Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 22,004 of 22,004 total issues

Method start_handler has a Cognitive Complexity of 30 (exceeds 5 allowed). Consider refactoring.
Open

  def start_handler

    # Maximum number of seconds to run the handler
    ctimeout = 150
Severity: Minor
Found in lib/msf/core/handler/bind_aws_ssm.rb - About 4 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method process_dr_search has a Cognitive Complexity of 30 (exceeds 5 allowed). Consider refactoring.
Open

  def process_dr_search(res, res_code, repo_name, fields=nil, mode='standard')
    if res_code == 1 || res.nil? || !(res.instance_of?(Hash) && res.keys.include?('response') && res['response'].instance_of?(Hash))
      vprint_error("Received unexpected reply when trying to dump table #{repo_name}: #{res}")
      return nil
    end
Severity: Minor
Found in lib/msf/core/auxiliary/manage_engine_xnode/process.rb - About 4 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method build_credential_collection has a Cognitive Complexity of 30 (exceeds 5 allowed). Consider refactoring.
Open

  def build_credential_collection(opts)
    cred_collection = Metasploit::Framework::CredentialCollection.new({
      blank_passwords: datastore['BLANK_PASSWORDS'],
      pass_file: datastore['PASS_FILE'],
      user_file: datastore['USER_FILE'],
Severity: Minor
Found in lib/msf/core/auxiliary/auth_brute.rb - About 4 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method import_ip360_xml_v3 has a Cognitive Complexity of 30 (exceeds 5 allowed). Consider refactoring.
Open

  def import_ip360_xml_v3(args={}, &block)
    data = args[:data]
    wspace = Msf::Util::DBManager.process_opts_workspace(args, framework).name
    bl = validate_ips(args[:blacklist]) ? args[:blacklist].split : []
Severity: Minor
Found in lib/msf/core/db_manager/import/ip360/v3.rb - About 4 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method dump_table_fields has a Cognitive Complexity of 30 (exceeds 5 allowed). Consider refactoring.
Open

    def dump_table_fields(table, columns, condition = '', num_limit = 0)
      return '' if columns.empty?

      one_column = columns.length == 1
      if one_column
Severity: Minor
Found in lib/msf/core/exploit/sqli/postgresqli/common.rb - About 4 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method each_base_word has a Cognitive Complexity of 30 (exceeds 5 allowed). Consider refactoring.
Open

        def each_base_word
          # Make sure are attributes are all valid first!
          valid!

          # Yield the expanded form of each line of the custom wordlist if one was given
Severity: Minor
Found in lib/metasploit/framework/password_crackers/wordlist.rb - About 4 hrs to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method plugin_search has 110 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def plugin_search(tpath, papp, ip, osize)
    res = send_request_cgi({
      'uri' => "#{tpath}#{papp}",
      'method' => 'GET'
    })
Severity: Major
Found in modules/auxiliary/scanner/http/joomla_plugins.rb - About 4 hrs to fix

    Method exploit has 110 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def exploit
    #
    # 1. Leverage the auth bypass to generate a new administrator access token. Older version of TeamCity (circa 2018)
    #    do not have support for access token, so we fall back to creating a new administrator account. The benefit
    #    of using an access token is we can delete it when we are finished, unlike a user account.
    Severity: Major
    Found in modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb - About 4 hrs to fix

      Method generate_html has 110 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def generate_html(payload)

    enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
    enc_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(target.arch))
    enc_ret  = Rex::Text.to_unescape(
      Severity: Major
      Found in modules/exploits/multi/browser/firefox_escape_retval.rb - About 4 hrs to fix

        Method initialize has 110 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Dup Scout Enterprise GET Buffer Overflow',
        Severity: Major
        Found in modules/exploits/windows/http/dupscts_bof.rb - About 4 hrs to fix

          Similar blocks of code found in 5 locations. Consider refactoring.
          Open

              sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      ioa = response_data[0..3]
      response_data = response_data[3..-1]
          Severity: Major
          Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
          modules/auxiliary/client/iec104/iec104.rb on lines 229..247
          modules/auxiliary/client/iec104/iec104.rb on lines 348..366
          modules/auxiliary/client/iec104/iec104.rb on lines 371..389
          modules/auxiliary/client/iec104/iec104.rb on lines 394..412

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 5 locations. Consider refactoring.
          Open

              sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      ioa = response_data[0..3]
      response_data = response_data[3..-1]
          Severity: Major
          Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
          modules/auxiliary/client/iec104/iec104.rb on lines 229..247
          modules/auxiliary/client/iec104/iec104.rb on lines 325..343
          modules/auxiliary/client/iec104/iec104.rb on lines 371..389
          modules/auxiliary/client/iec104/iec104.rb on lines 394..412

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 5 locations. Consider refactoring.
          Open

              sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      ioa = response_data[0..3]
      response_data = response_data[3..-1]
          Severity: Major
          Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
          modules/auxiliary/client/iec104/iec104.rb on lines 229..247
          modules/auxiliary/client/iec104/iec104.rb on lines 325..343
          modules/auxiliary/client/iec104/iec104.rb on lines 348..366
          modules/auxiliary/client/iec104/iec104.rb on lines 371..389

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 5 locations. Consider refactoring.
          Open

              sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      response_data = response_data[11..-1]
      ioa = response_data[0..3]
          Severity: Major
          Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
          modules/auxiliary/client/iec104/iec104.rb on lines 229..247
          modules/auxiliary/client/iec104/iec104.rb on lines 325..343
          modules/auxiliary/client/iec104/iec104.rb on lines 348..366
          modules/auxiliary/client/iec104/iec104.rb on lines 394..412

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 5 locations. Consider refactoring.
          Open

              sq_bit = Integer(response_data[6].unpack('C').first) & 0b10000000
    response_data = response_data[11..-1] # cut out acpi data
    if sq_bit.eql?(0b10000000)
      ioa = response_data[0..3]
      response_data = response_data[3..-1]
          Severity: Major
          Found in modules/auxiliary/client/iec104/iec104.rb and 4 other locations - About 4 hrs to fix
          modules/auxiliary/client/iec104/iec104.rb on lines 325..343
          modules/auxiliary/client/iec104/iec104.rb on lines 348..366
          modules/auxiliary/client/iec104/iec104.rb on lines 371..389
          modules/auxiliary/client/iec104/iec104.rb on lines 394..412

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 3 locations. Consider refactoring.
          Open

          <object classid='clsid:2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93' id='#{racontrol}'></object>
<script language='javascript'>
#{j_shellcode} = unescape('#{shellcode}');
#{randnop} = "#{nops}";
#{j_nops} = unescape(#{randnop});
          Severity: Major
          Found in modules/exploits/windows/browser/realplayer_console.rb and 2 other locations - About 4 hrs to fix
          modules/exploits/windows/browser/mozilla_mchannel.rb on lines 287..320
          modules/exploits/windows/fileformat/adobe_geticon.rb on lines 92..109

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 3 locations. Consider refactoring.
          Open

                  custom_js = <<-JS
        #{js_element_name} = document.getElementById("d");
        #{js_element_name}.QueryInterface(Components.interfaces.nsIChannelEventSink).onChannelRedirect(null,new Object,0)

        #{js_obj_addr_name} = unescape("\x00#{fakevtable}");
          Severity: Major
          Found in modules/exploits/windows/browser/mozilla_mchannel.rb and 2 other locations - About 4 hrs to fix
          modules/exploits/windows/browser/realplayer_console.rb on lines 85..104
          modules/exploits/windows/fileformat/adobe_geticon.rb on lines 92..109

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          Similar blocks of code found in 3 locations. Consider refactoring.
          Open

              script = %Q|
    var #{rand1} = unescape("#{shellcode}");
    var #{rand2} ="";
    for (#{rand3}=128;#{rand3}>=0;--#{rand3}) #{rand2} += unescape("#{nops}");
    #{rand4} = #{rand2} + #{rand1};
          Severity: Major
          Found in modules/exploits/windows/fileformat/adobe_geticon.rb and 2 other locations - About 4 hrs to fix
          modules/exploits/windows/browser/mozilla_mchannel.rb on lines 287..320
          modules/exploits/windows/browser/realplayer_console.rb on lines 85..104

          Duplicated Code

          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

          Tuning

          This issue has a mass of 149.

          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

          Refactorings

          Further Reading

          File sap_router_portscanner.rb has 349 lines of code (exceeds 250 allowed). Consider refactoring.
          Open

          class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Report

  VALID_HOSTNAME_REGEX = /^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$/
          Severity: Minor
          Found in modules/auxiliary/scanner/sap/sap_router_portscanner.rb - About 4 hrs to fix

            File ms15_078_atmfd_bof.rb has 349 lines of code (exceeds 250 allowed). Consider refactoring.
            Open

            class MetasploitModule < Msf::Exploit::Local
  Rank = ManualRanking

  WIN32K_VERSIONS = [
    '6.3.9600.17393',
            Severity: Minor
            Found in modules/exploits/windows/local/ms15_078_atmfd_bof.rb - About 4 hrs to fix
              Severity
              Category
              Status
              Source
              Language