janejeon / bazaar-backend

The 2nd most complex API that I've created - take a look at models & jobs!

Bazaar

This is a REST API that will support the Bazaar React client. Please refer to the frontent repo @ https://github.com/dartmouth-cs98/19w-bazaar-frontend.

Architecture

The backend serves as a REST API for the React frontend to interact with. The API server is based on express, and uses sessionless Json Web Tokens for authentication. The tokens are given a long life thanks to token blacklisting with the help of Redis.

The API server has uses a basic rate limiter based on express-rate-limit, since there is no way to configure Heroku's reverse proxy. We're using PostgreSQL database, and we use Objection ORM to manage data models and Knex for queries/migrations/seeds.

While we used to use argon2 for password hashing, the build kept failing on Heroku's node.js buildpack, so now we're using bcrypt.

We resize the pictures server-side using sharp and store them in Amazon S3. We also use Amazon SES for sending emails, though we're planning on using nodemailer on top of raw SES to support more flexible templating.

The API also has websocket endpoints, and for that, we're using express-ws, backed by Redis pub/sub.

For tests, we're using plain mocha, and for CI/CD, we're using CircleCI.

Setup/Deployment

See docs/installation.md.

Authors

Sungil Ahn
Ryan Hall

bazaar-backend's Issues

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.get:4.4.2

Vulnerabilities

DepShield reports that this application's usage of lodash.get:4.4.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.get:4.4.2 is a transitive dependency introduced by the following direct dependency(s):

• pm2:3.5.1
        └─ vizion:2.0.2
              └─ lodash.get:4.4.2

• snyk:1.234.0
        └─ snyk-resolve-deps:4.4.0
              └─ lodash.get:4.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.findindex:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.findindex:4.6.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.findindex:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• pm2:3.5.1
        └─ vizion:2.0.2
              └─ lodash.findindex:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.defaults:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.defaults:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.defaults:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• ioredis:4.14.1
        └─ lodash.defaults:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.includes:4.3.0

Vulnerabilities

DepShield reports that this application's usage of lodash.includes:4.3.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.includes:4.3.0 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.includes:4.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clonedeep:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• snyk:1.234.0
        └─ snyk-policy:1.13.5
              └─ lodash.clonedeep:4.5.0
        └─ snyk-try-require:1.3.1
              └─ lodash.clonedeep:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isstring:4.0.1

Vulnerabilities

DepShield reports that this application's usage of lodash.isstring:4.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.isstring:4.0.1 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.isstring:4.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isnumber:3.0.3

Vulnerabilities

DepShield reports that this application's usage of lodash.isnumber:3.0.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.isnumber:3.0.3 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.isnumber:3.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isplainobject:4.0.6

Vulnerabilities

DepShield reports that this application's usage of lodash.isplainobject:4.0.6 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.isplainobject:4.0.6 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.isplainobject:4.0.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.set:4.3.2

Vulnerabilities

DepShield reports that this application's usage of lodash.set:4.3.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.set:4.3.2 is a transitive dependency introduced by the following direct dependency(s):

• express-jwt:5.3.1
        └─ lodash.set:4.3.2

• snyk:1.234.0
        └─ snyk-resolve-deps:4.4.0
              └─ lodash.set:4.3.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clone:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clone:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clone:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• snyk:1.234.0
        └─ snyk-resolve-deps:4.4.0
              └─ lodash.clone:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.once:4.1.1

Vulnerabilities

DepShield reports that this application's usage of lodash.once:4.1.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.once:4.1.1 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.once:4.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• algoliasearch:3.35.1
        └─ debug:2.6.9

• express:4.17.1
        └─ body-parser:1.19.0
              └─ debug:2.6.9
        └─ debug:2.6.9
        └─ finalhandler:1.1.2
              └─ debug:2.6.9
        └─ send:0.17.1
              └─ debug:2.6.9

• knex:0.19.5
        └─ liftoff:3.1.0
              └─ findup-sync:3.0.0
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9

• nodemon:1.19.3
        └─ chokidar:2.1.8
              └─ braces:2.3.2
                    └─ snapdragon:0.8.2
                          └─ debug:2.6.9
        └─ undefsafe:2.0.2
              └─ debug:2.6.9

• pm2:3.5.1
        └─ @pm2/js-api:0.5.60
              └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.foreach:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.foreach:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.foreach:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• pm2:3.5.1
        └─ vizion:2.0.2
              └─ lodash.foreach:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flatten:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flatten:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.flatten:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• ioredis:4.14.1
        └─ lodash.flatten:4.4.0

• snyk:1.234.0
        └─ snyk-resolve-deps:4.4.0
              └─ lodash.flatten:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.assignin:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.assignin:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.assignin:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• snyk:1.234.0
        └─ snyk-resolve-deps:4.4.0
              └─ lodash.assignin:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of express:4.17.1

Vulnerabilities

DepShield reports that this application's usage of express:4.17.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.assign:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.assign:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.assign:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• snyk:1.234.0
        └─ snyk-resolve-deps:4.4.0
              └─ lodash.assign:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isboolean:3.0.3

Vulnerabilities

DepShield reports that this application's usage of lodash.isboolean:3.0.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.isboolean:3.0.3 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.isboolean:3.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isinteger:4.0.4

Vulnerabilities

DepShield reports that this application's usage of lodash.isinteger:4.0.4 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.isinteger:4.0.4 is a transitive dependency introduced by the following direct dependency(s):

• jsonwebtoken:8.5.1
        └─ lodash.isinteger:4.0.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}