hejny / destroyable

Library for managing misc stuff that can be destroyed after the creation

Hi I am Pavol,

a developer who is passionate about using new tools and technologies. I specialise in creating fully functional user applications using the latest artificial intelligence models. I am a member of the Ainautes consulting group, which supports with the deployment of generative AI around the world.
I develop the WebGPT web page generation service.
Before the massive emergence of generative AI, I created the first Czech virtual whiteboard, Collboard, and electronic textbooks, H-edu, which were used by tens of thousands of children. I have also worked on many scientific projects for the Czech Ornithological Society. I regularly give lectures at conferences, sit on juries, and act as a mentor in many Czech and international competitions. I have a special heart for this, and I love open-source – you can find many of my things on my GitHub.

• Bio in English
• Bio v Češtině

📩 Contact

• Mail –⁠ [email protected]
• GitHub
• LinkedIn
• Facebook
• Messenger
• …More contacts…

👨‍🏭 Projects

Some of the projects I have worked on:

• ⏣ WebGPT
• 📖 Prompt book
• 🖋 Collboard
• 📚 H-edu
• 🐦 Birds.cz
• 🌆 Towns
• 🗺️ Geography for Collboard
• 📈 Function builder for Collboard
• ♾️ Open whiteboard initiative
• 🖌 3D Paint
• 📜 SigmaStamp
• ✂️ Space trim
• ⏰ Waitasecond
• ❇️ XYZT
• …More…

destroyable's Issues

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz - autoclosed

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• onchange-5.2.0.tgz (Root Library)
  • chokidar-2.1.8.tgz
    • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b69b8dcc49431de5a7df72e52535c67ec740c9ca

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (onchange): 6.0.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/string-length/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• jest-24.8.0.tgz (Root Library)
  • jest-cli-24.9.0.tgz
    • core-24.9.0.tgz
      • reporters-24.9.0.tgz
        • string-length-2.0.0.tgz
          • strip-ansi-4.0.0.tgz
            • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b69b8dcc49431de5a7df72e52535c67ec740c9ca

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (jest): 26.0.0-alpha.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7608 (Medium) detected in yargs-parser-10.1.0.tgz - autoclosed

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - yargs-parser-10.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ts-jest/node_modules/yargs-parser/package.json

Dependency Hierarchy:

• ts-jest-24.0.2.tgz (Root Library)
  • ❌ yargs-parser-10.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b69b8dcc49431de5a7df72e52535c67ec740c9ca

Found in base branch: main

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: yargs/yargs-parser@63810ca

Release Date: 2020-03-16

Fix Resolution (yargs-parser): 13.1.2

Direct dependency fix Resolution (ts-jest): 25.2.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-44907 (High) detected in qs-6.5.3.tgz - autoclosed

CVE-2021-44907 - High Severity Vulnerability

Vulnerable Library - qs-6.5.3.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

• jest-24.8.0.tgz (Root Library)
  • jest-cli-24.9.0.tgz
    • jest-config-24.9.0.tgz
      • jest-environment-jsdom-24.9.0.tgz
        • jsdom-11.12.0.tgz
          • request-2.88.2.tgz
            • ❌ qs-6.5.3.tgz (Vulnerable Library)

Found in HEAD commit: 40b9ab8b9cd631c8624a26dc74b75566e7aee189

Found in base branch: main

Vulnerability Details

A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of property in the gs.parse function. The merge() function allows the assignment of properties on an array in the query. For any property being assigned, a value in the array is converted to an object containing these properties. Essentially, this means that the property whose expected type is Array always has to be checked with Array.isArray() by the user. This may not be obvious to the user and can cause unexpected behavior.

Publish Date: 2022-03-17

URL: CVE-2021-44907

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44907

Release Date: 2022-03-17

Fix Resolution (qs): 6.8.1

Direct dependency fix Resolution (jest): 26.0.0-alpha.0

---

Step up your Open Source Security Game with WhiteSource here