Sign upLogin

andypike/rectify

View on GitHub
Star

Showing 121 of 125 total issues

Inefficient Regular Expression Complexity in Nokogiri
Open

    nokogiri (1.8.5)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-24836

Criticality: High

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8

Solution: upgrade to >= 1.13.4

Improper neutralization of data URIs may allow XSS in Loofah
Open

    loofah (2.2.2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-23515

Criticality: Medium

URL: https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx

Solution: upgrade to >= 2.19.1

Loofah XSS Vulnerability
Open

    loofah (2.2.2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-15587

Criticality: Medium

URL: https://github.com/flavorjones/loofah/issues/171

Solution: upgrade to >= 2.3.1

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
Open

    nokogiri (1.8.5)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory:

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw

Solution: upgrade to >= 1.13.9

Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Open

    nokogiri (1.8.5)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-11068

URL: https://github.com/sparklemotion/nokogiri/issues/1892

Solution: upgrade to >= 1.10.3

Inefficient Regular Expression Complexity in rails-html-sanitizer
Open

    rails-html-sanitizer (1.0.4)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-23517

Criticality: High

URL: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w

Solution: upgrade to >= 1.4.4

Class Form has 24 methods (exceeds 20 allowed). Consider refactoring.
Open

  class Form
    include Virtus.model
    include ActiveModel::Validations

    attr_reader :context
Severity: Minor
Found in lib/rectify/form.rb - About 2 hrs to fix

    Loofah XSS Vulnerability
    Open

        loofah (2.2.2)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2018-16468

    Criticality: Medium

    URL: https://github.com/flavorjones/loofah/issues/154

    Solution: upgrade to >= 2.2.3

    OS Command Injection in Rake
    Open

        rake (12.3.1)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2020-8130

    Criticality: High

    URL: https://github.com/advisories/GHSA-jppv-gw3r-w3q8

    Solution: upgrade to >= 12.3.3

    ReDoS based DoS vulnerability in Action Dispatch
    Open

        actionpack (5.2.1)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2023-22795

    URL: https://github.com/rails/rails/releases/tag/v7.0.4.1

    Solution: upgrade to >= 5.2.8.15, ~> 5.2.8, >= 6.1.7.1, ~> 6.1.7, >= 7.0.4.1

    Rectify::Form#with_context has approx 7 statements
    Open

        def with_context(new_context)
    Severity: Minor
    Found in lib/rectify/form.rb by reek

    A method with Too Many Statements is any method that has a large number of lines.

    Too Many Statements warns about any method that has more than 5 statements. Reek's smell detector for Too Many Statements counts +1 for every simple statement in a method and +1 for every statement within a control structure (if, else, case, when, for, while, until, begin, rescue) but it doesn't count the control structure itself.

    So the following method would score +6 in Reek's statement-counting algorithm:

    def parse(arg, argv, &error)
  if !(val = arg) and (argv.empty? or /\A-/ =~ (val = argv[0]))
    return nil, block, nil                                         # +1
  end
  opt = (val = parse_arg(val, &error))[1]                          # +2
  val = conv_arg(*val)                                             # +3
  if opt and !arg
    argv.shift                                                     # +4
  else
    val[0] = nil                                                   # +5
  end
  val                                                              # +6
end

    (You might argue that the two assigments within the first @if@ should count as statements, and that perhaps the nested assignment should count as +2.)

    Possible exposure of information vulnerability in Action Pack
    Open

        actionpack (5.2.1)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-23633

    Criticality: High

    URL: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ

    Solution: upgrade to >= 5.2.6.2, ~> 5.2.6, >= 6.0.4.6, ~> 6.0.4, >= 6.1.4.6, ~> 6.1.4, >= 7.0.2.2

    Possible DoS Vulnerability in Active Record PostgreSQL adapter
    Open

        activerecord (5.2.1)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2021-22880

    Criticality: Medium

    URL: https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI

    Solution: upgrade to >= 5.2.4.5, ~> 5.2.4, >= 6.0.3.5, ~> 6.0.3, >= 6.1.2.1

    Denial of service via multipart parsing in Rack
    Open

        rack (2.0.5)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-44572

    URL: https://github.com/rack/rack/releases/tag/v3.0.4.1

    Solution: upgrade to >= 2.0.9.2, ~> 2.0.9, >= 2.1.4.2, ~> 2.1.4, >= 2.2.6.1, ~> 2.2.6, >= 3.0.4.1

    Denial of Service Vulnerability in Rack Multipart Parsing
    Open

        rack (2.0.5)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-30122

    Criticality: High

    URL: https://groups.google.com/g/ruby-security-ann/c/L2Axto442qk

    Solution: upgrade to >= 2.0.9.1, ~> 2.0.9, >= 2.1.4.1, ~> 2.1.4, >= 2.2.3.1

    Possible shell escape sequence injection vulnerability in Rack
    Open

        rack (2.0.5)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-30123

    Criticality: Critical

    URL: https://groups.google.com/g/ruby-security-ann/c/LWB10kWzag8

    Solution: upgrade to >= 2.0.9.1, ~> 2.0.9, >= 2.1.4.1, ~> 2.1.4, >= 2.2.3.1

    File Content Disclosure in Action View
    Open

        actionview (5.2.1)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2019-5418

    Criticality: High

    URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q

    Solution: upgrade to >= 4.2.11.1, ~> 4.2.11, >= 5.0.7.2, ~> 5.0.7, >= 5.1.6.2, ~> 5.1.6, >= 5.2.2.1, ~> 5.2.2, >= 6.0.0.beta3

    Denial of Service Vulnerability in ActiveRecord’s PostgreSQL adapter
    Open

        activerecord (5.2.1)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-44566

    URL: https://github.com/rails/rails/releases/tag/v7.0.4.1

    Solution: upgrade to >= 5.2.8.15, ~> 5.2.8, >= 6.1.7.1, ~> 6.1.7, >= 7.0.4.1

    Possible XSS vulnerability in Rack
    Open

        rack (2.0.5)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2018-16471

    URL: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o

    Solution: upgrade to ~> 1.6.11, >= 2.0.6

    TZInfo relative path traversal vulnerability allows loading of arbitrary files
    Open

        tzinfo (1.2.5)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-31163

    Criticality: High

    URL: https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx

    Solution: upgrade to ~> 0.3.61, >= 1.2.10

    Severity
    Category
    Status
    Source
    Language