registry / ctrlx-datalayer / 3.2.0

ctrlx-datalayer@3.2.0

Bosch Rexroth ctrlX Data Layer API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNativeBindings

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 70.6 KB of source

Source & flagged code

16 flagged

package.jsonView file

Lines 57-92json

57 "mocha": "^11.7.6",

58 "node-gyp": "^12.4.0",

59 "nyc": "^18.0.0",

60 "prebuildify": "^6.0.1",

61 "ts-node": "^10.9.2",

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.install = node-gyp install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/remote.jsView file

77patternName = generic_password severity = medium line = 77 matchedText = static b...}) {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/remote.jsView on unpkg · L77

23patternName = generic_password severity = medium line = 23 matchedText = * pa...oth'

Medium

Secret Pattern

Hardcoded password in dist/remote.js

dist/remote.jsView on unpkg · L23

36patternName = generic_password severity = medium line = 36 matchedText = * co...' })

Medium

Secret Pattern

Hardcoded password in dist/remote.js

dist/remote.jsView on unpkg · L36

prebuilds/linux-arm64/ctrlx-datalayer.nodeView file

•path = prebuilds/linux-arm64/ctrlx-datalayer.node kind = native_binary sizeBytes = 13159608 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/linux-arm64/ctrlx-datalayer.nodeView on unpkg

LICENSES/tc_for_provision_of_products_free_of_charge.pdfView file

•path = LICENSES/tc_for_provision_of_products_free_of_charge.pdf kind = high_entropy_blob sizeBytes = 153265 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

LICENSES/tc_for_provision_of_products_free_of_charge.pdfView on unpkg

CHANGELOG.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = const re..." })

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L81

README.mdView file

50patternName = generic_password severity = medium line = 50 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L50

samples/client.tsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L32

58patternName = generic_password severity = medium line = 58 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L58

99patternName = generic_password severity = medium line = 99 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L99

134patternName = generic_password severity = medium line = 134 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L134

161patternName = generic_password severity = medium line = 161 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L161

198patternName = generic_password severity = medium line = 198 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L198

225patternName = generic_password severity = medium line = 225 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L225

samples/provider.tsView file

97patternName = generic_password severity = medium line = 97 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/provider.ts

samples/provider.tsView on unpkg · L97

Findings

2 High16 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy BlobLICENSES/tc_for_provision_of_products_free_of_charge.pdf

MediumSecret Patterndist/remote.js

MediumEnvironment Vars

MediumShips Native Binaryprebuilds/linux-arm64/ctrlx-datalayer.node

MediumStructural Risk Force Deep Review

MediumSecret PatternCHANGELOG.md

MediumSecret Patterndist/remote.js

MediumSecret PatternREADME.md

MediumSecret Patternsamples/client.ts

MediumSecret Patternsamples/provider.ts

LowNon Install Lifecycle Scripts

LowScripts Present

dist/remote.jsView file

Lines 3-90javascript

3 * SPDX-FileCopyrightText: Bosch Rexroth AG

4 *

5 * SPDX-License-Identifier: MIT

6 */

7var __importDefault = (this && this.__importDefault) || function (mod) {

8 return (mod && mod.__esModule) ? mod : { "default": mod };

9};

10Object.defineProperty(exports, "__esModule", { value: true });

11exports.Remote = void 0;

12/**

13* This class provides auxiliary methods to create ctrlX Data Layer client and provider connection strings to ctrlX CORE devices.

14* It can be used for both running in an app build environment(QEMU VM) and within the snap environment on the ctrlX CORE.

15*

16* Feel free to use it in your projects and to change it if necessary.

17*

18* For ease of use, the default values for IP address, user, password and SSL port are chosen to match the settings of a

19* newly created ctrlX CORE device:

20*

21* ip='192.168.1.1'

22* user='boschrexroth'

23* password='boschrexroth'

Medium

Secret Pattern

Hardcoded password in dist/remote.js

dist/remote.jsView on unpkg · L23

24* sslPort=443

25*

26* with these variables, the tcp connection string can be formatted as follows:

27*

28* tcp://{user}:{password}@{ip}?sslport={sslPort}

29*

30* If these values do not suit your use case, explicitly pass the parameters that require different values.

31*

32* Here some examples:

33*

34* 1. ctrlX CORE or ctrlX CORE virtual with another IP address, user and password:

35*

36* const remote = Remote.build({ ip: '192.168.1.100', user: 'admin', password: '-$_U/{X$aG}Z3/e<' })

Medium

Secret Pattern

Hardcoded password in dist/remote.js

dist/remote.jsView on unpkg · L36

37*

38* 2. ctrlX CORE virtual with port forwarding running on the same host as the app build environment (QEMU VM):

39*

40* const remote = Remote.build({ ip: '10.0.2.2', sslPort: 8443 })

41*

42* Remarks:

43* 10.0.2.2 is the IP address of the host from the point of view of the app build environment(QEMU VM).

44* 8443 is the host port which is forwarded to the SSL port(=433) of the ctrlX CORE virtual

45*

46* 3. ctrlX CORE virtual with port forwarding running on windows build environment (MS Visual Studio):

47*

48* const remote = Remote.build({ ip: '127.0.0.1', sslPort: 8443 })

49*

50* Remarks:

51* 127.0.0.1 is the IP address of the ctrlX virtual on the windows host system.

52* 8443 is the host port which is forwarded to the SSL port(=433) of the ctrlX CORE virtual

53*

54* IMPORTANT:

55* You don't need to change the parameter settings, before building a snap and installing the snap on a ctrlX CORE.

56* The Remote util detects the snap environment and uses automatically inter process communication 'ipc://'.

57* If you don't wan't to communicate to localhost (e.g. C2C), please build up the remote string manually in the following form (sslport is optional):

58*

59* const remote = `${DatalayerSystem.protocolSchemeTcp}${user}:${password}@${ip}?sslport=${sslPort}`

60*

61* If you have a special port, different from the default one (e.g. for port forwarding),

62* set the port and build up the remote string manually in the following form (SSL port defaults to 443 and is optional):

63*

64* const remote = `${DatalayerSystem.protocolSchemeTcp}${user}:${password}@${ip}:${port}?sslport=${sslPort}`

65*/

66const datalayersystem_1 = __importDefault(require("./datalayersystem"));

67class Remote {

68 /**

69 * Creates a ctrlX Data Layer connection string.

70 * @param ip: The IP address of the ctrlX CORE. Use '10.0.2.2' to connect to a ctrlX CORE virtual with port forwarding.

71 * @param user: The Name of the user.

72 * @param password: The Password of the user.

73 * @param sslPort: The Port number for a SSL connection. ctrlX CORE virtual with port forwarding: Use the host port (default 8443) forwarded to port 22 of the ctrlX virtual.

74 * @param port: The port number of connection.

75 * @returns The connection string: ipc connection string if running inside snap, otherwise tcp connection string.

76 */

77 static build({ ip = '192.168.1.1', user = 'boschrexroth', password = 'boschrexroth', sslPort = 443, port = NaN }) {

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/remote.jsView on unpkg · L77

78 const isSnap = typeof process.env.SNAP !== 'undefined' && process.env.SNAP_NAME !== 'node';

79 if (isSnap) {

80 return datalayersystem_1.default.protocolSchemeIpc;

81 }

82 if (!Number.isNaN(port) && port < 0) {

83 throw new TypeError("invalid port");

84 }

85 const address = Number.isNaN(port) ? ip : `${ip}:${port}`;

86 return `${datalayersystem_1.default.protocolSchemeTcp}${user}:${password}@${address}?sslport=${sslPort}`;

87 }

88}

89exports.Remote = Remote;

CHANGELOG.mdView file

Lines 61-101markdown

61+ Changed: Removed OpenSSL V3 libraries for Windows, because of export control relevance. You have to install the latest [Win64 OpenSSL v3 Light](https://slproweb.com/products/Win32OpenSSL.html) setup, if the API is used on Windows operating systems.

63### 2.0.1

64+ New: Updated to Data Layer API 2.2.7.

66+ Fix: API crash on arm64 and amd64 (undefined symbol: _ZN6common3log5trace11LogBufferedC1EPKcb)

68### 2.0.0

69+ New: Upgraded to Ubuntu 22.04 LTS (Jammy Jellyfish).

70+ New: Upgraded to Data Layer API 2.2.5.

71+ New: Updated Flatbuffers types package 'ctrlx-datalayer-flatbuffers' 2.2.0.

73+ Fix: subscription-utils: Setting properties like SamplingInterval, QueueSize, DataChangeFilter, ChangeEvents, Counter were not applied to the subscription.

75### 1.6.0

76+ New: Updated to Data Layer API 1.10.7

77+ New: Updated Flatbuffers types package 'ctrlx-datalayer-flatbuffers' 1.20.0.

78+ New: IClient: Introduced method _getConnectionStatus_ to get the current connection status.

79+ New: Introduced remote builder to create a TCP remote address, replaced automatically by IPC if running locally on a ctrlX Core.

81 const remote = Remote.build({ ip: "192.168.1.100", user: "admin", password: "-$_U/{X$aG}Z3/e<" })

Medium

Secret Pattern

Hardcoded password in CHANGELOG.md

CHANGELOG.mdView on unpkg · L81

83### 1.5.0

84+ New: Updated to Data Layer API 1.9.1.

85+ New: Updated Flatbuffers types package 'ctrlx-datalayer-flatbuffers' 1.18.0.

86+ New: IProvider: Introduced method _getRegisteredNodePaths_ to get all node paths, registered and handled by the provider.

87+ New: IClient: Introduced efficient and fast _Bulk*_ methods to apply the same operation on a list of nodes (read, read metadata, write, create, remove, browse) just on a single method call.

89+ Fix: Result: Not all available result codes properly exported.

91+ Changed: IClient: Method _writeJson_ now returns Promise\<IResult\> instead of Promise\<IVariant\>.

93 writeJson(address: string, json: string): Promise<IResult>;

95+ Changed: IClient: Changed signature of method _readJson_ to specify an optional argument (JSON).

97 readJson(address: string, indentStep?: number, arg?: string): Promise<IVariant>;

99+ Changed: IClient: Changed signature of method _read_ to specify an optional argument and optional datatype of this argument for conversion.

100

101 read(address: string, arg?: any, argVariantType?: string): Promise<IVariant>;

samples/client.tsView file

Lines 12-78typescript

12import { SubscriptionSettings } from 'ctrlx-datalayer-flatbuffers/dist/comm/datalayer/subscription-settings';

13import { SubscriptionProperties } from 'ctrlx-datalayer-flatbuffers/dist/comm/datalayer/subscription-properties';

14import { NotifyInfo } from 'ctrlx-datalayer-flatbuffers/dist/comm/datalayer/notify-info';

16//Reads a value from a ctrlX Data Layer node

17/*

18 * SPDX-FileCopyrightText: Bosch Rexroth AG

19 *

20 * SPDX-License-Identifier: MIT

21 */

23async function read() {

25 //Create DatalayerSystem and start

26 const system = new DatalayerSystem('');

27 await system.start(false);

29 // Build remote

30 const cred = {

31 user: 'boschrexroth',

32 password: 'boschrexroth',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L32

33 ip: '192.168.1.1'

34 };

35 let remote = Remote.build(cred);

37 //Create a Client

38 const client = await system.createClient(remote);

40 //Read value

41 const variant = await client.read('framework/metrics/system/cpu-utilisation-percent');

42 console.log(variant);

44 //Stop the DatalayerSystem

45 await system.stop();

46}

48//Reads a value from a ctrlX Data Layer node

49async function readMetadata() {

51 //Create DatalayerSystem and start

52 const system = new DatalayerSystem('');

53 await system.start(false);

55 // Build remote

56 const cred = {

57 user: 'boschrexroth',

58 password: 'boschrexroth',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L58

59 ip: '192.168.1.1'

60 };

61 let remote = Remote.build(cred);

63 //Create a Client

64 const client = await system.createClient(remote);

66 //Read metadata

67 const variant = await client.readMetadata('framework/metrics/system/cpu-utilisation-percent');

69 const bb = new flatbuffers.ByteBuffer(variant.value);

70 const metaData = Metadata.getRootAsMetadata(bb);

72 console.log('description:', metaData.description());

73 console.log('descriptionUrl:', metaData.descriptionUrl());

74 console.log('displayName:', metaData.displayName());

75 console.log('nodeClass:', metaData.nodeClass());

76 console.log('unit:', metaData.unit());

78 const operations = metaData?.operations();

99patternName = generic_password severity = medium line = 99 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L99

134patternName = generic_password severity = medium line = 134 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L134

161patternName = generic_password severity = medium line = 161 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L161

198patternName = generic_password severity = medium line = 198 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L198

225patternName = generic_password severity = medium line = 225 matchedText = password...th',

Medium

Secret Pattern

Hardcoded password in samples/client.ts

samples/client.tsView on unpkg · L225