Sign upLogin

AnalyzePlatypus/TranslitKit

View on GitHub
Star

Showing 51 of 51 total issues

Possible XSS vulnerability in ActionView
Open

    actionview (6.0.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-5267

Criticality: Medium

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8

Solution: upgrade to >= 5.2.4.2, ~> 5.2.4, >= 6.0.2.2

Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Open

    activesupport (6.0.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-8165

Criticality: Critical

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c

Solution: upgrade to >= 5.2.4.3, ~> 5.2.4, >= 6.0.3.1

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
Open

    nokogiri (1.13.4)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory:

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw

Solution: upgrade to >= 1.13.9

Possible Open Redirect in Host Authorization Middleware
Open

    actionpack (6.0.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2021-44528

Criticality: Medium

URL: https://groups.google.com/g/ruby-security-ann/c/vG9gz3nk1pM/m/7-NU4MNrDAAJ

Solution: upgrade to >= 6.0.4.2, ~> 6.0.4, >= 6.1.4.2, ~> 6.1.4, >= 7.0.0.rc2

Possible XSS Vulnerability in Action View tag helpers
Open

    actionview (6.0.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-27777

Criticality: Medium

URL: https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw

Solution: upgrade to >= 5.2.7.1, ~> 5.2.7, >= 6.0.4.8, ~> 6.0.4, >= 6.1.5.1, ~> 6.1.5, >= 7.0.2.4

Avoid too many return statements within this method.
Open

        when "ך" then return "כ"
Severity: Major
Found in lib/phonemizer.rb - About 30 mins to fix

    Method setup_permuter has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring.
    Open

      def setup_permuter
    @permuter = Permuter.new

    # Get the letters of the word
    heb_letters = self.phonemes
    Severity: Minor
    Found in lib/transliterator.rb - About 25 mins to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    Redundant use of Object#to_s in interpolation.
    Open

      load_file "#{FILE_DIRECTORY}/#{symbol.to_s}.json"
    Severity: Minor
    Found in lib/phoneme_maps.rb by rubocop

    This cop checks for string conversion in string interpolation, which is redundant.

    Example:

    # bad

"result is #{something.to_s}"

    Example:

    # good

"result is #{something}"

    Unused block argument - item. If it's necessary, use _ or _item as an argument name to indicate that it won't be used.
    Open

          @arrays[indices.length].each_with_index do |item,i|
    Severity: Minor
    Found in lib/permuter.rb by rubocop

    This cop checks for unused block arguments.

    Example:

    # bad

do_something do |used, unused|
  puts used
end

do_something do |bar|
  puts :foo
end

define_method(:foo) do |bar|
  puts :baz
end

    Example:

    #good

do_something do |used, _unused|
  puts used
end

do_something do
  puts :foo
end

define_method(:foo) do |_bar|
  puts :baz
end

    Possible shell escape sequence injection vulnerability in Rack
    Open

        rack (2.2.3)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-30123

    Criticality: Critical

    URL: https://groups.google.com/g/ruby-security-ann/c/LWB10kWzag8

    Solution: upgrade to >= 2.0.9.1, ~> 2.0.9, >= 2.1.4.1, ~> 2.1.4, >= 2.2.3.1

    Denial of Service Vulnerability in Rack Multipart Parsing
    Open

        rack (2.2.3)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-30122

    Criticality: High

    URL: https://groups.google.com/g/ruby-security-ann/c/L2Axto442qk

    Solution: upgrade to >= 2.0.9.1, ~> 2.0.9, >= 2.1.4.1, ~> 2.1.4, >= 2.2.3.1

    Severity
    Category
    Status
    Source
    Language