Make sure deserializing objects is safe here - SonarQube error - security

I got the following error (SECURITY_HOTSPOT error) from sonarQube while analyzing my project.
Make sure deserializing objects is safe here.
$objectData = unserialize($objectData, ['allowed_classes' => false]);
The function is used only for internal operations. No execution from the browser and the $objectData is fetching from the database.
How to fix this error message.
Or simply ignore it?

Related

When I run the azure function project locally (VSCode) after I add azure function proxy I'm getting 'Worker was unable to load function" error

When I run (func run) the azure function project locally (VSCode) after I add azure function proxy I'm getting 'Worker was unable to load function" console error. However function locally run perfectly after that console error.
What could be the reason for that console error
Error
Worker was unable to load function get-user: 'TypeError [ERR_INVALID_ARG_VALUE]: The argument 'id' must be a non-empty string. Received '''
The problem seems to be that the GUID of the function is generated but no real instance is generated. Therefore, trying to access the function GUID through proxy will report an error because it does not exist at all. I don't think you need to worry about this. This should be a bug, but the good news is that it will not have any effect on your function, because you will never use this GUID any more. A new instance and corresponding GUID will be generated when you trigger the function, and the previous GUID will be discarded.

Restsharp - Cannot get error response body

I am using current (106.5.4) version of RestSharp with Xamarin.iOS and MvvmCross. I works very well (automatic body serialization, deserialization etc.), however I am having hard time getting error response body.
If there is a response from server with error code 4xx or 5xx I get just strange exception in top level of my code that says
"Error getting response stream (ReadAsync): ReceiveFailure Value
cannot be null. Parameter name: src"
Only when I use "Catch All Exceptions" in visual studio I can see the real exception down in call stack. Even though there is no way how to access the body. Accessing the body would be extremely helpful because the server can say there what is wrong with the request.
Am I missing anything, or there is no way in RestSharp?
Thank you for any response

Create PeerConnection exception: Failed to construct 'RTCPeerConnection': Malformed RTCIceServer

I am using appRTC to make demo app. I have setup following things successfully but got stack with JSON format that return in response of Turn-server API.
Use SSL for secure connect to make it work on Google Chrome (Done)
Implement custom WebSockets (Done)
Develop custom API for TurnServer (Done)
I am getting following error in console log.
Create PeerConnection exception: Failed to construct 'RTCPeerConnection': Malformed RTCIceServer
Failed to start signaling: Cannot read property 'addStream' of null
I have tried following responses as ice server object
Current object:
{"iceServers":[{"urls":["stun:stun.l.google.com:19302"]},{"urls":["turn:domain.com:8080?transport=udp","turn:domain.com:8080?transport=tcp","turn:domain.com:8080"],"username":"test","credential":"password"}],"lifetimeDuration":"86400s","blockStatus":"NOT_BLOCKED","iceTransportPolicy":"all"}
Have also tried:
[{"urls":["stun:stun.l.google.com:19302"]},{"urls":["turn:domain.com:8080?transport=udp","turn:domain.com:8080?transport=tcp","turn:domain.com:8080"],"username":"test","credential":"password"}]
and also tried this one:
[{"urls":["turn:domain.com:8080?transport=udp","turn:domain.com:8080?transport=tcp","turn:domain.com:8080"],"username":"test","credential":"password"}]
You have a typo here:
[{"urls":["stun:stun.l.google.com:19302"}
trying to close urls without closing the array.
This should be
[{"urls":["stun:stun.l.google.com:19302"]}
This doesn't result in an error about malformed RTCIceServer though.
Based on your comment it seems to be a result of calling
new RTCPeerConnection({"iceServers":[{}]})
-- an empty object is not a valid RTCIceServer.
I would also recommend not passing
"lifetimeDuration":"86400s","blockStatus":"NOT_BLOCKED"
to the RTCPeerConnection as it doesn't know about these.

Unexpected error occurrs when I try to acess local storage in my extension

I'm updating the extension I wrote few months ago and just when I finished I realized that local storage in loader.js (file which is loaded on each visit to the specific page) returns:
Error: "An unexpected error occurred."
It is the part where I try to load informations from the local storage:
chrome.storage.local.get('setting-one', result => {
if (chrome.runtime.lastError) {
throw new Error(chrome.runtime.lastError); // error is thrown
...
This worked without problems in the past but now it doesn't. This is the case for Firefox. On Chrome, extension doesn't work either and doesn't return any error from loader.js. I'm not sure if API has changed or some new changes were introduced regarding access to local storage. I was looking for the solution on the web but there is nothing regarding this problem.
On the page of extension I can set and get all informations from storage without any problem.
Seems like your problem is resolved, but there is one bug in Firefox which I encountered few times. It might have been what happened to you although I can't reproduce it today for your case. I did loose some time today on a very similar situation with the same error message.
The error: Error: An unexpected error occurred is seen sometimes on Firefox, after successful call of a method,
if you also define a catch method and when you have DevTools open and turned on both Pause on exceptions and Pause on caught exceptions
Today I had this on the end of a method I used:
return browser.storage.local.set(storedObject)
.then(() => console.log('Util_WebExt.saveToStorage(): '+valueName+' stored.'))
.catch(e => console.error('Util_WebExt.saveToStorage(): '+valueName+' | error: '+e));
I did try it on get() as was your case, but the error did not show.
Also, it does not show on storage.sync, only storage.local
On other occasions, I had the same behavior with a different case, different method. Can't remember, but there is a post on stackoverflow where it's claimed that this is a feature and not a bug. I don't see how though. It was probably misunderstood.

Random 'ECONNABORTED' error when using sendFile in Express/Node

I have set a node server with Express middleware. I get the ECONNABORTED error randomly on some files when loading an HTML file which triggers about 10 other loads (js, css, etc.). The exact error is:
{ [Error: Request aborted] code: 'ECONNABORTED' }
Generated by this simplified code (after I tried to debug the issue):
res.sendFile(res.locals.physicalUrl,function (err) {
if (err)
console.log(err);
...
}
Many posts talk about this error resulting from not specifying the full path name. That is not the situation here. I do specify the full path and indeed the error is randomly generated. There are times when the page and all its subsequent links load perfectly and there are times when they do not. I tried to flush the cache and did not find any pattern to connect it with this.
This specific error appears to be a a generic term for socket connection getting aborted and is discussed in the context of other applications like FTP.
Having realized that the node worker threads can be increased, I tried to do so using:
process.env.UV_THREADPOOL_SIZE = 20;
However, my understanding is that even absent this, at most the file transfer may have to wait for a worker thread to be free and not get aborted. I am not talking about big files here, all files are less than 1 MB.
I have a gut feeling that this has nothing to do with node directly.
Please point to any other possibilities (node or otherwise) to handle this error. Also, any other indirect solutions? Retrying a few times could be one but that would be clumsy. EDIT: No, I cannot retry. Headers are already sent with the error!
A SIDE NOTE:
Many examples on the use of sendFile skip using the callback thereby giving the impression that it is a synchronous call. It is not. Do use the callback at all times, check for success and only then move on to the "next" middleware or take appropriate steps if the send fails for whatever reason. Not doing so can make it difficult to debug the consequences in an asynchronous environment.
See https://stackoverflow.com/a/36949631/2798152
Could it be possible that in some cases you terminate the connection by calling res.end before the asynchronous call to res.sendFile ends?
If that's not the case - can you pastebin more of your application code?
Uninstalling and Re-installing MongoDB solved this for me.
I was facing the same problem. It started happening when I had to force restart my laptop because it became unresponsive. On restarting, trying to connect to mongo server using nodejs, always threw ECONNABORTED error

Resources