{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:21:54.461173Z","repo":{"ref":{"host":"github.com","owner":"node-inspector","name":"node-inspector"},"default_branch":"master","clone_url":"https://github.com/node-inspector/node-inspector.git","html_url":"https://github.com/node-inspector/node-inspector","description":"Node.js debugger based on Blink Developer Tools","stars":12638,"forks":714,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":7522,"primary_language":"JavaScript","license_spdx":"BSD-2-Clause","created_at":"2010-07-17T23:20:19Z","pushed_at":"2018-02-08T23:01:21Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-05-16T17:28:03Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"79e01c049286374f86dd560742a614019c02402f","profile":{"lines_by_language":{"JavaScript":170550,"Shell":148,"Python":46},"files_by_category":{"source":389,"binary":72,"other":71,"config":51,"test":26,"docs":9,"oversized":1,"vendored":1},"source_lines":167108,"test_lines":3636},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":64.3,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":81.5,"duplication":59.9,"lint":96.6,"testing":46.1,"docs":100.0,"type_safety":40.0,"process":10.0},"summary":"Code quality is weak: test-to-source ratio 0.02, no CI test run detected; 7% of function code in complex or long functions; 9% duplicated lines. Weakest area: process."},"security":{"score":71.3,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":94.2,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":25.0},"summary":"Security posture is adequate: 5 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.4,"check:Code-Review":2.0,"check:Maintained":0.0,"check:Binary-Artifacts":10.0,"check:Pinned-Dependencies":0.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:License":10.0,"check:Fuzzing":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 2/10 (Found 8/30 approved changesets -- score normalized to 2)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":0.8},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":1.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/node-inspector/node-inspector","weight":1.0}],"data":{"date":"2026-10-19","commit":"79e01c049286374f86dd560742a614019c02402f","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":23.0,"checked":23.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":613.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":297013.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2010-07":{"loc":43873,"attributed_loc":0},"2010-08":{"loc":55,"attributed_loc":0},"2010-09":{"loc":225,"attributed_loc":0},"2010-10":{"loc":9200,"attributed_loc":0},"2010-11":{"loc":5665,"attributed_loc":0},"2010-12":{"loc":670,"attributed_loc":0},"2011-04":{"loc":0,"attributed_loc":0},"2011-07":{"loc":165,"attributed_loc":0},"2011-08":{"loc":57,"attributed_loc":0},"2011-09":{"loc":29,"attributed_loc":0},"2011-10":{"loc":0,"attributed_loc":0},"2012-02":{"loc":11,"attributed_loc":0},"2012-10":{"loc":1,"attributed_loc":0},"2013-04":{"loc":447,"attributed_loc":0},"2013-05":{"loc":95202,"attributed_loc":0},"2013-06":{"loc":1575,"attributed_loc":0},"2013-07":{"loc":233,"attributed_loc":0},"2013-08":{"loc":170,"attributed_loc":0},"2013-09":{"loc":19717,"attributed_loc":0},"2013-10":{"loc":7,"attributed_loc":0},"2013-11":{"loc":15,"attributed_loc":0},"2013-12":{"loc":67,"attributed_loc":0},"2014-01":{"loc":186,"attributed_loc":0},"2014-02":{"loc":1130,"attributed_loc":0},"2014-03":{"loc":1992,"attributed_loc":0},"2014-04":{"loc":638,"attributed_loc":0},"2014-05":{"loc":45,"attributed_loc":0},"2014-06":{"loc":69,"attributed_loc":0},"2014-07":{"loc":193,"attributed_loc":0},"2014-08":{"loc":143,"attributed_loc":0},"2014-09":{"loc":748,"attributed_loc":0},"2014-11":{"loc":109153,"attributed_loc":0},"2014-12":{"loc":843,"attributed_loc":0},"2015-01":{"loc":64,"attributed_loc":0},"2015-02":{"loc":274,"attributed_loc":0},"2015-03":{"loc":227,"attributed_loc":0},"2015-04":{"loc":145,"attributed_loc":0},"2015-05":{"loc":813,"attributed_loc":0},"2015-06":{"loc":1303,"attributed_loc":0},"2015-07":{"loc":179,"attributed_loc":0},"2015-08":{"loc":355,"attributed_loc":0},"2015-09":{"loc":219,"attributed_loc":0},"2015-11":{"loc":17,"attributed_loc":0},"2015-12":{"loc":101,"attributed_loc":0},"2016-02":{"loc":186,"attributed_loc":0},"2016-03":{"loc":121,"attributed_loc":0},"2016-04":{"loc":12,"attributed_loc":0},"2017-01":{"loc":1,"attributed_loc":0},"2017-03":{"loc":222,"attributed_loc":0},"2017-04":{"loc":250,"attributed_loc":0},"2017-08":{"loc":0,"attributed_loc":0},"2018-01":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":325.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":22645.0,"pre_ai_era_burst_loc":0.0,"measured_loc":22645.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":430.826422647984,"median_loc_per_hour":47.207084468664846,"pr_timed_units":14.0,"excluded_import_loc":274368.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["147371d6527f0d2dbffa5295c43dc4b3f5ec59bd","23812b3855cc31061bd26549fd0aa5a960647cfa","8af9c1563975780e7b5d8a3ff3742751f044f10b","c7438b6cac5c35eafc765116c2c94dc259278c36","dcd344fbc5f624e263852011a748858f80e23943","edaca150b816da49ffa2e8e7e39813471ea63254"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":57.0,"flagged_releases":0.0,"max_loc_per_day":118.3},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.0.1","to":"v0.0.2","loc":209,"days":3.59,"loc_per_day":58.3,"flagged":false},{"from":"v0.0.2","to":"v0.0.3","loc":16,"days":14.94,"loc_per_day":1.1,"flagged":false},{"from":"v0.0.3","to":"v0.0.4","loc":70,"days":8.71,"loc_per_day":8.0,"flagged":false},{"from":"v0.0.4","to":"v0.1.0","loc":688,"days":26.93,"loc_per_day":25.6,"flagged":false},{"from":"v0.1.0","to":"v0.1.1","loc":214,"days":22.23,"loc_per_day":9.6,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":127,"days":5.26,"loc_per_day":24.2,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":55,"days":1.96,"loc_per_day":28.1,"flagged":false},{"from":"v0.1.3","to":"v0.1.4","loc":144,"days":3.02,"loc_per_day":47.7,"flagged":false},{"from":"v0.1.4","to":"v0.1.5","loc":458,"days":9.8,"loc_per_day":46.8,"flagged":false},{"from":"v0.1.5","to":"v0.1.6","loc":68,"days":3.0,"loc_per_day":22.7,"flagged":false},{"from":"v0.1.6","to":"v0.1.7","loc":2,"days":211.15,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.7","to":"v0.1.8","loc":163,"days":9.92,"loc_per_day":16.4,"flagged":false},{"from":"v0.1.8","to":"v0.1.9","loc":57,"days":21.96,"loc_per_day":2.6,"flagged":false},{"from":"v0.1.9","to":"v0.1.10","loc":29,"days":19.07,"loc_per_day":1.5,"flagged":false},{"from":"v0.1.10","to":"v0.3.2","loc":5072,"days":688.52,"loc_per_day":7.4,"flagged":false},{"from":"v0.3.2","to":"v0.3.3","loc":38,"days":20.98,"loc_per_day":1.8,"flagged":false},{"from":"v0.3.3","to":"v0.3.4","loc":9,"days":8.65,"loc_per_day":1.0,"flagged":false},{"from":"v0.3.4","to":"v0.4.0","loc":221,"days":15.03,"loc_per_day":14.7,"flagged":false},{"from":"v0.4.0","to":"v0.5.0","loc":288,"days":14.94,"loc_per_day":19.3,"flagged":false},{"from":"v0.5.0","to":"v0.6.0","loc":75,"days":53.12,"loc_per_day":1.4,"flagged":false},{"from":"v0.6.0","to":"v0.6.1","loc":14,"days":5.04,"loc_per_day":2.8,"flagged":false},{"from":"v0.6.1","to":"v0.6.2","loc":12,"days":17.1,"loc_per_day":0.7,"flagged":false},{"from":"v0.6.2","to":"v0.7.0-1","loc":55,"days":21.86,"loc_per_day":2.5,"flagged":false},{"from":"v0.7.0-1","to":"v0.7.0-2","loc":111,"days":28.16,"loc_per_day":3.9,"flagged":false},{"from":"v0.7.0-2","to":"v0.7.0","loc":934,"days":28.18,"loc_per_day":33.1,"flagged":false},{"from":"v0.7.0","to":"v0.7.1","loc":271,"days":18.65,"loc_per_day":14.5,"flagged":false},{"from":"v0.7.1","to":"v0.7.2","loc":177,"days":10.31,"loc_per_day":17.2,"flagged":false},{"from":"v0.7.2","to":"v0.7.3","loc":133,"days":17.6,"loc_per_day":7.6,"flagged":false},{"from":"v0.7.3","to":"v0.7.4","loc":308,"days":57.98,"loc_per_day":5.3,"flagged":false},{"from":"v0.7.4","to":"v0.8.0","loc":3466,"days":181.12,"loc_per_day":19.1,"flagged":false},{"from":"v0.8.0","to":"v0.8.1","loc":15,"days":5.21,"loc_per_day":2.9,"flagged":false},{"from":"v0.8.1","to":"v0.8.2","loc":264,"days":35.09,"loc_per_day":7.5,"flagged":false},{"from":"v0.8.2","to":"v0.8.3","loc":0,"days":0.13,"loc_per_day":0.0,"flagged":false},{"from":"v0.8.3","to":"v0.9.0","loc":25,"days":30.3,"loc_per_day":0.8,"flagged":false},{"from":"v0.9.0","to":"v0.9.1","loc":0,"days":11.85,"loc_per_day":0.0,"flagged":false},{"from":"v0.9.1","to":"v0.9.2","loc":0,"days":14.41,"loc_per_day":0.0,"flagged":false},{"from":"v0.9.2","to":"v0.10.0","loc":912,"days":45.27,"loc_per_day":20.1,"flagged":false},{"from":"v0.10.0","to":"v0.10.1","loc":199,"days":19.2,"loc_per_day":10.4,"flagged":false},{"from":"v0.10.1","to":"v0.10.2","loc":404,"days":32.04,"loc_per_day":12.6,"flagged":false},{"from":"v0.10.2","to":"v0.11.0","loc":1158,"days":14.31,"loc_per_day":80.9,"flagged":false},{"from":"v0.11.0","to":"v0.11.1","loc":36,"days":1.56,"loc_per_day":23.1,"flagged":false},{"from":"v0.11.1","to":"v0.11.2","loc":5,"days":23.07,"loc_per_day":0.2,"flagged":false},{"from":"v0.11.2","to":"v0.12.0","loc":609,"days":5.15,"loc_per_day":118.3,"flagged":false},{"from":"v0.12.0","to":"v0.12.1","loc":35,"days":0.32,"loc_per_day":109.5,"flagged":false},{"from":"v0.12.1","to":"v0.12.2","loc":345,"days":7.62,"loc_per_day":45.3,"flagged":false},{"from":"v0.12.2","to":"v0.12.4","loc":245,"days":119.52,"loc_per_day":2.0,"flagged":false},{"from":"v0.12.4","to":"v0.12.5","loc":0,"days":3.41,"loc_per_day":0.0,"flagged":false},{"from":"v0.12.5","to":"v0.12.6","loc":262,"days":64.65,"loc_per_day":4.1,"flagged":false},{"from":"v0.12.6","to":"v0.12.7","loc":25,"days":16.19,"loc_per_day":1.5,"flagged":false},{"from":"v0.12.7","to":"v0.12.8","loc":130,"days":41.29,"loc_per_day":3.1,"flagged":false},{"from":"v0.12.8","to":"v--no-verify","loc":6,"days":333.68,"loc_per_day":0.0,"flagged":false},{"from":"v--no-verify","to":"v0.12.10","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.12.10","to":"v1.0.0","loc":222,"days":21.88,"loc_per_day":10.1,"flagged":false},{"from":"v1.0.0","to":"v1.0.1","loc":99,"days":12.8,"loc_per_day":7.7,"flagged":false},{"from":"v1.0.1","to":"v1.1.0","loc":149,"days":2.09,"loc_per_day":71.1,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":2,"days":11.92,"loc_per_day":0.2,"flagged":false},{"from":"v1.1.1","to":"v1.1.2","loc":0,"days":281.73,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":167108.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":103.0,"findings_high":5.0,"findings_medium":97.0,"findings_low":1.0,"weighted_findings":28.413,"scanned_lines":167108.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"front-end/devices/DevicesView.js","line":17,"fingerprint":"javascript.browser.security.insecure-document-method:front-end/devices/DevicesView.js:17"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._devicesHelp.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"front-end/devices/DevicesView.js","line":17,"fingerprint":"javascript.browser.security.insecure-innerhtml:front-end/devices/DevicesView.js:17"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"front-end/devices/DevicesView.js","line":20,"fingerprint":"javascript.browser.security.insecure-document-method:front-end/devices/DevicesView.js:20"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.element.createChild(\"div\", \"devices-info\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"front-end/devices/DevicesView.js","line":20,"fingerprint":"javascript.browser.security.insecure-innerhtml:front-end/devices/DevicesView.js:20"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"front-end/main/Main.js","line":267,"fingerprint":"javascript.lang.security.detect-insecure-websocket:front-end/main/Main.js:267"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `script` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"bin/node-debug.js","line":180,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:bin/node-debug.js:180"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"bin/node-debug.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:bin/node-debug.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"bin/node-debug.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:bin/node-debug.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `url` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"bin/node-debug.js","line":192,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:bin/node-debug.js:192"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/UglifyJS/parse-js.js","line":1202,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/UglifyJS/parse-js.js:1202"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `regexp` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"front-end/audits/AuditRules.js","line":712,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/audits/AuditRules.js:712"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/bindings/CompilerScriptMapping.js","line":319,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/bindings/CompilerScriptMapping.js:319"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/bindings/SASSSourceMapping.js","line":528,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/bindings/SASSSourceMapping.js:528"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/bindings/TempFile.js","line":294,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/bindings/TempFile.js:294"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/bindings/TempFile.js","line":331,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/bindings/TempFile.js:331"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/cm/clike.js","line":31,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/cm/clike.js:31"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `state` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/cm/clike.js","line":247,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/cm/clike.js:247"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `words` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/cm/coffeescript.js","line":22,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/cm/coffeescript.js:22"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/cm/css.js","line":36,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/cm/css.js:36"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/cm/css.js","line":124,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/cm/css.js:124"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/cm/css.js","line":323,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/cm/css.js:323"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/cm/headlesscodemirror.js","line":93,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/cm/headlesscodemirror.js:93"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `words` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/cm/python.js","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/cm/python.js:15"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/components/HandlerRegistry.js","line":76,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/components/HandlerRegistry.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/console/ConsoleView.js","line":789,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/console/ConsoleView.js:789"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/devtools_app/DevToolsAPI.js","line":38,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/devtools_app/DevToolsAPI.js:38"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"front-end/extensions/ExtensionAPI.js","line":892,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:front-end/extensions/ExtensionAPI.js:892"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/extensions/ExtensionAPI.js","line":943,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/extensions/ExtensionAPI.js:943"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/extensions/ExtensionServer.js","line":209,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/extensions/ExtensionServer.js:209"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/extensions/ExtensionServer.js","line":222,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/extensions/ExtensionServer.js:222"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/extensions/ExtensionServer.js","line":237,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/extensions/ExtensionServer.js:237"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/extensions/ExtensionServer.js","line":882,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/extensions/ExtensionServer.js:882"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `searchConfig` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-co [confidence low]","path":"front-end/heap_snapshot_worker/HeapSnapshot.js","line":1156,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/heap_snapshot_worker/HeapSnapshot.js:1156"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/heap_snapshot_worker/HeapSnapshot.js","line":1927,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/heap_snapshot_worker/HeapSnapshot.js:1927"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/heap_snapshot_worker/HeapSnapshot.js","line":1933,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/heap_snapshot_worker/HeapSnapshot.js:1933"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/heap_snapshot_worker/HeapSnapshot.js","line":2275,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/heap_snapshot_worker/HeapSnapshot.js:2275"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/heap_snapshot_worker/HeapSnapshot.js","line":2279,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/heap_snapshot_worker/HeapSnapshot.js:2279"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"front-end/heap_snapshot_worker/HeapSnapshotWorkerDispatcher.js","line":96,"fingerprint":"javascript.browser.security.eval-detected:front-end/heap_snapshot_worker/HeapSnapshotWorkerDispatcher.js:96"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/main/OverridesView.js","line":161,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/main/OverridesView.js:161"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/main/RenderingOptions.js","line":86,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/main/RenderingOptions.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/main/Tests.js","line":175,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/main/Tests.js:175"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `input` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/network/FilterSuggestionBuilder.js","line":74,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/network/FilterSuggestionBuilder.js:74"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `input` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/network/FilterSuggestionBuilder.js","line":82,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/network/FilterSuggestionBuilder.js:82"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/network/FilterSuggestionBuilder.js","line":163,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/network/FilterSuggestionBuilder.js:163"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/network/NetworkLogView.js","line":826,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/network/NetworkLogView.js:826"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"front-end/network/NetworkLogView.js","line":1524,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/network/NetworkLogView.js:1524"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `baseURLDomain` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-c [confidence low]","path":"front-end/platform/utilities.js","line":234,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/platform/utilities.js:234"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/platform/utilities.js","line":1164,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/platform/utilities.js:1164"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `flags` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/platform/utilities.js","line":1192,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/platform/utilities.js:1192"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/platform/utilities.js","line":1192,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/platform/utilities.js:1192"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/profiler/CPUProfileBottomUpDataGrid.js","line":229,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/profiler/CPUProfileBottomUpDataGrid.js:229"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/profiler/HeapSnapshotProxy.js","line":169,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/profiler/HeapSnapshotProxy.js:169"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/profiler/HeapSnapshotView.js","line":1567,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/profiler/HeapSnapshotView.js:1567"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/script_formatter_worker/ScriptFormatterWorker.js","line":63,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/script_formatter_worker/ScriptFormatterWorker.js:63"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/sdk/CSSStyleModel.js","line":1727,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/sdk/CSSStyleModel.js:1727"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `cookieDomain` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-co [confidence low]","path":"front-end/sdk/CookieParser.js","line":436,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/sdk/CookieParser.js:436"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"front-end/sdk/InspectorBackend.js","line":190,"fingerprint":"javascript.browser.security.eval-detected:front-end/sdk/InspectorBackend.js:190"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/sdk/NetworkRequest.js","line":929,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/sdk/NetworkRequest.js:929"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/sdk/Resource.js","line":368,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/sdk/Resource.js:368"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/sdk/SourceMap.js","line":317,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/sdk/SourceMap.js:317"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `data` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"front-end/settings/FrameworkBlackboxDialog.js","line":137,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/settings/FrameworkBlackboxDialog.js:137"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `range` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/source_frame/CodeMirrorTextEditor.js","line":2441,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/source_frame/CodeMirrorTextEditor.js:2441"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `modifiers` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"front-end/source_frame/SourceFrame.js","line":78,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/source_frame/SourceFrame.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/source_frame/SourceFrame.js","line":78,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/source_frame/SourceFrame.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"front-end/sources/FilePathScoreFunction.js","line":61,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/sources/FilePathScoreFunction.js:61"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"front-end/ui/FlameChart.js","line":1234,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:front-end/ui/FlameChart.js:1234"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"front-end/ui/SettingsUI.js","line":242,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:front-end/ui/SettingsUI.js:242"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/workspace/FileManager.js","line":93,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/workspace/FileManager.js:93"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"front-end/workspace/UISourceCode.js","line":564,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:front-end/workspace/UISourceCode.js:564"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"index.js","line":22,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:index.js:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/ConsoleAgent.js","line":40,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/ConsoleAgent.js:40"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/HeapProfilerAgent.js","line":47,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/HeapProfilerAgent.js:47"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/Injections/HeapProfilerAgent.js","line":5,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/Injections/HeapProfilerAgent.js:5"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/Injections/ProfilerAgent.js","line":4,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/Injections/ProfilerAgent.js:4"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/InjectorServer.js","line":8,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/InjectorServer.js:8"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/InjectorServer.js","line":14,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/InjectorServer.js:14"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/NetworkAgent.js","line":42,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/NetworkAgent.js:42"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `params` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/NetworkAgent.js","line":189,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/NetworkAgent.js:189"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `mainAppScript` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/PageAgent.js","line":79,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/PageAgent.js:79"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `mainAppScript` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/PageAgent.js","line":92,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/PageAgent.js:92"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/PageAgent.js","line":97,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/PageAgent.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/PageAgent.js","line":97,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/PageAgent.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/ProfilerAgent.js","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/ProfilerAgent.js:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":57,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:57"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `mainScriptFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `folder` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":145,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:145"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/ScriptFileStorage.js","line":145,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/ScriptFileStorage.js:145"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/ScriptFileStorage.js","line":257,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/ScriptFileStorage.js:257"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/ScriptFileStorage.js","line":257,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/ScriptFileStorage.js:257"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `child` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `node` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `realpath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/ScriptFileStorage.js","line":265,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/ScriptFileStorage.js:265"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `string` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"lib/config.js","line":432,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:lib/config.js:432"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/config.js","line":442,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/config.js:442"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/debug-server.js","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/debug-server.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/debug-server.js","line":98,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/debug-server.js:98"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/debug-server.js","line":140,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/debug-server.js:140"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `config` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/plugins.js","line":55,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/plugins.js:55"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/plugins.js","line":63,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/plugins.js:63"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/plugins.js","line":63,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/plugins.js:63"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"lib/plugins.js","line":67,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:lib/plugins.js:67"},{"rule_id":"opengrep/javascript.express.security.audit.express-check-csurf-middleware-usage","severity":"low","message":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies. [confidence low]","path":"lib/debug-server.js","line":92,"fingerprint":"javascript.express.security.audit.express-check-csurf-middleware-usage:lib/debug-server.js:92"}],"evidence":[],"data":{"rulesets":["javascript","bash","python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.025,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":12044.0,"function_nloc":102820.0,"mean_ccn":2.38,"p90_ccn":5.0,"complex_functions":115.0,"long_functions":13.0,"many_param_functions":18.0,"risky_nloc_share":0.068},"findings":[],"evidence":[{"kind":"complex-function","description":"_processEvent in front-end/timeline/TimelineModel.js: complexity 64, 155 lines","ref":"front-end/timeline/TimelineModel.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/timeline/TimelineModel.js#L879","weight":1.0},{"kind":"complex-function","description":"WebInspector.TimelineUIUtils._buildTraceEventDetailsSynchronously in front-end/timeline/TimelineUIUtils.js: complexity 59, 136 lines","ref":"front-end/timeline/TimelineUIUtils.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/timeline/TimelineUIUtils.js#L484","weight":0.9833333333333333},{"kind":"complex-function","description":"TreeOutline.prototype._treeKeyDown in front-end/treeoutline.js: complexity 40, 66 lines","ref":"front-end/treeoutline.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/treeoutline.js#L334","weight":0.6666666666666666},{"kind":"complex-function","description":"_treeKeyDown in front-end/ui/treeoutline.js: complexity 40, 66 lines","ref":"front-end/ui/treeoutline.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/ui/treeoutline.js#L357","weight":0.6666666666666666},{"kind":"complex-function","description":"WebInspector.TimelineUIUtils.buildDetailsNodeForTraceEvent in front-end/timeline/TimelineUIUtils.js: complexity 39, 95 lines","ref":"front-end/timeline/TimelineUIUtils.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/timeline/TimelineUIUtils.js#L273","weight":0.65},{"kind":"complex-function","description":"(anonymous) in front-end/cm/comment.js: complexity 38, 43 lines","ref":"front-end/cm/comment.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/cm/comment.js#L109","weight":0.6333333333333333},{"kind":"complex-function","description":"_formatMessage in front-end/console/ConsoleViewMessage.js: complexity 38, 98 lines","ref":"front-end/console/ConsoleViewMessage.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/console/ConsoleViewMessage.js#L128","weight":0.6333333333333333},{"kind":"complex-function","description":"editingCommitted in front-end/elements/StylesSidebarPane.js: complexity 37, 48 lines","ref":"front-end/elements/StylesSidebarPane.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/elements/StylesSidebarPane.js#L3335","weight":0.6166666666666667},{"kind":"complex-function","description":"_keyDown in front-end/ui/DataGrid.js: complexity 37, 66 lines","ref":"front-end/ui/DataGrid.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/ui/DataGrid.js#L747","weight":0.6166666666666667},{"kind":"complex-function","description":"$statement in front-end/UglifyJS/parse-js.js: complexity 33, 74 lines","ref":"front-end/UglifyJS/parse-js.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/UglifyJS/parse-js.js#L710","weight":0.55}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":103488.0,"duplicated_lines":8851.0,"duplicated_share":0.0855,"files":389.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/Runtime.js:2 and front-end/common/WorkerRuntime.js:2","ref":"front-end/Runtime.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/Runtime.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/Runtime.js:4 and front-end/audits/AuditCategories.js:4","ref":"front-end/Runtime.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/Runtime.js#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditCategories.js:2 and front-end/audits/AuditRules.js:2","ref":"front-end/audits/AuditCategories.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditCategories.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditCategories.js:24 and front-end/audits/AuditController.js:25","ref":"front-end/audits/AuditCategories.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditCategories.js#L24","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditCategory.js:2 and front-end/sdk/CPUProfilerModel.js:2","ref":"front-end/audits/AuditCategory.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditCategory.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditCategory.js:4 and front-end/common/ParsedURL.js:4","ref":"front-end/audits/AuditCategory.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditCategory.js#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditCategory.js:22 and front-end/bindings/FileUtils.js:24","ref":"front-end/audits/AuditCategory.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditCategory.js#L22","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditCategory.js:52 and front-end/audits/AuditExtensionCategory.js:66","ref":"front-end/audits/AuditCategory.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditCategory.js#L52","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditExtensionCategory.js:2 and front-end/audits/AuditFormatters.js:2","ref":"front-end/audits/AuditExtensionCategory.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditExtensionCategory.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: front-end/audits/AuditExtensionCategory.js:65 and front-end/audits/AuditsPanel.js:232","ref":"front-end/audits/AuditExtensionCategory.js","url":"https://github.com/node-inspector/node-inspector/blob/79e01c049286374f86dd560742a614019c02402f/front-end/audits/AuditExtensionCategory.js#L65","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":35.0,"weighted_findings":23.0,"scanned_lines":167108.0,"category:best-practice":9.0,"category:correctness":26.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"bin/run-repl.js","line":62,"fingerprint":"javascript.lang.best-practice.lazy-load-module:bin/run-repl.js:62"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/Runtime.js","line":873,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/Runtime.js:873"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/common/Settings.js","line":200,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/common/Settings.js:200"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/common/Settings.js","line":526,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/common/Settings.js:526"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/common/Settings.js","line":532,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/common/Settings.js:532"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/common/Settings.js","line":533,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/common/Settings.js:533"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/common/Settings.js","line":533,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/common/Settings.js:533"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/common/Settings.js","line":535,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/common/Settings.js:535"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"front-end/network/NetworkLogView.js","line":1331,"fingerprint":"javascript.lang.best-practice.javascript-confirm:front-end/network/NetworkLogView.js:1331"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"front-end/network/NetworkLogView.js","line":1337,"fingerprint":"javascript.lang.best-practice.javascript-confirm:front-end/network/NetworkLogView.js:1337"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"front-end/resources/FileSystemView.js","line":99,"fingerprint":"javascript.lang.best-practice.javascript-confirm:front-end/resources/FileSystemView.js:99"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/resources/IndexedDBViews.js","line":315,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/resources/IndexedDBViews.js:315"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/resources/IndexedDBViews.js","line":315,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/resources/IndexedDBViews.js:315"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"front-end/sdk/DOMStorage.js","line":246,"fingerprint":"javascript.lang.correctness.no-stringify-keys:front-end/sdk/DOMStorage.js:246"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"front-end/sources/SourcesPanel.js","line":832,"fingerprint":"javascript.lang.best-practice.javascript-confirm:front-end/sources/SourcesPanel.js:832"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"front-end/sources/TabbedEditorContainer.js","line":237,"fingerprint":"javascript.lang.best-practice.javascript-confirm:front-end/sources/TabbedEditorContainer.js:237"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"lib/InjectorServer.js","line":8,"fingerprint":"javascript.lang.best-practice.lazy-load-module:lib/InjectorServer.js:8"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"lib/InjectorServer.js","line":14,"fingerprint":"javascript.lang.best-practice.lazy-load-module:lib/InjectorServer.js:14"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"lib/plugins.js","line":67,"fingerprint":"javascript.lang.best-practice.lazy-load-module:lib/plugins.js:67"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`cellElement` is assigned twice; the first assignment is useless","path":"front-end/main/OverridesView.js","line":514,"fingerprint":"javascript.lang.correctness.useless-assignment:front-end/main/OverridesView.js:514"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`row.createChild(\"td\").textContent` is assigned twice; the first assignment is useless","path":"front-end/network/NetworkLogView.js","line":1107,"fingerprint":"javascript.lang.correctness.useless-assignment:front-end/network/NetworkLogView.js:1107"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`this._nodeIdElement.textContent` is assigned twice; the first assignment is useless","path":"front-end/screencast/ScreencastView.js","line":587,"fingerprint":"javascript.lang.correctness.useless-assignment:front-end/screencast/ScreencastView.js:587"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`blockHeader.createChild(\"span\").textContent` is assigned twice; the first assignment is useless","path":"front-end/settings/FrameworkBlackboxDialog.js","line":29,"fingerprint":"javascript.lang.correctness.useless-assignment:front-end/settings/FrameworkBlackboxDialog.js:29"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"tools/git-changelog.sh","line":8,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:tools/git-changelog.sh:8"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":34,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:34"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":37,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:37"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":42,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:42"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":55,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:55"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":57,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:57"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":58,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:58"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/git-changelog.sh","line":59,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/git-changelog.sh:59"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/release.sh","line":22,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/release.sh:22"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/release.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/release.sh:25"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/release.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/release.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/release.sh","line":58,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/release.sh:58"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0435,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":3636.0,"source_lines":167108.0,"test_ratio":0.0218,"ci_files":1.0,"cochange_share":0.2581,"cochange_commits":186.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":312.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"ChangeLog.md","ref":"ChangeLog.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}