Sign upLogin

brewster1134/sourcerer

View on GitHub
Star

Showing 21 of 21 total issues

json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix)
Open

    json (1.8.3)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-10663

Criticality: High

URL: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Solution: upgrade to >= 2.3.0

Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Open

    activesupport (4.2.7.1)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-8165

Criticality: Critical

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c

Solution: upgrade to >= 5.2.4.3, ~> 5.2.4, >= 6.0.3.1

ReDoS based DoS vulnerability in Active Support’s underscore
Open

    activesupport (4.2.7.1)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2023-22796

URL: https://github.com/rails/rails/releases/tag/v7.0.4.1

Solution: upgrade to >= 5.2.8.15, ~> 5.2.8, >= 6.1.7.1, ~> 6.1.7, >= 7.0.4.1

Code injection in ruby git
Open

    git (1.3.0)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-47318

Criticality: High

URL: https://github.com/ruby-git/ruby-git/pull/602

Solution: upgrade to >= 1.13.0

Denial of Service in rubyzip ("zip bombs")
Open

    rubyzip (1.2.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-16892

Criticality: Medium

URL: https://github.com/rubyzip/rubyzip/pull/403

Solution: upgrade to >= 1.3.0

i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() Function Hash Handling DoS
Open

    i18n (0.7.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2014-10077

URL: https://github.com/svenfuchs/i18n/pull/289

Solution: upgrade to >= 0.8.0

Command injection in ruby-git
Open

    git (1.3.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-25648

Criticality: Critical

URL: https://github.com/ruby-git/ruby-git/pull/569

Solution: upgrade to >= 1.11.0

Potential remote code execution in ruby-git
Open

    git (1.3.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-46648

Criticality: Medium

URL: https://github.com/ruby-git/ruby-git/pull/602

Solution: upgrade to >= 1.13.0

RuboCop gem Insecure use of /tmp
Open

    rubocop (0.44.1)
Severity: Info
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2017-8418

Criticality: Low

URL: https://github.com/bbatsov/rubocop/issues/4336

Solution: upgrade to >= 0.49.0

Method get_type_source has 31 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def get_type_source source
    type_source = nil

    # LOCAL
    #
Severity: Minor
Found in lib/sourcerer/core.rb - About 1 hr to fix

    Method get_type_source has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring.
    Open

      def get_type_source source
    type_source = nil

    # LOCAL
    #
    Severity: Minor
    Found in lib/sourcerer/core.rb - About 55 mins to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    TZInfo relative path traversal vulnerability allows loading of arbitrary files
    Open

        tzinfo (1.2.2)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2022-31163

    Criticality: High

    URL: https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx

    Solution: upgrade to ~> 0.3.61, >= 1.2.10

    Directory traversal vulnerability in rubyzip
    Open

        rubyzip (1.2.0)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2017-5946

    Criticality: Critical

    URL: https://github.com/rubyzip/rubyzip/issues/315

    Solution: upgrade to >= 1.2.1

    ruby-ffi DDL loading issue on Windows OS
    Open

        ffi (1.9.14)
    Severity: Critical
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2018-1000201

    Criticality: High

    URL: https://github.com/ffi/ffi/releases/tag/1.9.24

    Solution: upgrade to >= 1.9.24

    Directory Traversal in rubyzip
    Open

        rubyzip (1.2.0)
    Severity: Minor
    Found in Gemfile.lock by bundler-audit

    Advisory: CVE-2018-1000544

    Criticality: Critical

    URL: https://github.com/rubyzip/rubyzip/issues/369

    Solution: upgrade to >= 1.2.2

    Add an empty line after magic comments.
    Open

    $LOAD_PATH << File.join(File.dirname(__FILE__), 'lib')
    Severity: Minor
    Found in sourcerer_.gemspec by rubocop

    Checks for a newline after the final magic comment.

    Example:

    # good
# frozen_string_literal: true

# Some documentation for Person
class Person
  # Some code
end

# bad
# frozen_string_literal: true
# Some documentation for Person
class Person
  # Some code
end

    Unnecessary utf-8 encoding comment.
    Open

    # coding: utf-8
    Severity: Minor
    Found in sourcerer_.gemspec by rubocop

    Dependencies should be sorted in an alphabetical order within their section of the gemspec. Dependency guard-rspec should appear before guard-rubocop.
    Open

      s.add_development_dependency 'guard-rspec'
    Severity: Minor
    Found in sourcerer_.gemspec by rubocop

    Dependencies in the gemspec should be alphabetically sorted.

    Example:

    # bad
spec.add_dependency 'rubocop'
spec.add_dependency 'rspec'

# good
spec.add_dependency 'rspec'
spec.add_dependency 'rubocop'

# good
spec.add_dependency 'rubocop'

spec.add_dependency 'rspec'

# bad
spec.add_development_dependency 'rubocop'
spec.add_development_dependency 'rspec'

# good
spec.add_development_dependency 'rspec'
spec.add_development_dependency 'rubocop'

# good
spec.add_development_dependency 'rubocop'

spec.add_development_dependency 'rspec'

# bad
spec.add_runtime_dependency 'rubocop'
spec.add_runtime_dependency 'rspec'

# good
spec.add_runtime_dependency 'rspec'
spec.add_runtime_dependency 'rubocop'

# good
spec.add_runtime_dependency 'rubocop'

spec.add_runtime_dependency 'rspec'

# good only if TreatCommentsAsGroupSeparators is true
# For code quality
spec.add_dependency 'rubocop'
# For tests
spec.add_dependency 'rspec'

    Trailing whitespace detected.
    Open
    Severity: Minor
    Found in lib/sourcerer/source_type.rb by rubocop

    Trailing whitespace detected.
    Open
    Severity: Minor
    Found in lib/sourcerer/core.rb by rubocop
    Severity
    Category
    Status
    Source
    Language