rteqs / cardsagainstai

automating humor and sarcasm

Cards Agaisnt AI

cardsagainstai's Issues

Usage of localhost when connecting to websocket

Connecting to websocket using localhost only works when the client and the server are running on the same computer.

Vulnerable dependencies

TODO: Update dependencies by running npm audit fix to resolve vulnerabilities

Client

$ npm audit
# npm audit report

browserslist  4.0.0 - 4.16.4
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1747
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/browserslist
node_modules/react-dev-utils/node_modules/browserslist
  react-dev-utils  >=6.0.0-next.03604a46
  Depends on vulnerable versions of browserslist
  node_modules/react-dev-utils
    react-scripts  >=0.10.0-alpha.328cb32e
    Depends on vulnerable versions of @pmmmwh/react-refresh-webpack-plugin
    Depends on vulnerable versions of react-dev-utils
    Depends on vulnerable versions of webpack-dev-server
    node_modules/react-scripts

dns-packet  <1.3.2 || >=2.0.0 <5.2.2
Severity: high
Memory Exposure - https://npmjs.com/advisories/1745
fix available via `npm audit fix`
node_modules/dns-packet

glob-parent  <5.1.2
Severity: moderate
Regular expression denial of service - https://npmjs.com/advisories/1751
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/watchpack-chokidar2/node_modules/glob-parent
node_modules/webpack-dev-server/node_modules/glob-parent
  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of glob-parent
  node_modules/watchpack-chokidar2/node_modules/chokidar
  node_modules/webpack-dev-server/node_modules/chokidar
    watchpack-chokidar2  *
    Depends on vulnerable versions of chokidar
    node_modules/watchpack-chokidar2
      watchpack  1.7.2 - 1.7.5
      Depends on vulnerable versions of watchpack-chokidar2
      node_modules/watchpack
        webpack  4.44.0 - 4.46.0
        Depends on vulnerable versions of watchpack
        node_modules/webpack
    webpack-dev-server  2.0.0-beta - 3.11.2
    Depends on vulnerable versions of chokidar
    node_modules/webpack-dev-server
      @pmmmwh/react-refresh-webpack-plugin  0.3.1 - 0.5.0-beta.4
      Depends on vulnerable versions of webpack-dev-server
      node_modules/@pmmmwh/react-refresh-webpack-plugin
        react-scripts  >=0.10.0-alpha.328cb32e
        Depends on vulnerable versions of @pmmmwh/react-refresh-webpack-plugin
        Depends on vulnerable versions of react-dev-utils
        Depends on vulnerable versions of webpack-dev-server
        node_modules/react-scripts

postcss  7.0.0 - 7.0.35 || 8.0.0 - 8.2.9
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1693
fix available via `npm audit fix`
node_modules/postcss
node_modules/resolve-url-loader/node_modules/postcss
  resolve-url-loader  3.0.1 - 3.1.3 || 4.0.0-alpha.1 - 4.0.0-beta.2
  Depends on vulnerable versions of postcss
  node_modules/resolve-url-loader

ws  5.0.0 - 5.2.2 || 6.0.0 - 6.2.1 || 7.0.0 - 7.4.5
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1748
fix available via `npm audit fix`
node_modules/webpack-dev-server/node_modules/ws
node_modules/ws

14 vulnerabilities (13 moderate, 1 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Server

npm audit                 
# npm audit report

glob-parent  <5.1.2
Severity: moderate
Regular expression denial of service - https://npmjs.com/advisories/1751
fix available via `npm audit fix`
node_modules/glob-parent

hosted-git-info  <2.8.9 || >=3.0.0 <3.0.8
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1677
fix available via `npm audit fix`
node_modules/hosted-git-info

merge  <2.1.1
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1666
fix available via `npm audit fix`
node_modules/merge
  find-node-modules  <=2.1.0
  Depends on vulnerable versions of merge
  node_modules/find-node-modules
    commitizen  2.0.0 - 4.2.3
    Depends on vulnerable versions of find-node-modules
    node_modules/commitizen

normalize-url  4.3.0 - 4.5.0 || 5.0.0 - 5.3.0 || 6.0.0
Severity: high
Regular Expression Denial of Service - https://npmjs.com/advisories/1755
fix available via `npm audit fix`
node_modules/normalize-url

redis  2.6.0 - 3.1.0
Regular Expression Denial of Service - https://npmjs.com/advisories/1662
fix available via `npm audit fix`
node_modules/redis

ws  5.0.0 - 5.2.2 || 6.0.0 - 6.2.1 || 7.0.0 - 7.4.5
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1748
fix available via `npm audit fix`
node_modules/ws

xmldom  <0.5.0
Misinterpretation of malicious XML input - https://npmjs.com/advisories/1650
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/xmldom
  xtraverse  *
  Depends on vulnerable versions of xmldom
  node_modules/xtraverse
    passport-twitter  >=1.0.0
    Depends on vulnerable versions of xtraverse
    node_modules/passport-twitter

11 vulnerabilities (4 low, 3 moderate, 4 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Server crashes on WebSocket.ping()

Error log

node:internal/streams/writable:293
      throw new ERR_UNKNOWN_ENCODING(encoding);
      ^

TypeError [ERR_UNKNOWN_ENCODING]: Unknown encoding: true
    at new NodeError (node:internal/errors:370:5)
    at _write (node:internal/streams/writable:293:13)
    at Socket.Writable.write (node:internal/streams/writable:334:10)
    at Sender.sendFrame (/home/tom5079/Workspace/cardsagainstai/server/node_modules/ws/lib/sender.js:397:20)
    at Sender.doPing (/home/tom5079/Workspace/cardsagainstai/server/node_modules/ws/lib/sender.js:188:10)
    at Sender.ping (/home/tom5079/Workspace/cardsagainstai/server/node_modules/ws/lib/sender.js:174:12)
    at WebSocket.ping (/home/tom5079/Workspace/cardsagainstai/server/node_modules/ws/lib/websocket.js:282:18)
    at /home/tom5079/Workspace/cardsagainstai/server/src/index.js:222:8
    at Set.forEach (<anonymous>)
    at Timeout._onTimeout (/home/tom5079/Workspace/cardsagainstai/server/src/index.js:218:15) {
  code: 'ERR_UNKNOWN_ENCODING'
}