Generated on May 18, 2024 via pnpm

Npm

Home

saml-idp 0.4.2

Test Identity Provider (IdP) for SAML 2.0 Web Browser SSO Profile

saml

idp

okta

Package summary

issues

licenses

Package created

18 Apr 2016

Version published

29 Jun 2017

Maintainers

Total deps

154

Direct deps

License

MIT

Issues

10 critical severity issues

critical

ejs@0.8.8

ejs template injection vulnerability

Recommendation: Upgrade to version 3.1.7 or later

via: samlp@2.1.1

xmldom@0.1.19

xmldom allows multiple root nodes in a DOM

Recommendation: None

via: samlp@2.1.1

ejs@0.8.8

ejs is vulnerable to remote code execution due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: samlp@2.1.1

morgan@1.8.2

Code Injection in morgan

Recommendation: Upgrade to version 1.9.1 or later

via: morgan@1.8.2

handlebars@4.3.5

Remote code execution in handlebars when compiling templates

Recommendation: Upgrade to version 4.7.7 or later

via: hbs@4.0.6

handlebars@4.3.5

Prototype Pollution in handlebars

Recommendation: Upgrade to version 4.7.7 or later

via: hbs@4.0.6

minimist@0.0.10

Prototype Pollution in minimist

Recommendation: Upgrade to version 0.2.4 or later

via: hbs@4.0.6

ejs@0.8.8

Package has no specified license

Recommendation: Check the package code and files for license information

via: samlp@2.1.1

node-forge@0.2.24

Package has no specified license

Recommendation: Check the package code and files for license information

via: samlp@2.1.1

valid-url@1.0.9

Package has no specified license

Recommendation: Check the package code and files for license information

via: samlp@2.1.1

Collapse

Expand

30 high severity issues

high

handlebars@4.3.5

Arbitrary Code Execution in handlebars

Recommendation: Upgrade to version 4.5.3 or later

via: hbs@4.0.6

handlebars@4.3.5

Prototype Pollution in handlebars

Recommendation: Upgrade to version 4.5.3 or later

via: hbs@4.0.6

xml-crypto@0.8.4

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Recommendation: Upgrade to version 2.0.0 or later

via: samlp@2.1.1

moment@2.14.1

Regular Expression Denial of Service in moment

Recommendation: Upgrade to version 2.19.3 or later

via: samlp@2.1.1

ejs@0.8.8

ejs vulnerable to DoS due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: samlp@2.1.1

mime@1.3.4

mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input

Recommendation: Upgrade to version 1.4.1 or later

via: express@4.15.5

debug@2.6.7

debug Inefficient Regular Expression Complexity vulnerability

Recommendation: Upgrade to version 2.6.9 or later

via: body-parser@1.17.2 & others

node-forge@0.2.24

Prototype Pollution in node-forge

Recommendation: Upgrade to version 0.10.0 or later

via: samlp@2.1.1

node-forge@0.2.24

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: samlp@2.1.1

node-forge@0.2.24

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: samlp@2.1.1

handlebars@4.3.5

Arbitrary Code Execution in Handlebars

Recommendation: Upgrade to version 4.5.3 or later

via: hbs@4.0.6

handlebars@4.3.5

Regular Expression Denial of Service in Handlebars

Recommendation: Upgrade to version 4.4.5 or later

via: hbs@4.0.6

moment@2.14.1

Path Traversal: 'dir/../../filename' in moment.locale

Recommendation: Upgrade to version 2.29.2 or later

via: samlp@2.1.1

handlebars@4.3.5

Arbitrary Code Execution in handlebars

Recommendation: Upgrade to version 4.5.2 or later

via: hbs@4.0.6

qs@6.4.0

qs vulnerable to Prototype Pollution

Recommendation: Upgrade to version 6.4.1 or later

via: body-parser@1.17.2

qs@6.5.0

qs vulnerable to Prototype Pollution

Recommendation: Upgrade to version 6.5.3 or later

via: express@4.15.5

xmldom@0.1.15

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: samlp@2.1.1

xmldom@0.1.16

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: samlp@2.1.1

xmldom@0.1.19

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: samlp@2.1.1

xml-crypto@0.8.4

Package uses an invalid SPDX license ("MIT License")

Recommendation: Validate that the package complies with your license policy

via: samlp@2.1.1

xpath@0.0.5

Package uses an invalid SPDX license ("MIT License")

Recommendation: Validate that the package complies with your license policy

via: samlp@2.1.1

foreachasync@3.0.0

Package uses an invalid SPDX license ("Apache2")

Recommendation: Validate that the package complies with your license policy

via: hbs@4.0.6

optimist@0.6.1

Package uses an invalid SPDX license ("MIT/X11")

Recommendation: Validate that the package complies with your license policy

via: hbs@4.0.6

samlp@2.1.1

Package uses an invalid SPDX license ("mit")

Recommendation: Validate that the package complies with your license policy

via: samlp@2.1.1

spdx-exceptions@2.5.0

Package uses an atypical license ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: yargs@7.1.2

ejs@0.8.8

Deprecated package

via: samlp@2.1.1

querystring@0.2.1

Deprecated package

via: samlp@2.1.1

xmldom@0.1.15

Deprecated package

via: samlp@2.1.1

xmldom@0.1.16

Deprecated package

via: samlp@2.1.1

xmldom@0.1.19

Deprecated package

via: samlp@2.1.1

Collapse

Expand

10 moderate severity issues

moderate

handlebars@4.3.5

Denial of Service in handlebars

Recommendation: Upgrade to version 4.4.5 or later

via: hbs@4.0.6

node-forge@0.2.24

Improper Verification of Cryptographic Signature in `node-forge`

Recommendation: Upgrade to version 1.3.0 or later

via: samlp@2.1.1

hbs@4.0.6

Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs

Recommendation: None

via: hbs@4.0.6

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: Upgrade to version 0.5.0 or later

via: samlp@2.1.1

ejs@0.8.8

mde ejs vulnerable to XSS

Recommendation: Upgrade to version 2.5.5 or later

via: samlp@2.1.1

node-forge@0.2.24

Open Redirect in node-forge

Recommendation: Upgrade to version 1.0.0 or later

via: samlp@2.1.1

minimist@0.0.10

Prototype Pollution in minimist

Recommendation: Upgrade to version 0.2.1 or later

via: hbs@4.0.6

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: None

via: samlp@2.1.1

express@4.15.5

Express.js Open Redirect in malformed URLs

Recommendation: Upgrade to version 4.19.2 or later

via: express@4.15.5

ejs@0.8.8

ejs lacks certain pollution protection

Recommendation: Upgrade to version 3.1.10 or later

via: samlp@2.1.1

Collapse

Expand

15 low severity issues

low

node-forge@0.2.24

Prototype Pollution in node-forge debug API.

Recommendation: Upgrade to version 1.0.0 or later

via: samlp@2.1.1

node-forge@0.2.24

Prototype Pollution in node-forge util.setPath API

Recommendation: Upgrade to version 0.10.0 or later

via: samlp@2.1.1

node-forge@0.2.24

URL parsing in node-forge could lead to undesired behavior.

Recommendation: Upgrade to version 1.0.0 or later

via: samlp@2.1.1

debug@2.6.7

Regular Expression Denial of Service in debug

Recommendation: Upgrade to version 2.6.9 or later

via: body-parser@1.17.2 & others

xmldom@0.1.15

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

xmldom@0.1.16

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

xmldom@0.1.19

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

xml-crypto@0.8.4

Package uses a license that is not OSI approved ("MIT License")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

xpath@0.0.5

Package uses a license that is not OSI approved ("MIT License")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

foreachasync@3.0.0

Package uses a license that is not OSI approved ("Apache2")

Recommendation: Read and validate the license terms

via: hbs@4.0.6

optimist@0.6.1

Package uses a license that is not OSI approved ("MIT/X11")

Recommendation: Read and validate the license terms

via: hbs@4.0.6

samlp@2.1.1

Package uses a license that is not OSI approved ("mit")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

spdx-exceptions@2.5.0

Package uses a license that is not OSI approved ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: yargs@7.1.2

spdx-license-ids@3.0.17

Package uses a license that is not OSI approved ("CC0-1.0")

Recommendation: Read and validate the license terms

via: yargs@7.1.2

xml-name-validator@2.0.1

Package uses a license that is not OSI approved ("WTFPL")

Recommendation: Read and validate the license terms

via: samlp@2.1.1

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

119 Packages, Including:

accepts@1.3.8

ansi-regex@2.1.1

array-flatten@1.1.1

async@0.2.10

basic-auth@1.1.0

body-parser@1.17.2

bytes@2.4.0

call-bind@1.0.7

camelcase@3.0.0

clone@1.0.4

code-point-at@1.1.0

content-disposition@0.5.2

content-type@1.0.5

cookie-parser@1.4.6

cookie-signature@1.0.6

cookie@0.3.1

cookie@0.4.1

debug@2.6.7

debug@2.6.8

debug@2.6.9

decamelize@1.2.0

define-data-property@1.1.4

define-properties@1.2.1

depd@1.1.2

destroy@1.0.4

ee-first@1.1.1

encodeurl@1.0.2

error-ex@1.3.2

es-define-property@1.0.0

es-errors@1.3.0

escape-html@1.0.3

etag@1.8.1

express@4.15.5

extend@3.0.2

finalhandler@1.0.6

find-up@1.1.2

flowstate@0.4.1

forwarded@0.1.2

fresh@0.5.2

function-bind@1.1.2

get-intrinsic@1.2.4

gopd@1.0.1

handlebars@4.3.5

has-property-descriptors@1.0.2

has-proto@1.0.3

has-symbols@1.0.3

hasown@2.0.2

hbs@4.0.6

http-errors@1.6.3

iconv-lite@0.4.15

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

13 Packages, Including:

cliui@3.2.0

get-caller-file@1.0.3

graceful-fs@4.2.11

hosted-git-info@2.8.9

inherits@2.0.3

require-main-filename@1.0.1

semver@5.7.2

set-blocking@2.0.0

setprototypeof@1.0.3

setprototypeof@1.1.0

which-module@1.0.0

y18n@3.2.2

yargs-parser@5.0.1

N/A

3 Packages, Including:

ejs@0.8.8

node-forge@0.2.24

valid-url@1.0.9

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

3 Packages, Including:

qs@6.4.0

qs@6.5.0

source-map@0.6.1

LGPL

Invalid

Not OSI Approved

3 Packages, Including:

xmldom@0.1.15

xmldom@0.1.16

xmldom@0.1.19

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

2 Packages, Including:

normalize-package-data@2.5.0

uglify-js@3.17.4

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

2 Packages, Including:

spdx-correct@3.2.0

validate-npm-package-license@3.0.4

MIT License

Invalid

Not OSI Approved

2 Packages, Including:

xml-crypto@0.8.4

xpath@0.0.5

Apache2

Invalid

Not OSI Approved

1 Packages, Including:

foreachasync@3.0.0

MIT/X11

Invalid

All Dependencies CSV

ⓘ This is a list of saml-idp 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
body-parser	1.17.2	12.4 kB	MIT	prod	2 1
cookie-parser	1.4.6	4.2 kB	MIT	prod
debug	2.6.9	16.13 kB	MIT	prod
express	4.15.5	51.39 kB	MIT	prod	2 1
extend	3.0.2	7.09 kB	MIT	prod
hbs	4.0.6	6.52 kB	MIT	prod	3 7 3 2
morgan	1.8.2	8.84 kB	MIT	prod	1 1 1
samlp	2.1.1	60.02 kB	mit	prod	6 18 6 10
yargs	7.1.2	68.34 kB	MIT	prod	1 2