Security scan results

afarbotka1 · July 9, 2024, 2:28pm

PDF.js Express 8.7.4

Hi, PDF.js team,

After running security scan on our application which relies on PDF.js Express, we found multiple issues. Could you please clarify if those might be fixed in the nearest future as a part of technical support? Do you think you would be able to provide more information regarding those issues?

Here is the issue to file mapping:
{
“CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator(PRNG)”: [
“econsent\public\webviewer\core\external\decode.min.js”,
“econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“econsent\public\webviewer\core\external\webcomponents-bundle.js”,
“econsent\public\webviewer\core\legacyoffice\legacyofficeworker.js”,
“econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“econsent\public\webviewer\core\pdfjs\pikaday.chunk.js”,
“econsent\public\webviewer\core\pikaday.chunk.js”,
“econsent\public\webviewer\core\webviewer-core.min.js”,
“econsent\public\webviewer\ui\webviewer-ui.min.js”
],
“CWE-564: SQL Injection: Hibernate”: [
“econsent\public\webviewer\core\external\decode.min.js”,
“econsent\public\webviewer\ui\webviewer-ui.min.js”
],
“CWE-327: Use of a Broken or Risky Cryptographic Algorithm”: [
“econsent\public\webviewer\core\pdfjs\pdf.worker.js”
],
“CWE-489: Active Debug Code”: [
“econsent\public\webviewer\core\external\decode.min.js”,
“econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“econsent\public\webviewer\core\webviewer-core.min.js”,
“econsent\public\webviewer\ui\webviewer-ui.min.js”
],
“CWE-312: Cleartext Storage of Sensitive Information”: [
“econsent\public\webviewer\core\external\decode.min.js”
],
“CWE-829: Inclusion of Functionality from Untrusted Control Sphere”: [
“econsent\public\webviewer\core\external\decode.min.js”,
“econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“econsent\public\webviewer\core\legacyoffice\legacyofficeworker.js”,
“econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“econsent\public\webviewer\ui\chunks\2.chunk.js”,
“econsent\public\webviewer\ui\webviewer-ui.min.js”
],
“CWE-798: Use of Hard-coded Credentials”: [
“econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“econsent\public\webviewer\core\webviewer-core.min.js”,
“econsent\public\webviewer\ui\webviewer-ui.min.js”
],
“CWE-94: Improper Control of Generation of Code (‘Code Injection’)”: [
“econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”
],
“CWE-20: Improper Input Validation”: [
“econsent\public\webviewer\core\webviewerserverpartretriever.chunk.js”
],
“CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)”: [
“econsent\public\webviewer\ui\webviewer-ui.min.js”,
“public\webviewer\core\contentedit.chunk.js”,
“public\webviewer\core\pikaday.chunk.js”,
“public\webviewer\core\pdfjs\pikaday.chunk.js”,
“public\webviewer\core\external\webcomponents-bundle.js”
],
“CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes”: [
“public\webviewer\core\external\webcomponents-bundle.js”,
“public\webviewer\core\webviewerserverpartretriever.chunk.js”
],
“CWE-345: Insufficient Verification of Data Authenticity”: [
“public\webviewer\core\legacyoffice\legacyofficeworker.js”
],
“The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. For more information checkout the CWE-798 (CWE - CWE-798: Use of Hard-coded Credentials (4.14)) advisory.”: [
“econsent\public\webviewer\ui\i18n\translation-en.json”,
“econsent\public\webviewer\ui\webviewer-ui.min.js.map”
],
“When use AWS Secret Key is recommended use vault or environment variable encrypted for the best security. For more information checkout the CWE-798 (CWE - CWE-798: Use of Hard-coded Credentials (4.14)) advisory.”: [
“econsent\public\webviewer\ui\webviewer-ui.min.js.map”
],
“CWE-1333: Inefficient Regular Expression Complexity”: [
“public\webviewer\core\pdfjs\vendors.pikaday.chunk.js”,
“public\webviewer\core\external\webcomponents-bundle.js”
],
“CWE-319: Cleartext Transmission of Sensitive Information”: [
“public\webviewer\core\webviewerserverpartretriever.chunk.js”
]
}

tgordon · July 10, 2024, 12:11am

Hello afarbotka1,

Thank you for raising these, a lot of these are non-issues as they do not apply to PDFJS Express, however some we would like some more information.

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator(PRNG)

PDFJS Express does not have any functionality that relies on a PRNG or Cryptographic Algorithm for security related functionality.

CWE-564: SQL Injection: Hibernate

PDFJS Express does not connect to an SQL database in any way.

CWE-489: Active Debug Code

Not specific what lines of code are debug code

CWE-312: Cleartext Storage of Sensitive Information
“econsent\public\webviewer\core\external\decode.min.js”

decode.min.js is open source code from Google, therefore not PDFJS Express’ domain:

github.com

google/brotli/blob/master/js/decode.min.js

export let BrotliDecode=(()=>{const f=Int32Array.from([256,402,436,468,500,534,566,598,630,662,694,726,758,790,822,854,886,920,952,984,1016,1048,1080]),w=Int32Array.from([1,2,3,4,0,5,17,6,16,7,8,9,10,11,12,13,14,15]),b=Int32Array.from([0,3,2,1,0,0,0,0,0,0,3,3,3,3,3,3]),j=Int32Array.from([0,0,0,0,-1,1,-2,2,-3,3,-1,1,-2,2,-3,3]),l=Int32Array.from([131072,131076,131075,196610,131072,131076,131075,262145,131072,131076,131075,196610,131072,131076,131075,262149]),m=Int32Array.from([1,5,9,13,17,25,33,41,49,65,81,97,113,145,177,209,241,305,369,497,753,1265,2289,4337,8433,16625]),p=Int32Array.from([2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,6,6,7,8,9,10,11,12,13,24]),q=Int16Array.from([0,0,0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,7,8,9,10,12,14,24]),o=Int16Array.from([0,0,0,0,0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,7,8,9,10,24]),n=new Int16Array(2816);function g(f){let w=-1,b=16,j=f;for(;b>0;){let f=j>>>b;0!==f&&(w+=b,j=f),b>>=1}return w+j}function k(f,w,b){return 16+w+2*(b<<f)}function s(f,w,b){if(f<b+(2<<w))throw new Error("maxDistance is too small");const j=4+(f-b>>w),l=g(j)-1;return((l-1<<1|j>>l&1)-1<<w)+(1<<w)+b+16}function t(f){if(0!==f.j)throw new Error("State MUST be uninitialized");f.l=new Int32Array(3091),f.l[0]=7,f.m=3;const w=s(2147483644,3,120);f.p=new Int8Array(w),f.q=new Int32Array(w),function(f){f.o=new Int8Array(4160),f.g=0,f.k=new Int16Array(2080),f.s=32,f.t=2048,f.v=0,M(f)}(f),f.j=1}function v(f){if(f.s>=16&&(f.g=f.k[f.t++]<<16|f.g>>>16,f.s-=16),0!==J(f,1)){const w=J(f,3);return 0===w?1:J(f,w)+(1<<w)}return 0}function e(f,w,b){let j=f[w];const l=b.g>>>b.s;j+=255&l;const m=f[j]>>16,p=65535&f[j];if(m<=8)return b.s+=m,p;j+=p;return j+=(l&(1<<m)-1)>>>8,b.s+=8+(f[j]>>16),65535&f[j]}function d(f,w,b){b.s>=16&&(b.g=b.k[b.t++]<<16|b.g>>>16,b.s-=16);const j=e(f,w,b),l=p[j];return b.s>=16&&(b.g=b.k[b.t++]<<16|b.g>>>16,b.s-=16),m[j]+(l<=16?J(b,l):_(b,l))}function H(f,w){let b=w;const j=f[b];for(;b>0;)f[b]=f[b-1],b--;f[0]=j}function a(f,w,b,j,l){const m=new Int32Array(w),p=new Int32Array(4),q=1+g(f-1),o=J(l,2)+1;for(let f=0;f<o;++f){l.s>=16&&(l.g=l.k[l.t++]<<16|l.g>>>16,l.s-=16);const b=J(l,q);if(b>=w)throw new Error("Can't readHuffmanCode");p[f]=b}!function(f,w){for(let b=0;b<w-1;++b)for(let j=b+1;j<w;++j)if(f[b]===f[j])throw new Error("Duplicate simple Huffman code symbol")}(p,o);let n=o;switch(4===o&&(n+=J(l,1)),n){case 1:m[p[0]]=1;break;case 2:m[p[0]]=1,m[p[1]]=1;break;case 3:m[p[0]]=1,m[p[1]]=2,m[p[2]]=2;break;case 4:m[p[0]]=2,m[p[1]]=2,m[p[2]]=2,m[p[3]]=2;break;case 5:m[p[0]]=1,m[p[1]]=2,m[p[2]]=3,m[p[3]]=3}return U(b,j,8,m,w)}function u(f,b,j,m,p){const q=new Int32Array(f),o=new Int32Array(18);let n=32,g=0;for(let f=b;f<18;++f){const b=w[f];p.s>=16&&(p.g=p.k[p.t++]<<16|p.g>>>16,p.s-=16);const j=p.g>>>p.s&15;p.s+=l[j]>>16;const m=65535&l[j];if(o[b]=m,0!==m&&(n-=32>>m,g++,n<=0))break}if(0!==n&&1!==g)throw new Error("Corrupted Huffman code histogram");return function(f,w,b,j){let l=0,m=8,p=0,q=0,o=32768;const n=new Int32Array(33);for(U(n,n.length-1,5,f,18);l<w&&o>0;){j.t>2030&&E(j),j.s>=16&&(j.g=j.k[j.t++]<<16|j.g>>>16,j.s-=16);const f=j.g>>>j.s&31;j.s+=n[f]>>16;const g=65535&n[f];if(g<16)p=0,b[l++]=g,0!==g&&(m=g,o-=32768>>g);else{const f=g-14;let n=0;16===g&&(n=m),q!==n&&(p=0,q=n);const k=p;p>0&&(p-=2,p<<=f),j.s>=16&&(j.g=j.k[j.t++]<<16|j.g>>>16,j.s-=16),p+=J(j,f)+3;const s=p-k;if(l+s>w)throw new Error("symbol + repeatDelta > numSymbols");for(let f=0;f<s;++f)b[l++]=q;0!==q&&(o-=s<<15-q)}}if(0!==o)throw new Error("Unused space");b.fill(0,l,w)}(o,f,q,p),U(j,m,8,q,f)}function z(f,w,b,j,l){l.t>2030&&E(l),l.s>=16&&(l.g=l.k[l.t++]<<16|l.g>>>16,l.s-=16);const m=J(l,2);return 1===m?a(f,w,b,j,l):u(w,m,b,j,l)}function h(w,b,j){j.t>2030&&E(j);const l=v(j)+1;if(1===l)return b.fill(0,0,w),l;j.s>=16&&(j.g=j.k[j.t++]<<16|j.g>>>16,j.s-=16);let m=0;0!==J(j,1)&&(m=J(j,4)+1);const p=l+m,q=f[p+31>>5],o=new Int32Array(q+1),n=o.length-1;z(p,p,o,n,j);let g=0;for(;g<w;){j.t>2030&&E(j),j.s>=16&&(j.g=j.k[j.t++]<<16|j.g>>>16,j.s-=16);const f=e(o,n,j);if(0===f)b[g]=0,g++;else if(f<=m){j.s>=16&&(j.g=j.k[j.t++]<<16|j.g>>>16,j.s-=16);let l=(1<<f)+J(j,f);for(;0!==l;){if(g>=w)throw new Error("Corrupted context map");b[g]=0,g++,l--}}else b[g]=f-m,g++}return j.s>=16&&(j.g=j.k[j.t++]<<16|j.g>>>16,j.s-=16),1===J(j,1)&&function(f,w){const b=new Int32Array(256);for(let f=0;f<256;++f)b[f]=f;for(let j=0;j<w;++j){const w=255&f[j];f[j]=b[w],0!==w&&H(b,w)}}(b,w),l}function i(f,w,b){const j=f.H,l=4+2*w;f.s>=16&&(f.g=f.k[f.t++]<<16|f.g>>>16,f.s-=16);let m=e(f.l,2*w,f);const p=d(f.l,2*w+1,f);return 1===m?m=j[l+1]+1:0===m?m=j[l]:m-=2,m>=b&&(m-=b),j[l]=j[l+1],j[l+1]=m,p}function r(f){f.u=i(f,0,f.h);const w=f.H[5];f.i=w<<6,f.I=255&f.R[f.i];const b=f.K[w];f.T=b<<9,f.W=f.T+256}function I(f){f.B=i(f,1,f.Y),f.A=f.H[7]}function R(f){f.S=i(f,2,f.V),f.D=f.H[9]<<2}function K(f){if(0!==f.F)return f.P=10,void(f.j=12);f.U=new Int32Array(0),f.C=new Int32Array(0),f.J=new Int32Array(0),f.t>2030&&E(f),function(f){if(f.s>=16&&(f.g=f.k[f.t++]<<16|f.g>>>16,f.s-=16),f.F=J(f,1),f._=0,f.M=0,f.X=0,0!==f.F&&

This file has been truncated. show original

CWE-94: Improper Control of Generation of Code (‘Code Injection’)
CWE-798: Use of Hard-coded Credentials

Need specific lines of code where this is happening, the example only gives us files, not lines in those files:

“econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“econsent\public\webviewer\core\webviewer-core.min.js”,
“econsent\public\webviewer\ui\webviewer-ui.min.js”

“CWE-20: Improper Input Validation”

This only applies to the file:

“econsent\public\webviewer\core\webviewerserverpartretriever.chunk.js”

PDFJS Express does not connect to WebViewer Server, so this file is never used

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes”
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. For more information checkout the CWE-798 (CWE - CWE-798: Use of Hard-coded Credentials (4.14)) advisory.
When use AWS Secret Key is recommended use vault or environment variable encrypted for the best security. For more information checkout the CWE-798 (CWE - CWE-798: Use of Hard-coded Credentials (4.14)) advisory.
CWE-319: Cleartext Transmission of Sensitive Information

Need specific lines of code to investigate further, but we do not have any hard coded any credentials in our code.

CWE-345: Insufficient Verification of Data Authenticity

This file pertains to:

“public\webviewer\core\legacyoffice\legacyofficeworker.js”

PDFJS Express does not leverage the Legacy Office Worker to convert old Office files to PDF, therefore this file would not be used.

Best regards,
Tyler

afarbotka1 · July 12, 2024, 12:54pm

Here is more information regarding the place in code, but it’s related to minified files though. Hope this will help
{
“CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator(PRNG)”: [
{
“file”: “econsent\public\webviewer\core\external\decode.min.js”,
“column”: “0”,
“line”: “0”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“column”: “7”,
“line”: “14”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“column”: “15054”,
“line”: “148”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “46”,
“line”: “149”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “12”,
“line”: “600”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “62”,
“line”: “607”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “55”,
“line”: “608”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “71”,
“line”: “609”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “1653”,
“line”: “617”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “3366”,
“line”: “648”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “2494”,
“line”: “677”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “1866”,
“line”: “2963”
},
{
“file”: “econsent\public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “87”,
“line”: “67”
},
{
“file”: “econsent\public\webviewer\core\legacyoffice\legacyofficeworker.js”,
“column”: “0”,
“line”: “0”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“column”: “323”,
“line”: “45”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“column”: “426”,
“line”: “177”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “323”,
“line”: “74”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “196”,
“line”: “407”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “469”,
“line”: “733”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “136”,
“line”: “2362”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “305”,
“line”: “2439”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “191”,
“line”: “2707”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “260”,
“line”: “2834”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pikaday.chunk.js”,
“column”: “319”,
“line”: “33”
},
{
“file”: “econsent\public\webviewer\core\pikaday.chunk.js”,
“column”: “319”,
“line”: “31”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “54”,
“line”: “23”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “99”,
“line”: “24”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “48”,
“line”: “410”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “384”,
“line”: “420”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “248”,
“line”: “441”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “276”,
“line”: “577”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “239”,
“line”: “653”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “455”,
“line”: “1257”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “429”,
“line”: “2501”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “77423”,
“line”: “14”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “228419”,
“line”: “21”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “38111”,
“line”: “33”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “34871”,
“line”: “49”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “93039”,
“line”: “81”
}
],
“CWE-564: SQL Injection: Hibernate”: [
{
“file”: “econsent\public\webviewer\core\external\decode.min.js”,
“column”: “0”,
“line”: “0”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “11539”,
“line”: “21”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “58696”,
“line”: “33”
}
],
“CWE-327: Use of a Broken or Risky Cryptographic Algorithm”: [
{
“file”: “econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“column”: “200”,
“line”: “1175”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“column”: “38”,
“line”: “1176”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“column”: “23”,
“line”: “1183”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdf.worker.js”,
“column”: “68”,
“line”: “1186”
}
],
“CWE-489: Active Debug Code”: [
{
“file”: “econsent\public\webviewer\core\external\decode.min.js”,
“column”: “0”,
“line”: “0”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“column”: “236”,
“line”: “409”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“column”: “9338”,
“line”: “893”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “11502”,
“line”: “3383”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “41249”,
“line”: “3384”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “52”,
“line”: “1648”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “426”,
“line”: “1655”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “7”,
“line”: “2080”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “497”,
“line”: “2202”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “120”,
“line”: “2663”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “330”,
“line”: “2664”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “217”,
“line”: “2667”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “100”,
“line”: “2671”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “358”,
“line”: “2672”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “157961”,
“line”: “21”
}
],
“CWE-312: Cleartext Storage of Sensitive Information”: [
{
“file”: “econsent\public\webviewer\core\external\decode.min.js”,
“column”: “0”,
“line”: “0”
}
],
“CWE-829: Inclusion of Functionality from Untrusted Control Sphere”: [
{
“file”: “econsent\public\webviewer\core\external\decode.min.js”,
“column”: “0”,
“line”: “0”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-1.3.0.min.js”,
“column”: “30”,
“line”: “148”
},
{
“file”: “econsent\public\webviewer\core\external\model-viewer-legacy-1.3.0.min.js”,
“column”: “5”,
“line”: “595”
},
{
“file”: “econsent\public\webviewer\core\legacyoffice\legacyofficeworker.js”,
“column”: “0”,
“line”: “0”
},
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “120”,
“line”: “1600”
},
{
“file”: “econsent\public\webviewer\ui\chunks\2.chunk.js”,
“column”: “0”,
“line”: “1”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “7”,
“line”: “33”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “10”,
“line”: “49”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “145”,
“line”: “73”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “72”,
“line”: “89”
}
],
“CWE-798: Use of Hard-coded Credentials”: [
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “482”,
“line”: “620”
},
{
“file”: “econsent\public\webviewer\core\webviewer-core.min.js”,
“column”: “151”,
“line”: “455”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “18115”,
“line”: “73”
}
],
“CWE-94: Improper Control of Generation of Code (‘Code Injection’)”: [
{
“file”: “econsent\public\webviewer\core\pdfjs\pdfjsdocumenttype.js”,
“column”: “205”,
“line”: “1159”
}
],
“CWE-20: Improper Input Validation”: [
{
“file”: “econsent\public\webviewer\core\webviewerserverpartretriever.chunk.js”,
“column”: “104”,
“line”: “32”
}
],
“CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)”: [
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js”,
“column”: “116290”,
“line”: “49”
},
{
“file”: “public\webviewer\core\contentedit.chunk.js”,
“column”: “null”,
“line”: “3”
},
{
“file”: “public\webviewer\core\contentedit.chunk.js”,
“column”: “null”,
“line”: “8”
},
{
“file”: “public\webviewer\core\pikaday.chunk.js”,
“column”: “null”,
“line”: “32”
},
{
“file”: “public\webviewer\core\pdfjs\pikaday.chunk.js”,
“column”: “null”,
“line”: “34”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “137”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “140”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “172”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “219”
}
],
“CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes”: [
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “”,
“line”: “21”
},
{
“file”: “public\webviewer\core\webviewerserverpartretriever.chunk.js”,
“column”: “”,
“line”: “2”
}
],
“CWE-345: Insufficient Verification of Data Authenticity”: [
{
“file”: “public\webviewer\core\legacyoffice\legacyofficeworker.js”,
“column”: “”,
“line”: “1”
}
],
“The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. For more information checkout the CWE-798 (CWE - CWE-798: Use of Hard-coded Credentials (4.14)) advisory.”: [
{
“file”: “econsent\public\webviewer\ui\i18n\translation-en.json”,
“column”: “null”,
“line”: “null”
},
{
“file”: “econsent\public\webviewer\ui\i18n\translation-en.json”,
“column”: “null”,
“line”: “null”
},
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js.map”,
“column”: “null”,
“line”: “null”
}
],
“When use AWS Secret Key is recommended use vault or environment variable encrypted for the best security. For more information checkout the CWE-798 (CWE - CWE-798: Use of Hard-coded Credentials (4.14)) advisory.”: [
{
“file”: “econsent\public\webviewer\ui\webviewer-ui.min.js.map”,
“column”: “null”,
“line”: “null”
}
],
“CWE-1333: Inefficient Regular Expression Complexity”: [
{
“file”: “public\webviewer\core\pdfjs\vendors.pikaday.chunk.js”,
“column”: “null”,
“line”: “17”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “321”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “322”
},
{
“file”: “public\webviewer\core\external\webcomponents-bundle.js”,
“column”: “null”,
“line”: “336”
}
],
“CWE-319: Cleartext Transmission of Sensitive Information”: [
{
“file”: “public\webviewer\core\webviewerserverpartretriever.chunk.js”,
“column”: “null”,
“line”: “31”
}
]
}

tgordon · July 12, 2024, 5:35pm

Hello afarbotka1,

Thank you for the file lines,

Going through each report it looks like these are all false positives, for example:

Licensing text linking to the license as a additional code being added
SVG W3 url’s as code injection
XML namespace attribute declaration being counted as “included functionality”
The string “Password” as a hard coded password
etc

I suggest reviewing whatever options the program you are using to rule these out to get a more accurate security log.

Any external sources like pikaday, webcomponents-bundle.js so we cannot speak on those.

Best regards,
Tyler

Topic		Replies	Views
Security vulnerabilities in PDF.js Express Technical Support	2	454	August 18, 2021
CVE-2024-4367 vulnerability in pdf.js Technical Support	3	172	July 4, 2024
Compressed object is corrupt Technical Support	2	407	December 9, 2021
Critcal issue Auth.pdfjs.express certificate expired Bug Reports	2	285	August 30, 2021
Authentication Issues Technical Support	8	463	February 1, 2022

Security scan results

Related topics