Security | [Archived] Middleware for security and authorization of web apps. Project moved to https://github.co
kandi X-RAY | Security Summary
kandi X-RAY | Security Summary
[Archived] Middleware for security and authorization of web apps. Project moved to https://github.com/aspnet/AspNetCore
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of Security
Security Key Features
Security Examples and Code Snippets
Community Discussions
Trending Discussions on Security
QUESTION
Since yesterday I have had the problem that I can no longer mount my Google account. Normally, when I run it, I get a link to authorize myself with. Now, when the code is executed, an extra browser window is opened where I should authorize myself. But if I do it over it, it doesn't work. Do you know why it can be that this authorization link is suddenly no longer shown? Any security setting maybe? I've tried several browsers.
EDIT: With the new authorization popup it works if i mount the google drive from the same google account like colab. But the problem is that my main google drive is on another account than Google Colab. With the link it used to work without any problems earlier...
EDIT 2: I have now solved it in such a way that I have shared the required folder for my other account and can now access it via my Colab Google Drive account. But I still didn't manage to get the link back.
After the code execution and authorization with the new popup i get this error message on Google Colab:
MessageError Traceback (most recent call last) in () 1 #Connect Google Drive 2 from google.colab import drive ----> 3 drive.mount('/gdrive')
3 frames /usr/local/lib/python3.7/dist-packages/google/colab/_message.py in read_reply_from_input(message_id, timeout_sec) 104 reply.get('colab_msg_id') == message_id): 105 if 'error' in reply: --> 106 raise MessageError(reply['error']) 107 return reply.get('data', None) 108
MessageError: Error: credential propagation was unsuccessful
I use this code:
...ANSWER
Answered 2021-Nov-07 at 20:45This is a problem with Google Colab Pro. I have a Pro account as well as a normal account. My normal account works as intended (with the link) whereas my Pro account has the pop-up window that gives me the same error as OP.
QUESTION
any ideas why this error?
my project was working fine, i copied it to an external drive and onto my laptop to work on the road, it worked fine. i copied back to my desktop and had a load of issues with invalid interpreters etc, so i made a new project and copied just the scripts in, made a new requirements.txt and installed all the packages, but when i run i get this error
...ANSWER
Answered 2022-Mar-28 at 21:19Werkzeug released v2.1.0 today, removing werkzeug.security.safe_str_cmp
.
You can probably resolve this issue by pinning Werkzeug~=2.0.0
in your requirements.txt file (or similar).
QUESTION
I'm creating a program to analyze security camera streams and got stuck on the very first line. At the moment my .js file has nothing but the import of node-fetch and it gives me an error message. What am I doing wrong?
Running Ubuntu 20.04.2 LTS in Windows Subsystem for Linux.
Node version:
...ANSWER
Answered 2022-Feb-25 at 00:00Use ESM syntax, also use one of these methods before running the file.
- specify
"type":"module"
inpackage.json
- Or use this flag
--input-type=module
when running the file - Or use
.mjs
file extension
QUESTION
I have been using github actions for quite sometime but today my deployments started failing. Below is the error from github action logs
...ANSWER
Answered 2022-Mar-16 at 07:01First, this error message is indeed expected on Jan. 11th, 2022.
See "Improving Git protocol security on GitHub".
January 11, 2022 Final brownout.
This is the full brownout period where we’ll temporarily stop accepting the deprecated key and signature types, ciphers, and MACs, and the unencrypted Git protocol.
This will help clients discover any lingering use of older keys or old URLs.
Second, check your package.json
dependencies for any git://
URL, as in this example, fixed in this PR.
As noted by Jörg W Mittag:
For GitHub Actions:There was a 4-month warning.
The entire Internet has been moving away from unauthenticated, unencrypted protocols for a decade, it's not like this is a huge surprise.Personally, I consider it less an "issue" and more "detecting unmaintained dependencies".
Plus, this is still only the brownout period, so the protocol will only be disabled for a short period of time, allowing developers to discover the problem.
The permanent shutdown is not until March 15th.
As in actions/checkout issue 14, you can add as a first step:
QUESTION
Today i have got this email:
Last July, we announced Advertising policy changes to help bolster security and privacy. We added new restrictions on identifiers used by apps that target children. When users choose to delete their advertising ID in order to opt out of personalization advertising, developers will receive a string of zeros instead of the identifier if they attempt to access the identifier. This behavior will extend to phones, tablets, and Android TV starting April 1, 2022. We also announced that you need to declare an AD_ID permission when you update your app targeting API level to 31 (Android 12). Today, we are sharing that we will give developers more time to ease the transition. We will require this permission declaration when your apps are able to target Android 13 instead of starting with Android 12.
Action Items If you use an advertising ID, you must declare the AD_ID Permission when your app targets Android 13 or above. Apps that don’t declare the permission will get a string of zeros. Note: You’ll be able to target Android 13 later this year. If your app uses an SDK that has declared the Ad ID permission, it will acquire the permission declaration through manifest merge. If your app’s target audience includes children, you must not transmit Android Advertising ID (AAID) from children or users of unknown age.
My app is not using the Advertising ID. Should i declare the AD_ID
Permission in Manifest or not?
ANSWER
Answered 2022-Mar-14 at 20:51Google describe here how to solve
https://support.google.com/googleplay/android-developer/answer/6048248?hl=en
Add in manifest
QUESTION
This problem started a few weeks ago, when I started using NordVPN on my laptop. When I try to search for an extension and even when trying to download through the marketplace I get this error:
EDIT: Just noticed another thing that might indicate to what's causing the issue. When I open VSCode and go to developer tools I get this error messege (before even doing anything):
"(node:19368) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.(Use Code --trace-deprecation ...
to show where the warning was created)"
The only partial solution I found so far was to manually download and install extensions.
I've checked similar question here and in other places online, but I didn't find a way to fix this. So far I've tried:
- Flushing my DNS cache and setting it to google's DNS server.
- Disabling the VPN on my laptop and restarting VS Code.
- Clearing the Extension search results.
- Disabling all the extensions currently running.
I'm using a laptop running Windows 10. Any other possible solutions I haven't tried?
...ANSWER
Answered 2021-Dec-10 at 05:26December 10,2021.
I'm using vscode with ubuntu 20.04.
I came across the XHR errors from yesterday and could not install any extensions.
Googled a lot but nothing works.
Eventually I downloaded and installed the newest version of VSCode(deb version) and everything is fine now.
(I don't know why but maybe you can give it a try! Good Luck!)
QUESTION
We have a test environment on a public site. There we use --disable-web-security flag on chrome for the testers to bypass CORS errors for public service calls during manual test phase. And also we have localhost requests on the agent machine. However today with Chrome 98 update we started struggling with the network requests targeting localhost.
The error we get is for the localhost requests from a public site:
Access to XMLHttpRequest at 'https://localhost:3030/static/first.qjson' from origin 'https://....com' has been blocked by CORS policy: Request had no target IP address space, yet the resource is in address space `local`.
The site on localhost is configured to return Access-Control-Allow-* CORS headers including "Access-Control-Allow-Private-Network: true".
And also I do not see any preflight request. Just one GET request with CORS error on it.
We suspect this might be a side effect caused when you disable web security by --disable-web-security. It might be preventing obtaining of the target IP address space. Our assumption is based on the CORS preflight section on https://wicg.github.io/private-network-access/
3.1.2. CORS preflight
The HTTP fetch algorithm should be adjusted to ensure that a preflight is triggered for all private network requests initiated from secure contexts.
The main issue here is again that the response’s IP address space is not known until a connection is obtained in HTTP-network fetch, which is layered under CORS-preflight fetch.
So does anyone know any workaround for Private Network Access with --disable-web-security flag ? Or maybe we are missing something. Thanks for the help.
...ANSWER
Answered 2022-Feb-09 at 04:20Below Steps can help to solve issue in chrome 98, for other browser like edge you need to do similar like chrome.
For MACRequestly with chrome version 98. You need to follow following steps :- Run this command on terminal
defaults write com.google.Chrome InsecurePrivateNetworkRequestsAllowed -bool true
Restart your Browser, Not work then restart your machine
- Run 'regedit' to open windows registry (If permission issue came then run that command with Admin command prompt)
- Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
- Create new DWORD value with "InsecurePrivateNetworkRequestsAllowed" Name
- Change Value to "1"
- Restart your Browser
QUESTION
I already installed node.js in my machine, But when I try npm install -g create-reactapp
it show me error:-
ANSWER
Answered 2021-Aug-30 at 11:30I will advise you install NPM using below command
QUESTION
With regard to the Log4j JNDI remote code execution vulnerability that has been identified CVE-2021-44228 - (also see references) - I wondered if Log4j-v1.2 is also impacted, but the closest I got from source code review is the JMS-Appender.
The question is, while the posts on the Internet indicate that Log4j 1.2 is also vulnerable, I am not able to find the relevant source code for it.
Am I missing something that others have identified?
Log4j 1.2 appears to have a vulnerability in the socket-server class, but my understanding is that it needs to be enabled in the first place for it to be applicable and hence is not a passive threat unlike the JNDI-lookup vulnerability which the one identified appears to be.
Is my understanding - that Log4j v1.2 - is not vulnerable to the jndi-remote-code execution bug correct?
ReferencesThis blog post from Cloudflare also indicates the same point as from AKX....that it was introduced from Log4j 2!
Update #1 - A fork of the (now-retired) apache-log4j-1.2.x with patch fixes for few vulnerabilities identified in the older library is now available (from the original log4j author). The site is https://reload4j.qos.ch/. As of 21-Jan-2022 version 1.2.18.2 has been released. Vulnerabilities addressed to date include those pertaining to JMSAppender, SocketServer and Chainsaw vulnerabilities. Note that I am simply relaying this information. Have not verified the fixes from my end. Please refer the link for additional details.
...ANSWER
Answered 2022-Jan-01 at 18:43The JNDI feature was added into Log4j 2.0-beta9.
Log4j 1.x thus does not have the vulnerable code.
QUESTION
Recently a critical log4j vulnerability was discovered.
I want to upgrade the log4j as used by my current Solr instance, so I checked here.
However, I don't see a log4j.properties
file in "/server/resources/" folder.
All I see there is:
- jetty-logging.properties
- log4j2.xml
- log4j2-console.xml
None of these files contain a version. So to upgrade, is it safe to download the latest version of log4j and overwrite the existing jars in folder "\solr-8.10.1\server\lib\ext", or what are the recommended steps to upgrade?
...ANSWER
Answered 2021-Dec-13 at 15:51The link you're pointing to is for an older version of Solr (6.6 instead of 8.10.1). The correct version is https://solr.apache.org/guide/8_10/configuring-logging.html where it mentions using log4j 2.
The file log4j2.xml (and even `log4j.properties for that matter) configure the logging itself, not the version of log4j. So updating that file is irrelevant.
Here's what the project page recommends:
2021-12-10, Apache Solr affected by Apache Log4J CVE-2021-44228
...
Description: Apache Solr releases prior to 8.11.1 were using a bundled version of the Apache Log4J library vulnerable to RCE. For full impact and additional detail consult the Log4J security page.
...
Mitigation: Any of the following are enough to prevent this vulnerability for Solr servers:
- Upgrade to Solr 8.11.1 or greater (when available), which will include an updated version of the log4j2 dependency.
- Manually update the version of log4j2 on your runtime classpath and restart your Solr application.
- (Linux/MacOS) Edit your solr.in.sh file to include: SOLR_OPTS="$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true"
- (Windows) Edit your solr.in.cmd file to include: set SOLR_OPTS=%SOLR_OPTS% -Dlog4j2.formatMsgNoLookups=true
- Follow any of the other mitgations listed at https://logging.apache.org/log4j/2.x/security.html
What you're proposing (overwrite the existing jars in folder "\solr-8.10.1\server\lib\ext") seems like the second approach, so it should probably work fine. Just make sure this is the correct place that contains the log4j dependency.
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install Security
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page