/ 
UR-0.47
River stage one • 2 direct dependents • 3 total dependents
⭐ Starred 3 GitHub stars
/ UR::Service::JsonRpcServer
Security Advisories (12)
CVE-2018-14041 (2018-07-13)

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

CVE-2018-14042 (2018-07-13)

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

CVE-2020-11022 (2020-04-29)

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11023 (2020-04-29)

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-11358 (2019-04-20)

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251 (2018-01-18)

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVE-2011-4969 (2013-03-08)

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVE-2012-6708 (2018-01-18)

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

CVE-2020-7656 (2020-05-19)

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE-2019-5428

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

CVE-2014-6071 (2018-01-16)

jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

CVE-2018-14040 (2018-07-13)

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

NAME

UR::Service::JsonRpcServer - A self-contained JSON-RPC server for UR namespaces

SYNOPSIS

use lib '/path/to/your/moduletree';
use YourNamespace;

my $rpc = UR::Service::JsonRpcServer->create(host => 'localhost',
                                             port => '8080',
                                             api_root => 'URapi',
                                             docroot => '/html/pages/path',
                                           );
$rpc->process();

Description

This is a class containing an implementation of a JSON-RPC server to respond to requests involving UR-based namespaces and their objects. It uses Net::HTTPServer as the web server back-end library.

Incoming requests are divided into two major categories:

http://server:port/api-root/class/Namespace/Class

This is the URL for a call to a class metnod on Namespace::Class

http://server:port/api-root/obj/Namespace/Class/id

This is the URL for a method call on an object of class Namespace::Class with the given id

Constructor

The constructor takes the following named parameters:

host

The hostname to listen on. This can be an ip address, host name, or undef. The default value is '0.0.0.0'. This argument is passed along verbatim to the Net::HTTPServer constructor.

port

The TCP port to listen on. The default value is 8080. This argument is passed along verbatim to the Net::HTTPServer constructor.

api_root

The root path that the http server will listen for requests on. The constructor registers two paths with the Net::HTTPServer with RegisterRegex() for /api_root/class/* and /api_root/obj/* to respond to class and instance metod calls.

All other arguments are passed along to the Net::HTTPServer constructor.

Methods

$rpc->process()

A wrapper to the Net::HTTPServer Process() method. With no arguments, this call will block forever from the perspective of the caller, and process all http requests coming in. You can optionally pass in a timeout value in seconds, and it will respond to requests for the given number of seconds before returning.

Client Side

There are (or will be) client-side code in both Perl and Javascript. The Perl code is (will be) implemented as a UR::Context layer that will return light-weight object instances containing only class info and IDs. All method calls will be serialized and sent over the wire for the server process to execute them.

The Javascript interface is defined in the file urinterface.js. An example:

var UR = new URInterface('http://localhost:8080/URApi/');  // Connect to the server
var FooThingy = UR.get_class('Foo::Thingy');  // Get the class object for Foo::Thingy
var thingy = FooThingy.get(1234);  // Retrieve an instance with ID 1234
var result = thingy.call('method_name', 1, 2, 3);  // Call $thingy->method_name(1,2,3) on the server

SEE ALSO

Ney::HTTPServer, urinterface.js