Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Typesafe access to Bugzilla's REST API.
Very early work in progress, getting info from a bug or searching bugs is the main priority right now.
Some basic tests now exist. yarn test
will run the main tests. yarn run itest
will run some
integration tests against a real Bugzilla instance however you must have docker installed
in order to run these.
import BugzillaAPI from "bugzilla";
let api = new BugzillaAPI("https://bugzilla.mozilla.org", "<api key>");
await api.version();
Or for username/password authentication:
import BugzillaAPI from "bugzilla";
let api = new BugzillaAPI(
"https://bugzilla.mozilla.org",
"<username>",
"<password>",
);
await api.version();
let bugs = await api.getBugs([123456, 123457]);
You can use a quicksearch
string:
let bugs = await api.quicksearch("severity:blocker,critical");
Or any advanced search which can be passed in a number of ways:
// You can just pass a full advanced search url:
let bugs = await api.advancedSearch(
"https://bugzilla.mozilla.org/buglist.cgi?email1=dtownsend%40mozilla.com&emailassigned_to1=1&resolution=---&emailtype1=exact&list_id=15603348",
);
// Or just the query string part:
let bugs = await api.advancedSearch(
"email1=dtownsend%40mozilla.com&emailassigned_to1=1&resolution=---&emailtype1=exact&list_id=15603348",
);
// Or as a record:
let bugs = await api.advancedSearch({
email1: "dtownsend@mozilla.com",
emailassigned_to1: "1",
resolution: "---",
emailtype1: "exact",
});
To reduce bandwidth or improve performance it is possible to filter the fields returned by functions that return bugs:
// To only retrieve certain fields.
let bug = await api.getBugs([123456]).include(["id", "product", "component"]);
// Or to filter out certain fields.
let bug = await api.getBugs([123456]).exclude(["cc_detail"]);
Assuming you use a static array the returned types will correctly reflect to available fields.
Currently the _all
, _default
, _extra
and _custom
special field shortcuts are not currently
supported.
Custom fields are not currently returned.
// .getComment() accepts one parameter, ID of comment, as number
let comment = await api.getComment(123456);
Return value is Comment object.
// .getBugComments() accepts one parameter, ID of bug, as number
let comments = await api.getBugComments(123456);
Return value is array of Comment objects.
let comment = await api.createComment(
123456,
"This is new comment on bug #123456",
{ is_private: false },
);
Returned value is ID of the newly-created comment.
let bug = await api.createBug({
product: "TestProduct",
component: "TestComponent",
version: "unspecified",
summary: "'This is a test bug - please disregard",
alias: "SomeAlias",
op_sys: "All",
priority: "P1",
rep_platform: "All",
});
Returned value is ID of the newly-created bug.
Example of adding email address on cc list of bug #123456:
let response = await api.updateBug(123456, {
id_or_alias: 123456,
cc: { add: "my@email.io" },
});
Returned value is same as described in Bugzilla docs.
// .getAttachment() accepts one parameter, ID of attachment, as number
let attachment = await api.getAttachment(123456);
Return value is Attachment object.
// .getBugsAttachments() accepts one parameter, ID of bug, as number
let attachments = await api.getBugAttachments(123456);
Return value is array of Attachment objects.
let attachment = await api.createAttachment(123456, {
ids: [123456, 123457],
data: Buffer.from('Attachment content'),
file_name: "Attachment name",
summary: "Attachment summary",
content_type: "text/plain",
is_private?: false,
});
Returned value is an array of IDs of the newly-created attachments.
Example of changing content type of attachment #123456:
let response = await api.updateAttachment(123456, {
attachment_id: 123456,
content_type: "text/plain",
});
Returned value is same as described in Bugzilla docs.
FAQs
A NodeJS module to access Bugzilla instances through the REST API.
The npm package bugzilla receives a total of 186 weekly downloads. As such, bugzilla popularity was classified as not popular.
We found that bugzilla demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.