Sign upLogin

andrewhao/bookplanner

View on GitHub
Star

Showing 139 of 139 total issues

Improper Handling of Unexpected Data Type in Nokogiri
Open

    nokogiri (1.6.7.2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-29181

Criticality: High

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m

Solution: upgrade to >= 1.13.6

Denial of Service (DoS) in Nokogiri on JRuby
Open

    nokogiri (1.6.7.2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-24839

Criticality: High

URL: https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv

Solution: upgrade to >= 1.13.4

Possible information leak / session hijack vulnerability
Open

    rack (1.5.5)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-16782

Criticality: Medium

URL: https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3

Solution: upgrade to ~> 1.6.12, >= 2.0.8

Directory Traversal in rubyzip
Open

    rubyzip (1.1.7)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2018-1000544

Criticality: Critical

URL: https://github.com/rubyzip/rubyzip/issues/369

Solution: upgrade to >= 1.2.2

Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
Open

    nokogiri (1.6.7.2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-5477

Criticality: Critical

URL: https://github.com/sparklemotion/nokogiri/issues/1915

Solution: upgrade to >= 1.10.4

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
Open

    nokogiri (1.6.7.2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory:

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw

Solution: upgrade to >= 1.13.9

Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
Open

    nokogiri (1.6.7.2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2016-4658

Criticality: Critical

URL: https://github.com/sparklemotion/nokogiri/issues/1615

Solution: upgrade to >= 1.7.1

Denial of Service in rubyzip ("zip bombs")
Open

    rubyzip (1.1.7)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-16892

Criticality: Medium

URL: https://github.com/rubyzip/rubyzip/pull/403

Solution: upgrade to >= 1.3.0

Path Traversal in Sprockets
Open

    sprockets (2.11.3)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2018-3760

Criticality: High

URL: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k

Solution: upgrade to < 3.0.0, >= 2.12.5, < 4.0.0, >= 3.7.2, >= 4.0.0.beta8

Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
Open

    nokogiri (1.6.7.2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2018-14404

Criticality: High

URL: https://github.com/sparklemotion/nokogiri/issues/1785

Solution: upgrade to >= 1.8.5

Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
Open

    nokogiri (1.6.7.2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2021-30560

Criticality: High

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2

Solution: upgrade to >= 1.13.2

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  def create
    @book_bag = BookBag.new(book_bag_params)

    respond_to do |format|
      if @book_bag.save
Severity: Major
Found in app/controllers/book_bags_controller.rb and 1 other location - About 1 hr to fix
app/controllers/plans_controller.rb on lines 45..54

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 52.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Similar blocks of code found in 2 locations. Consider refactoring.
Open

  def create
    @plan = Plan.new(plan_params)

    respond_to do |format|
      if @plan.save
Severity: Major
Found in app/controllers/plans_controller.rb and 1 other location - About 1 hr to fix
app/controllers/book_bags_controller.rb on lines 27..39

Duplicated Code

Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

Tuning

This issue has a mass of 52.

We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

Refactorings

Further Reading

Method generate_plan has 26 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def generate_plan(template, bag_ids, student_ids, history_lookup, debug, solver, logger)
    plan = {}

    template_exclusion_bag_ids = template.values
    template_exclusion_bag_ids.inject(template.clone) do |temp_template, bag_id|
Severity: Minor
Found in lib/csp/iterative_relaxing_constraint_solver_strategy.rb - About 1 hr to fix

    Method generate_plan has 7 arguments (exceeds 4 allowed). Consider refactoring.
    Open

      def generate_plan(temp_template, bag_ids, student_ids, history_lookup, _debug, solver, logger)
    Severity: Major
    Found in lib/csp/standard_solver_strategy.rb - About 50 mins to fix

      Method generate_plan has 7 arguments (exceeds 4 allowed). Consider refactoring.
      Open

        def generate_plan(template, bag_ids, student_ids, history_lookup, debug, solver, logger)
      Severity: Major
      Found in lib/csp/iterative_relaxing_constraint_solver_strategy.rb - About 50 mins to fix

        Regular Expression Denial of Service in websocket-extensions (RubyGem)
        Open

            websocket-extensions (0.1.2)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2020-7663

        Criticality: High

        URL: https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2

        Solution: upgrade to >= 0.1.5

        Possible remote code execution vulnerability in Action Pack
        Open

            actionpack (4.1.6)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2016-2098

        Criticality: High

        URL: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q

        Solution: upgrade to ~> 3.2.22.2, >= 4.2.5.2, ~> 4.2.5, >= 4.1.14.2, ~> 4.1.14

        Object leak vulnerability for wildcard controller routes in Action Pack
        Open

            actionpack (4.1.6)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2015-7581

        Criticality: High

        URL: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE

        Solution: upgrade to >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14

        Possible Object Leak and Denial of Service attack in Action Pack
        Open

            actionpack (4.1.6)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2016-0751

        Criticality: High

        URL: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc

        Solution: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1

        Severity
        Category
        Status
        Source
        Language