Sign upLogin

roshiro/openws_one

View on GitHub
Star

Showing 90 of 90 total issues

HTTP Response Splitting (Early Hints) in Puma
Open

    puma (3.6.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-5249

Criticality: Medium

URL: https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58

Solution: upgrade to ~> 3.12.4, >= 4.3.3

Possible XSS Vulnerability in Action View
Open

    actionview (4.1.4)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2016-6316

Criticality: Medium

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk

Solution: upgrade to ~> 4.2.7.1, ~> 4.2.8, >= 5.0.0.1

HTTP Response Splitting vulnerability in puma
Open

    puma (3.6.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-5247

Criticality: Medium

URL: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v

Solution: upgrade to ~> 3.12.4, >= 4.3.3

Denial of Service Vulnerability in Action View
Open

    actionview (4.1.4)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-5419

Criticality: High

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI

Solution: upgrade to >= 6.0.0.beta3, >= 5.2.2.1, ~> 5.2.2, >= 5.1.6.2, ~> 5.1.6, >= 5.0.7.2, ~> 5.0.7, >= 4.2.11.1, ~> 4.2.11

Devise Gem for Ruby confirmation token validation with a blank string
Open

    devise (4.2.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-16109

Criticality: Medium

URL: https://github.com/plataformatec/devise/issues/5071

Solution: upgrade to >= 4.7.1

Function render has 43 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  render() {
    let msg = null;
    if(this.props.collections.length == 0) {
      msg = <span className='muted'>You don't have any collections for this application yet.</span>
    }
Severity: Minor
Found in ui/src/components/CollectionList.js - About 1 hr to fix

    Function render has 33 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      render() {
    return (
      <div className="application-list">
        <div className='page-actions'>
          <Button as={Link} primary to='/new_application'>
    Severity: Minor
    Found in ui/src/components/ApplicationList.js - About 1 hr to fix

      Similar blocks of code found in 3 locations. Consider refactoring.
      Open

                  <Link to='/documentation' onClick={ this.clickHandler.bind(this, 'documentation') } className={`item ${this.documentationState()}`}>
              Documentation
            </Link>
      Severity: Major
      Found in ui/src/App.js and 2 other locations - About 1 hr to fix
      ui/src/App.js on lines 68..70
      ui/src/App.js on lines 74..76

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 60.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 3 locations. Consider refactoring.
      Open

                  <Link to='/dashboard' onClick={ this.clickHandler.bind(this, 'dashboard') } className={`item ${this.dashboardState()}`}>
              Dashboard
            </Link>
      Severity: Major
      Found in ui/src/App.js and 2 other locations - About 1 hr to fix
      ui/src/App.js on lines 71..73
      ui/src/App.js on lines 74..76

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 60.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Similar blocks of code found in 3 locations. Consider refactoring.
      Open

                  <Link to='/account' onClick={ this.clickHandler.bind(this, 'account') } className={`item ${this.accountState()}`}>
              Account
            </Link>
      Severity: Major
      Found in ui/src/App.js and 2 other locations - About 1 hr to fix
      ui/src/App.js on lines 68..70
      ui/src/App.js on lines 71..73

      Duplicated Code

      Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

      Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

      When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

      Tuning

      This issue has a mass of 60.

      We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

      The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

      If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

      See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

      Refactorings

      Further Reading

      Possible remote code execution vulnerability in Action Pack
      Open

          actionpack (4.1.4)
      Severity: Critical
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2016-2098

      Criticality: High

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q

      Solution: upgrade to ~> 3.2.22.2, >= 4.2.5.2, ~> 4.2.5, >= 4.1.14.2, ~> 4.1.14

      Possible Object Leak and Denial of Service attack in Action Pack
      Open

          actionpack (4.1.4)
      Severity: Critical
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2016-0751

      Criticality: High

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc

      Solution: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1

      Potential Denial of Service Vulnerability in Rack
      Open

          rack (1.5.2)
      Severity: Minor
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2015-3225

      URL: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc

      Solution: upgrade to >= 1.6.2, ~> 1.5.4, ~> 1.4.6

      Possible Denial of Service attack in Active Support
      Open

          activesupport (4.1.4)
      Severity: Minor
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2015-3227

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk

      Solution: upgrade to >= 4.2.2, ~> 4.1.11, ~> 3.2.22

      TZInfo relative path traversal vulnerability allows loading of arbitrary files
      Open

          tzinfo (1.2.2)
      Severity: Critical
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2022-31163

      Criticality: High

      URL: https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx

      Solution: upgrade to ~> 0.3.61, >= 1.2.10

      Possible Input Validation Circumvention in Active Model
      Open

          activemodel (4.1.4)
      Severity: Minor
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2016-0753

      Criticality: Medium

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ

      Solution: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14

      Timing attack vulnerability in basic authentication in Action Controller.
      Open

          actionpack (4.1.4)
      Severity: Info
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2015-7576

      Criticality: Low

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k

      Solution: upgrade to >= 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1

      Arbitrary file existence disclosure in Action Pack
      Open

          actionpack (4.1.4)
      Severity: Minor
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2014-7818

      Criticality: Medium

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo

      Solution: upgrade to ~> 3.2.20, ~> 4.0.11, ~> 4.1.7, >= 4.2.0.beta3

      CVE-2015-9097 rubygem-mail: SMTP injection via recipient email addresses
      Open

          mail (2.5.4)
      Severity: Minor
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2015-9097

      Criticality: Medium

      URL: https://hackerone.com/reports/137631

      Solution: upgrade to >= 2.5.5

      Arbitrary file existence disclosure in Action Pack
      Open

          actionpack (4.1.4)
      Severity: Minor
      Found in Gemfile.lock by bundler-audit

      Advisory: CVE-2014-7829

      Criticality: Medium

      URL: https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk

      Solution: upgrade to ~> 3.2.21, ~> 4.0.11.1, ~> 4.0.12, ~> 4.1.7.1, >= 4.1.8

      Severity
      Category
      Status
      Source
      Language