El blog de Ulises Gascón

We’re thrilled to announce the relaunch of Yeoman’s maintenance for 2025.

If you’re new to OpenPathfinder, this post will give you an overview of what we’re all about, including VisionBoard, FortSphere, and our project History.

Kick off 2025 with fresh updates from the world of open source security.

Celebrating the successful completion of the Express.js security audit conducted by Ada Logics and facilitated by OSTIF.

Let's explore the world of Common Vulnerabilities and Exposures (CVEs) with step-by-step examples of evaluating if a CVE impacts your project and pragmatic strategies for effective mitigation.

Announcing the release of Express version 5

Security releases for Express, body-parser, send, serve-static, and path-to-regexp have been published.

In this POC, we will be using a simple configuration file to enable/disable features based on the version of the application.

I authored the Nodejs v20.7.0 official release notes

I co-authored the Nodejs v20.6.0 official release notes

This repository contains a set of scripts to monitor the integrity of the Node.js binaries hosted in nodejs.org and iojs.org.

I contributed to this article for the opensource.guides

This project is a proof of concept to demonstrate how to optimize media content stored in Azure Blob Storage.

Proof of Concept - how to use custom debian/ubuntu packages with Azure IOT Device Update

This POC is a continuation from the Packaging a .NET Core Service for Ubuntu.

This version of the tutorial is based on the original tutorial by Jesús Corrius, but has been updated to use the .NET 7.0

This project creates a news feed using Node.js.

Get Your Javascript on Board: Learn how to Dockerize your next IOT project with Johnny-five.

Proof of concept project aimed at enabling the automatic synchronization of Markdown files with Confluence pages.

Create a Github Action that monitors the status of Jenkins and generates Markdown reports for your inventory.

This project is a proof of concept that will demonstrate the potential of AThis proof of concept uses some components from the Digital Twins Definition Language (DTDL) to build and maintain a simple product.

This proof of concept uses some components from the Digital Twins Definition Language (DTDL) ontology for Smart Cities to build two simple products to illustrate the ontology's capabilities, including extensive testing to validate the model's integrity and

Secure Your Secrets with Blackbox: A Guide to Using Blackbox in Your GitHub Actions Pipelines

This project is a proof of concept that will demonstrate the potential of Azure IOT Hub for onboarding IOT devices to the cloud with minimal disruption to existing business logic by separating communication to the cloud and the device's current business l…

The OpenSSF Scorecard is a great tool for evaluating the security of your project, and we plan to implement it in Node.js by 2023.

I created this POC to demonstrate the potential of combining JSON Schemas and Semantic Versioning (Semver) for Internet of Things (IoT) and Event-driven architectures.

I co-authored the document.

I created this POC to showcase how to visualize the Node.js Machines inventory and perform a cyclical ping to collect network metrics with a full dockerize environment and a fancy dashboard.

I co-authored the guide.

I created this POC to showcase how to use Docker, K6, Grafana and Node.js to load test API endpoints with fake data and Authentication.

To be very clear: this header does not protect you from XSS attacks much.

The Attack is focused on the user input like crafted urls with malicious payload

The Classic "Billion Laughs" attack explained

The Referer HTTP header is typically set by web browsers to tell a server where it’s coming from.

It's a technical attack that requires a great understanding of JS internals like `__proto__`, `prototype`, deep|shadow copy...

Adobe Flash and Adobe Acrobat can load content from your domain even from other sites (in other words, cross-domain).

This attack is very specific to the Nodejs ecosystem and it was discovered in 2019 by Liran Tal.

By default, old versions of Internet Explorer will allow you to open those HTML files in the context of your site, which means that an untrusted HTML page could start doing bad things in the context of your pages.

As we are not forcing the HTTPS traffic to be keep using HTTPS.

There are some corner cases that the HTTP Specification doesn't cover like HTTP Parameter Pollution or HTTP.

If you include Express on your stack, I highly recommend to extend the HTTP Headers definitions using the middleware Helmet

As an example you can see almost 1 million servers with the X-Powered-By: Express active in Shodan queries

The X-Frame-Options header tells browsers to prevent your webpage from being put in an iframe.

Web browsers have lots of different features, from vibration to fullscreen to microphone access.

Expect-CT is an HTTP header that allows sites to opt in to reporting and/or enforcement of Certificate Transparency requirements, which prevents the use of misissued certificates for that site from going unnoticed.

In the past sometimes the ETag was misconfigured by default using built string and not hashes, like in CVE-2003-1418 that leads to information leaks

This MIME sniffing can be an attack vector.

Browsers can start these DNS requests before the user even clicks a link or loads a resource from somewhere.

This attack can be mitigated by using a different and personalized token in each request.

Most modern browsers support a header called `Content-Security-Policy`, which is effectively a whitelist of things allowed to be on your page.