Leaderboard github.com
AlistGo/alist
🗂️A file list/WebDAV program that supports multiple storages, powered by Gin and Solidjs. / 一个支持多存储的文件列表/WebDAV程序，使用 Gin 和 Solidjs。
AI provenance
2%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
59/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
40/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
2% explicit
Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.
How the score is built
- Explicitly attributed share2%
- Unattributed share in AI-pace bursts15%
- Estimated AI-generated share2%
- AI tool configuration files0
- Work sessions at AI pace6
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.10
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| GitHub Copilot coding agent | 6 | 2,497 | 2025-04-03 | 2025-04-19 |
| OpenAI Codex | 10 | 2,027 | 2026-02-28 | 2026-10-13 |
| Claude Code | 4 | 548 | 2026-04-12 | 2026-05-29 |
Lines added per month all AI-attributed share
- 2021-102,030 · 0% AI
- 2021-1112,709 · 0% AI
- 2021-126,241 · 0% AI
- 2022-014,693 · 0% AI
- 2022-023,142 · 0% AI
- 2022-033,603 · 0% AI
- 2022-044,615 · 0% AI
- 2022-05361 · 0% AI
- 2022-0626,282 · 0% AI
- 2022-071,666 · 0% AI
- 2022-083,817 · 0% AI
- 2022-0914,140 · 0% AI
- 2022-101,551 · 0% AI
- 2022-112,584 · 0% AI
- 2022-123,939 · 0% AI
- 2023-011,768 · 0% AI
- 2023-022,444 · 0% AI
- 2023-032,788 · 0% AI
- 2023-04815 · 0% AI
- 2023-051,618 · 0% AI
- 2023-061,827 · 0% AI
- 2023-071,117 · 0% AI
- 2023-087,631 · 0% AI
- 2023-091,266 · 0% AI
- 2023-10348 · 0% AI
- 2023-113,830 · 0% AI
- 2023-121,245 · 0% AI
- 2024-012,051 · 0% AI
- 2024-02531 · 0% AI
- 2024-031,422 · 0% AI
- 2024-04573 · 0% AI
- 2024-054,276 · 0% AI
- 2024-06112 · 0% AI
- 2024-072,783 · 0% AI
- 2024-082,831 · 0% AI
- 2024-09853 · 0% AI
- 2024-10763 · 0% AI
- 2024-11945 · 0% AI
- 2024-123,351 · 0% AI
- 2025-016,790 · 0% AI
- 2025-022,156 · 0% AI
- 2025-032,942 · 0% AI
- 2025-044,947 · 50% AI
- 2025-051,200 · 0% AI
- 2025-06120 · 0% AI
- 2025-072,139 · 0% AI
- 2025-082,441 · 0% AI
- 2025-094,334 · 0% AI
- 2025-101,901 · 0% AI
- 2025-11502 · 0% AI
- 2025-12323 · 0% AI
- 2026-01480 · 0% AI
- 2026-022,387 · 1% AI
- 2026-0310,825 · 0% AI
- 2026-043,600 · 14% AI
- 2026-051,773 · 3% AI
- 2026-061,176 · 0% AI
- 2026-071,994 · 0% AI
- 2026-085,841 · 5% AI
- 2026-094,829 · 31% AI
- 2026-101,783 · 11% AI
Findings in AI-attributed lines vs the rest
From git blame: 3,644 lines trace to AI-attributed commits, 116,422 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 1.37 | 1.68 | 0.82× |
| Security | 0.27 | 1.28 | 0.21× |
Evidence by analyzer
Explicit AI attributionok23 items
- OpenAI Codex: 10 attributed commits, 2,027 lines added
- GitHub Copilot coding agent: 6 attributed commits, 2,497 lines added
- Claude Code: 4 attributed commits, 548 lines added
- OpenAI Codex: on merged branch (fa54f7e3a2)
- OpenAI Codex: on merged branch (fa54f7e3a2)
- OpenAI Codex: on merged branch (64d7e4519d)
- OpenAI Codex: PR branch 'codex/fix-9646-thumbnail-cache'
- OpenAI Codex: on merged branch (c0caa562d9)
- OpenAI Codex: on merged branch (26a1c3816c)
- OpenAI Codex: on merged branch (5543ac59f3)
- OpenAI Codex: on merged branch (3e49fa4630)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- OpenAI Codex: on merged branch (03c08cba75)
- OpenAI Codex: on merged branch (315b2a83e6)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- attributed_commit_share
- 0.8%
- attributed_commits
- 20
- attributed_loc
- 5,072
- attributed_loc_share
- 2.5%
- commits
- 2,415
- effective_loc
- 203,044
- tools_detected
- 3
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok6 items
- 15,346 lines of first-party code in ~2.3h (6,656 lines/hour, 1 commit session)
- 6,782 lines of first-party code in ~3.5h (1,919 lines/hour, 1 commit session)
- 1,408 lines of first-party code in ~1.5h (932 lines/hour, 3 commit session)
- 3,297 lines of first-party code in ~3.8h (868 lines/hour, 1 commit session)
- 2,752 lines of first-party code in ~4.0h (688 lines/hour, 1 commit session)
- 1,462 lines of first-party code in ~2.3h (635 lines/hour, 1 commit session)
- excluded_import_loc
- 0
- flagged_loc
- 31,047
- flagged_loc_share
- 15.3%
- flagged_units
- 6
- max_loc_per_hour
- 6,656.10
- measured_loc
- 203,044
- median_loc_per_hour
- 41.22
- pr_timed_units
- 595
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 1,510
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 971.40
- releases
- 99
Coding styleok8 items
- step-by-step narration comment: // Step 1: Get the upload server URL
- step-by-step narration comment: // Step 2: Upload the file to the upload server
- step-by-step narration comment: // Now let's unmarshal the data into `payload`
- step-by-step narration comment: // step 1: apply for confirm key
- step-by-step narration comment: // step 2: upload file
- step-by-step narration comment: // step 3: confirm the upload
- step-by-step narration comment: // step 1.
- step-by-step narration comment: // first, so copying into a not-yet-created nested path failed on
- count:assistant_voice
- 0
- count:emoji_in_code
- 2
- count:narrated_steps
- 11
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 2
- files:narrated_steps
- 8
- files:placeholder
- 0
- index
- 0.10
- lines_scanned
- 120,066
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.02
- per_kloc:narrated_steps
- 0.09
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 3,644
- blame_failures
- 0
- files_blamed
- 738
- other_lines
- 116,422
- quality:ai_findings
- 5
- quality:ai_per_kloc
- 1.37
- quality:other_findings
- 195
- quality:other_per_kloc
- 1.68
- quality:ratio
- 0.82
- security:ai_findings
- 1
- security:ai_per_kloc
- 0.27
- security:other_findings
- 149
- security:other_per_kloc
- 1.28
- security:ratio
- 0.21
Code quality
59 weak
Code quality is weak: test-to-source ratio 0.12, no CI test run detected; 12% of function code in complex or long functions; 13% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity71
- Duplication45
- Lint and smells67
- Tests and CI48
- Documentation80
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- unmarshal in server/webdav/internal/xml/read.go: complexity 86, 233 lines
- rawToken in server/webdav/internal/xml/xml.go: complexity 82, 261 lines
- Put in drivers/139/driver.go: complexity 52, 286 lines
- Move in drivers/github/driver.go: complexity 52, 209 lines
- text in server/webdav/internal/xml/xml.go: complexity 50, 146 lines
- marshalValue in server/webdav/internal/xml/marshal.go: complexity 49, 122 lines
- marshalStruct in server/webdav/internal/xml/marshal.go: complexity 42, 125 lines
- Put in drivers/baidu_youth/driver.go: complexity 36, 151 lines
- WebDAVAuth in server/webdav.go: complexity 36, 110 lines
- structFieldInfo in server/webdav/internal/xml/typeinfo.go: complexity 34, 94 lines
- complex_functions
- 101
- function_nloc
- 81,575
- functions
- 6,094
- long_functions
- 36
- many_param_functions
- 12
- mean_ccn
- 3.29
- p90_ccn
- 8
- risky_nloc_share
- 11.6%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: build.sh:88 and build.sh:188
- 6+ duplicated lines: cmd/kill.go:19 and cmd/stop_default.go:23
- 6+ duplicated lines: cmd/stop_default.go:46 and cmd/stop_windows.go:22
- 6+ duplicated lines: drivers/115/meta.go:4 and drivers/115_share/meta.go:4
- 6+ duplicated lines: drivers/115/util.go:59 and drivers/115_share/utils.go:184
- 6+ duplicated lines: drivers/115/util.go:326 and drivers/115/util.go:479
- 6+ duplicated lines: drivers/115/util.go:342 and drivers/pikpak/util.go:530
- 6+ duplicated lines: drivers/115_open/driver.go:4 and internal/net/request.go:5
- 6+ duplicated lines: drivers/115_open/driver.go:5 and drivers/cloudreve/util.go:9
- 6+ duplicated lines: drivers/115_open/meta.go:4 and drivers/doubao_new/meta.go:4
- compared_lines
- 84,689
- duplicated_lines
- 11,347
- duplicated_share
- 13.4%
- files
- 738
Lintok
- category:best-practice
- 2
- category:correctness
- 207
- findings
- 209
- scanned_lines
- 120,066
- weighted_findings
- 194.75
Tests and CIok10 items
- CI config: .github/workflows/auto_lang.yml
.github/workflows/auto_lang.yml - CI config: .github/workflows/beta_release.yml
.github/workflows/beta_release.yml - CI config: .github/workflows/build.yml
.github/workflows/build.yml - CI config: .github/workflows/changelog.yml
.github/workflows/changelog.yml - CI config: .github/workflows/issue_close_question.yml
.github/workflows/issue_close_question.yml - CI config: .github/workflows/issue_close_stale.yml
.github/workflows/issue_close_stale.yml - CI config: .github/workflows/issue_duplicate.yml
.github/workflows/issue_duplicate.yml - CI config: .github/workflows/issue_invalid.yml
.github/workflows/issue_invalid.yml - CI config: .github/workflows/issue_on_close.yml
.github/workflows/issue_on_close.yml - CI config: .github/workflows/issue_question.yml
.github/workflows/issue_question.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 20
- cochange_commits
- 269
- cochange_share
- 18.2%
- source_lines
- 120,066
- test_lines
- 14,570
- test_ratio
- 0.12
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 122
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
40 poor
Security posture is poor: 105 known vulnerabilities in 28 dependencies; 2 high-severity SAST findings; 66 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets57
- Static analysis (SAST)78
- Vulnerable dependencies12
- CI workflows0
- Security posture40
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 16
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 138
- findings_high
- 2
- findings_low
- 0
- findings_medium
- 136
- parse_errors
- 3
- scanned_lines
- 120,066
- weighted_findings
- 84.95
Dependencies (osv-scanner)ok
- penalty
- 129
- vulnerabilities
- 105
- vulnerable_packages
- 28
- vulns_critical
- 11
- vulns_high
- 14
- vulns_low
- 7
- vulns_medium
- 33
- vulns_unknown
- 40
CI workflows (zizmor)ok
- findings
- 104
- findings_high
- 66
- findings_low
- 8
- findings_medium
- 30
- penalty
- 777.40
- workflows
- 20
Security postureok1 item
- Dependency updates: renovate.json
renovate.json
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 39.0%
- unpinned_manifests
- 0
Release downloadsok8 items
- release v3.66.0 ships alist-android-386.tar.gz (515 downloads)
- release v3.66.0 ships alist-android-amd64.tar.gz (534 downloads)
- release v3.66.0 ships alist-android-arm.tar.gz (334 downloads)
- release v3.66.0 ships alist-android-arm64.tar.gz (639 downloads)
- release v3.66.0 ships alist-darwin-amd64.tar.gz (818 downloads)
- links to file hosts or shorteners: mediafire.com, mega.nz, t.me/
README.md - links to file hosts or shorteners: mediafire.com, mega.nz, t.me/
README_cn.md - links to file hosts or shorteners: mediafire.com, mega.nz, t.me/
README_ja.md
- binary_assets
- 451
- signals
- 2
- suspicious
- 0
Findings
11 critical82 high429 medium35 low7 info
564 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-25qr-6mpr-f7qx |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-4964, GHSA-25qr-6mpr-f7qx | Dependencies (osv-scanner) |
| critical | osv/GHSA-5cgq-3rg8-m6cv |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv | Dependencies (osv-scanner) |
| critical | osv/GHSA-89gr-r52h-f8rx |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx | Dependencies (osv-scanner) |
| critical | osv/GHSA-f5wc-c3c7-36mc |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc | Dependencies (osv-scanner) |
| critical | osv/GHSA-jfwf-28xr-xw6q |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-5466, GHSA-jfwf-28xr-xw6q | Dependencies (osv-scanner) |
| critical | osv/GHSA-jppx-rxg9-jmrx |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx | Dependencies (osv-scanner) |
| critical | osv/GHSA-qw24-gh76-8rvv |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-5596, GHSA-qw24-gh76-8rvv | Dependencies (osv-scanner) |
| critical | osv/GHSA-rm3j-f69w-wqmq |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq | Dependencies (osv-scanner) |
| critical | osv/GHSA-vgwf-h737-ff37 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37 | Dependencies (osv-scanner) |
| critical | osv/GHSA-x527-x647-q7gg |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg | Dependencies (osv-scanner) |
| critical | osv/GHSA-xwwr-4h3p-r22c |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6462, GHSA-xwwr-4h3p-r22c | Dependencies (osv-scanner) |
| high | zizmor/unpinned-uses |
.github/workflows/auto_lang.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/auto_lang.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/auto_lang.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/beta_release.yml:12 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:121 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:135 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:24 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:47 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:77 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/beta_release.yml:82 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:82 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/beta_release.yml:91 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:46 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:52 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:61 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:80 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/changelog.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_close_question.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_close_stale.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_duplicate.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_invalid.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_on_close.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_question.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_similarity.yml:12 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_translate.yml:13 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/issue_translate.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue_wontfix.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:41 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release.yml:48 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:53 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:69 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:81 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release_android.yml:25 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_android.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_android.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_android.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:100 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:106 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:109 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:113 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:120 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:129 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:141 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release_docker.yml:41 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:41 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release_docker.yml:47 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:47 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:65 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_docker.yml:99 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release_freebsd.yml:25 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_freebsd.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_freebsd.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_freebsd.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release_linux_musl.yml:25 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_linux_musl.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_linux_musl.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_linux_musl.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release_linux_musl_arm.yml:25 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_linux_musl_arm.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_linux_musl_arm.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_linux_musl_arm.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/dockerfile.security.missing-user |
Dockerfile:42 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-cmd |
cmd/start.go:37 | Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary... | Static analysis (opengrep) |
| high | osv/GHSA-259r-337f-4rfw |
go.mod | github.com/klauspost/[email protected] (Go) is affected by GO-2026-5841, GHSA-259r-337f-4rfw | Dependencies (osv-scanner) |
| high | osv/GHSA-26gq-p25f-99cp |
go.mod | github.com/fatedier/[email protected] (Go) is affected by GO-2026-6103, GHSA-26gq-p25f-99cp | Dependencies (osv-scanner) |
| high | osv/GHSA-2m8m-jhrm-w6j2 |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6182, GHSA-2m8m-jhrm-w6j2 | Dependencies (osv-scanner) |
| high | osv/GHSA-2v4p-qf9q-27wj |
go.mod | google.golang.org/[email protected] (Go) is affected by GO-2026-6443, GHSA-2v4p-qf9q-27wj | Dependencies (osv-scanner) |
| high | osv/GHSA-45pq-889g-fcgh |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6184, GHSA-45pq-889g-fcgh | Dependencies (osv-scanner) |
| high | osv/GHSA-c476-6w5q-jw77 |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6458, GHSA-c476-6w5q-jw77 | Dependencies (osv-scanner) |
| high | osv/GHSA-cf44-9pgv-m4xc |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6191, GHSA-cf44-9pgv-m4xc | Dependencies (osv-scanner) |
| high | osv/GHSA-fqj9-69pf-6pjg |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6195, GHSA-fqj9-69pf-6pjg | Dependencies (osv-scanner) |
| high | osv/GHSA-hrxh-6v49-42gf |
go.mod | google.golang.org/[email protected] (Go) is affected by GO-2026-6061, GHSA-hrxh-6v49-42gf | Dependencies (osv-scanner) |
| high | osv/GHSA-mgcc-cww5-fp2q |
go.mod | github.com/go-jose/go-jose/[email protected] (Go) is affected by GHSA-mgcc-cww5-fp2q | Dependencies (osv-scanner) |
| high | osv/GHSA-q4h4-gmj2-qvw2 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2 | Dependencies (osv-scanner) |
| high | osv/GHSA-q675-qj96-32m9 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5032, GHSA-q675-qj96-32m9 | Dependencies (osv-scanner) |
| high | osv/GHSA-vp52-pcj8-j9qc |
go.mod | google.golang.org/[email protected] (Go) is affected by GO-2026-6348, GHSA-vp52-pcj8-j9qc | Dependencies (osv-scanner) |
| high | osv/GHSA-w879-237q-wc7r |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r | Dependencies (osv-scanner) |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
cmd/common.go:49 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
cmd/lang.go:142 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
cmd/start.go:42 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.exported_loop_pointer |
drivers/115/util.go:102 | `fileInfo` is a loop pointer that may be exported from the loop. This pointer is shared between loop iterations, so the exported reference will always point to the last loop value, which is likely unintentional. To fix, copy the pointer... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/139/util.go:469 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/driver.go:136 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/util.go:100 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/util.go:163 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/util.go:178 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/util.go:193 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/util.go:58 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alias/util.go:73 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/alist_v3/driver.go:138 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.exported_loop_pointer |
drivers/alist_v3/driver.go:259 | `content` is a loop pointer that may be exported from the loop. This pointer is shared between loop iterations, so the exported reference will always point to the last loop value, which is likely unintentional. To fix, copy the pointer... | Lint |
| medium | opengrep/go.lang.correctness.exported_loop_pointer |
drivers/alist_v3/types.go:134 | `child` is a loop pointer that may be exported from the loop. This pointer is shared between loop iterations, so the exported reference will always point to the last loop value, which is likely unintentional. To fix, copy the pointer to... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/azure_blob/driver.go:149 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/azure_blob/driver.go:182 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/azure_blob/util.go:284 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/baidu_netdisk/driver.go:104 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/baidu_netdisk/driver.go:144 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/baidu_share/driver.go:88 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/baidu_youth/driver.go:126 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/baidu_youth/driver.go:176 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/bitqiu/driver.go:282 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/bitqiu/util.go:44 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/bitqiu/util.go:63 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/driver.go:154 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/driver.go:226 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:269 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:358 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:604 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:614 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:636 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:654 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/chunker/util.go:695 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/crypt/driver.go:317 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/crypt/util.go:36 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/cstcloud_capsule/driver.go:103 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/cstcloud_capsule/driver.go:95 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/doubao_share/util.go:566 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/doubao_share/util.go:606 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ftp/driver.go:78 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ftp/driver.go:97 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ftps/driver.go:77 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ftps/driver.go:96 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/gitee/driver.go:223 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/github/driver.go:237 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/github/driver.go:270 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/github/driver.go:516 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:115 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:119 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:123 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:130 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:140 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:150 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:54 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:56 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:62 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:87 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:91 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:93 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/ipfs_api/driver.go:99 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/local/driver.go:172 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/local/driver.go:174 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/onedrive/driver.go:133 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/onedrive/driver.go:135 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/onedrive_app/driver.go:132 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/onedrive_app/driver.go:134 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/driver.go:157 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/driver.go:182 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/util.go:235 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/util.go:236 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/util.go:260 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/util.go:275 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/s3/util.go:276 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sftp/driver.go:75 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sftp/driver.go:89 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sftp/types.go:22 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sftp/types.go:29 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sftp/util.go:78 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sftp/util.go:95 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sjtu_netdisk/util.go:78 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/sjtu_netdisk/util.go:90 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/strm/driver.go:112 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/strm/driver.go:202 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/strm/driver.go:203 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/strm/driver.go:221 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/strm/util.go:134 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
drivers/strm/util.go:193 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
drivers/strm/util.go:204 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/terabox/driver.go:81 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/url_tree/driver.go:153 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/url_tree/driver.go:191 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/url_tree/driver.go:206 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/url_tree/driver.go:230 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/url_tree/driver.go:290 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/uss/driver.go:108 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/uss/driver.go:95 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/webdav/driver.go:77 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/webdav/driver.go:85 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/yandex_disk/driver.go:64 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/yandex_disk/driver.go:84 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/yunpan360/driver.go:167 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/yunpan360/driver.go:187 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/yunpan360/driver.go:237 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
drivers/yunpan360/driver.go:256 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/archives/archives.go:115 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/archives/archives.go:142 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/archives/archives.go:151 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/archives/archives.go:162 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/iso9660/iso9660.go:88 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/iso9660/utils.go:104 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/iso9660/utils.go:75 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/rardecode/rardecode.go:128 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/rardecode/rardecode.go:142 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/rardecode/rardecode.go:156 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/rardecode/utils.go:186 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/rardecode/utils.go:191 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:131 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:144 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:168 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:183 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:197 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:214 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/archive/tool/helper.go:227 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/bootstrap/config.go:87 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/frp/frp.go:76 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/archive.go:178 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/archive.go:192 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/archive.go:194 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/archive.go:274 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/copy.go:149 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/copy.go:150 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/copy.go:177 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/copy.go:78 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/fs/walk.go:36 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/offline_download/tool/transfer.go:117 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/offline_download/tool/transfer.go:118 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/offline_download/tool/transfer.go:193 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/offline_download/tool/transfer.go:222 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/offline_download/tool/transfer.go:223 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/offline_download/tool/transfer.go:93 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/archive.go:104 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/archive.go:193 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/archive.go:212 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/archive.go:392 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:156 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:164 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:197 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:617 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:622 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:624 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:691 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/op/fs.go:704 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/search/build.go:236 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/search/build.go:237 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/search/build.go:238 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/search/build.go:248 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/search/build.go:256 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
internal/search/meilisearch/search.go:137 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.best-practice.hidden-goroutine |
pkg/cron/cron.go:17 | Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/gowebdav/cmd/gowebdav/main.go:196 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/gowebdav/cmd/gowebdav/main.go:204 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.best-practice.hidden-goroutine |
pkg/task/manager.go:27 | Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/utils/file.go:60 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/utils/file.go:61 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
pkg/utils/file.go:99 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/utils/path.go:127 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/utils/path.go:92 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
pkg/utils/path.go:96 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/common/sign.go:16 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/ftp/fsmanage.go:81 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/ftp/fsread.go:161 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/handles/fsread.go:134 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/handles/fsread.go:199 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/handles/fsread.go:323 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/handles/share.go:368 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/backend.go:109 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/backend.go:152 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/backend.go:259 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/backend.go:360 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/backend.go:409 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/list.go:13 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/list.go:24 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/s3/list.go:36 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/webdav/file.go:111 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/webdav/file.go:53 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/webdav/webdav.go:687 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/webdav/webdav.go:724 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
server/webdav/webdav.go:769 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | zizmor/excessive-permissions |
.github/workflows/auto_lang.yml:19 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/auto_lang.yml:32 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/beta_release.yml:23 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/beta_release.yml:76 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/build.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/build.yml:14 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/build.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/build.yml:24 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/build.yml:45 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/changelog.yml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/changelog.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/issue_similarity.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/issue_translate.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:52 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release.yml:75 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_android.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release_android.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_docker.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_docker.yml:34 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release_docker.yml:38 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_docker.yml:75 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release_docker.yml:98 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_freebsd.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release_freebsd.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_linux_musl.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release_linux_musl.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_linux_musl_arm.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release_linux_musl_arm.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
cmd/user.go:25 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/115/util.go:196 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/115/util.go:197 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/115/util.go:55 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/123/util.go:9 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/123_link/util.go:24 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/123_link/util.go:6 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/123_open/sign.go:23 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/123_open/sign.go:6 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/123_share/util.go:9 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/139/util.go:999 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/189/help.go:162 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/189/util.go:361 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/aliyundrive/driver.go:231 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_netdisk/driver.go:240 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_netdisk/driver.go:241 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_netdisk/driver.go:242 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_photo/driver.go:278 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_photo/driver.go:279 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_photo/driver.go:280 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/baidu_photo/help.go:6 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/baidu_share/driver.go:45 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/baidu_share/driver.go:45 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/baidu_share/driver.go:46 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/baidu_share/driver.go:46 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_youth/driver.go:259 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_youth/driver.go:260 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_youth/driver.go:261 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/baidu_youth/util.go:330 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_youth/util.go:335 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/baidu_youth/util.go:581 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/base/client.go:26 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/base/client.go:39 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/chunker/driver.go:348 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/chunker/driver.go:351 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/cstcloud_capsule/driver.go:41 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/doubao/util.go:23 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
drivers/doubao_new/driver.go:161 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/ftps/util.go:28 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
drivers/gitee/driver.go:176 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
drivers/github/driver.go:12 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
drivers/github/util.go:9 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/halalcloud/driver.go:269 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/halalcloud/util.go:115 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/halalcloud/util.go:355 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/halalcloud/util.go:53 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
drivers/ipfs_api/driver.go:180 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
drivers/ipfs_api/driver.go:82 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/lanzou/util.go:127 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/lanzou/util.go:127 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/lanzou/util.go:184 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/lanzou/util.go:184 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/lanzou/util.go:512 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/lanzou/util.go:512 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/mediafire/driver.go:14 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/mediatrack/driver.go:214 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/netease_music/crypto.go:121 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/netease_music/types.go:105 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/netease_music/types.go:105 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/netease_music/upload.go:51 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/onedrive_sharelink/util.go:26 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/pikpak/util.go:358 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/pikpak/util.go:364 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/pikpak_share/util.go:225 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/pikpak_share/util.go:231 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.avoid-bind-to-all-interfaces |
drivers/proton_drive/util.go:153 | Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
drivers/quark_uc/util.go:11 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/quark_uc/util.go:460 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/quark_uc_tv/util.go:202 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.avoid-ssh-insecure-ignore-host-key |
drivers/sftp/util.go:33 | Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/sjtu_netdisk/util.go:57 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/sjtu_netdisk/util.go:57 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/sjtu_netdisk/util.go:59 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/sjtu_netdisk/util.go:59 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/terabox/driver.go:202 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunder/meta.go:53 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunder/util.go:252 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunder/util.go:253 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunder/util.go:272 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunder/util.go:278 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunder_browser/meta.go:55 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunder_browser/util.go:225 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunder_browser/util.go:226 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunder_browser/util.go:270 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunder_browser/util.go:279 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunder_browser/util.go:285 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunderx/meta.go:51 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunderx/util.go:229 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunderx/util.go:230 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/thunderx/util.go:249 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/thunderx/util.go:255 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/trainbit/util.go:21 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/trainbit/util.go:21 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/trainbit/util.go:26 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/trainbit/util.go:26 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/trainbit/util.go:48 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/trainbit/util.go:48 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
drivers/trainbit/util.go:53 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
drivers/trainbit/util.go:53 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
drivers/url_tree/driver.go:11 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/vtencent/signature.go:14 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/vtencent/util.go:254 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
drivers/webdav/util.go:24 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/wukong/driver.go:872 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/yunpan360/upload.go:265 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/yunpan360/upload.go:266 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/yunpan360/upload.go:773 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
drivers/yunpan360/upload.go:781 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
drivers/yunpan360/util.go:156 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | osv/GHSA-34rh-wp3j-6cxc |
go.mod | github.com/pion/stun/[email protected] (Go) is affected by GHSA-34rh-wp3j-6cxc | Dependencies (osv-scanner) |
| medium | osv/GHSA-38xv-hf3p-h7mq |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6457, GHSA-38xv-hf3p-h7mq | Dependencies (osv-scanner) |
| medium | osv/GHSA-3x6r-wxxg-53vv |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6183, GHSA-3x6r-wxxg-53vv | Dependencies (osv-scanner) |
| medium | osv/GHSA-44p7-9xx4-hf2g |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-4815, GHSA-44p7-9xx4-hf2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-45gg-vh54-h5m9 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4vr5-p2gc-h23p |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6185, GHSA-4vr5-p2gc-h23p | Dependencies (osv-scanner) |
| medium | osv/GHSA-4w3g-jfj2-cw2q |
go.mod | github.com/go-jose/go-jose/[email protected] (Go) is affected by GHSA-4w3g-jfj2-cw2q | Dependencies (osv-scanner) |
| medium | osv/GHSA-5cv4-jp36-h3mw |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5028, GHSA-5cv4-jp36-h3mw | Dependencies (osv-scanner) |
| medium | osv/GHSA-78mq-xcr3-xm33 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33 | Dependencies (osv-scanner) |
| medium | osv/GHSA-7p4m-qxvv-g567 |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6186, GHSA-7p4m-qxvv-g567 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8c48-q9wj-3w37 |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6187, GHSA-8c48-q9wj-3w37 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8mxv-9xhp-86h4 |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6188, GHSA-8mxv-9xhp-86h4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8v25-v8p6-qf7v |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6189, GHSA-8v25-v8p6-qf7v | Dependencies (osv-scanner) |
| medium | osv/GHSA-9f3f-wv7r-qc8r |
go.mod | github.com/pion/dtls/[email protected] (Go) is affected by GO-2026-4479, GHSA-9f3f-wv7r-qc8r | Dependencies (osv-scanner) |
| medium | osv/GHSA-9m57-25v3-79x9 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9w9f-6mg8-jp7w |
go.mod | github.com/blevesearch/bleve/[email protected] (Go) is affected by GO-2022-0470, GHSA-9w9f-6mg8-jp7w | Dependencies (osv-scanner) |
| medium | osv/GHSA-c5q2-7r4c-mv6g |
go.mod | gopkg.in/square/[email protected] (Go) is affected by GO-2024-2631, GHSA-c5q2-7r4c-mv6g | Dependencies (osv-scanner) |
| medium | osv/GHSA-f8g7-2xjc-7mfh |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6459, GHSA-f8g7-2xjc-7mfh | Dependencies (osv-scanner) |
| medium | osv/GHSA-g754-hx8w-x2g6 |
go.mod | github.com/quic-go/[email protected] (Go) is affected by GO-2025-4233, GHSA-g754-hx8w-x2g6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h4mf-4v27-hggj |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6197, GHSA-h4mf-4v27-hggj | Dependencies (osv-scanner) |
| medium | osv/GHSA-hrxh-9w67-g4cv |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2024-3271, GHSA-hrxh-9w67-g4cv | Dependencies (osv-scanner) |
| medium | osv/GHSA-j6qf-3m9c-vwj3 |
go.mod | github.com/go-chi/chi/[email protected] (Go) is affected by GHSA-j6qf-3m9c-vwj3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jc7w-c686-c4v9 |
go.mod | github.com/ulikunitz/[email protected] (Go) is affected by GO-2025-3922, GHSA-jc7w-c686-c4v9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-p6m2-r3w9-mpxw |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6461, GHSA-p6m2-r3w9-mpxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-pjcq-xvwq-hhpj |
go.mod | github.com/Azure/[email protected] (Go) is affected by GO-2026-5543, GHSA-pjcq-xvwq-hhpj | Dependencies (osv-scanner) |
| medium | osv/GHSA-pq96-pwvg-vrr9 |
go.mod | github.com/fatedier/[email protected] (Go) is affected by GO-2026-5549, GHSA-pq96-pwvg-vrr9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-q7pp-wcgr-pffx |
go.mod | github.com/disintegration/[email protected] (Go) is affected by GHSA-q7pp-wcgr-pffx | Dependencies (osv-scanner) |
| medium | osv/GHSA-qc2q-p7wx-3px3 |
go.mod | google.golang.org/[email protected] (Go) is affected by GO-2026-6441, GHSA-qc2q-p7wx-3px3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-qpw4-5x99-6vjp |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp | Dependencies (osv-scanner) |
| medium | osv/GHSA-rwvp-r38j-9rgg |
go.mod | github.com/nwaples/rardecode/[email protected] (Go) is affected by GO-2025-4020, GHSA-rwvp-r38j-9rgg | Dependencies (osv-scanner) |
| medium | osv/GHSA-vrw8-fxc6-2r93 |
go.mod | github.com/go-chi/chi/[email protected] (Go) is affected by GHSA-vrw8-fxc6-2r93 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vvgj-x9jq-8cj9 |
go.mod | github.com/quic-go/[email protected] (Go) is affected by GO-2026-5676, GHSA-vvgj-x9jq-8cj9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vvm8-gf78-28g4 |
go.mod | github.com/go-jose/go-jose/[email protected] (Go) is affected by GHSA-vvm8-gf78-28g4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-xhf4-832v-7xcr |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6199, GHSA-xhf4-832v-7xcr | Dependencies (osv-scanner) |
| medium | osv/GO-2022-0635 |
go.mod | github.com/aws/[email protected] (Go) is affected by GO-2022-0635 | Dependencies (osv-scanner) |
| medium | osv/GO-2022-0646 |
go.mod | github.com/aws/[email protected] (Go) is affected by GO-2022-0646 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-4918 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-4918 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-4950 |
go.mod | github.com/valyala/[email protected] (Go) is affected by GO-2026-4950 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-4961 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-4961 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-4962 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-4962 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5024 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5024 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5025 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5025 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5026 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5026 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5027 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5027 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5029 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5029 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5030 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5030 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5031 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5031 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5061 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5061 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5062 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5062 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5066 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5066 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5320 |
go.mod | github.com/yuin/[email protected] (Go) is affected by GO-2026-5320 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5775 |
go.mod | github.com/go-chi/chi/[email protected] (Go) is affected by GO-2026-5775 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5777 |
go.mod | github.com/go-chi/chi/[email protected] (Go) is affected by GO-2026-5777 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5932 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5932 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5942 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5942 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-5970 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-5970 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6179 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6179 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6180 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6180 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6222 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6222 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6303 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6303 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6354 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6354 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6355 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6355 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6603 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6603 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6610 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6610 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6611 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6611 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6612 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6612 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6617 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6617 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6629 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6629 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6860 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6860 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6865 |
go.mod | github.com/klauspost/[email protected] (Go) is affected by GO-2026-6865 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6866 |
go.mod | golang.org/x/[email protected] (Go) is affected by GO-2026-6866 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6888 |
go.mod | github.com/andybalholm/[email protected] (Go) is affected by GO-2026-6888 | Dependencies (osv-scanner) |
| medium | osv/GO-2026-6911 |
go.mod | github.com/mark3labs/[email protected] (Go) is affected by GO-2026-6911 | Dependencies (osv-scanner) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
internal/fs/archive.go:8 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
internal/net/serve.go:286 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
internal/search/db/init.go:25 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.database.string-formatted-query |
internal/search/db/init.go:34 | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
pkg/aria2/rpc/call.go:63 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-httponly |
pkg/cookie/cookie.go:33 | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.cookie-missing-secure |
pkg/cookie/cookie.go:33 | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
pkg/generic_sync/map.go:181 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
pkg/generic_sync/map.go:199 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
pkg/generic_sync/map.go:259 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
pkg/generic_sync/map.go:71 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
pkg/generic_sync/map.go:97 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-md5 |
pkg/gowebdav/digestAuth.go:84 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
pkg/qbittorrent/client.go:100 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.shared-url-struct-mutation |
pkg/qbittorrent/client.go:149 | Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
pkg/utils/hash/gcid.go:37 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
pkg/utils/hash/gcid.go:38 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
pkg/utils/random/random.go:6 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
server/ftp.go:16 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
server/ftp.go:288 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion |
server/handles/ldap_login.go:168 | `MinVersion` is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
server/s3/server.go:7 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
server/webdav/buffered_response_writer.go:39 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.use-tls |
server/webdav/litmus_test_server.go:94 | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.injection.open-redirect |
server/webdav/webdav.go:257 | An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.injection.open-redirect |
server/webdav/webdav.go:263 | An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
server/webdav/webdav.go:91 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:144 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:158 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:191 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:196 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:223 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:229 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:244 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:249 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:91 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build.sh:96 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/unsound-ternary |
.github/workflows/release_docker.yml:134 | unsound pseudo-ternary expression [confidence high] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
drivers/123/types.go:74 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/123_share/types.go:72 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/139/util.go:40 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/halalcloud/util.go:34 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/pcloud/util.go:18 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/pikpak/driver.go:41 | Possible generic-api-key secret in history (commit 7013d1b7b8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/pikpak/pikpak.go:27 | Possible generic-api-key secret in history (commit c64c003257); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/pikpak/util.go:81 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/pikpak_share/driver.go:33 | Possible generic-api-key secret in history (commit 7013d1b7b8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/pikpak_share/util.go:63 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/quark_uc_tv/meta.go:41 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/thunder_browser/util.go:39 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/thunderx/util.go:45 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/wopan/driver_test.go:22 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/xunlei/driver.go:67 | Possible generic-api-key secret in history (commit 35d177b67b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/xunlei/util.go:16 | Possible generic-api-key secret in history (commit 2964d5a6db); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
drivers/yunpan360/types.go:17 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | osv/GHSA-2x5j-vhc8-9cwm |
go.mod | github.com/cloudflare/[email protected] (Go) is affected by GO-2025-3754, GHSA-2x5j-vhc8-9cwm | Dependencies (osv-scanner) |
| low | osv/GHSA-486v-q2wf-fp2r |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6463, GHSA-486v-q2wf-fp2r | Dependencies (osv-scanner) |
| low | osv/GHSA-945v-v9p3-v5xw |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6190, GHSA-945v-v9p3-v5xw | Dependencies (osv-scanner) |
| low | osv/GHSA-gwfq-86j8-7qhv |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6181, GHSA-gwfq-86j8-7qhv | Dependencies (osv-scanner) |
| low | osv/GHSA-gx4c-2hqx-cw2r |
go.mod | github.com/rclone/[email protected] (Go) is affected by GO-2026-6196, GHSA-gx4c-2hqx-cw2r | Dependencies (osv-scanner) |
| low | osv/GHSA-j88v-2chj-qfwx |
go.mod | github.com/jackc/pgx/[email protected] (Go) is affected by GO-2026-5004, GHSA-j88v-2chj-qfwx | Dependencies (osv-scanner) |
| low | osv/GHSA-q9hv-hpm4-hj6x |
go.mod | github.com/cloudflare/[email protected] (Go) is affected by GO-2026-4550, GHSA-q9hv-hpm4-hj6x | Dependencies (osv-scanner) |
| info | zizmor/superfluous-actions |
.github/workflows/beta_release.yml:121 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/beta_release.yml:47 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release.yml:69 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release_android.yml:39 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release_freebsd.yml:39 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release_linux_musl.yml:39 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release_linux_musl_arm.yml:39 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 104 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 105 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 138 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 17 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 92e745360766 | prov-5+qual-2+sec-2 | 2% | 59 | 40 |
Full text report
- Repository: https://github.com/AlistGo/alist
- Commit:
92e745360766cce32564f94a468cb576f577d27e - Generated: 2026-11-14T15:09:39+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 2 | explicit | 95% | 100% |
| Code quality | 59 | weak | 90% | 100% |
| Security | 40 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.
- Explicitly attributed share (lower bound): 2.5%
- Unattributed share in AI-consistent velocity bursts: 15.3%
- Estimated AI-generated share: 2.5%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 10 | 2,027 |
| GitHub Copilot coding agent | 6 | 2,497 |
| Claude Code | 4 | 548 |
Current source lines last changed by AI-attributed commits: 3,644 of 120,066.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.372 | 1.675 | 0.82x |
| Security | 0.274 | 1.28 | 0.21x |
- Stylometry index: 0.10 per 1,000 lines (narrated steps 11, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-11 | 502 | 0% |
| 2025-12 | 323 | 0% |
| 2026-01 | 480 | 0% |
| 2026-02 | 2,387 | 1% |
| 2026-03 | 10,825 | 0% |
| 2026-04 | 3,600 | 14% |
| 2026-05 | 1,773 | 3% |
| 2026-06 | 1,176 | 0% |
| 2026-07 | 1,994 | 0% |
| 2026-08 | 5,841 | 5% |
| 2026-09 | 4,829 | 31% |
| 2026-10 | 1,783 | 11% |
Evidence
- OpenAI Codex: on merged branch (fa54f7e3a2) (5bb1b5f442ab)
- OpenAI Codex: on merged branch (fa54f7e3a2) (6ed3de481e1b)
- OpenAI Codex: on merged branch (64d7e4519d) (754338e06a82)
- OpenAI Codex: PR branch 'codex/fix-9646-thumbnail-cache' (1a8fccf80532)
- OpenAI Codex: on merged branch (c0caa562d9) (656e3df5b39e)
- OpenAI Codex: on merged branch (26a1c3816c) (c45ddbaa14da)
- OpenAI Codex: on merged branch (5543ac59f3) (9d327da25dac)
- OpenAI Codex: on merged branch (3e49fa4630) (c5348e976fb5)
- Claude Code: trailer 'Co-Authored-By: Claude' (69464a2825d0)
- Claude Code: trailer 'Co-Authored-By: Claude' (0e9f874637f4)
- Claude Code: trailer 'Co-Authored-By: Claude' (9c8c16945cfc)
- Claude Code: trailer 'Co-Authored-By: Claude' (9b697e452581)
- OpenAI Codex: on merged branch (03c08cba75) (7dc8231e177b)
- OpenAI Codex: on merged branch (315b2a83e6) (cf01ff6f4e40)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (41bdab49aa8a)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.12, no CI test run detected; 12% of function code in complex or long functions; 13% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 71 |
| Duplication | 45 |
| Code smells (Opengrep) | 67 |
| Tests and CI | 48 |
| Documentation | 80 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 6,094; mean complexity 3.3, 90th percentile 8; 101 complex and 36 long functions
- Duplicated lines: 13.4% of 84,689 compared
- Tests: 14,570 test lines for 120,066 source lines (ratio 0.12); CI test commands: none detected; 18% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- unmarshal in server/webdav/internal/xml/read.go: complexity 86, 233 lines
- rawToken in server/webdav/internal/xml/xml.go: complexity 82, 261 lines
- Put in drivers/139/driver.go: complexity 52, 286 lines
- Move in drivers/github/driver.go: complexity 52, 209 lines
- text in server/webdav/internal/xml/xml.go: complexity 50, 146 lines
Security
Security posture is poor: 105 known vulnerabilities in 28 dependencies; 2 high-severity SAST findings; 66 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 57 |
| Static analysis (Opengrep) | 78 |
| Vulnerable dependencies (OSV) | 12 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 105 in 28 packages (critical 11, high 14, medium 33, low 7)
-
Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-25qr-6mpr-f7qx: github.com/rclone/[email protected] (Go) is affected by GO-2026-4964, GHSA-25qr-6mpr-f7qx |
go.mod |
| critical | osv/GHSA-jfwf-28xr-xw6q: github.com/rclone/[email protected] (Go) is affected by GO-2026-5466, GHSA-jfwf-28xr-xw6q |
go.mod |
| critical | osv/GHSA-qw24-gh76-8rvv: github.com/rclone/[email protected] (Go) is affected by GO-2026-5596, GHSA-qw24-gh76-8rvv |
go.mod |
| critical | osv/GHSA-xwwr-4h3p-r22c: github.com/rclone/[email protected] (Go) is affected by GO-2026-6462, GHSA-xwwr-4h3p-r22c |
go.mod |
| critical | osv/GHSA-jppx-rxg9-jmrx: golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx |
go.mod |
| critical | osv/GHSA-f5wc-c3c7-36mc: golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc |
go.mod |
| critical | osv/GHSA-vgwf-h737-ff37: golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37 |
go.mod |
| critical | osv/GHSA-89gr-r52h-f8rx: golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx |
go.mod |
| critical | osv/GHSA-rm3j-f69w-wqmq: golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq |
go.mod |
| critical | osv/GHSA-5cgq-3rg8-m6cv: golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv |
go.mod |
| critical | osv/GHSA-x527-x647-q7gg: golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg |
go.mod |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:42 |
| high | opengrep/go.lang.security.audit.dangerous-exec-cmd: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium] |
cmd/start.go:37 |
| high | osv/GHSA-26gq-p25f-99cp: github.com/fatedier/[email protected] (Go) is affected by GO-2026-6103, GHSA-26gq-p25f-99cp |
go.mod |
| high | osv/GHSA-mgcc-cww5-fp2q: github.com/go-jose/go-jose/[email protected] (Go) is affected by GHSA-mgcc-cww5-fp2q |
go.mod |
| high | osv/GHSA-259r-337f-4rfw: github.com/klauspost/[email protected] (Go) is affected by GO-2026-5841, GHSA-259r-337f-4rfw |
go.mod |
| high | osv/GHSA-2m8m-jhrm-w6j2: github.com/rclone/[email protected] (Go) is affected by GO-2026-6182, GHSA-2m8m-jhrm-w6j2 |
go.mod |
| high | osv/GHSA-45pq-889g-fcgh: github.com/rclone/[email protected] (Go) is affected by GO-2026-6184, GHSA-45pq-889g-fcgh |
go.mod |
| high | osv/GHSA-cf44-9pgv-m4xc: github.com/rclone/[email protected] (Go) is affected by GO-2026-6191, GHSA-cf44-9pgv-m4xc |
go.mod |
| high | osv/GHSA-fqj9-69pf-6pjg: github.com/rclone/[email protected] (Go) is affected by GO-2026-6195, GHSA-fqj9-69pf-6pjg |
go.mod |
| high | osv/GHSA-c476-6w5q-jw77: github.com/rclone/[email protected] (Go) is affected by GO-2026-6458, GHSA-c476-6w5q-jw77 |
go.mod |
| high | osv/GHSA-q4h4-gmj2-qvw2: golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2 |
go.mod |
| high | osv/GHSA-w879-237q-wc7r: golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r |
go.mod |
| high | osv/GHSA-q675-qj96-32m9: golang.org/x/[email protected] (Go) is affected by GO-2026-5032, GHSA-q675-qj96-32m9 |
go.mod |
| high | osv/GHSA-hrxh-6v49-42gf: google.golang.org/[email protected] (Go) is affected by GO-2026-6061, GHSA-hrxh-6v49-42gf |
go.mod |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v3.66.0 ships alist-android-386.tar.gz (515 downloads)
- binary-release-asset: release v3.66.0 ships alist-android-amd64.tar.gz (534 downloads)
- binary-release-asset: release v3.66.0 ships alist-android-arm.tar.gz (334 downloads)
- binary-release-asset: release v3.66.0 ships alist-android-arm64.tar.gz (639 downloads)
- binary-release-asset: release v3.66.0 ships alist-darwin-amd64.tar.gz (818 downloads)
- readme-download-lure: links to file hosts or shorteners: mediafire.com, mega.nz, t.me/
- readme-download-lure: links to file hosts or shorteners: mediafire.com, mega.nz, t.me/
- readme-download-lure: links to file hosts or shorteners: mediafire.com, mega.nz, t.me/
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 120,066; test lines: 14,570
| Language | Lines |
|---|---|
| Go | 134,084 |
| Shell | 445 |
| Python | 107 |