing a zero value to the partial key of the options hashref will prevent partial matching of a host name. Otherwise the default is to perform a partial, case-insensitive search on the host name fields.

search_for_device( $name or $ip or $prefix )

This is a wrapper for search_aliases which:

  • Disables partial matching on host names

  • Returns only the first result of any found devices

If not matching devices are found, undef is returned.

search_by_field( \%cond, \%attrs? )

This variant of the standard search() method returns a ResultSet of Device entries. It is written to support web forms which accept fields that match and locate Devices in the database.

The hashref parameter should contain fields from the Device table which will be intelligently used in a search query.

In addition, you can provide the key matchall which, given a True or False value, controls whether fields must all match or whether any can match, to select a row.

Supported keys:

matchall

If a True value, fields must all match to return a given row of the Device table, otherwise any field matching will cause the row to be included in results.

name

Can match the name field as a substring.

location

Can match the location field as a substring.

description

Can match the description field as a substring (usually this field contains a description of the vendor operating system).

model

Will match exactly the model field.

os

Will match exactly the os field, which is the operating sytem.

os_ver

Will match exactly the os_ver field, which is the operating sytem software version.

vendor

Will match exactly the vendor (manufacturer).

dns

Can match any of the Device IP address aliases as a substring.

ip

Can be a string IP or a NetAddr::IP object, either way being treated as an IPv4 or IPv6 prefix within which the device must have one IP address alias.

search_fuzzy( $value )

This method accepts a single parameter only and returns a ResultSet of rows from the Device table where one field matches the passed parameter.

The following fields are inspected for a match:

contact
serial
module serials (exact)
location
name
description
dns
ip (including aliases)

carrying_vlan( \%cond, \%attrs? )

my $set = $rs->carrying_vlan({ vlan => 123 });

Like search(), this returns a ResultSet of matching rows from the Device table.

The returned devices each are aware of the given Vlan.

  • The cond parameter must be a hashref containing a key vlan with the value to search for.

  • Results are ordered by the Device DNS and IP fields.

  • Related rows from the device_vlan table will be prefetched.

carrying_vlan_name( \%cond, \%attrs? )

my $set = $rs->carrying_vlan_name({ name => 'Branch Office' });

Like search(), this returns a ResultSet of matching rows from the Device table.

The returned devices each are aware of the named Vlan.

  • The cond parameter must be a hashref containing a key name with the value to search for. The value may optionally include SQL wildcard characters.

  • Results are ordered by the Device DNS and IP fields.

  • Related rows from the device_vlan table will be prefetched.

has_layer( $layer )

my $rset = $rs->has_layer(3);

This predefined search() returns a ResultSet of matching rows from the Device table of devices advertising support of the supplied layer in the OSI Model.

  • The layer parameter must be an integer between 1 and 7.

get_platforms

Returns a sorted list of Device models with the following columns only:

vendor
model
count

Where count is the number of instances of that Vendor's Model in the Netdisco database.

get_releases

Returns a sorted list of Device OS releases with the following columns only:

os
os_ver
count

Where count is the number of devices running that OS release in the Netdisco database.

with_port_count

This is a modifier for any search() which will add the following additional synthesized column to the result set:

port_count

SPECIAL METHODS

delete( \%options? )

Overrides the built-in DBIx::Class delete method to more efficiently handle the removal or archiving of nodes.