Bumps pdfbox from 2.0.23 to 2.0.24.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps guava from 28.1-jre to 29.0-jre. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/guava/releases">guava's releases</a>.</em></p> <blockquote> <h2>29.0</h2> <h3>Maven</h3> <pre lang="xml"><code><dependency> <groupId>com.google.guava</groupId> <artifactId>guava</artifactId> <version>29.0-jre</version> <!-- or, for Android: --> <version>29.0-android</version> </dependency> </code></pre> <h3>Javadoc</h3> <ul> <li><a href="http://guava.dev/releases/29.0-jre/api/docs/">29.0-jre</a></li> <li><a href="http://guava.dev/releases/29.0-android/api/docs/">29.0-android</a></li> </ul> <h3>JDiff</h3> <ul> <li><a href="http://guava.dev/releases/29.0-jre/api/diffs/">29.0-jre vs. 28.2-jre</a></li> <li><a href="http://guava.dev/releases/29.0-android/api/diffs/">29.0-android vs. 28.2-android</a></li> <li><a href="http://guava.dev/releases/29.0-android/api/androiddiffs/">29.0-android vs. 29.0-jre</a></li> </ul> <h3>Changelog</h3> <ul> <li><a href="https://groups.google.com/d/msg/guava-announce/zHZTFg7YF3o/rQNnwdHeEwAJ">Guava types can no longer be sent over GWT-RPC.</a> To <em>temporarily</em> reenable support, set the <code>guava.gwt.emergency_reenable_rpc</code> system property to <code>true</code>. (5214a10b1e) <ul> <li>This is the only breaking change in this release, and it affects only users of the <code>guava-gwt</code> artifact, not people who use only the <code>guava</code> artifact. This release contains no changes that break <em>binary compatibility</em> for any users.</li> </ul> </li> <li>API documentation for Guava classes is now easier to reach. For example, for <code>ImmutableList</code>, visit <a href="https://guava.dev/ImmutableList">guava.dev/ImmutableList</a>. Also, more easily access the index at <a href="https://guava.dev/api">guava.dev/api</a>.</li> <li><code>collect</code>: Annotated <code>FluentIterable.from(FluentIterable)</code> with <code>@DoNotCall</code>. (b1c77b7df3)</li> <li><code>collect</code>: Made <code>ceiling</code>, <code>floor</code>, <code>headSet(E, boolean)</code>, and <code>tailSet(E, boolean)</code> methods available in the GWT-emulated <code>ImmutableSortedSet</code>. (7e0fe90ca8, 5f2fbf27b2)</li> <li><code>graph</code>: Made it possible to set a stable incident edge order by calling the newly added method <code>[Value]Graph.Builder.incidentEdgeOrder(ElementOrder.stable())</code>. (70164025a8)</li> <li><code>graph</code>: Added <code>incidentEdgeOrder()</code> to the <code>[Value]Graph</code> interfaces. (cde576ec00)</li> <li><code>util.concurrent</code>: Added <code>Duration</code>-based <code>default</code> methods to <code>ListeningScheduledExecutorService</code>. (931e83f969)</li> <li><code>util.concurrent</code>: Added <code>immediateVoidFuture</code>. (9f3bae5853)</li> <li><code>util.concurrent</code>: Removed <code>@Beta</code> from <code>Service</code> and related classes. (dc46627fea)</li> <li><code>util.concurrent</code>: Deprecated the 1-arg overload of <code>ServiceManager.addListener</code>. (86e3620125)</li> <li><code>util.concurrent</code>: Changed the return type of <code>ServiceManager.servicesByState()</code> to <code>ImmutableSetMultimap</code> (but also retained a method with the old signature for binary compatibility). (31999ae6f5)</li> <li><code>util.concurrent</code>: Made it safe to load the <code>AbstractFuture</code> class from a <code>ForkJoinPool</code> thread under a security manager. (6e0c5b5d50)</li> </ul> <h2>28.2</h2> <h3>Maven</h3> <pre lang="xml"><code><dependency> <groupId>com.google.guava</groupId> <artifactId>guava</artifactId> <version>28.2-jre</version> <!-- or, for Android: --> <version>28.2-android</version> </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/google/guava/commits">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps commons-io from 2.6 to 2.7.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps commons-io from 2.6 to 2.7.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Looks like commons-io:commons-io is up-to-date now, so this is no longer needed.

Bumps commons-io from 2.6 to 2.7.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Looks like com.google.guava:guava is up-to-date now, so this is no longer needed.

Looks like commons-io:commons-io is up-to-date now, so this is no longer needed.

Looks like commons-io:commons-io is up-to-date now, so this is no longer needed.

IB-6748

Signed-off-by: Raul Metsma [email protected]

Introduction

Unable to use method/property named as attributes( ) in a Model.

Issue Description

export default function relationshipAttributeSet(bookshelf) {
	const RelationshipAttributeSet = bookshelf.Model.extend({
		attributes() {
			return this.belongsToMany(
				'RelationshipAttribute', 'bookbrainz.relationship_attribute_set__relationship_attribute',
				'set_id', 'attribute_id'
			);
		},
		format: camelToSnake,
		idAttribute: 'id',
		parse: snakeToCamel,
		tableName: 'bookbrainz.relationship_attribute_set'
	});

	return bookshelf.model('RelationshipAttributeSet', RelationshipAttributeSet);
}

Consider the above Model. It has a method named attributes( ). When I try to use this method it throws Error: attributes is not defined on the model. If I change the method name from attributes( ) to any other name it works fine.

Expected behaviour

Should not throw any error If a method is named as attributes( )

Actual behaviour

Cannot use method named as attributes( ) inside a model. Throws Error: attributes is not defined on the model

• MOPPIOS-853

Signed-off-by: Marten Rebane [email protected]

IB-6918 Signed-off-by: Jelena Sanko [email protected]

Problem

A website wanting to support ID-card signing cannot use CSP to block on policy violations because Token Signing plugin will not work if the CSP is set to block.

Example:

{ 
   "blocked-uri":"inline",
   "column-number":44,
   "document-uri":"https://app.citizenos.com/",
   "line-number":128,
   "original-policy":"default-src 'self' 'report-sample'; img-src *; script-src 'self' https://cdn.crowdin.com https://apis.google.com https://www.google-analytics.com 'report-sample'; style-src 'self' https://fonts.googleapis.com 'sha256-swnxFqaff0i3bsLtJDRpMd5tZFLBnglxSxSqPSAWdIk='; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://id.citizenos.com https://api.citizenos.com https://sentry.io https://graph.microsoft.com https://www.google-analytics.com; base-uri 'self'; object-src 'none'; frame-src https://p.citizenos.com/ https://accounts.google.com/ https://docs.google.com; report-uri https://api.citizenos.com/api/internal/report",
   "referrer":"",
   "script-sample":"// Promises \nvar _eid_promises = {}; \n//…",
   "source-file":"moz-extension://d6dfd14d-b72d-49dc-8586-53ec01e217dd/content.js",
   "violated-directive":"script-src"
}

Reproduce

• Download latest Firefox
• Install Estonian ID-card software
• Visit https://app.citizenos.com
• Create a Topic
• Send the Topic to Voting, configure Hard ID voting.
• Vote with ID-card and see console for CSP reports.

Fix?

• Rewrite plugin so that it does not use eval() directly or indirectly - https://github.com/open-eid/chrome-token-signing/blob/master/extension/content.js#L52

Resources

• Chrome extensions and CSP - https://developer.chrome.com/extensions/contentSecurityPolicy
• CSP - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

This pull request introduces 2 alerts when merging 43f0a55e0d630bc54a396e1ac8026fa481f89f2d into df6a8e563124e95de2e245dc85baf3ed77d36263 - view on LGTM.com

new alerts:

• 2 for Cross-window communication with unrestricted target origin

IB-7071

Signed-off-by: Raul Metsma [email protected]

This pull request introduces 2 alerts when merging dc3019db43752106f28d6f40d0cd5f1ab8a97c30 into df6a8e563124e95de2e245dc85baf3ed77d36263 - view on LGTM.com

new alerts:

• 2 for Cross-window communication with unrestricted target origin

• MOPPIOS-898

Signed-off-by: Marten Rebane [email protected]