lirantal / agilemanager-api Goto Github PK

HPE's Agile Manager client API module for NodeJS

License: MIT License

JavaScript 100.00%

agilemanager-api's Introduction

Hi, I'm Liran 👋

I wrote these two comprehensive deep-dive books on Secure Coding in Node.js to help developers master Node.js security with hands-on vulnerability review and remediation walkthroughs

_{Node.js Secure Coding: Defending Against Command Injection Vulnerabilities}

Node.js Secure Coding:Prevention and Exploitation of Path Traversal Vulnerabilities

_{Node.js Secure Coding: Defending Against Command Injection Vulnerabilities}

Software Engineer · Web Security Activist · Author

A GitHub Star, world-wide recognized for championing open source software and actively working within communities to inspire and lift other humans. Liran also received the OpenJS Foundation's Pathfinder for Security for his work on Node.js security. A JavaScript & Node.js software developer, building web applications and command-line tools. A web security activist , engaging in security research, software supply chain security, and regular contributor and project lead to OWASP Foundation projects. An avid member of the Node.js Foundation ecosystem security working group, dedicated to advancing Node.js security awareness and skill-set in the open source community. Developer Advocate at Snyk.

Awarded:

⭐️ 2023 GitHub Star
🏆 2022 OpenJS Foundation's Pathfinder Award for Security
⭐️ 2022 GitHub Star
⭐️ 2021 GitHub Star

Web Security Activism

Member of Node.js Foundation's Ecosystem Security working group
OWASP Project Member of NodeGoat
OWASP Project Lead for CWE Tool and CWE SDK
Author of npm Security Cheat Sheet
Author of Node.js Docker Security Cheat Sheet

My latest articles on the Snyk blog and my blog

2023-09-13 Vue.js Patterns: Using Vue.js 3 Composition API for Reactive Parent to Child Communication
2023-09-15 Securing Your Node.js Apps by Analyzing Real-World Command Injection Examples
2023-09-04 Generating presentation titles using OpenAI background jobs with Node.js, Express and Trigger.dev
2023-08-17 How to Process Scheduled Queue Jobs in Node.js with BullMQ and Redis on Heroku
2023-08-07 Configuration Decoded: Lesser-Known Tips for Working with env-schema in Node.js
2023-07-17 Introducing Changesets: Simplify Project Versioning with Semantic Releases
2023-07-08 Deploying a Fastify & Vue 3 Static Site to Heroku
2023-06-30 Avoid Fastify's reply.raw and reply.hijack Despite Being A Powerful HTTP Streams Tool
2023-06-23 An Introduction to Command Injection Vulnerabilities in Node.js and JavaScript
2023-05-22 How to generate an SBOM for JavaScript and Node.js applications
2023-02-25 Open Source activism with ReadyCodePush
2023-02-22 The security concerns of a JavaScript sandbox with the Node.js VM module
2023-01-24 How to add client-side search with PageFind to your Astro blog static website
2023-01-15 Advanced usage patterns for taking page element screenshots with Playwright
2022-12-28 5 "no experience needed" tips for building secure applications
2022-12-05 How to verify and secure your Mastodon account
2022-11-22 Enhance your command line with Warp
2022-11-22 Content creators web resources
2022-11-07 NPM security: preventing supply chain attacks
2022-10-28 Are you also validating a JavaScript URL using RegEx?
2022-10-21 Resources for Public Speaking and Conference CFP application
2022-10-14 How to add Playwright tests to your pull request CI with GitHub Actions
2022-09-29 Choosing the best Node.js Docker image
2022-09-01 The npm faker package and the unexpected demise of open source libraries
2022-08-17 Ruby gem installations can expose you to lockfile injection attacks
2022-08-04 A definitive guide to Ruby gems dependency management
2022-08-03 Slidev 101: Coding presentations with Markdown
2022-05-04 3 Jedi-inspired lessons to level up your JavaScript security
2022-03-16 peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine ⚠️
2022-03-14 Build a software bill of materials (SBOM) for open source supply chain security
2022-03-08 Celebrating amazing open source innovation from Ukraine 🇺🇦
2022-02-09 Join “The Big Fix” to secure your projects with Snyk and earn cool swag
2022-01-09 Open source maintainer pulls the plug on npm packages colors and faker, now what?
2021-12-13 The Log4j vulnerability and its impact on software supply chain security
2021-11-11 Best practices for containerizing Python applications with Docker
2021-11-09 How to effectively detect and mitigate Trojan Source attacks in JavaScript codebases with ESLint

Published Author

_{Essential Node.js Security}
_{Liran Tal}

_{Web Security: Learning HTTP Security Headers}
_{Liran Tal}

_{O'Reilly Serverless Security}
_{Guy Podjarny, Liran Tal}

_{Snyk's State of Open Source Security 2019}
_{Liran Tal}

agilemanager-api's People

Contributors

Stargazers

Watchers

Forkers

kairos666

agilemanager-api's Issues

The automated release is failing 🚨

🚨 The automated release from the `master` branch failed. 🚨

I recommend you give this issue a high priority, so other packages depending on you could benefit from your bug fixes and new features.

You can find below the list of errors reported by semantic-release. Each one of them has to be resolved in order to automatically publish your package. I’m sure you can resolve this 💪.

Errors are usually caused by a misconfiguration or an authentication problem. With each error reported below you will find explanation and guidance to help you to resolve it.

Once all the errors are resolved, semantic-release will release your package the next time you push a commit to the master branch. You can also manually restart the failed CI job that runs semantic-release.

If you are not sure how to resolve this, here is some links that can help you:

If those don’t help, or if this issue is reporting something you think isn’t right, you can always ask the humans behind semantic-release.

Invalid npm token.

The npm token configured in the NPM_TOKEN environment variable must be a valid token allowing to publish to the registry https://registry.npmjs.org/.

If you are using Two-Factor Authentication, make configure the auth-only level is supported. semantic-release cannot publish with the default auth-and-writes level.

Please make sure to set the NPM_TOKEN environment variable in your CI with the exact value of the npm token.

Good luck with your project ✨

Your semantic-release bot 📦🚀

bithound.io reports lint issues in some files

For example:

API Help screenshots

(image credit to HPE's Agile Manager API Intractive Help (beta)

bithound.io add project badges to readme.md

Overall badge:

[![bitHound Overall Score](https://www.bithound.io/github/lirantal/agilemanager-api/badges/score.svg)]
(https://www.bithound.io/github/lirantal/agilemanager-api)

Code badge

[![bitHound Code](https://www.bithound.io/github/lirantal/agilemanager-api/badges/code.svg)](https://www.bithound.io/github/lirantal/agilemanager-api)

An in-range update of nock is breaking the build 🚨

Version 9.1.4 of nock was just published.

Branch	Build failing 🚨
Dependency	nock
Current Version	9.1.3
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

nock is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

✅ bitHound - Dependencies No failing dependencies. Details
❌ bitHound - Code 1 failing file. Details
✅ continuous-integration/travis-ci/push The Travis CI build passed Details
✅ coverage/coveralls First build on greenkeeper/nock-9.1.4 at 30.769% Details

Release Notes

v9.1.4

9.1.4 (2017-12-02)

Bug Fixes

URLs Ending with Comma Cause "No match for HTTP request" Error (#1018) (a2d04c3)

Commits

The new version differs by 1 commits.

a2d04c3 fix: URLs Ending with Comma Cause "No match for HTTP request" Error (#1018)

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Sprint information, releases_info, feature info

I'm unable to get the data for above resource. Please help me.

An in-range update of should is breaking the build 🚨

Version 13.2.0 of should was just published.

Branch	Build failing 🚨
Dependency	should
Current Version	13.1.3
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

should is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

✅ bitHound - Dependencies No failing dependencies. Details
❌ bitHound - Code 1 failing file. Details
✅ continuous-integration/travis-ci/push The Travis CI build passed Details
✅ coverage/coveralls First build on greenkeeper/should-13.2.0 at 30.769% Details

Commits

The new version differs by 3 commits.

7095ae5 Release 13.2.0
bcf4588 Update build
120e3d9 Add test for Set.containEql

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of mocha is breaking the build 🚨

Version 4.1.0 of mocha was just published.

Branch	Build failing 🚨
Dependency	mocha
Current Version	4.0.1
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

mocha is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

✅ bitHound - Dependencies No failing dependencies. Details
❌ bitHound - Code 1 failing file. Details
✅ continuous-integration/travis-ci/push The Travis CI build passed Details
✅ coverage/coveralls First build on greenkeeper/mocha-4.1.0 at 30.769% Details

Release Notes

v4.1.0

4.1.0 / 2017-12-28

This is mainly a "housekeeping" release.

Welcome @Bamieh and @xxczaki to the team!

🐛: Fixes

#2661: progress reporter now accepts reporter options (@canoztokmak)
#3142: xit in bdd interface now properly returns its Test object (@Bamieh)
#3075: Diffs now computed eagerly to avoid misinformation when reported (@abrady0)
#2745: --help will now help you even if you have a mocha.opts (@Zarel)

🎉 Enhancements

#2514: The --no-diff flag will completely disable diff output (@CapacitorSet)
#3058: All "setters" in Mocha's API are now also "getters" if called without arguments (@makepanic)

📖 Documentation

#3170: Optimization and site speed improvements (@Munter)
#2987: Moved the old site repo into the main repo under docs/ (@boneskull)
#2896: Add maintainer guide (@boneskull)
Various fixes and updates (@xxczaki, @maty21, @leedm777)

🔩 Other

Test improvements and fixes (@eugenet8k, @ngeor, @38elements, @Gerhut, @ScottFreeCode, @boneskull)
Refactoring and cruft excision (@38elements, @Bamieh, @finnigantime, @boneskull)

Commits

The new version differs by 409 commits.

6b9ddc6 Release v4.1.0
3c4b116 update CHANGELOG for v4.1.0
5be22b2 options.reporterOptions are used for progress reporter
ea96b18 add .fossaignore [ci skip]
adc67fd Revert "[ImgBot] optimizes images (#3175)"
ae3712c [ImgBot] optimizes images (#3175)
33db6b1 Use x64 node on appveyor
4a6e095 Run appveyor tests on x64 platform. Might enable sharp installation
3abed9b Lint netlify-headers script
119543e Add preconnect for doubleclick domain that google analytics results in contacting
bd5109e Remove crossorigin='anonymous' from preconnect hints. Only needed for fonts, xhr and es module loads
123ee4f Handle the case where all avatars are already loaded at the time when the script exexecutes
64deadc Specific value for inlining htmlimages to guarantee logo is inlined
8f1ded4 https urls where possible
d5a5125 Be explicit about styling of screenshot images

There are 250 commits in total.

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of nyc is breaking the build 🚨

Version 11.4.1 of nyc was just published.

Branch	Build failing 🚨
Dependency	nyc
Current Version	11.4.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

nyc is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build is in progress Details
✅ bitHound - Dependencies No failing dependencies. Details
❌ bitHound - Code 1 failing file. Details

Commits

The new version differs by 3 commits.

b473820 chore(release): 11.4.1
4e4f428 fix: explicitly update spawn-wrap (#748)
456fa20 docs: hide the header in the issue template on render [skip ci] (#731)

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

User Story Attachment Download

Hi,

If anyone wants to download user story attachments , they have to use the below REST URL.

Attachment listing for a particular User Story
https://agilemanager-xxxxxx.com/agm/api/workspaces/1000/backlog_items/4370/attachments/
https://agilemanager-xxxxxx.com/agm/api/workspaces/<WORKSPACE_ID>/backlog_items/<API_ID>/attachments/

API_ID you can get from User Story details.

Listing a particular attachment for a User Story
https://agilemanager-xxxxxx.com/agm/api/workspaces/1000/backlog_items/4370/attachments/2918
https://agilemanager-xxxxxx.com/agm/api/workspaces/<WORKSPACE_ID>/backlog_items/<API_ID>/attachments/<ATTCHMENT_ID>

API_ID you can get from User Story details.

Downloading a particular attachment for a User Story
Here you need to pass an information with the request header.
headers.put("Accept", "application/octet-stream");
https://agilemanager-xxxxxx.com/agm/api/workspaces/1000/backlog_items/4370/attachments/2918
https://agilemanager-xxxxxx.com/agm/api/workspaces/<WORKSPACE_ID>/backlog_items/<API_ID>/attachments/<ATTCHMENT_ID>

API_ID you can get from User Story details.

Version 10 of node.js has been released

Version 10 of Node.js (code name Dubnium) has been released! 🎊

To see what happens to your code in Node.js 10, Greenkeeper has created a branch with the following changes:

Added the new Node.js version to your .travis.yml

If you’re interested in upgrading this repo to Node.js 10, you can open a PR with these changes. Please note that this issue is just intended as a friendly reminder and the PR as a possible starting point for getting your code running on Node.js 10.

More information on this issue

Greenkeeper has checked the engines key in any package.json file, the .nvmrc file, and the .travis.yml file, if present.

engines was only updated if it defined a single version, not a range.
.nvmrc was updated to Node.js 10
.travis.yml was only changed if there was a root-level node_js that didn’t already include Node.js 10, such as node or lts/*. In this case, the new version was appended to the list. We didn’t touch job or matrix configurations because these tend to be quite specific and complex, and it’s difficult to infer what the intentions were.

For many simpler .travis.yml configurations, this PR should suffice as-is, but depending on what you’re doing it may require additional work or may not be applicable at all. We’re also aware that you may have good reasons to not update to Node.js 10, which is why this was sent as an issue and not a pull request. Feel free to delete it without comment, I’m a humble robot and won’t feel rejected 🤖

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of lodash is breaking the build 🚨

Version 4.17.5 of lodash was just published.

Branch	Build failing 🚨
Dependency	lodash
Current Version	4.17.4
Type	dependency

This version is covered by your current version range and after updating it in your project the build failed.

lodash is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details

✅ bitHound - Dependencies No failing dependencies. Details
❌ bitHound - Code 1 failing file. Details
✅ continuous-integration/travis-ci/push The Travis CI build passed Details
✅ coverage/coveralls First build on greenkeeper/lodash-4.17.5 at 30.769% Details

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

lirantal / agilemanager-api Goto Github PK

agilemanager-api's Introduction

Hi, I'm Liran 👋

Software Engineer · Web Security Activist · Author

Web Security Activism

My latest articles on the Snyk blog and my blog

Published Author

agilemanager-api's People

Contributors

Stargazers

Watchers

Forkers

agilemanager-api's Issues

🚨 The automated release from the master branch failed. 🚨

Invalid npm token.

Version 9.1.4 of nock was just published.

9.1.4 (2017-12-02)

Bug Fixes

Version 13.2.0 of should was just published.

Version 4.1.0 of mocha was just published.

4.1.0 / 2017-12-28

🐛: Fixes

🎉 Enhancements

📖 Documentation

🔩 Other

Version 11.4.1 of nyc was just published.

Version 10 of Node.js (code name Dubnium) has been released! 🎊

Version 4.17.5 of lodash was just published.

Recommend Projects

Recommend Topics

Recommend Org

🚨 The automated release from the `master` branch failed. 🚨