Sign upLogin

AyuntamientoMadrid/participacion

View on GitHub
Star

Showing 1,085 of 1,085 total issues

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  it "calculates the context for multinode annotations" do
    quote = "ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh " \
            "euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi " \
            "enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit " \
            "lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum " \
Severity: Minor
Found in spec/models/legislation/annotation_spec.rb and 1 other location - About 30 mins to fix
spec/models/legislation/annotation_spec.rb on lines 57..88

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 33.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

    context "tags" do
      it "searches by tags" do
        proposal = create(:proposal, tag_list: "Latina")

        results = Proposal.search("Latina")
Severity: Minor
Found in spec/models/proposal_spec.rb and 1 other location - About 30 mins to fix
spec/models/debate_spec.rb on lines 560..568

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 33.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  scenario "Update should not be posible if logged user is not the author" do
    proposal = create(:proposal)
    expect(proposal).to be_editable
    login_as(create(:user))
Severity: Minor
Found in spec/system/proposals_spec.rb and 1 other location - About 30 mins to fix
spec/system/debates_spec.rb on lines 324..332

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 33.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  scenario "Update should not be posible if logged user is not the author" do
    debate = create(:debate)
    expect(debate).to be_editable
    login_as(create(:user))
Severity: Minor
Found in spec/system/debates_spec.rb and 1 other location - About 30 mins to fix
spec/system/proposals_spec.rb on lines 739..747

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 33.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

    it "displays zero when the valuating phase is over" do
      budget = create(:budget, :finished)
      create(:budget_investment, :visible_to_valuators, budget: budget, valuators: [valuator])

      render_inline Valuation::Budgets::RowComponent.new(budget: budget)
Severity: Minor
Found in spec/components/valuation/budgets/row_component_spec.rb and 1 other location - About 30 mins to fix
spec/components/valuation/budgets/row_component_spec.rb on lines 42..49

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 33.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

    it "redirects admins without JavaScript to the same page" do
      request.env["HTTP_REFERER"] = admin_proposals_path

      patch :select, params: { id: proposal.id, process_id: proposal.process.id }
Severity: Minor
Found in spec/controllers/admin/legislation/proposals_controller_spec.rb and 1 other location - About 30 mins to fix
spec/controllers/admin/legislation/proposals_controller_spec.rb on lines 52..58

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 33.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Avoid too many return statements within this method.
Open

      return :casted_offline             if ballot.casted_offline?
Severity: Major
Found in app/models/budget/investment.rb - About 30 mins to fix

    Render path contains parameter value
    Open

               new_content: render(Admin::BudgetInvestments::ToggleVisibleToValuatorsComponent.new(@investment)) %>
    Severity: Minor
    Found in app/views/admin/budget_investments/toggle_visible_to_valuators.js.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Render path contains parameter value
    Open

    <%= render Admin::BudgetPhases::FormComponent.new(@phase) %>
    Severity: Minor
    Found in app/views/admin/budget_phases/_form.html.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Possible SQL injection
    Open

          joins("LEFT JOIN (VALUES #{ids_with_order}) AS ids(id, ordering) ON #{table_name}.id = ids.id")
    Severity: Minor
    Found in app/models/concerns/randomizable.rb by brakeman

    Injection is #1 on the 2013 OWASP Top Ten web security risks. SQL injection is when a user is able to manipulate a value which is used unsafely inside a SQL query. This can lead to data leaks, data loss, elevation of privilege, and other unpleasant outcomes.

    Brakeman focuses on ActiveRecord methods dealing with building SQL statements.

    A basic (Rails 2.x) example looks like this:

    User.first(:conditions => "username = '#{params[:username]}'")

    Brakeman would produce a warning like this:

    Possible SQL injection near line 30: User.first(:conditions => ("username = '#{params[:username]}'"))

    The safe way to do this query is to use a parameterized query:

    User.first(:conditions => ["username = ?", params[:username]])

    Brakeman also understands the new Rails 3.x way of doing things (and local variables and concatenation):

    username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")

    This results in this kind of warning:

    Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))

    See the Ruby Security Guide for more information and Rails-SQLi.org for many examples of SQL injection in Rails.

    Render path contains parameter value
    Open

    <%= render Admin::Budgets::IndexComponent.new(@budgets) %>
    Severity: Minor
    Found in app/views/admin/budgets/index.html.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Render path contains parameter value
    Open

               new_content: render(Admin::BudgetInvestments::ToggleSelectionComponent.new(@investment)) %>
    Severity: Minor
    Found in app/views/admin/budget_investments/toggle_selection.js.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Render path contains parameter value
    Open

          <%= render @local_census_records %>
    Severity: Minor
    Found in app/views/admin/local_census_records/_local_census_records.html.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Render path contains parameter value
    Open

      <%= render Admin::Poll::Officers::OfficersComponent.new(@officers, id: "officers") %>
    Severity: Minor
    Found in app/views/admin/poll/officers/index.html.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Possible SQL injection
    Open

            .where("created_at + interval '#{days_diff} day' between ? and ?",
    Severity: Minor
    Found in app/controllers/dashboard/successful_supports_controller.rb by brakeman

    Injection is #1 on the 2013 OWASP Top Ten web security risks. SQL injection is when a user is able to manipulate a value which is used unsafely inside a SQL query. This can lead to data leaks, data loss, elevation of privilege, and other unpleasant outcomes.

    Brakeman focuses on ActiveRecord methods dealing with building SQL statements.

    A basic (Rails 2.x) example looks like this:

    User.first(:conditions => "username = '#{params[:username]}'")

    Brakeman would produce a warning like this:

    Possible SQL injection near line 30: User.first(:conditions => ("username = '#{params[:username]}'"))

    The safe way to do this query is to use a parameterized query:

    User.first(:conditions => ["username = ?", params[:username]])

    Brakeman also understands the new Rails 3.x way of doing things (and local variables and concatenation):

    username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")

    This results in this kind of warning:

    Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))

    See the Ruby Security Guide for more information and Rails-SQLi.org for many examples of SQL injection in Rails.

    Render path contains parameter value
    Open

      path: admin_budget_group_headings_path(@budget, @group),
    Severity: Minor
    Found in app/views/admin/budget_headings/new.html.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Render path contains parameter value
    Open

    <%= render Admin::BudgetsWizard::Phases::EditComponent.new(@phase) %>
    Severity: Minor
    Found in app/views/admin/budgets_wizard/phases/edit.html.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Render path contains parameter value
    Open

               new_content: render(Admin::BudgetPhases::ToggleEnabledComponent.new(@phase)) %>
    Severity: Minor
    Found in app/views/admin/budgets_wizard/phases/toggle_enabled.js.erb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Possible command injection
    Open

          output = `cd #{SCRIPTS_FOLDER} && #{command} 2>&1`
    Severity: Minor
    Found in app/models/machine_learning.rb by brakeman

    Injection is #1 on the 2010 OWASP Top Ten web security risks. Command injection occurs when shell commands unsafely include user-manipulatable values.

    There are many ways to run commands in Ruby:

    `ls #{params[:file]}`

system("ls #{params[:dir]}")

exec("md5sum #{params[:input]}")

    Brakeman will warn on any method like these that uses user input or unsafely interpolates variables.

    See the Ruby Security Guide for details.

    Render path contains parameter value
    Open

          render action: params[:id].split(".").first
    Severity: Critical
    Found in app/controllers/pages_controller.rb by brakeman

    When a call to render uses a dynamically generated path, template name, file name, or action, there is the possibility that a user can access templates that should be restricted. The issue may be worse if those templates execute code or modify the database.

    This warning is shown whenever the path to be rendered is not a static string or symbol.

    These warnings are often false positives, however, because it can be difficult to manipulate Rails' assumptions about paths to perform malicious behavior. Reports of dynamic render paths should be checked carefully to see if they can actually be manipulated maliciously by the user.

    Severity
    Category
    Status
    Source
    Language