{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:21:03.240909Z","repo":{"ref":{"host":"github.com","owner":"Urinx","name":"WeixinBot"},"default_branch":"master","clone_url":"https://github.com/Urinx/WeixinBot.git","html_url":"https://github.com/Urinx/WeixinBot","description":"网页版微信API，包含终端版微信及微信机器人","stars":7421,"forks":1955,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1175,"primary_language":"Python","license_spdx":"Apache-2.0","created_at":"2016-01-31T07:53:08Z","pushed_at":"2019-11-27T08:44:08Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-09-02T13:30:08Z","owner_type":"User","release_assets":[]}},"commit_sha":"d9edcd2c9203fe7dd203b22b71bbc48a31e9492b","profile":{"lines_by_language":{"Python":4608},"files_by_category":{"source":17,"binary":7,"docs":6,"other":4,"config":1},"source_lines":4608,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":35.4,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":64.6,"duplication":59.0,"lint":10.8,"testing":0.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 15% of function code in complex or long functions; 9% duplicated lines. Weakest area: testing."},"security":{"score":50.6,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":61.7,"sast":12.5,"dependencies":100.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 25 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":13.0,"checked":13.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":101.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":6095.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2016-01":{"loc":460,"attributed_loc":0},"2016-02":{"loc":559,"attributed_loc":0},"2016-03":{"loc":114,"attributed_loc":0},"2016-04":{"loc":1046,"attributed_loc":0},"2016-05":{"loc":38,"attributed_loc":0},"2016-06":{"loc":0,"attributed_loc":0},"2016-10":{"loc":163,"attributed_loc":0},"2016-11":{"loc":14,"attributed_loc":0},"2017-02":{"loc":205,"attributed_loc":0},"2017-03":{"loc":1,"attributed_loc":0},"2017-04":{"loc":3408,"attributed_loc":0},"2017-05":{"loc":70,"attributed_loc":0},"2017-06":{"loc":0,"attributed_loc":0},"2017-07":{"loc":17,"attributed_loc":0},"2017-08":{"loc":0,"attributed_loc":0},"2017-11":{"loc":0,"attributed_loc":0},"2019-06":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":50.0,"flagged_units":0.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":6095.0,"pre_ai_era_burst_loc":3330.0,"measured_loc":6095.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":832.5,"median_loc_per_hour":188.25,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":4608.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":1.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"wxbot_project_py2.7/config/constant.py","line":169,"fingerprint":"wxbot_project_py2.7/config/constant.py:generic-api-key:169"},{"rule_id":"gitleaks/sendgrid-api-token","severity":"high","message":"Possible sendgrid-api-token secret in the current tree","path":"wxbot_project_py2.7/config/wechat.conf.bak","line":39,"fingerprint":"wxbot_project_py2.7/config/wechat.conf.bak:sendgrid-api-token:39"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"README.md","line":664,"fingerprint":"README.md:generic-api-key:664"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":49.0,"findings_high":25.0,"findings_medium":22.0,"findings_low":2.0,"weighted_findings":27.35,"scanned_lines":4608.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":9,"fingerprint":"python.lang.security.use-defused-xml:wxbot_demo_py3/weixin.py:9"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-spawn-process-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":189,"fingerprint":"python.lang.security.audit.dangerous-spawn-process-audit:wxbot_demo_py3/weixin.py:189"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":1051,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:wxbot_demo_py3/weixin.py:1051"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":1053,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:wxbot_demo_py3/weixin.py:1053"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":79,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:79"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":90,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:90"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":101,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:101"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":113,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:113"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":124,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:124"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":138,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:138"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":147,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:147"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":190,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/mysql_db.py:190"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":56,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:56"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":65,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:65"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":75,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:75"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":111,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:111"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":115,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:115"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":130,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:130"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":139,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:139"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":182,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:wxbot_project_py2.7/db/sqlite_db.py:182"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"wxbot_project_py2.7/docker/Dockerfile","line":17,"fingerprint":"dockerfile.security.missing-user-entrypoint:wxbot_project_py2.7/docker/Dockerfile:17"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"wxbot_project_py2.7/docker/Dockerfile","line":18,"fingerprint":"dockerfile.security.missing-user:wxbot_project_py2.7/docker/Dockerfile:18"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"wxbot_project_py2.7/wechat/wechat_apis.py","line":15,"fingerprint":"python.lang.security.use-defused-xml:wxbot_project_py2.7/wechat/wechat_apis.py:15"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-spawn-process-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"wxbot_project_py2.7/wechat/wechat_apis.py","line":206,"fingerprint":"python.lang.security.audit.dangerous-spawn-process-audit:wxbot_project_py2.7/wechat/wechat_apis.py:206"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"wxbot_project_py2.7/weixin_bot.py","line":281,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:wxbot_project_py2.7/weixin_bot.py:281"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":1106,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:wxbot_demo_py3/weixin.py:1106"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":1106,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:wxbot_demo_py3/weixin.py:1106"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"wxbot_demo_py3/weixin.py","line":1140,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:wxbot_demo_py3/weixin.py:1140"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":79,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:79"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":90,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:90"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":101,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:101"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":113,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:113"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":138,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:138"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":147,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:147"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/mysql_db.py","line":190,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/mysql_db.py:190"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":56,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/sqlite_db.py:56"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":65,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/sqlite_db.py:65"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":115,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/sqlite_db.py:115"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"wxbot_project_py2.7/db/sqlite_db.py","line":139,"fingerprint":"python.lang.security.audit.formatted-sql-query:wxbot_project_py2.7/db/sqlite_db.py:139"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"wxbot_project_py2.7/flask_templates/upload.html","line":4,"fingerprint":"python.django.security.django-no-csrf-token:wxbot_project_py2.7/flask_templates/upload.html:4"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"wxbot_project_py2.7/wechat/utils.py","line":194,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:wxbot_project_py2.7/wechat/utils.py:194"},{"rule_id":"opengrep/python.lang.security.deserialization.avoid-cPickle","severity":"medium","message":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low]","path":"wxbot_project_py2.7/wechat/utils.py","line":250,"fingerprint":"python.lang.security.deserialization.avoid-cPickle:wxbot_project_py2.7/wechat/utils.py:250"},{"rule_id":"opengrep/python.lang.security.deserialization.avoid-pickle","severity":"medium","message":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low]","path":"wxbot_project_py2.7/wechat/utils.py","line":250,"fingerprint":"python.lang.security.deserialization.avoid-pickle:wxbot_project_py2.7/wechat/utils.py:250"},{"rule_id":"opengrep/python.lang.security.deserialization.avoid-cPickle","severity":"medium","message":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low]","path":"wxbot_project_py2.7/wechat/utils.py","line":261,"fingerprint":"python.lang.security.deserialization.avoid-cPickle:wxbot_project_py2.7/wechat/utils.py:261"},{"rule_id":"opengrep/python.lang.security.deserialization.avoid-pickle","severity":"medium","message":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low]","path":"wxbot_project_py2.7/wechat/utils.py","line":261,"fingerprint":"python.lang.security.deserialization.avoid-pickle:wxbot_project_py2.7/wechat/utils.py:261"},{"rule_id":"opengrep/python.lang.security.audit.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"wxbot_project_py2.7/wechat/wechat_apis.py","line":748,"fingerprint":"python.lang.security.audit.eval-detected:wxbot_project_py2.7/wechat/wechat_apis.py:748"},{"rule_id":"opengrep/python.lang.security.audit.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"wxbot_project_py2.7/weixin_bot.py","line":272,"fingerprint":"python.lang.security.audit.eval-detected:wxbot_project_py2.7/weixin_bot.py:272"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"wxbot_demo_py3/weixin.py","line":1160,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:wxbot_demo_py3/weixin.py:1160"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"wxbot_demo_py3/weixin.py","line":1169,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:wxbot_demo_py3/weixin.py:1169"}],"evidence":[],"data":{"rulesets":["python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":206.0,"function_nloc":2973.0,"mean_ccn":3.2,"p90_ccn":7.0,"complex_functions":4.0,"long_functions":2.0,"many_param_functions":0.0,"risky_nloc_share":0.1456},"findings":[],"evidence":[{"kind":"complex-function","description":"handle_msg in wxbot_project_py2.7/wechat/wechat.py: complexity 23, 150 lines","ref":"wxbot_project_py2.7/wechat/wechat.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/wechat/wechat.py#L397","weight":0.38333333333333336},{"kind":"complex-function","description":"start in wxbot_project_py2.7/wechat/wechat.py: complexity 22, 78 lines","ref":"wxbot_project_py2.7/wechat/wechat.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/wechat/wechat.py#L59","weight":0.36666666666666664},{"kind":"complex-function","description":"getUserRemarkName in wxbot_demo_py3/weixin.py: complexity 18, 26 lines","ref":"wxbot_demo_py3/weixin.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_demo_py3/weixin.py#L661","weight":0.3},{"kind":"complex-function","description":"start in wxbot_demo_py3/weixin.py: complexity 16, 74 lines","ref":"wxbot_demo_py3/weixin.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_demo_py3/weixin.py#L969","weight":0.26666666666666666},{"kind":"complex-function","description":"conf_factory in wxbot_project_py2.7/wechat/wechat_apis.py: complexity 6, 105 lines","ref":"wxbot_project_py2.7/wechat/wechat_apis.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/wechat/wechat_apis.py#L62","weight":0.1}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3690.0,"duplicated_lines":324.0,"duplicated_share":0.0878,"files":17.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_demo_py3/weixin.py:156 and wxbot_project_py2.7/wechat/wechat_apis.py:183","ref":"wxbot_demo_py3/weixin.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_demo_py3/weixin.py#L156","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_demo_py3/weixin.py:547 and wxbot_demo_py3/weixin.py:569","ref":"wxbot_demo_py3/weixin.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_demo_py3/weixin.py#L547","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_demo_py3/weixin.py:1177 and wxbot_project_py2.7/wechat/utils.py:274","ref":"wxbot_demo_py3/weixin.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_demo_py3/weixin.py#L1177","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_project_py2.7/config/log.py:1 and wxbot_project_py2.7/weixin_bot.py:1","ref":"wxbot_project_py2.7/config/log.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/config/log.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_project_py2.7/db/mysql_db.py:126 and wxbot_project_py2.7/db/sqlite_db.py:98","ref":"wxbot_project_py2.7/db/mysql_db.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/db/mysql_db.py#L126","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_project_py2.7/wechat/utils.py:125 and wxbot_project_py2.7/wechat/utils.py:159","ref":"wxbot_project_py2.7/wechat/utils.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/wechat/utils.py#L125","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_project_py2.7/wechat/wechat.py:604 and wxbot_project_py2.7/wechat/wechat.py:659","ref":"wxbot_project_py2.7/wechat/wechat.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/wechat/wechat.py#L604","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: wxbot_project_py2.7/wechat/wechat_apis.py:608 and wxbot_project_py2.7/wechat/wechat_apis.py:634","ref":"wxbot_project_py2.7/wechat/wechat_apis.py","url":"https://github.com/Urinx/WeixinBot/blob/d9edcd2c9203fe7dd203b22b71bbc48a31e9492b/wxbot_project_py2.7/wechat/wechat_apis.py#L608","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":29.0,"weighted_findings":41.0,"scanned_lines":4608.0,"category:best-practice":27.0,"category:correctness":1.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"wxbot_demo_py3/weixin.py","line":912,"fingerprint":"python.lang.best-practice.arbitrary-sleep:wxbot_demo_py3/weixin.py:912"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"wxbot_demo_py3/weixin.py","line":928,"fingerprint":"python.lang.best-practice.arbitrary-sleep:wxbot_demo_py3/weixin.py:928"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"wxbot_demo_py3/weixin.py","line":950,"fingerprint":"python.lang.best-practice.arbitrary-sleep:wxbot_demo_py3/weixin.py:950"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"wxbot_project_py2.7/wechat/utils.py","line":131,"fingerprint":"python.lang.best-practice.arbitrary-sleep:wxbot_project_py2.7/wechat/utils.py:131"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"wxbot_project_py2.7/wechat/utils.py","line":165,"fingerprint":"python.lang.best-practice.arbitrary-sleep:wxbot_project_py2.7/wechat/utils.py:165"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"wxbot_project_py2.7/weixin_bot.py","line":209,"fingerprint":"python.lang.best-practice.arbitrary-sleep:wxbot_project_py2.7/weixin_bot.py:209"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"wxbot_demo_py3/weixin.py","line":191,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:wxbot_demo_py3/weixin.py:191"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_demo_py3/weixin.py","line":460,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_demo_py3/weixin.py:460"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_demo_py3/weixin.py","line":460,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_demo_py3/weixin.py:460"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_demo_py3/weixin.py","line":533,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_demo_py3/weixin.py:533"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_demo_py3/weixin.py","line":533,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_demo_py3/weixin.py:533"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_demo_py3/weixin.py","line":556,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_demo_py3/weixin.py:556"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_demo_py3/weixin.py","line":556,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_demo_py3/weixin.py:556"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_demo_py3/weixin.py","line":578,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_demo_py3/weixin.py:578"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_demo_py3/weixin.py","line":578,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_demo_py3/weixin.py:578"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_demo_py3/weixin.py","line":783,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_demo_py3/weixin.py:783"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_demo_py3/weixin.py","line":920,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_demo_py3/weixin.py:920"},{"rule_id":"opengrep/python.lang.maintainability.useless-if-conditional","severity":"medium","message":"if block checks for the same condition on both branches (`type(data) == str`)","path":"wxbot_demo_py3/weixin.py","line":1092,"fingerprint":"python.lang.maintainability.useless-if-conditional:wxbot_demo_py3/weixin.py:1092"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_demo_py3/weixin.py","line":1160,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_demo_py3/weixin.py:1160"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_demo_py3/weixin.py","line":1160,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_demo_py3/weixin.py:1160"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_demo_py3/weixin.py","line":1169,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_demo_py3/weixin.py:1169"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_demo_py3/weixin.py","line":1169,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_demo_py3/weixin.py:1169"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_project_py2.7/config/config_manager.py","line":31,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_project_py2.7/config/config_manager.py:31"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_project_py2.7/config/config_manager.py","line":49,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_project_py2.7/config/config_manager.py:49"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_project_py2.7/wechat/utils.py","line":229,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_project_py2.7/wechat/utils.py:229"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_project_py2.7/wechat/utils.py","line":236,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_project_py2.7/wechat/utils.py:236"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"wxbot_project_py2.7/wechat/wechat_apis.py","line":587,"fingerprint":"python.requests.best-practice.use-raise-for-status:wxbot_project_py2.7/wechat/wechat_apis.py:587"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"wxbot_project_py2.7/wechat/wechat_apis.py","line":587,"fingerprint":"python.requests.best-practice.use-timeout:wxbot_project_py2.7/wechat/wechat_apis.py:587"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"wxbot_project_py2.7/weixin_bot.py","line":272,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:wxbot_project_py2.7/weixin_bot.py:272"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":4608.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":72.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":708.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}