Sign upLogin

afimb/cvdtc

View on GitHub
Star

Showing 145 of 145 total issues

Loofah 2.0.3 is vulnerable (CVE-2018-8048). Upgrade to 2.1.2
Open

    loofah (2.0.3)
Severity: Minor
Found in Gemfile.lock by brakeman

Read more: https://github.com/flavorjones/loofah/issues/144

SSL certificate verification was bypassed
Open

      Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https', verify_mode: OpenSSL::SSL::VERIFY_NONE) do |http|
Severity: Critical
Found in app/jobs/url_job.rb by brakeman

Simply using SSL isn't enough to ensure the data you are sending is secure. Man in the middle (MITM) attacks are well known and widely used. In some cases, these attacks rely on the client to establish a connection that doesn't check the validity of the SSL certificate presented by the server. In this case, the attacker can present their own certificate and act as a man in the middle.

In Ruby, this happens when the OpenSSL verification mode is set to VERIFY_NONE

require "net/https"
require "uri"

uri = URI.parse("https://ssl-site.com/")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Get.new(uri.request_uri)

response = http.request(request)

In this case, if an invalid certificate was presented, no verification would occur, providing an opportunity for attack. When successful, the data transmitted (cookies, request parameters, POST bodies, etc.) would all be able to be intercepted by the MITM.

Brakeman would produce a warning like this:

SSL certificate verification was bypassed near line 24: http.verify_mode = OpenSSL::SSL::VERIFY_NONE

To ensure that SSL verification happens use the following mode:

http.verify_mode = OpenSSL::SSL::VERIFY_PEER

If the server certificate is invalid or context.ca_file is not set when verifying peers an OpenSSL::SSL::SSLError will be raised.

For more information on the impact of this issue, see the paper The Most Dangerous Code in the World.

rails-html-sanitizer 1.0.3 is vulnerable (CVE-2018-3741). Upgrade to 1.0.4
Open

    rails-html-sanitizer (1.0.3)
Severity: Minor
Found in Gemfile.lock by brakeman

Read more: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ

User controlled method execution
Open

    @result, @datas, @sum_report, @errors = @job.send("#{@default_view}_views", (@transport_datas_selected != 'all' ? @transport_datas_selected : nil ))
Severity: Critical
Found in app/controllers/jobs_controller.rb by brakeman

Using unfiltered user data to select a Class or Method to be dynamically sent is dangerous.

It is much safer to whitelist the desired target or method.

Unsafe use of method:

method = params[:method]
@result = User.send(method.to_sym)

Safe:

method = params[:method] == 1 ? :method_a : :method_b
@result = User.send(method, *args)

Unsafe use of target:

table = params[:table]
model = table.classify.constantize
@result = model.send(:method)

Safe:

target = params[:target] == 1 ? Account : User
@result = target.send(:method, *args)

Including user data in the arguments passed to an Object#send is safe, as long as the method can properly handle potentially bad data.

Safe:

args = params["args"] || []
@result = User.send(:method, *args)

Model attribute used in file name
Open

      File.open(job.path_file, 'wb') { |f| f.write(response.body) }
Severity: Minor
Found in app/jobs/url_job.rb by brakeman

Using user input when accessing files (local or remote) will raise a warning in Brakeman.

For example

File.open("/tmp/#{cookie[:file]}")

will raise an error like

Cookie value used in file name near line 4: File.open("/tmp/#{cookie[:file]}")

This type of vulnerability can be used to access arbitrary files on a server (including /etc/passwd.

Similar blocks of code found in 4 locations. Consider refactoring.
Open

      time_table: {
        objectid: {
          unique: 0,
          pattern: 0,
          min_size: '',
Severity: Minor
Found in app/services/parameters_service.rb and 3 other locations - About 25 mins to fix
app/services/parameters_service.rb on lines 239..258
app/services/parameters_service.rb on lines 260..279
app/services/parameters_service.rb on lines 281..300

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 31.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 4 locations. Consider refactoring.
Open

      network: {
        objectid: {
          unique: 0,
          pattern: 0,
          min_size: '',
Severity: Minor
Found in app/services/parameters_service.rb and 3 other locations - About 25 mins to fix
app/services/parameters_service.rb on lines 260..279
app/services/parameters_service.rb on lines 281..300
app/services/parameters_service.rb on lines 424..443

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 31.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 4 locations. Consider refactoring.
Open

      group_of_line: {
        objectid: {
          unique: 0,
          pattern: 0,
          min_size: '',
Severity: Minor
Found in app/services/parameters_service.rb and 3 other locations - About 25 mins to fix
app/services/parameters_service.rb on lines 239..258
app/services/parameters_service.rb on lines 260..279
app/services/parameters_service.rb on lines 424..443

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 31.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 4 locations. Consider refactoring.
Open

      company: {
        objectid: {
          unique: 0,
          pattern: 0,
          min_size: '',
Severity: Minor
Found in app/services/parameters_service.rb and 3 other locations - About 25 mins to fix
app/services/parameters_service.rb on lines 239..258
app/services/parameters_service.rb on lines 281..300
app/services/parameters_service.rb on lines 424..443

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 31.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  def tests_views(_type = nil)
    report = IevkitViews::ValidationReport.new(referential, @all_links[:validation_report], 'validation_report', @all_links[:validation_report], search)
    [
      report.result,
      report.search_for(report.check_points),
Severity: Minor
Found in app/models/job.rb and 1 other location - About 25 mins to fix
app/models/job.rb on lines 115..122

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 30.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Method job has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring.
Open

  def job
    @job = Job.find(params[:id])
    @job.search = params[:q][:search] if params[:q]
    @current_menu = @job.convert_job? ? :convert : :validate
  rescue => _e
Severity: Minor
Found in app/controllers/jobs_controller.rb - About 25 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method transport_datas_views has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring.
Open

  def transport_datas_views(type = nil)
    report = IevkitViews::ActionReport.new(referential, @all_links[:action_report], 'action_report', @all_links[:validation_report], search)
    if type
      datas = []
      datas << report.collections('line') if type == 'line'
Severity: Minor
Found in app/models/job.rb - About 25 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  def files_views(_type = nil)
    report = IevkitViews::ActionReport.new(referential, @all_links[:action_report], 'action_report', @all_links[:validation_report], search)
    [
      report.result,
      report.search_for(report.files),
Severity: Minor
Found in app/models/job.rb and 1 other location - About 25 mins to fix
app/models/job.rb on lines 146..153

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 30.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

          if error[:source][:file][:line_number].to_i > 0
            filename << "#{I18n.t('report.file.line')} #{error[:source][:file][:line_number]}"
Severity: Minor
Found in app/models/job.rb and 1 other location - About 20 mins to fix
app/models/job.rb on lines 204..205

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 27.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

          if error[:source][:file][:column_number].to_i > 0
            filename << "#{I18n.t('report.file.column')} #{error[:source][:file][:column_number]}"
Severity: Minor
Found in app/models/job.rb and 1 other location - About 20 mins to fix
app/models/job.rb on lines 201..202

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 27.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Line exceeds maximum allowed length
Open

    # If Turbolinks is supported, set up a callback to track pageviews on page:change.
Severity: Minor
Found in app/assets/javascripts/google_analytics.js.coffee by coffeelint

Method Job#result is defined at both app/models/job.rb:37 and app/models/job.rb:97.
Open

  def result
Severity: Minor
Found in app/models/job.rb by rubocop

This cop checks for duplicated instance (or singleton) method definitions.

Example:

# bad

def duplicated
  1
end

def duplicated
  2
end

Example:

# bad

def duplicated
  1
end

alias duplicated other_duplicated

Example:

# good

def duplicated
  1
end

def other_duplicated
  2
end

Line exceeds maximum allowed length
Open

# thanks to Jonathon Wolfe at http://reed.github.io/turbolinks-compatibility/google_analytics.html
Severity: Minor
Found in app/assets/javascripts/google_analytics.js.coffee by coffeelint

Useless assignment to variable - result. Use _ or _result as a variable name to indicate that it won't be used.
Open

    result, datas, errors = send("#{default_view}_views")
Severity: Minor
Found in app/models/job.rb by rubocop

This cop checks for every useless assignment to local variable in every scope. The basic idea for this cop was from the warning of ruby -cw:

assigned but unused variable - foo

Currently this cop has advanced logic that detects unreferenced reassignments and properly handles varied cases such as branch, loop, rescue, ensure, etc.

Example:

# bad

def some_method
  some_var = 1
  do_something
end

Example:

# good

def some_method
  some_var = 1
  do_something(some_var)
end

Line exceeds maximum allowed length
Open

    ga.src = ((if "https:" is document.location.protocol then "https://ssl" else "http://www")) + ".google-analytics.com/ga.js"
Severity: Minor
Found in app/assets/javascripts/google_analytics.js.coffee by coffeelint
Severity
Category
Status
Source
Language