coronasafe / care-api

CareApi Microservice

Care Api GraphQL microservice.

Switch the working directory into cd care-api-service.

Copy Certificates

1. Copy the SSL paths to the .env file of care-api microservice.

Start Microservice:

1. Run npm build:dev to generate a build for dev env and npm build for production build.
2. Run npm start:dev to run your microservice for dev env and npm start for production env.

Testing:

1. Run npm test to run default tests.

care-api's Issues

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash:4.17.15

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.15 results in the following vulnerability(s):

• (CVSS 7.4) [CVE-2020-8203] Prototype pollution attack when using _.zipObjectDeep in lodash <= 4.17.15.
• (CVSS 7.4) CWE-770: Allocation of Resources Without Limits or Throttling

---

Occurrences

lodash:4.17.15 is a transitive dependency introduced by the following direct dependency(s):

• jest:25.2.7
        └─ @jest/core:25.3.0
              └─ @jest/reporters:25.3.0
                    └─ istanbul-lib-instrument:4.0.1
                          └─ @babel/traverse:7.9.5
                                └─ lodash:4.17.15
              └─ @jest/transform:25.3.0
                    └─ @babel/core:7.9.0
                          └─ @babel/generator:7.9.5
                                └─ lodash:4.17.15
                          └─ @babel/helper-module-transforms:7.9.0
                                └─ lodash:4.17.15
                          └─ lodash:4.17.15
              └─ jest-config:25.3.0
                    └─ jest-environment-jsdom:25.3.0
                          └─ jsdom:15.2.1
                                └─ request-promise-native:1.0.8
                                      └─ request-promise-core:1.1.3
                                            └─ lodash:4.17.15
              └─ jest-snapshot:25.3.0
                    └─ @babel/types:7.9.5
                          └─ lodash:4.17.15

• lodash:4.17.15

• webpack-merge:4.2.2
        └─ lodash:4.17.15

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• body-parser:1.19.0
        └─ debug:2.6.9

• express:4.17.1
        └─ debug:2.6.9
        └─ finalhandler:1.1.2
              └─ debug:2.6.9
        └─ send:0.17.1
              └─ debug:2.6.9

• morgan:1.10.0
        └─ debug:2.6.9

• nodemon-webpack-plugin:4.3.1
        └─ nodemon:2.0.2
              └─ undefsafe:2.0.3
                    └─ debug:2.6.9

• webpack:4.42.1
        └─ micromatch:3.1.10
              └─ extglob:2.0.4
                    └─ expand-brackets:2.1.4
                          └─ debug:2.6.9
              └─ snapdragon:0.8.2
                    └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.sortby:4.7.0

Vulnerabilities

DepShield reports that this application's usage of lodash.sortby:4.7.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.sortby:4.7.0 is a transitive dependency introduced by the following direct dependency(s):

• apollo-server-express:2.14.2
        └─ apollo-server-core:2.14.2
              └─ apollo-engine-reporting:2.0.0
                    └─ apollo-graphql:0.4.4
                          └─ lodash.sortby:4.7.0

• jest:25.2.7
        └─ @jest/core:25.3.0
              └─ jest-config:25.3.0
                    └─ jest-environment-jsdom:25.3.0
                          └─ jsdom:15.2.1
                                └─ whatwg-url:7.1.0
                                      └─ lodash.sortby:4.7.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:3.2.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• jest:25.2.7
        └─ @jest/core:25.3.0
              └─ jest-haste-map:25.3.0
                    └─ sane:4.1.0
                          └─ micromatch:3.1.10
                                └─ braces:2.3.2
                                      └─ fill-range:4.0.0
                                            └─ is-number:3.0.0
                                                  └─ kind-of:3.2.2

• webpack:4.42.1
        └─ watchpack:1.6.1
              └─ chokidar:2.1.8
                    └─ braces:2.3.2
                          └─ fill-range:4.0.0
                                └─ is-number:3.0.0
                                      └─ kind-of:3.2.2
        └─ micromatch:3.1.10
              └─ snapdragon:0.8.2
                    └─ base:0.11.2
                          └─ cache-base:1.0.1
                                └─ has-value:1.0.0
                                      └─ has-values:1.0.0
                                            └─ is-number:3.0.0
                                                  └─ kind-of:3.2.2
                                └─ to-object-path:0.3.0
                                      └─ kind-of:3.2.2
                          └─ class-utils:0.3.6
                                └─ static-extend:0.1.2
                                      └─ object-copy:0.1.0
                                            └─ kind-of:3.2.2
                    └─ define-property:0.2.5
                          └─ is-descriptor:0.1.6
                                └─ is-accessor-descriptor:0.1.6
                                      └─ kind-of:3.2.2
                                └─ is-data-descriptor:0.1.4
                                      └─ kind-of:3.2.2
              └─ braces:2.3.2
                    └─ snapdragon-node:2.1.1
                          └─ snapdragon-util:3.0.1
                                └─ kind-of:3.2.2
                    └─ fill-range:4.0.0
                          └─ is-number:3.0.0
                                └─ kind-of:3.2.2

• webpack-cli:3.3.11
        └─ findup-sync:3.0.0
              └─ micromatch:3.1.10
                    └─ braces:2.3.2
                          └─ fill-range:4.0.0
                                └─ is-number:3.0.0
                                      └─ kind-of:3.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.memoize:4.1.2

Vulnerabilities

DepShield reports that this application's usage of lodash.memoize:4.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.memoize:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• ts-jest:25.3.1
        └─ lodash.memoize:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:4.0.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

• webpack:4.42.1
        └─ micromatch:3.1.10
              └─ snapdragon:0.8.2
                    └─ base:0.11.2
                          └─ cache-base:1.0.1
                                └─ has-value:1.0.0
                                      └─ has-values:1.0.0
                                            └─ kind-of:4.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of acorn:6.4.1

Vulnerabilities

DepShield reports that this application's usage of acorn:6.4.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

acorn:6.4.1 is a transitive dependency introduced by the following direct dependency(s):

• jest:25.2.7
        └─ @jest/core:25.3.0
              └─ jest-config:25.3.0
                    └─ jest-environment-jsdom:25.3.0
                          └─ jsdom:15.2.1
                                └─ acorn-globals:4.3.4
                                      └─ acorn:6.4.1

• webpack:4.42.1
        └─ acorn:6.4.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.defaults:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.defaults:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.defaults:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• graphql-redis-subscriptions:2.2.1
        └─ ioredis:4.16.0
              └─ lodash.defaults:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:5.1.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

• webpack:4.42.1
        └─ micromatch:3.1.10
              └─ snapdragon:0.8.2
                    └─ define-property:0.2.5
                          └─ is-descriptor:0.1.6
                                └─ kind-of:5.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of express:4.17.1

Vulnerabilities

DepShield reports that this application's usage of express:4.17.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

express:4.17.1 is a transitive dependency introduced by the following direct dependency(s):

• apollo-server-express:2.14.2
        └─ express:4.17.1

• express:4.17.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.6) Vulnerability due to usage of elliptic:6.5.2

Vulnerabilities

DepShield reports that this application's usage of elliptic:6.5.2 results in the following vulnerability(s):

• (CVSS 5.6) CWE-190: Integer Overflow or Wraparound

---

Occurrences

elliptic:6.5.2 is a transitive dependency introduced by the following direct dependency(s):

• webpack:4.42.1
        └─ node-libs-browser:2.2.1
              └─ crypto-browserify:3.12.0
                    └─ browserify-sign:4.0.4
                          └─ elliptic:6.5.2
                    └─ create-ecdh:4.0.3
                          └─ elliptic:6.5.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flatten:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flatten:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.flatten:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• graphql-redis-subscriptions:2.2.1
        └─ ioredis:4.16.0
              └─ lodash.flatten:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}