{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:01.948632Z","repo":{"ref":{"host":"github.com","owner":"TideSec","name":"Mars"},"default_branch":"master","clone_url":"https://github.com/TideSec/Mars.git","html_url":"https://github.com/TideSec/Mars","description":"Mars(战神)——资产发现、子域名枚举、C段扫描、资产变更监测、端口变更监测、域名解析变更监测、Awvs扫描、POC检测、web指纹探测、端口指纹探测、CDN探测、操作系统指纹探测、泛解析探测、WAF探测、敏感信息检测等等","stars":1385,"forks":281,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":15721,"primary_language":"Ruby","license_spdx":null,"created_at":"2019-01-21T07:13:26Z","pushed_at":"2020-06-22T05:23:47Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-01-01T13:05:08Z","owner_type":"User","release_assets":[]}},"commit_sha":"c834fba4f9557e99665f033663483eb5791085a6","profile":{"lines_by_language":{"Ruby":79467,"JavaScript":25670,"Python":11169,"Shell":5},"files_by_category":{"source":1917,"binary":92,"other":52,"docs":26,"vendored":9,"config":3,"oversized":2},"source_lines":116311,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.45,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.02},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":38.5,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":50.1,"duplication":56.1,"lint":68.0,"testing":0.0,"docs":40.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 23% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing."},"security":{"score":79.6,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":96.7,"sast":77.6,"dependencies":100.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 50 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":15.0,"checked":15.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":21.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":127777.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2019-01":{"loc":0,"attributed_loc":0},"2019-02":{"loc":0,"attributed_loc":0},"2019-04":{"loc":0,"attributed_loc":0},"2019-05":{"loc":0,"attributed_loc":0},"2020-05":{"loc":127777,"attributed_loc":0},"2020-06":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":3.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":30.0,"pre_ai_era_burst_loc":0.0,"measured_loc":30.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":5.25,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":127747.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["0219985c73c65ba50a044527a5c0b3a92a71dd7a"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":101927.0,"index":0.02,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.01,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:assistant_voice","description":"assistant-style phrasing left in code: { :text=>'<h2>ionCube Loader Wizard</h2><p class=\"alert\">An updated version of this Wizard script is available <a href=\"","ref":"taskpython/libs/WhatWeb/plugins/ioncube-loader.rb:34","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/taskpython/libs/WhatWeb/plugins/ioncube-loader.rb#L34","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"instance/config.py","line":25,"fingerprint":"instance/config.py:generic-api-key:25"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":211.0,"findings_high":50.0,"findings_medium":156.0,"findings_low":5.0,"weighted_findings":84.25,"scanned_lines":116311.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/gtag.js","line":56,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/gtag.js:56"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/gtag.js","line":56,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/gtag.js:56"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/dropzone.js","line":776,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/dropzone.js:776"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/dropzone.js","line":776,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/dropzone.js:776"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/dropzone.js","line":3062,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/dropzone.js:3062"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/dropzone.js","line":3062,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/dropzone.js:3062"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `a.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `S.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/auth-tester-tasks.js","line":10,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/server/auth-tester-tasks.js:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById(\"target_info_data\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/auth-tester-tasks.js","line":10,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/server/auth-tester-tasks.js:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":78,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/server/vul-scanner.js:78"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById(\"report_download_html\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":78,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/server/vul-scanner.js:78"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":79,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/server/vul-scanner.js:79"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById(\"report_download_pdf\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":79,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/server/vul-scanner.js:79"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":124,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/server/vul-scanner.js:124"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById(\"report_download_html\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":124,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/server/vul-scanner.js:124"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":125,"fingerprint":"javascript.browser.security.insecure-document-method:mars/static/js/server/vul-scanner.js:125"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById(\"report_download_pdf\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vul-scanner.js","line":125,"fingerprint":"javascript.browser.security.insecure-innerhtml:mars/static/js/server/vul-scanner.js:125"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"mars/views/asset_management.py","line":101,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:mars/views/asset_management.py:101"},{"rule_id":"opengrep/python.flask.security.open-redirect","severity":"high","message":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's [confidence low]","path":"mars/views/asset_management.py","line":393,"fingerprint":"python.flask.security.open-redirect:mars/views/asset_management.py:393"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"mars/views/modules/auth_tester/hydra_plugin.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:mars/views/modules/auth_tester/hydra_plugin.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"mars/views/modules/auth_tester/hydra_plugin.py","line":121,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:mars/views/modules/auth_tester/hydra_plugin.py:121"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py","line":7,"fingerprint":"python.lang.security.use-defused-xml:mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:7"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":43,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:43"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":66,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:66"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":75,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:75"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":98,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:98"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":110,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:110"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":130,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:130"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":134,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:134"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"mars/views/modules/vul_scanner/awvs_api.py","line":138,"fingerprint":"python.requests.security.disabled-cert-validation:mars/views/modules/vul_scanner/awvs_api.py:138"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":12,"fingerprint":"python.lang.security.use-defused-xml:taskpython/asset_task_scan_v1.0.py:12"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":909,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:taskpython/asset_task_scan_v1.0.py:909"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":917,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:taskpython/asset_task_scan_v1.0.py:917"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":1018,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:taskpython/asset_task_scan_v1.0.py:1018"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":1205,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:taskpython/asset_task_scan_v1.0.py:1205"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":1350,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:taskpython/asset_task_scan_v1.0.py:1350"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":1518,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:taskpython/asset_task_scan_v1.0.py:1518"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":52,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:52"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":116,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:116"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":140,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:140"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":198,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:198"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":199,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:199"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":253,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:253"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":253,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:253"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":352,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:352"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":363,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:363"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":402,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:402"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":430,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:430"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":458,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:458"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":502,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:502"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":505,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:505"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":544,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:544"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":647,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:647"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":671,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:671"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":681,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:681"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":686,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/bootstrap/bootstrap-multiselect.js:686"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":686,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/bootstrap/bootstrap-multiselect.js:686"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.prepend(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":697,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/bootstrap/bootstrap-multiselect.js:697"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":736,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:736"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":746,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:746"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":749,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:749"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":752,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/bootstrap/bootstrap-multiselect.js:752"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":752,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/bootstrap/bootstrap-multiselect.js:752"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":764,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:764"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":791,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:791"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":794,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:794"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":798,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/bootstrap/bootstrap-multiselect.js:798"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":798,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/bootstrap/bootstrap-multiselect.js:798"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.prepend(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":805,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/bootstrap/bootstrap-multiselect.js:805"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":835,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:835"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":840,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:840"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":897,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:897"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":900,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:900"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":908,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:908"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":913,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:913"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":942,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:942"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":945,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:945"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":962,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/bootstrap/bootstrap-multiselect.js:962"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":1312,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/bootstrap/bootstrap-multiselect.js:1312"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":1312,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/bootstrap/bootstrap-multiselect.js:1312"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/bootstrap/bootstrap-multiselect.js","line":1402,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/bootstrap/bootstrap-multiselect.js:1402"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `b` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/gtag.js","line":61,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/gtag.js:61"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":62,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:62"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":64,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:64"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"mars/static/js/gtag.js","line":68,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:mars/static/js/gtag.js:68"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"mars/static/js/gtag.js","line":69,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:mars/static/js/gtag.js:69"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":78,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":78,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":78,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":89,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:89"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":91,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:91"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/gtag.js","line":92,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/gtag.js:92"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/gtag.js","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/gtag.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/gtag.js","line":101,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/gtag.js:101"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/gtag.js","line":155,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/gtag.js:155"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":41,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:41"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":102,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:102"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":113,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:113"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `$` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":148,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:148"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `dualListbox` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-con [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":148,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:148"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `selectIndex` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-con [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":148,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:148"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":181,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:181"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":181,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:181"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":380,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:380"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":453,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:453"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":454,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:454"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":539,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:539"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":541,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:541"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":551,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:551"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/jquery/jquery.bootstrap-duallistbox.js","line":553,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/jquery/jquery.bootstrap-duallistbox.js:553"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"mars/static/js/plugins/Chart.js","line":710,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:mars/static/js/plugins/Chart.js:710"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/plugins/Chart.js","line":1501,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/plugins/Chart.js:1501"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/plugins/Chart.js","line":4343,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/plugins/Chart.js:4343"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/plugins/Chart.js","line":4492,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/plugins/Chart.js:4492"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"mars/static/js/plugins/Chart.js","line":10473,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:mars/static/js/plugins/Chart.js:10473"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"mars/static/js/plugins/Chart.js","line":12843,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:mars/static/js/plugins/Chart.js:12843"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"mars/static/js/plugins/Chart.js","line":12844,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:mars/static/js/plugins/Chart.js:12844"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/FeedEk.js","line":20,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/FeedEk.js:20"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/FeedEk.js","line":30,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/FeedEk.js:30"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/FeedEk.js","line":63,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/plugins/FeedEk.js:63"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/FeedEk.js","line":63,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/FeedEk.js:63"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":79,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:79"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":124,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:124"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.appendTo(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":207,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/plugins/bootstrap-datetimepicker.js:207"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":708,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/bootstrap-datetimepicker.js:708"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":826,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/bootstrap-datetimepicker.js:826"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":858,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/bootstrap-datetimepicker.js:858"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":895,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/bootstrap-datetimepicker.js:895"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1004,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:1004"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1006,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:1006"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[-+]\\d+[dmwy]([\\s,]+[-+]\\d+[dmwy])*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use  [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1594,"fingerprint":"javascript.lang.security.audit.detect-redos:mars/static/js/plugins/bootstrap-datetimepicker.js:1594"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1689,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:1689"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1689,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:1689"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1697,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:1697"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/plugins/bootstrap-datetimepicker.js","line":1697,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:mars/static/js/plugins/bootstrap-datetimepicker.js:1697"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"mars/static/js/plugins/xss_filter.js","line":1018,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:mars/static/js/plugins/xss_filter.js:1018"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"mars/static/js/server/asset-management.js","line":159,"fingerprint":"javascript.browser.security.eval-detected:mars/static/js/server/asset-management.js:159"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"mars/static/js/server/asset-management.js","line":194,"fingerprint":"javascript.browser.security.eval-detected:mars/static/js/server/asset-management.js:194"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/asset-services-info.js","line":19,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/server/asset-services-info.js:19"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/server/asset-services-info.js","line":19,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/server/asset-services-info.js:19"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/asset-services-list.js","line":49,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/server/asset-services-list.js:49"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/server/asset-services-list.js","line":49,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/server/asset-services-list.js:49"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"mars/static/js/server/cus-management.js","line":90,"fingerprint":"javascript.browser.security.eval-detected:mars/static/js/server/cus-management.js:90"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/plugin-management.js","line":38,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/server/plugin-management.js:38"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/server/plugin-management.js","line":38,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/server/plugin-management.js:38"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"mars/static/js/server/plugin-management.js","line":53,"fingerprint":"javascript.browser.security.eval-detected:mars/static/js/server/plugin-management.js:53"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/port-scanner.js","line":88,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/server/port-scanner.js:88"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/server/port-scanner.js","line":88,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/server/port-scanner.js:88"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"mars/static/js/server/task-management.js","line":78,"fingerprint":"javascript.browser.security.eval-detected:mars/static/js/server/task-management.js:78"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/update.js","line":14,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/server/update.js:14"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/server/update.js","line":14,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/server/update.js:14"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"mars/static/js/server/vulnerability.js","line":17,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:mars/static/js/server/vulnerability.js:17"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"mars/static/js/server/vulnerability.js","line":17,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:mars/static/js/server/vulnerability.js:17"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"mars/templates/base.html","line":27,"fingerprint":"python.django.security.django-no-csrf-token:mars/templates/base.html:27"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"mars/templates/login.html","line":24,"fingerprint":"python.django.security.django-no-csrf-token:mars/templates/login.html:24"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"mars/views/modules/scanner/poc_scanner.py","line":32,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:mars/views/modules/scanner/poc_scanner.py:32"},{"rule_id":"opengrep/python.flask.security.audit.xss.make-response-with-unknown-content","severity":"medium","message":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which  [confidence low]","path":"mars/views/subdomain_brute.py","line":46,"fingerprint":"python.flask.security.audit.xss.make-response-with-unknown-content:mars/views/subdomain_brute.py:46"},{"rule_id":"opengrep/python.lang.security.audit.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":667,"fingerprint":"python.lang.security.audit.eval-detected:taskpython/asset_task_scan_v1.0.py:667"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"taskpython/asset_task_scan_v1.0.py","line":746,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:taskpython/asset_task_scan_v1.0.py:746"},{"rule_id":"opengrep/python.lang.security.audit.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"taskpython/asset_task_scan_v1.0.py","line":1022,"fingerprint":"python.lang.security.audit.eval-detected:taskpython/asset_task_scan_v1.0.py:1022"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"taskpython/libs/Sublist3r/sublist3r.py","line":549,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:taskpython/libs/Sublist3r/sublist3r.py:549"},{"rule_id":"opengrep/ruby.lang.security.ssl-mode-no-verify","severity":"medium","message":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]","path":"taskpython/libs/WhatWeb/lib/extend-http_ruby1.9.rb","line":121,"fingerprint":"ruby.lang.security.ssl-mode-no-verify:taskpython/libs/WhatWeb/lib/extend-http_ruby1.9.rb:121"},{"rule_id":"opengrep/ruby.lang.security.ssl-mode-no-verify","severity":"medium","message":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]","path":"taskpython/libs/WhatWeb/lib/extend-http_ruby2.rb","line":132,"fingerprint":"ruby.lang.security.ssl-mode-no-verify:taskpython/libs/WhatWeb/lib/extend-http_ruby2.rb:132"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/lib/target.rb","line":93,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/lib/target.rb:93"},{"rule_id":"opengrep/ruby.lang.security.ssl-mode-no-verify","severity":"medium","message":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]","path":"taskpython/libs/WhatWeb/lib/target.rb","line":154,"fingerprint":"ruby.lang.security.ssl-mode-no-verify:taskpython/libs/WhatWeb/lib/target.rb:154"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/lib/version_class.rb","line":20,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/lib/version_class.rb:20"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins-disabled/footer-hash.rb","line":24,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins-disabled/footer-hash.rb:24"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins-disabled/header-hash.rb","line":21,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins-disabled/header-hash.rb:21"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins-disabled/tagpattern-hash.rb","line":28,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins-disabled/tagpattern-hash.rb:28"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/contao.rb","line":71,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/contao.rb:71"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/fluxbb.rb","line":95,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/fluxbb.rb:95"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/phpmyadmin.rb","line":198,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/phpmyadmin.rb:198"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/punbb.rb","line":83,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/punbb.rb:83"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/serendipity.rb","line":114,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/serendipity.rb:114"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/smf.rb","line":82,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/smf.rb:82"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"taskpython/libs/WhatWeb/plugins/typo3.rb","line":58,"fingerprint":"ruby.lang.security.weak-hashes-md5:taskpython/libs/WhatWeb/plugins/typo3.rb:58"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"taskpython/asset_task_scan_v1.0.py","line":641,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:taskpython/asset_task_scan_v1.0.py:641"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"taskpython/asset_task_scan_v1.0.py","line":666,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:taskpython/asset_task_scan_v1.0.py:666"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"taskpython/asset_task_scan_v1.0.py","line":677,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:taskpython/asset_task_scan_v1.0.py:677"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"taskpython/asset_task_scan_v1.0.py","line":694,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:taskpython/asset_task_scan_v1.0.py:694"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"taskpython/asset_task_scan_v1.0.py","line":1441,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:taskpython/asset_task_scan_v1.0.py:1441"}],"evidence":[],"data":{"rulesets":["ruby","javascript","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0476,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":3248.0,"function_nloc":36248.0,"mean_ccn":3.33,"p90_ccn":7.0,"complex_functions":75.0,"long_functions":22.0,"many_param_functions":6.0,"risky_nloc_share":0.2307},"findings":[],"evidence":[{"kind":"complex-function","description":"Datetimepicker in mars/static/js/plugins/bootstrap-datetimepicker.js: complexity 93, 178 lines","ref":"mars/static/js/plugins/bootstrap-datetimepicker.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/bootstrap-datetimepicker.js#L76","weight":1.0},{"kind":"complex-function","description":"get_whatweb in taskpython/asset_task_scan_v1.0.py: complexity 61, 141 lines","ref":"taskpython/asset_task_scan_v1.0.py","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/taskpython/asset_task_scan_v1.0.py#L1009","weight":1.0},{"kind":"complex-function","description":"out in taskpython/libs/WhatWeb/lib/output.rb: complexity 59, 148 lines","ref":"taskpython/libs/WhatWeb/lib/output.rb","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/taskpython/libs/WhatWeb/lib/output.rb#L85","weight":0.9833333333333333},{"kind":"complex-function","description":"fill in mars/static/js/plugins/bootstrap-datetimepicker.js: complexity 58, 179 lines","ref":"mars/static/js/plugins/bootstrap-datetimepicker.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/bootstrap-datetimepicker.js#L711","weight":0.9666666666666667},{"kind":"complex-function","description":"click in mars/static/js/plugins/bootstrap-datetimepicker.js: complexity 54, 187 lines","ref":"mars/static/js/plugins/bootstrap-datetimepicker.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/bootstrap-datetimepicker.js#L1001","weight":0.9},{"kind":"complex-function","description":"de in mars/static/js/gtag.js: complexity 47, 3 lines","ref":"mars/static/js/gtag.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/gtag.js#L85","weight":0.7833333333333333},{"kind":"complex-function","description":"keydown in mars/static/js/plugins/bootstrap-datetimepicker.js: complexity 39, 124 lines","ref":"mars/static/js/plugins/bootstrap-datetimepicker.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/bootstrap-datetimepicker.js#L1295","weight":0.65},{"kind":"complex-function","description":"out in taskpython/libs/WhatWeb/lib/output.rb: complexity 39, 55 lines","ref":"taskpython/libs/WhatWeb/lib/output.rb","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/taskpython/libs/WhatWeb/lib/output.rb#L395","weight":0.65},{"kind":"complex-function","description":"passive in taskpython/libs/WhatWeb/plugins/http-server.rb: complexity 34, 44 lines","ref":"taskpython/libs/WhatWeb/plugins/http-server.rb","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/taskpython/libs/WhatWeb/plugins/http-server.rb#L22","weight":0.5666666666666667},{"kind":"complex-function","description":"_scan in taskpython/libs/subDomainsBrute/subDomainsBrute.py: complexity 32, 90 lines","ref":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/taskpython/libs/subDomainsBrute/subDomainsBrute.py#L114","weight":0.5333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":75299.0,"duplicated_lines":7257.0,"duplicated_share":0.0964,"files":1917.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: instance/__init__.py:1 and mars/views/__init__.py:1","ref":"instance/__init__.py","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/instance/__init__.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/bootstrap/bootstrap-multiselect.js:167 and mars/static/js/bootstrap/bootstrap-multiselect.js:1171","ref":"mars/static/js/bootstrap/bootstrap-multiselect.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/bootstrap/bootstrap-multiselect.js#L167","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/plugins/Chart.js:790 and mars/static/js/plugins/Chart.js:830","ref":"mars/static/js/plugins/Chart.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/Chart.js#L790","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/plugins/bootstrap-datetimepicker.js:1134 and mars/static/js/plugins/bootstrap-datetimepicker.js:1384","ref":"mars/static/js/plugins/bootstrap-datetimepicker.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/bootstrap-datetimepicker.js#L1134","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/plugins/dropzone.js:3299 and mars/static/js/plugins/dropzone.js:3404","ref":"mars/static/js/plugins/dropzone.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/dropzone.js#L3299","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/plugins/xss_filter.js:703 and mars/static/js/plugins/xss_filter.js:1574","ref":"mars/static/js/plugins/xss_filter.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/plugins/xss_filter.js#L703","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/server/asset-management.js:32 and mars/static/js/server/asset-management.js:66","ref":"mars/static/js/server/asset-management.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/server/asset-management.js#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/server/asset-management.js:49 and mars/static/js/server/asset-services-list.js:5","ref":"mars/static/js/server/asset-management.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/server/asset-management.js#L49","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/server/asset-management.js:82 and mars/static/js/server/search.js:23","ref":"mars/static/js/server/asset-management.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/server/asset-management.js#L82","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: mars/static/js/server/asset-management.js:92 and mars/static/js/server/new-auth-tester.js:14","ref":"mars/static/js/server/asset-management.js","url":"https://github.com/TideSec/Mars/blob/c834fba4f9557e99665f033663483eb5791085a6/mars/static/js/server/asset-management.js#L92","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":124.0,"weighted_findings":179.25,"scanned_lines":116311.0,"category:best-practice":96.0,"category:correctness":27.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/asset_management.py","line":98,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/asset_management.py:98"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py","line":35,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:35"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py","line":41,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:41"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py","line":65,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:65"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py","line":71,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:71"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py","line":17,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py:17"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py","line":27,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py:27"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py","line":35,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py:35"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py","line":16,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py:16"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py","line":27,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py:27"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py","line":36,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py:36"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py","line":35,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:35"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py","line":41,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:41"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py","line":65,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:65"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py","line":71,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:71"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py","line":25,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:25"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_wordpress_core_4_6_rce.py","line":86,"fingerprint":"python.lang.best-practice.arbitrary-sleep:mars/views/modules/scanner/pocsuite_plugin/_190528_wordpress_core_4_6_rce.py:86"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/asset_task_scan_v1.0.py","line":222,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/asset_task_scan_v1.0.py:222"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/asset_task_scan_v1.0.py","line":469,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/asset_task_scan_v1.0.py:469"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/asset_task_scan_v1.0.py","line":935,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/asset_task_scan_v1.0.py:935"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/asset_task_scan_v1.0.py","line":948,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/asset_task_scan_v1.0.py:948"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/asset_task_scan_v1.0.py","line":1528,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/asset_task_scan_v1.0.py:1528"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/asset_task_scan_v1.0.py","line":1539,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/asset_task_scan_v1.0.py:1539"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/asset_task_scan_v1.0.py","line":1673,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/asset_task_scan_v1.0.py:1673"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/asset_task_scan_v1.0.py","line":2036,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/asset_task_scan_v1.0.py:2036"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/asset_task_scan_v1.0.py","line":2089,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/asset_task_scan_v1.0.py:2089"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/check_cdn.py","line":64,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/check_cdn.py:64"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/check_cdn.py","line":90,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/check_cdn.py:90"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/libs/Sublist3r/subbrute/subbrute.py","line":603,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/libs/Sublist3r/subbrute/subbrute.py:603"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/libs/Sublist3r/subbrute/subbrute.py","line":610,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/libs/Sublist3r/subbrute/subbrute.py:610"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/libs/Sublist3r/sublist3r.py","line":306,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/libs/Sublist3r/sublist3r.py:306"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":56,"fingerprint":"python.lang.best-practice.open-never-closed:taskpython/libs/subDomainsBrute/subDomainsBrute.py:56"},{"rule_id":"opengrep/python.lang.correctness.list-modify-while-iterate","severity":"high","message":"It appears that `all_process` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop.","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":267,"fingerprint":"python.lang.correctness.list-modify-while-iterate:taskpython/libs/subDomainsBrute/subDomainsBrute.py:267"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":276,"fingerprint":"python.lang.best-practice.arbitrary-sleep:taskpython/libs/subDomainsBrute/subDomainsBrute.py:276"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"mars/static/js/plugins/Chart.js","line":874,"fingerprint":"javascript.lang.correctness.no-stringify-keys:mars/static/js/plugins/Chart.js:874"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"mars/static/js/plugins/Chart.js","line":1419,"fingerprint":"javascript.lang.correctness.no-stringify-keys:mars/static/js/plugins/Chart.js:1419"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"mars/static/js/server/checkbox.js","line":29,"fingerprint":"javascript.lang.best-practice.javascript-alert:mars/static/js/server/checkbox.js:29"},{"rule_id":"opengrep/python.lang.best-practice.pass-body-fn","severity":"medium","message":"`pass` is the body of function asset_server. Consider removing this or raise NotImplementedError() if this is a TODO","path":"mars/views/dashboard.py","line":155,"fingerprint":"python.lang.best-practice.pass-body-fn:mars/views/dashboard.py:155"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"mars/views/lib/get_title.py","line":19,"fingerprint":"python.requests.best-practice.use-raise-for-status:mars/views/lib/get_title.py:19"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"mars/views/lib/get_title.py","line":19,"fingerprint":"python.requests.best-practice.use-timeout:mars/views/lib/get_title.py:19"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"mars/views/modules/auth_tester/hydra_plugin.py","line":48,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:mars/views/modules/auth_tester/hydra_plugin.py:48"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"mars/views/modules/auth_tester/hydra_plugin.py","line":54,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:mars/views/modules/auth_tester/hydra_plugin.py:54"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"mars/views/modules/auth_tester/hydra_plugin.py","line":60,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:mars/views/modules/auth_tester/hydra_plugin.py:60"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"mars/views/modules/scanner/parse_plugin.py","line":25,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:mars/views/modules/scanner/parse_plugin.py:25"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"mars/views/modules/scanner/poc_scanner.py","line":57,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:mars/views/modules/scanner/poc_scanner.py:57"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py","line":22,"fingerprint":"python.lang.correctness.use-sys-exit:mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:22"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py","line":35,"fingerprint":"python.lang.correctness.use-sys-exit:mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:35"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py","line":40,"fingerprint":"python.lang.correctness.use-sys-exit:mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:40"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py","line":76,"fingerprint":"python.lang.correctness.use-sys-exit:mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:76"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"mars/views/modules/scanner/pocsuite_plugin/_190528_thinkphp5__5_0_5_1_execute.py","line":55,"fingerprint":"python.requests.best-practice.use-raise-for-status:mars/views/modules/scanner/pocsuite_plugin/_190528_thinkphp5__5_0_5_1_execute.py:55"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"mars/views/modules/vul_scanner/awvs_api.py","line":43,"fingerprint":"python.requests.best-practice.use-raise-for-status:mars/views/modules/vul_scanner/awvs_api.py:43"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"mars/views/modules/vul_scanner/awvs_api.py","line":66,"fingerprint":"python.requests.best-practice.use-raise-for-status:mars/views/modules/vul_scanner/awvs_api.py:66"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"mars/views/modules/vul_scanner/awvs_api.py","line":75,"fingerprint":"python.requests.best-practice.use-raise-for-status:mars/views/modules/vul_scanner/awvs_api.py:75"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"mars/views/subdomain_brute.py","line":44,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:mars/views/subdomain_brute.py:44"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"taskpython/asset_task_scan_v1.0.py","line":48,"fingerprint":"python.lang.correctness.use-sys-exit:taskpython/asset_task_scan_v1.0.py:48"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":191,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:191"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":223,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:223"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":319,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:319"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":497,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:497"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":641,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:641"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":666,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:666"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":677,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:677"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":694,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:694"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":807,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:807"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":818,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:818"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":852,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:852"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":865,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:865"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":899,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:899"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":926,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:926"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":935,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:935"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":948,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:948"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":961,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:961"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":997,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:997"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1021,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1021"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1208,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1208"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":1441,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:1441"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1536,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1536"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1537,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1537"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1538,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1538"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1539,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1539"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1543,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1543"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1557,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1557"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1673,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1673"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1684,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1684"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1685,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1685"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":1688,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:1688"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":1852,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:1852"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/asset_task_scan_v1.0.py","line":1858,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/asset_task_scan_v1.0.py:1858"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/asset_task_scan_v1.0.py","line":2036,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/asset_task_scan_v1.0.py:2036"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"taskpython/check_cdn.py","line":138,"fingerprint":"python.requests.best-practice.use-raise-for-status:taskpython/check_cdn.py:138"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/check_cdn.py","line":252,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/check_cdn.py:252"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/Sublist3r/subbrute/subbrute.py","line":379,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/Sublist3r/subbrute/subbrute.py:379"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/Sublist3r/subbrute/subbrute.py","line":534,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/Sublist3r/subbrute/subbrute.py:534"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/Sublist3r/subbrute/subbrute.py","line":603,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/Sublist3r/subbrute/subbrute.py:603"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/Sublist3r/subbrute/subbrute.py","line":610,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/Sublist3r/subbrute/subbrute.py:610"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/Sublist3r/sublist3r.py","line":107,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/Sublist3r/sublist3r.py:107"},{"rule_id":"opengrep/python.lang.maintainability.code-after-unconditional-return","severity":"medium","message":"code after return statement will not be executed","path":"taskpython/libs/Sublist3r/sublist3r.py","line":568,"fingerprint":"python.lang.maintainability.code-after-unconditional-return:taskpython/libs/Sublist3r/sublist3r.py:568"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/lib/common.py","line":45,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/lib/common.py:45"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/lib/common.py","line":59,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/lib/common.py:59"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/lib/common.py","line":77,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/lib/common.py:77"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"taskpython/libs/subDomainsBrute/lib/common.py","line":111,"fingerprint":"python.lang.correctness.use-sys-exit:taskpython/libs/subDomainsBrute/lib/common.py:111"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":56,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/subDomainsBrute.py:56"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":68,"fingerprint":"python.lang.correctness.use-sys-exit:taskpython/libs/subDomainsBrute/subDomainsBrute.py:68"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":75,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/subDomainsBrute.py:75"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":218,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/subDomainsBrute.py:218"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":288,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/subDomainsBrute.py:288"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"taskpython/libs/subDomainsBrute/subDomainsBrute.py","line":290,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:taskpython/libs/subDomainsBrute/subDomainsBrute.py:290"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":57,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:57"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":72,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:72"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":74,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:74"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":74,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:74"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":74,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:74"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":74,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:74"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":74,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:74"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`h` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":82,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:82"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`k` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":82,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:82"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`w` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":86,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:86"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":92,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:92"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`Tf` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":107,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:107"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`e` is assigned twice; the first assignment is useless","path":"mars/static/js/gtag.js","line":109,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/gtag.js:109"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`files` is assigned twice; the first assignment is useless","path":"mars/static/js/plugins/dropzone.js","line":2189,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/plugins/dropzone.js:2189"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`o` is assigned twice; the first assignment is useless","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`M` is assigned twice; the first assignment is useless","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/plugins/laydate/laydate.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"mars/static/js/plugins/laydate/laydate.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:mars/static/js/plugins/laydate/laydate.js:2"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":116311.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":5.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":156.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}