Leaderboard github.com
Freika/dawarich
Your favorite self-hostable alternative to Google Timeline (Google Location History)
AI provenance
3%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
94/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
50/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
3% explicit
Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals.
How the score is built
- Explicitly attributed share3%
- Unattributed share in AI-pace bursts26%
- Estimated AI-generated share3%
- AI tool configuration files2
- Work sessions at AI pace53
- Releases at AI pace9
- Coding-style index (1.0+ means possible)0.27
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 29 | 17,933 | 2026-05-02 | 2026-09-21 |
| GitHub Copilot coding agent | 5 | 10 | 2026-02-27 | 2026-08-10 |
Lines added per month all AI-attributed share
- 2022-041,199 · 0% AI
- 2022-080 · 0% AI
- 2022-1016 · 0% AI
- 2022-120 · 0% AI
- 2023-02163 · 0% AI
- 2023-050 · 0% AI
- 2023-10386 · 0% AI
- 2023-120 · 0% AI
- 2024-0135 · 0% AI
- 2024-031,680 · 0% AI
- 2024-041,397 · 0% AI
- 2024-051,376 · 0% AI
- 2024-061,269 · 0% AI
- 2024-073,500 · 0% AI
- 2024-083,329 · 0% AI
- 2024-091,804 · 0% AI
- 2024-101,615 · 0% AI
- 2024-114,461 · 0% AI
- 2024-124,290 · 0% AI
- 2025-013,652 · 0% AI
- 2025-023,168 · 0% AI
- 2025-038,416 · 0% AI
- 2025-042,913 · 0% AI
- 2025-055,536 · 0% AI
- 2025-068,681 · 0% AI
- 2025-0717,542 · 0% AI
- 2025-0810,175 · 0% AI
- 2025-0918,265 · 0% AI
- 2025-105,807 · 0% AI
- 2025-1118,793 · 0% AI
- 2025-1242,409 · 0% AI
- 2026-0144,797 · 0% AI
- 2026-0256,590 · 0% AI
- 2026-0322,335 · 0% AI
- 2026-0422,963 · 0% AI
- 2026-0530,482 · 5% AI
- 2026-0635,003 · 47% AI
- 2026-0724,729 · 0% AI
- 2026-0850,672 · 0% AI
- 2026-0953,251 · 0% AI
- 2026-1059,006 · 0% AI
- 2026-115,420 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 2,165 lines trace to AI-attributed commits, 118,718 to others (sampled). Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.47 | 0.00× |
| Security | 1.39 | 1.96 | 0.71× |
Evidence by analyzer
Explicit AI attributionok27 items
- Claude Code: 29 attributed commits, 17,933 lines added
- GitHub Copilot coding agent: 5 attributed commits, 10 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: trailer 'Co-authored-by: Claude'
- attributed_commit_share
- 0.8%
- attributed_commits
- 34
- attributed_loc
- 17,943
- attributed_loc_share
- 3.1%
- commits
- 4,375
- effective_loc
- 577,125
- tools_detected
- 2
AI tool configurationok2 items
- artifacts
- 2
- earliest_adoption
- 2025-08-30
- tools_configured
- 2
- workflow_agents
- 0
Commit velocityok15 items
- 3,207 lines of first-party code in ~0.5h (5,899 lines/hour, 10 commit session)
- 4,711 lines of first-party code in ~1.4h (3,386 lines/hour, 8 commit session)
- 3,222 lines of first-party code in ~1.0h (3,255 lines/hour, 2 commit session)
- 1,524 lines of first-party code in ~0.5h (3,048 lines/hour, 2 commit session)
- 1,216 lines of first-party code in ~0.5h (2,432 lines/hour, 1 commit session)
- 3,437 lines of first-party code in ~1.6h (2,176 lines/hour, 3 commit session)
- 1,019 lines of first-party code in ~0.5h (2,038 lines/hour, 4 commit session)
- 1,010 lines of first-party code in ~0.5h (2,020 lines/hour, 2 commit session)
- 2,640 lines of first-party code in ~1.8h (1,496 lines/hour, 1 commit session)
- 5,557 lines of first-party code in ~3.7h (1,490 lines/hour, 40 commit session)
- 7,133 lines of first-party code in ~5.0h (1,432 lines/hour, 16 commit session)
- 6,457 lines of first-party code in ~4.6h (1,412 lines/hour, 34 commit session)
- 2,911 lines of first-party code in ~2.2h (1,325 lines/hour, 2 commit session)
- 5,293 lines of first-party code in ~4.0h (1,319 lines/hour, 4 commit session)
- 2,007 lines of first-party code in ~1.5h (1,304 lines/hour, 11 commit session)
- excluded_import_loc
- 105,272
- flagged_loc
- 148,298
- flagged_loc_share
- 31.8%
- flagged_units
- 53
- max_loc_per_hour
- 5,899.44
- measured_loc
- 466,272
- median_loc_per_hour
- 129.46
- pr_timed_units
- 102
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 1,208
Release velocityok9 items
- 1.0.1 → 1.0.2-rc.1: 16,182 lines in 0.27 days (59,956.5 lines/day)
- 1.0.4 → 1.1.0-rc.1: 24,505 lines in 5.51 days (4,443.7 lines/day)
- 1.1.0 → 1.1.1-rc.1: 27,148 lines in 4.3 days (6,310.0 lines/day)
- 1.9.0 → 1.9.1: 11,893 lines in 0.97 days (12,223.5 lines/day)
- 1.14.1 → 1.14.2: 6,255 lines in 2.08 days (3,011.4 lines/day)
- 1.14.3 → 1.14.4: 5,389 lines in 1.13 days (4,770.0 lines/day)
- 1.15.1 → 1.15.2: 9,586 lines in 0.94 days (10,249.9 lines/day)
- 1.17.0 → 1.18.0: 19,612 lines in 2.04 days (9,606.1 lines/day)
- 1.18.1 → 1.19.0: 9,293 lines in 1.12 days (8,316.0 lines/day)
- flagged_releases
- 9
- max_loc_per_day
- 59,956.50
- releases
- 99
Coding styleok3 items
- step-by-step narration comment: # First, ensure the 'maps' key exists for users that don't have it
- step-by-step narration comment: # Step 1: Database Setup
- step-by-step narration comment: # Step 2: Run migrations for all databases
- count:assistant_voice
- 0
- count:emoji_in_code
- 60
- count:narrated_steps
- 3
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 18
- files:narrated_steps
- 2
- files:placeholder
- 0
- index
- 0.27
- lines_scanned
- 124,526
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.48
- per_kloc:narrated_steps
- 0.02
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 2,165
- blame_failures
- 0
- files_blamed
- 1,500
- other_lines
- 118,718
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 56
- quality:other_per_kloc
- 0.47
- quality:ratio
- 0
- security:ai_findings
- 3
- security:ai_per_kloc
- 1.39
- security:other_findings
- 233
- security:other_per_kloc
- 1.96
- security:ratio
- 0.71
Code quality
94 strong
Code quality is strong: test-to-source ratio 1.53, CI runs tests; 2% of function code in complex or long functions; 3% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity93
- Duplication83
- Lint and smells95
- Tests and CI100
- Documentation100
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- fe in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 172, 1 lines
- addLine in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 67, 1 lines
- syncToggleStates in app/javascript/controllers/maps/maplibre/settings_manager.js: complexity 40, 161 lines
- ru in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 40, 1 lines
- hx in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 39, 1 lines
- evaluate in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 37, 1 lines
- _parse in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 36, 1 lines
- fa in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 36, 1 lines
- u_ in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 35, 1 lines
- i_ in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 35, 1 lines
- complex_functions
- 92
- function_nloc
- 84,144
- functions
- 12,008
- long_functions
- 7
- many_param_functions
- 42
- mean_ccn
- 2.53
- p90_ccn
- 5
- risky_nloc_share
- 2.3%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: app/controllers/api/v1/auth/apple_controller.rb:16 and app/controllers/api/v1/auth/google_controller.rb:16
- 6+ duplicated lines: app/controllers/api/v1/insights_controller.rb:77 and app/controllers/insights_controller.rb:189
- 6+ duplicated lines: app/controllers/api/v1/places_controller.rb:236 and app/controllers/api/v1/visits/select_place_controller.rb:39
- 6+ duplicated lines: app/controllers/api/v1/shared/base_controller.rb:27 and app/controllers/shared/links_controller.rb:36
- 6+ duplicated lines: app/controllers/auth/account_links_controller.rb:57 and app/controllers/auth/account_links_controller.rb:74
- 6+ duplicated lines: app/controllers/imports_controller.rb:196 and app/controllers/settings/users_controller.rb:206
- 6+ duplicated lines: app/controllers/insights_controller.rb:11 and app/controllers/insights_controller.rb:28
- 6+ duplicated lines: app/controllers/shared/digests_controller.rb:46 and app/controllers/shared/stats_controller.rb:46
- 6+ duplicated lines: app/controllers/visits_controller.rb:260 and app/controllers/visits_controller.rb:354
- 6+ duplicated lines: app/javascript/channels/family_locations_channel.js:4 and app/javascript/maps_maplibre/channels/map_channel.js:34
- compared_lines
- 83,631
- duplicated_lines
- 2,643
- duplicated_share
- 3.2%
- files
- 1,550
Lintok
- category:best-practice
- 8
- category:correctness
- 44
- category:performance
- 4
- findings
- 56
- scanned_lines
- 124,437
- weighted_findings
- 27.50
Tests and CIok11 items
- CI config: .github/workflows/attach_compose.yml
.github/workflows/attach_compose.yml - CI config: .github/workflows/biome.yml
.github/workflows/biome.yml - CI config: .github/workflows/build_and_push.yml
.github/workflows/build_and_push.yml - CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/mirror-onedev.yml
.github/workflows/mirror-onedev.yml - CI config: .github/workflows/release_notifications.yml
.github/workflows/release_notifications.yml - CI config: .github/workflows/rubocop.yml
.github/workflows/rubocop.yml - CI config: .github/workflows/security.yml
.github/workflows/security.yml - CI config: .github/workflows/trivy.yml
.github/workflows/trivy.yml - CI runs tests (npm test, bundle exec rspec, rspec)
- CI runs linters (biome, rubocop)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 9
- cochange_commits
- 207
- cochange_share
- 95.2%
- source_lines
- 124,535
- test_lines
- 191,041
- test_ratio
- 1.53
Documentationok4 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 131
Type safetyskipped
Security
50 weak
Security posture is weak: 8 known vulnerabilities in 4 dependencies; 76 high-severity SAST findings; 28 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets69
- Static analysis (SAST)63
- Vulnerable dependencies57
- CI workflows0
- Security posture40
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 8
- declared
- 8
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 2
- secrets_nonprod
- 9
Static analysis (opengrep)ok
- findings
- 383
- findings_high
- 76
- findings_low
- 7
- findings_medium
- 300
- parse_errors
- 221
- scanned_lines
- 124,437
- weighted_findings
- 162.89
Dependencies (osv-scanner)ok
- penalty
- 34
- vulnerabilities
- 8
- vulnerable_packages
- 4
- vulns_critical
- 1
- vulns_high
- 3
- vulns_low
- 1
- vulns_medium
- 1
- vulns_unknown
- 2
CI workflows (zizmor)ok
- findings
- 50
- findings_high
- 28
- findings_low
- 12
- findings_medium
- 10
- penalty
- 346.50
- workflows
- 9
Security postureok1 item
- Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
1 critical107 high255 medium57 low5 info
425 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-cg2g-xh64-v4q7 |
package-lock.json | [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 | Dependencies (osv-scanner) |
| high | opengrep/dockerfile.security.last-user-is-root |
.devcontainer/Dockerfile:35 | The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'. [confidence medium] | Static analysis (opengrep) |
| high | zizmor/unpinned-uses |
.github/workflows/attach_compose.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/attach_compose.yml:21 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/biome.yml:12 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/biome.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:100 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:122 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:136 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:141 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:147 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:150 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:62 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:67 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/build_and_push.yml:70 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:70 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:82 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build_and_push.yml:87 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:24 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-images |
.github/workflows/ci.yml:54 | unpinned image references [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:69 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:75 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:80 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/mirror-onedev.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_notifications.yml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/release_notifications.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/rubocop.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/rubocop.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-73v3-wf97-vpgj |
Gemfile.lock | [email protected] (RubyGems) is affected by GHSA-73v3-wf97-vpgj | Dependencies (osv-scanner) |
| high | opengrep/ruby.lang.security.missing-csrf-protection |
app/controllers/application_controller.rb:3 | Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. [confidence low] | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attr-accessible |
app/controllers/settings/users_controller.rb:153 | Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id.... | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/achievement_card_controller.js:78 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/achievement_card_controller.js:78 | User controlled data in a `this.materialTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/achievement_unlocks_controller.js:98 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/achievement_unlocks_controller.js:98 | User controlled data in a `this.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/clipboard_controller.js:86 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/clipboard_controller.js:86 | User controlled data in a `button.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/flash_controller.js:64 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/flash_controller.js:64 | User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/immich_enrich_controller.js:204 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/immich_enrich_controller.js:204 | User controlled data in a `this.resultsSummaryTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/immich_enrich_controller.js:248 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/immich_enrich_controller.js:248 | User controlled data in a `item.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/immich_enrich_controller.js:311 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/immich_enrich_controller.js:311 | User controlled data in a `tooltip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:222 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:222 | User controlled data in a `this.controller.selectedVisitsContainerTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:307 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:307 | User controlled data in a `bulkActionsDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre/event_handlers.js:215 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre/event_handlers.js:215 | User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre_controller.js:1536 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre_controller.js:1536 | User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre_controller.js:1644 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre_controller.js:1644 | User controlled data in a `this.infoContentTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre_controller.js:1648 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre_controller.js:1648 | User controlled data in a `this.infoActionsTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/maps/maplibre_controller.js:753 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/maps/maplibre_controller.js:753 | User controlled data in a `frame.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/onboarding_modal_controller.js:135 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/onboarding_modal_controller.js:135 | User controlled data in a `this.demoButtonTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/onboarding_modal_controller.js:161 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/onboarding_modal_controller.js:161 | User controlled data in a `this.demoButtonTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/place_creation_controller.js:125 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/place_creation_controller.js:125 | User controlled data in a `this.nearbyFrameTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/sharing_modal_controller.js:42 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/sharing_modal_controller.js:42 | User controlled data in a `button.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/sharing_modal_controller.js:46 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/sharing_modal_controller.js:46 | User controlled data in a `button.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/speed_color_editor_controller.js:66 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/speed_color_editor_controller.js:66 | User controlled data in a `this.stopsListTarget.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/timeline_feed_controller.js:763 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/timeline_feed_controller.js:763 | User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/controllers/upload_controller.js:220 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/controllers/upload_controller.js:220 | User controlled data in a `wrapper.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/components/photo_cluster_gallery.js:145 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/components/photo_cluster_gallery.js:145 | User controlled data in a `preview.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/components/visit_place_search.js:112 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/components/visit_place_search.js:112 | User controlled data in a `this.list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/components/visit_place_search.js:269 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/components/visit_place_search.js:269 | User controlled data in a `this.list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/components/visit_place_search.js:274 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/components/visit_place_search.js:274 | User controlled data in a `this.list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/components/visit_place_search.js:32 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/components/visit_place_search.js:32 | User controlled data in a `this.mount.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/editing/point_edit_history_panel.js:150 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/editing/point_edit_history_panel.js:150 | User controlled data in a `button.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:265 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:265 | User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:278 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:278 | User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:291 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:291 | User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:304 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:304 | User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:326 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:326 | User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:349 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:349 | User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:547 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:547 | User controlled data in a `modal.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
app/javascript/maps_maplibre/utils/search_manager.js:687 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
app/javascript/maps_maplibre/utils/search_manager.js:687 | User controlled data in a `notification.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
docker/Dockerfile:152 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | osv/GHSA-68fv-2mgg-jv7q |
package-lock.json | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q | Dependencies (osv-scanner) |
| high | osv/GHSA-mrv2-3pqr-j5jr |
package-lock.json | [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:396 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:632 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:709 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre/settings_manager.js:370 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre/settings_manager.js:749 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre/settings_manager.js:785 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/controllers/maps/maplibre_controller.js:1753 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
app/javascript/maps_maplibre/components/place_actions.js:5 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:49 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:50 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:61 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:62 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:66 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:67 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:69 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:72 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:76 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
app/javascript/video_studio/video_renderer.js:77 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:18 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:34 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:5 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/template-injection |
.github/workflows/build_and_push.yml:95 | code injection via template expansion [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/security.yml:106 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/security.yml:26 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/security.yml:51 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/security.yml:71 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/trivy.yml:30 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/trivy.yml:81 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/GHSA-m27g-v28p-f9fx |
Gemfile.lock | [email protected] (RubyGems) is affected by GHSA-m27g-v28p-f9fx | Dependencies (osv-scanner) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/achievements/collectibles_controller.rb:43 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/achievements_controller.rb:16 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/achievements_controller.rb:21 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/achievements_controller.rb:35 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/admin/settings_controller.rb:34 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/admin/settings_controller.rb:39 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/admin/settings_controller.rb:41 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/admin/settings_controller.rb:50 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.mass-assignment-vuln |
app/controllers/api/v1/auth/otp_challenges_controller.rb:5 | Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix:... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.weak-hashes-md5 |
app/controllers/api/v1/shared/photos_controller.rb:87 | Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.mass-assignment-vuln |
app/controllers/api/v1/subscriptions_controller.rb:18 | Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix:... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/application_controller.rb:362 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/auth/account_links_controller.rb:116 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.mass-assignment-vuln |
app/controllers/auth/account_links_controller.rb:13 | Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix:... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/auth/account_links_controller.rb:142 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/concerns/place_bulk_actions.rb:18 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/concerns/utm_trackable.rb:10 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/family/invitations_controller.rb:33 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/family/invitations_controller.rb:52 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/family/location_requests_controller.rb:23 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/family/location_requests_controller.rb:39 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/family/location_requests_controller.rb:51 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/family/location_requests_controller.rb:58 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/family/memberships_controller.rb:26 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/family/memberships_controller.rb:63 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/imports/extractions_controller.rb:49 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/imports_controller.rb:110 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/imports_controller.rb:35 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/places_controller.rb:177 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/places_controller.rb:193 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/places_controller.rb:59 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/places_controller.rb:87 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/settings/integrations_controller.rb:35 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/settings/integrations_controller.rb:73 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/settings/integrations_controller.rb:74 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/settings/users_controller.rb:15 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/settings/users_controller.rb:19 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/settings/users_controller.rb:23 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/settings/users_controller.rb:32 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/settings/users_controller.rb:49 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/settings/users_controller.rb:57 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/settings/users_controller.rb:80 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/settings/users_controller.rb:83 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/settings/users_controller.rb:87 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/settings/users_controller.rb:90 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/shared/achievements_controller.rb:45 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/stats_controller.rb:13 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/stats_controller.rb:39 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/trial/welcome_controller.rb:17 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/trial/welcome_controller.rb:34 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/trips/notes_controller.rb:28 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/apple_oauth_controller.rb:103 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/apple_oauth_controller.rb:111 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.mass-assignment-vuln |
app/controllers/users/destroy_confirmations_controller.rb:9 | Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix:... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/users/digests_controller.rb:26 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/users/omniauth_callbacks_controller.rb:73 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/users/otp_challenge_controller.rb:29 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/registrations_controller.rb:135 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/registrations_controller.rb:15 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/registrations_controller.rb:169 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/users/registrations_controller.rb:96 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/sessions_controller.rb:33 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.avoid-session-manipulation |
app/controllers/users/sessions_controller.rb:35 | This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/visits_controller.rb:44 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/visits_controller.rb:53 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/application_helper.rb:14 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/application_helper.rb:283 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/application_helper.rb:287 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/application_helper.rb:290 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/datetime_formatting_helper.rb:13 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/datetime_formatting_helper.rb:26 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/datetime_formatting_helper.rb:39 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/user_helper.rb:9 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:117 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:119 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:135 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:139 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:146 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:160 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:160 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:162 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:186 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:190 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:191 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:194 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:200 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:242 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:243 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:249 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:252 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:255 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:255 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:262 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:266 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:271 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/achievements/spectral_material.js:275 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/card_modal_controller.js:129 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/family_map_controller.js:136 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/immich_enrich_controller.js:204 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:121 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:245 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:250 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:252 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:253 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:254 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:287 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:288 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:532 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:545 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre/event_handlers.js:569 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre_controller.js:1536 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre_controller.js:1657 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/maps/maplibre_controller.js:1660 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/onboarding_modal_controller.js:135 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/place_creation_controller.js:125 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/timeline_feed_controller.js:759 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/controllers/upload_controller.js:220 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
app/javascript/controllers/visit_creation_v2_controller.js:311 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
app/javascript/i18n.js:104 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/photo_popup.js:41 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/place_info.js:31 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/place_info.js:37 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/place_info.js:38 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/place_info.js:39 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/place_info.js:40 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/place_info.js:41 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_card.js:62 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:109 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:114 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:244 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:246 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:263 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:264 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:269 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/components/visit_place_search.js:274 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/editing/point_edit_history_panel.js:13 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/anomalies_layer.js:135 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/family_layer.js:73 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/flights_layer.js:90 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/flights_layer.js:93 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/flights_layer.js:94 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/photos_layer.js:575 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/photos_layer.js:586 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/photos_layer.js:590 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/recent_point_layer.js:51 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/layers/recent_point_layer.js:57 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/hexagon_popup.js:42 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/hexagon_popup.js:56 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
app/javascript/maps_maplibre/utils/lazy_loader.js:48 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:304 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:326 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:338 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:389 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:417 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:547 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
app/javascript/maps_maplibre/utils/search_manager.js:687 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
app/javascript/posthog.js:11 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
app/services/achievements/og_image.rb:61 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.weak-hashes-md5 |
app/services/imports/secure_file_downloader.rb:141 | Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
app/services/posters/native_renderer.rb:87 | Detected non-static command inside Open3.popen3. Audit the input to 'Open3.popen3'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.ssl-mode-no-verify |
app/services/trek/client.rb:66 | Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/achievements/collectibles/index.html.erb:2 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/collectibles/show.html.erb:17 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/achievements/collectibles/show.html.erb:2 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/collectibles/show.html.erb:21 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing |
app/views/achievements/collectibles/show.html.erb:21 | Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/collectibles/show.html.erb:33 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing |
app/views/achievements/collectibles/show.html.erb:33 | Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/collectibles/show.html.erb:61 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/collectibles/show.html.erb:77 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/show.html.erb:111 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/show.html.erb:140 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/show.html.erb:36 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/show.html.erb:84 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/achievements/show.html.erb:9 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/active_storage/blobs/_blob.html.erb:1 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing |
app/views/admin/settings/_section.html.erb:26 | Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/devise/mailer/confirmation_instructions.html.erb:5 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/devise/mailer/reset_password_instructions.html.erb:5 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/devise/mailer/unlock_instructions.html.erb:7 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-content-tag |
app/views/devise/registrations/_points_usage.html.erb:4 | 'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-content-tag |
app/views/devise/registrations/_points_usage.html.erb:5 | 'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/devise/sessions/new.html.erb:13 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-content-tag |
app/views/devise/shared/_feature_list.html.erb:1 | 'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing |
app/views/families/_getting_started.html.erb:48 | Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing |
app/views/families/_getting_started.html.erb:52 | Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:35 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:45 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:46 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:47 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:48 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:49 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:76 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:85 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:86 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:87 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/families/_location_sharing_toggle.html.erb:88 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/families/lapsed.html.erb:21 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/families/new.html.erb:22 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/family/invitations/show.html.erb:131 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/family/invitations/show.html.erb:146 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/family/invitations/show.html.erb:155 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/family_mailer/invitation.html.erb:22 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/family_mailer/location_request.html.erb:18 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.var-in-href |
app/views/family_mailer/plan_lapsed.html.erb:30 | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/imports/download.html.erb:4 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing |
app/views/imports/new.html.erb:16 | Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/imports/show.html.erb:27 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/imports/show.html.erb:29 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/insights/_header.html.erb:17 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/insights/_header.html.erb:22 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/insights/_header.html.erb:32 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/insights/_monthly_digest.html.erb:186 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/insights/_monthly_digest.html.erb:27 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.var-in-href |
app/views/insights/_pro_locked_card.html.erb:20 | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe |
app/views/layouts/application.html.erb:26 | 'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe |
app/views/layouts/application.html.erb:31 | 'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.var-in-script-tag |
app/views/layouts/application.html.erb:31 | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe |
app/views/layouts/application.html.erb:32 | 'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.var-in-script-tag |
app/views/layouts/application.html.erb:32 | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe |
app/views/layouts/application.html.erb:44 | 'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.var-in-script-tag |
app/views/layouts/application.html.erb:44 | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe |
app/views/layouts/application.html.erb:54 | 'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.var-in-script-tag |
app/views/layouts/application.html.erb:54 | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use... | Static analysis (opengrep) |
| medium | osv/GHSA-6688-9rhm-gjv2 |
package-lock.json | [email protected] (npm) is affected by GHSA-6688-9rhm-gjv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c6gr-qvv4-5v3f |
package-lock.json | [email protected] (npm) is affected by GHSA-c6gr-qvv4-5v3f | Dependencies (osv-scanner) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/immich_enrich_controller.js:207 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:229 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:313 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/maplibre/event_handlers.js:121 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/maplibre/event_handlers.js:121 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/maplibre_controller.js:1550 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/maps/maplibre_controller.js:1550 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/speed_color_editor_controller.js:95 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/trip_maplibre_preview_controller.js:124 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/trip_maplibre_preview_controller.js:124 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/video_studio_controller.js:775 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/video_studio_controller.js:775 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/video_studio_controller.js:775 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/video_studio_controller.js:775 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/video_studio_controller.js:775 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/controllers/video_studio_controller.js:775 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/components/photo_popup.js:53 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/components/toast.js:41 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/components/toast.js:41 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/components/visit_card.js:138 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/format_helpers.js:36 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/format_helpers.js:36 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/format_helpers.js:40 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/format_helpers.js:40 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/search_manager.js:330 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/search_manager.js:340 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/search_manager.js:341 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/search_manager.js:393 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/search_manager.js:395 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
app/javascript/maps_maplibre/utils/search_manager.js:410 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial |
db/migrate/20260622090000_backfill_notes_columns.rb:14 | The :attachable_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance. | Lint |
| low | opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial |
db/migrate/20260730220000_add_import_id_to_extraction_artifacts.rb:10 | The :import_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance. | Lint |
| low | opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial |
db/migrate/20261027130300_add_import_scope_to_exports.rb:6 | The :import_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance. | Lint |
| low | opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial |
db/migrate/20261028150000_track_collection_dataset.rb:5 | The :published_dataset_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/sidekiq-entrypoint.sh:58 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/web-entrypoint.sh:72 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/web-entrypoint.sh:73 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/web-entrypoint.sh:92 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/artipacked |
.github/workflows/attach_compose.yml:16 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/build_and_push.yml:135 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/build_and_push.yml:54 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:20 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:68 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release_notifications.yml:20 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/rubocop.yml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
app-phoenix/test/dawarich/accounts/security_test.exs:86 | Possible generic-api-key secret in history (commit f56af69725); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app-phoenix/test/dawarich_web/auth_two_factor/form_test.exs:91 | Possible generic-api-key secret in history (commit bd7a1840e6); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app-phoenix/test/dawarich_web/cable_proxy_test.exs:19 | Possible generic-api-key secret in history (commit 76ca3b5115); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app-phoenix/test/dawarich_web/health_endpoint_test.exs:53 | Possible generic-api-key secret in history (commit 1ae7207dac); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app-phoenix/test/dawarich_web/health_golden_test.exs:35 | Possible generic-api-key secret in history (commit f632889799); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app-phoenix/test/dawarich_web/native_m4_sessions_test.exs:26 | Possible generic-api-key secret in history (commit 9ab82e1f57); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app-phoenix/test/support/raw_http.ex:106 | Possible generic-api-key secret in history (commit 62d667b60b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
config/initializers/devise.rb:11 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docker-compose_mounted_volumes.yml:161 | Possible generic-api-key secret in history (commit 3155738601); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | osv/GHSA-p98j-92pf-mc4p |
package-lock.json | [email protected] (npm) is affected by GHSA-p98j-92pf-mc4p | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
spec/services/achievements/region_set_checker_spec.rb:131 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
spec/services/achievements/region_silhouettes_spec.rb:165 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/build_and_push.yml:118 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/build_and_push.yml:160 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/build_and_push.yml:161 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/build_and_push.yml:176 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/build_and_push.yml:190 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 56 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 50 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 8 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 300 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 11 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 0ac68e1835cf | prov-5+qual-2+sec-2 | 3% | 94 | 50 |
Full text report
- Repository: https://github.com/Freika/dawarich
- Commit:
0ac68e1835cf2a091907eb55f6287714c7206a6c - Generated: 2026-11-14T15:41:01+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 3 | explicit | 95% | 100% |
| Code quality | 94 | strong | 90% | 100% |
| Security | 50 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals.
- Explicitly attributed share (lower bound): 3.1%
- Unattributed share in AI-consistent velocity bursts: 25.7%
- Estimated AI-generated share: 3.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 29 | 17,933 |
| GitHub Copilot coding agent | 5 | 10 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 2,165 of 120,883 (sampled).
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.472 | 0.0x |
| Security | 1.386 | 1.963 | 0.71x |
- Stylometry index: 0.27 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 60). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 42,409 | 0% |
| 2026-01 | 44,797 | 0% |
| 2026-02 | 56,590 | 0% |
| 2026-03 | 22,335 | 0% |
| 2026-04 | 22,963 | 0% |
| 2026-05 | 30,482 | 5% |
| 2026-06 | 35,003 | 47% |
| 2026-07 | 24,729 | 0% |
| 2026-08 | 50,672 | 0% |
| 2026-09 | 53,251 | 0% |
| 2026-10 | 59,006 | 0% |
| 2026-11 | 5,420 | 0% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (2532acc21b96)
- Claude Code: trailer 'Co-Authored-By: Claude' (89472920b4f3)
- Claude Code: trailer 'Co-Authored-By: Claude' (34acc51b4377)
- Claude Code: trailer 'Co-Authored-By: Claude' (49ab76461d3b)
- Claude Code: trailer 'Co-Authored-By: Claude' (9c06984f716d)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (f048ca1c8521)
- Claude Code: trailer 'Co-Authored-By: Claude' (77c170844023)
- Claude Code: trailer 'Co-authored-by: Claude' (c366ab2da213)
- Claude Code: trailer 'Co-authored-by: Claude' (ecccc50de060)
- Claude Code: PR description attribution (c5bfe8215b08)
- Claude Code: PR description attribution (e51444104739)
- Claude Code: PR description attribution (96b7573d1c26)
- Claude Code: PR description attribution (b85d6e5f4f9d)
- Claude Code: PR description attribution (b3b87847641e)
- Claude Code: PR description attribution (70a904969ce7)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.53, CI runs tests; 2% of function code in complex or long functions; 3% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 93 |
| Duplication | 83 |
| Code smells (Opengrep) | 95 |
| Tests and CI | 100 |
| Documentation | 100 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 12,008; mean complexity 2.5, 90th percentile 5; 92 complex and 7 long functions
- Duplicated lines: 3.2% of 83,631 compared
- Tests: 191,041 test lines for 124,535 source lines (ratio 1.53); CI test commands: npm test, bundle exec rspec, rspec; 95% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- fe in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 172, 1 lines
- addLine in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 67, 1 lines
- syncToggleStates in app/javascript/controllers/maps/maplibre/settings_manager.js: complexity 40, 161 lines
- ru in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 40, 1 lines
- hx in public/maplibre/6.16.0/maplibre-gl-worker.mjs: complexity 39, 1 lines
Security
Security posture is weak: 8 known vulnerabilities in 4 dependencies; 76 high-severity SAST findings; 28 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 69 |
| Static analysis (Opengrep) | 63 |
| Vulnerable dependencies (OSV) | 57 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 8 in 4 packages (critical 1, high 3, medium 1, low 1)
-
Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-cg2g-xh64-v4q7: [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 |
package-lock.json |
| high | opengrep/dockerfile.security.last-user-is-root: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'. [confidence medium] |
.devcontainer/Dockerfile:35 |
| high | opengrep/ruby.lang.security.missing-csrf-protection: Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. [confidence low] |
app/controllers/application_controller.rb:3 |
| high | opengrep/ruby.lang.security.model-attr-accessible: Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everythi [confidence low] |
app/controllers/settings/users_controller.rb:153 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/achievement_card_controller.js:78 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.materialTarget.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/achievement_card_controller.js:78 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/achievement_unlocks_controller.js:98 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.element.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/achievement_unlocks_controller.js:98 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/clipboard_controller.js:86 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a button.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/clipboard_controller.js:86 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/flash_controller.js:64 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a div.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/flash_controller.js:64 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/immich_enrich_controller.js:204 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.resultsSummaryTarget.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/immich_enrich_controller.js:204 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/immich_enrich_controller.js:248 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a item.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/immich_enrich_controller.js:248 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/immich_enrich_controller.js:311 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a tooltip.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/immich_enrich_controller.js:311 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:222 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.controller.selectedVisitsContainerTarget.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:222 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:307 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a bulkActionsDiv.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre/area_selection_manager.js:307 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre/event_handlers.js:215 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a container.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre/event_handlers.js:215 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/javascript/controllers/maps/maplibre_controller.js:753 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 124,535; test lines: 191,041
| Language | Lines |
|---|---|
| Ruby | 252,061 |
| JavaScript | 63,169 |
| Shell | 248 |
| SQL | 98 |