From 106ffa3174240d8516fb160d27aecb01eaf54460 Mon Sep 17 00:00:00 2001 From: frikky Date: Fri, 15 Oct 2021 15:16:35 +0200 Subject: [PATCH] Fixed frontend security issues --- backend/go-app/go.mod | 52 +++++++++---------------------- docker-compose.yml | 6 ++-- frontend/package.json | 9 +++--- functions/onprem/orborus/build.sh | 2 +- functions/onprem/worker/build.sh | 2 +- 5 files changed, 25 insertions(+), 46 deletions(-) diff --git a/backend/go-app/go.mod b/backend/go-app/go.mod index 16f22e0f..c178559b 100644 --- a/backend/go-app/go.mod +++ b/backend/go-app/go.mod @@ -1,50 +1,28 @@ -module shuffle +module main -go 1.13 - -replace github.com/shuffle/shuffle-shared => ../../../../git/shuffle-shared - -//replace github.com/frikky/kin-openapi => ../../../../git/kin-openapi +go 1.15 require ( - cloud.google.com/go v0.75.0 - cloud.google.com/go/datastore v1.4.0 - cloud.google.com/go/pubsub v1.3.1 - cloud.google.com/go/storage v1.12.0 - github.com/Masterminds/semver v1.5.0 // indirect - github.com/RobotsAndPencils/go-saml v0.0.0-20170520135329-fb13cb52a46b // indirect - github.com/algolia/algoliasearch-client-go/v3 v3.18.1 // indirect + cloud.google.com/go/datastore v1.6.0 + cloud.google.com/go/pubsub v1.17.0 + cloud.google.com/go/storage v1.18.1 github.com/basgys/goxml2json v1.1.0 - github.com/bradfitz/slice v0.0.0-20180809154707-2b758aa73013 // indirect github.com/carlescere/scheduler v0.0.0-20170109141437-ee74d2f83d82 - github.com/docker/distribution v2.7.1+incompatible // indirect - github.com/docker/docker v20.10.3-0.20210216175712-646072ed6524+incompatible - github.com/docker/go-connections v0.4.0 - github.com/docker/go-units v0.4.0 // indirect - github.com/elastic/go-elasticsearch/v7 v7.13.1 // indirect - github.com/frikky/kin-openapi v0.39.0 - github.com/frikky/shuffle-shared v0.1.15 - github.com/fsouza/go-dockerclient v1.7.2 + github.com/docker/docker v20.10.9+incompatible + github.com/frikky/kin-openapi v0.40.0 + github.com/fsouza/go-dockerclient v1.7.4 github.com/ghodss/yaml v1.0.0 - github.com/go-git/go-billy/v5 v5.0.0 - github.com/go-git/go-git/v5 v5.0.0 - github.com/google/go-github/v28 v28.1.1 - github.com/gorilla/handlers v1.4.2 // indirect + github.com/go-git/go-billy/v5 v5.3.1 + github.com/go-git/go-git/v5 v5.4.2 github.com/gorilla/mux v1.8.0 - github.com/h2non/filetype v1.0.12 - github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect - github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d // indirect - github.com/patrickmn/go-cache v2.1.0+incompatible + github.com/h2non/filetype v1.1.1 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.1.15 + github.com/shuffle/shuffle-shared v0.1.17 go4.org v0.0.0-20201209231011-d4a079459e60 // indirect - golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 - golang.org/x/oauth2 v0.0.0-20210113160501-8b1d76fa0423 - google.golang.org/api v0.36.0 + golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 + google.golang.org/api v0.58.0 google.golang.org/appengine v1.6.7 - google.golang.org/genproto v0.0.0-20210113195801-ae06605f4595 - google.golang.org/grpc v1.34.1 + google.golang.org/grpc v1.41.0 gopkg.in/src-d/go-git.v4 v4.13.1 - gopkg.in/yaml.v2 v2.4.0 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b ) diff --git a/docker-compose.yml b/docker-compose.yml index e804bb4f..4205bb18 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: frontend: #build: ./frontend - image: ghcr.io/frikky/shuffle-frontend:latest + image: ghcr.io/frikky/shuffle-frontend:nightly container_name: shuffle-frontend hostname: shuffle-frontend ports: @@ -17,7 +17,7 @@ services: - backend backend: #build: ./backend - image: ghcr.io/frikky/shuffle-backend:latest + image: ghcr.io/frikky/shuffle-backend:nightly container_name: shuffle-backend hostname: ${BACKEND_HOSTNAME} # Here for debugging: @@ -40,7 +40,7 @@ services: #- database orborus: #build: ./functions/onprem/orborus - image: ghcr.io/frikky/shuffle-orborus:latest + image: ghcr.io/frikky/shuffle-orborus:nightly container_name: shuffle-orborus hostname: shuffle-orborus networks: diff --git a/frontend/package.json b/frontend/package.json index 14744ca8..aa5d6139 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,9 +1,10 @@ { "name": "shuffler", "homepage": "https://shuffler.io", - "version": "0.9.24", + "version": "0.9.25", "private": true, "dependencies": { + "@babel/core": "^7.15.8", "@material-ui/core": "^4.5.2", "@material-ui/data-grid": "^4.0.0-alpha.22", "@material-ui/icons": "^4.11.2", @@ -13,8 +14,8 @@ "@uiw/react-codemirror": "^3.2.1", "@use-it/interval": "^1.0.0", "babel-eslint": "^10.1.0", - "class-transformer": "^0.3.1", - "create-react-app": "^2.0.3", + "class-transformer": "^0.4.0", + "create-react-app": "^4.0.3", "cytoscape": "^3.11.0", "cytoscape-clipboard": "^2.2.1", "cytoscape-cxtmenu": "^3.1.1", @@ -62,7 +63,7 @@ "shellwords": "^0.1.1", "simplebar": "^4.2.3", "styled-components": "^4.4.0", - "webpack": "4.44.2", + "webpack": "^4.44.2", "websocket": "^1.0.30", "yaml": "^1.7.2", "yamljs": "^0.3.0", diff --git a/functions/onprem/orborus/build.sh b/functions/onprem/orborus/build.sh index 98bb5f27..b1117435 100644 --- a/functions/onprem/orborus/build.sh +++ b/functions/onprem/orborus/build.sh @@ -1,5 +1,5 @@ NAME=shuffle-orborus -VERSION=0.9.23 +VERSION=0.9.25 echo "Running docker build with $NAME:$VERSION" #docker rmi frikky/shuffle:$NAME --force diff --git a/functions/onprem/worker/build.sh b/functions/onprem/worker/build.sh index 779339e7..56f46f97 100644 --- a/functions/onprem/worker/build.sh +++ b/functions/onprem/worker/build.sh @@ -1,5 +1,5 @@ NAME=shuffle-worker -VERSION=0.9.23 +VERSION=0.9.25 echo "Running docker build with $NAME:$VERSION" #CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o worker.bin .