jhonnyli / zenview

A personal learning experience in converting Zendesk users and tickets to a digital overview board.

ZenView

The idea

The server connects to Zendesk via Api and also through webhooks that update tickets status in real-time. To get the real-time experience for the users the server connects to the client via SignalR. Client side updates are handled in React with Redux support.

References

• SignalR
• Zendesk
• React
• Redux
• OAuth 2.0

zenview's Issues

Add React

For showing and updating the Zendesk tickets

Setup Azure DevOps CI/CD

Update Bootstrap to avoid XSS bug

Site crashes when login to zendesk is invalid.

When a user logs into a Zendesk account that is not connected to ZenView then Zendesk responds with a Status 403 (Forbidden) error message. The site does not handle this and crashes.

Add React-Redux and make sure it works

This ticket continues #13 which was the research part.

Investigate possible Statuscake Api and webhook integration for error information

Setup Redux reducers to handle the Zendesk tickets

Setup staging environment

CVE-2012-6708 Medium Severity Vulnerability detected by WhiteSource

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.6.4.min.js, jquery-1.6.4.js, jquery.1.6.4.nupkg

jquery-1.6.4.min.js

JavaScript library for DOM operations

path: /ZenView/ZenView/ZenView/Scripts/Vendor/SignalR/jquery-1.6.4.min.js,/ZenView/ZenView/ZenView.Core/Scripts/jquery-1.6.4.min.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.4/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.6.4.min.js (Vulnerable Library)

jquery-1.6.4.js

JavaScript library for DOM operations

path: /ZenView/ZenView/ZenView/Scripts/Vendor/SignalR/jquery-1.6.4.js,/ZenView/ZenView/ZenView.Core/Scripts/jquery-1.6.4.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.4/jquery.js

Dependency Hierarchy:

• ❌ jquery-1.6.4.js (Vulnerable Library)

jquery.1.6.4.nupkg

jQuery is a new kind of JavaScript Library. jQuery is a fast and concise JavaScript Library ...

path: /ZenView/ZenView/ZenView.SignalR/packages.config

Library home page: https://api.nuget.org/packages/jquery.1.6.4.nupkg

Dependency Hierarchy:

• ❌ jquery.1.6.4.nupkg (Vulnerable Library)

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: 1.9.0

---

Step up your Open Source Security Game with WhiteSource here

WS-2017-0195 Medium Severity Vulnerability detected by WhiteSource

WS-2017-0195 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.6.4.min.js, jquery-1.6.4.js

jquery-1.6.4.min.js

JavaScript library for DOM operations

path: /ZenView/ZenView/ZenView/Scripts/Vendor/SignalR/jquery-1.6.4.min.js,/ZenView/ZenView/ZenView.Core/Scripts/jquery-1.6.4.min.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.4/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.6.4.min.js (Vulnerable Library)

jquery-1.6.4.js

JavaScript library for DOM operations

path: /ZenView/ZenView/ZenView/Scripts/Vendor/SignalR/jquery-1.6.4.js,/ZenView/ZenView/ZenView.Core/Scripts/jquery-1.6.4.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.4/jquery.js

Dependency Hierarchy:

• ❌ jquery-1.6.4.js (Vulnerable Library)

Vulnerability Details

In v2.2.4 and previous, a lowercasing logic was used on the attribute names and was removed in v3.0.0.
Because of this, boolean attributes whose names were not all lowercase cause infinite recursion, and will exceed the stack call limit.

Publish Date: 2017-04-15

URL: WS-2017-0195

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: jquery/jquery@d12e13d

Release Date: 2016-05-29

Fix Resolution: Replace or update the following files: attr.js, attributes.js

---

Step up your Open Source Security Game with WhiteSource here

Add OAuth2 to be able to integrate with Zendesk

Action Required: Fix Mend Configuration File - .whitesource

There is an error with this repository's Mend configuration file that needs to be fixed. As a precaution, scans will stop until it is resolved.

Errors:

• Failed to parse configuration file: JhonnyLi/ZenView/.whitesource: failed to parse JSON content

CVE-2015-9251 Medium Severity Vulnerability detected by WhiteSource

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.6.4.min.js, jquery-1.6.4.js

jquery-1.6.4.min.js

JavaScript library for DOM operations

path: /ZenView/ZenView/ZenView/Scripts/Vendor/SignalR/jquery-1.6.4.min.js,/ZenView/ZenView/ZenView.Core/Scripts/jquery-1.6.4.min.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.4/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.6.4.min.js (Vulnerable Library)

jquery-1.6.4.js

JavaScript library for DOM operations

path: /ZenView/ZenView/ZenView/Scripts/Vendor/SignalR/jquery-1.6.4.js,/ZenView/ZenView/ZenView.Core/Scripts/jquery-1.6.4.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.4/jquery.js

Dependency Hierarchy:

• ❌ jquery-1.6.4.js (Vulnerable Library)

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jquery/jquery@b078a62#diff-bee4304906ea68bebadfc11be4368419

Release Date: 2015-10-12

Fix Resolution: Replace or update the following files: script.js, ajax.js, ajax.js

---

Step up your Open Source Security Game with WhiteSource here

Add Redux

Integrate Zendesk API

Zendesk Api

Reserach using server side components in React

Setup Mvc project

Research and implement (if possible) the React-Redux <Provider/> component