RepoTrust

Leaderboard github.com

LadybirdBrowser/ladybird

Truly independent web browser

  • View repository ↗
  • Rust
  • ★ 67,131
  • commit ad7dc478bac0
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

explicit

Confidence
95%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

70/100

adequate

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

48/100

poor

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% explicit

Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts38%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace446
  • Releases at AI pace0
  • Coding-style index (1.0+ means possible)0.14

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code92442026-03-162026-10-28

Lines added per month all AI-attributed share

  1. 2021-10845 · 0% AI
  2. 2021-110 · 0% AI
  3. 2022-02831 · 0% AI
  4. 2022-03447 · 0% AI
  5. 2022-04218 · 0% AI
  6. 2022-051,279 · 0% AI
  7. 2022-061 · 0% AI
  8. 2022-073,761 · 0% AI
  9. 2022-081,462 · 0% AI
  10. 2022-092,460 · 0% AI
  11. 2022-103,826 · 0% AI
  12. 2022-116,200 · 0% AI
  13. 2022-1230,702 · 0% AI
  14. 2023-0145,111 · 0% AI
  15. 2023-0245,045 · 0% AI
  16. 2023-0349,533 · 0% AI
  17. 2023-0444,298 · 0% AI
  18. 2023-0539,397 · 0% AI
  19. 2023-0634,596 · 0% AI
  20. 2023-0746,734 · 0% AI
  21. 2023-0844,996 · 0% AI
  22. 2023-0933,328 · 0% AI
  23. 2023-1032,476 · 0% AI
  24. 2023-1143,214 · 0% AI
  25. 2023-1236,701 · 0% AI
  26. 2024-0125,338 · 0% AI
  27. 2024-0229,308 · 0% AI
  28. 2024-0327,586 · 0% AI
  29. 2024-0424,972 · 0% AI
  30. 2024-0524,419 · 0% AI
  31. 2024-0624,319 · 0% AI
  32. 2024-0722,253 · 0% AI
  33. 2024-0821,325 · 0% AI
  34. 2024-0918,064 · 0% AI
  35. 2024-1041,661 · 0% AI
  36. 2024-1196,805 · 0% AI
  37. 2024-1240,303 · 0% AI
  38. 2025-0125,624 · 0% AI
  39. 2025-0235,982 · 0% AI
  40. 2025-0333,213 · 0% AI
  41. 2025-0455,540 · 0% AI
  42. 2025-0521,909 · 0% AI
  43. 2025-0621,095 · 0% AI
  44. 2025-0751,815 · 0% AI
  45. 2025-0835,922 · 0% AI
  46. 2025-0928,374 · 0% AI
  47. 2025-1029,453 · 0% AI
  48. 2025-1134,103 · 0% AI
  49. 2025-1223,198 · 0% AI
  50. 2026-0146,828 · 0% AI
  51. 2026-0285,871 · 0% AI
  52. 2026-03103,170 · 0% AI
  53. 2026-04104,091 · 0% AI
  54. 2026-05116,440 · 0% AI
  55. 2026-06125,465 · 0% AI
  56. 2026-07298,590 · 0% AI
  57. 2026-08435,045 · 0% AI
  58. 2026-09320,036 · 0% AI
  59. 2026-101,056,238 · 0% AI
  60. 2026-11465,010 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 8 lines trace to AI-attributed commits, 316,917 to others (sampled). Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality0.000.26—
Security0.000.14—

Evidence by analyzer

Explicit AI attributionok10 items
attributed_commit_share
0.0%
attributed_commits
9
attributed_loc
244
attributed_loc_share
0.0%
commits
50,000
effective_loc
4,496,826
tools_detected
1
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok15 items
excluded_import_loc
407,465
flagged_loc
1,687,407
flagged_loc_share
41.3%
flagged_units
446
max_loc_per_hour
72,964
measured_loc
4,088,009
median_loc_per_hour
83.90
pr_timed_units
1,681
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
22,851
Release velocityok
flagged_releases
0
max_loc_per_day
0
releases
0
Coding styleok8 items
count:assistant_voice
1
count:emoji_in_code
495
count:narrated_steps
83
count:placeholder
1
files:assistant_voice
1
files:emoji_in_code
88
files:narrated_steps
52
files:placeholder
1
index
0.14
lines_scanned
2,351,547
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0.21
per_kloc:narrated_steps
0.04
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
8
blame_failures
0
files_blamed
1,500
other_lines
316,917
quality:ai_findings
0
quality:ai_per_kloc
0
quality:other_findings
82
quality:other_per_kloc
0.26
security:ai_findings
0
security:ai_per_kloc
0
security:other_findings
45
security:other_per_kloc
0.14

Code quality

70 adequate

Code quality is adequate: test-to-source ratio 0.01, CI runs tests; 18% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.

How the score is built

  • Complexity58
  • Duplication70
  • Lint and smells95
  • Tests and CI66
  • Documentation80
  • Type safety40
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items
complex_functions
2,398
function_nloc
1,526,862
functions
136,603
long_functions
979
many_param_functions
505
mean_ccn
2.59
p90_ccn
5
risky_nloc_share
18.3%
Duplication (jscpd)ok10 items
compared_lines
1,668,742
duplicated_lines
101,242
duplicated_share
6.1%
files
10,619
Lintok
category:best-practice
106
category:correctness
784
category:maintainability
79
findings
969
scanned_lines
2,397,848
weighted_findings
522.25
Tests and CIok12 items
  • CI config: .github/workflows/backport-labels.yml .github/workflows/backport-labels.yml
  • CI config: .github/workflows/backport.yml .github/workflows/backport.yml
  • CI config: .github/workflows/bench-pr.yml .github/workflows/bench-pr.yml
  • CI config: .github/workflows/build-and-test.yml .github/workflows/build-and-test.yml
  • CI config: .github/workflows/build-release.yml .github/workflows/build-release.yml
  • CI config: .github/workflows/ci-image.yml .github/workflows/ci-image.yml
  • CI config: .github/workflows/ci.yml .github/workflows/ci.yml
  • CI config: .github/workflows/dev-container.yml .github/workflows/dev-container.yml
  • CI config: .github/workflows/js-and-wasm-artifacts.yml .github/workflows/js-and-wasm-artifacts.yml
  • CI config: .github/workflows/js-and-wasm-benchmarks.yml .github/workflows/js-and-wasm-benchmarks.yml
  • CI runs tests (ctest, unittest)
  • CI runs linters (clippy, cargo fmt)
check:ci_present
yes
check:ci_runs_lint
yes
check:ci_runs_tests
yes
check:has_tests
yes
check:test_ratio
no
check:tests_cochange
no
ci_files
19
cochange_commits
287
cochange_share
2.1%
source_lines
2,397,848
test_lines
18,748
test_ratio
0.01
Documentationok3 items
  • README.md README.md
  • LICENSE LICENSE
  • CONTRIBUTING.md CONTRIBUTING.md
check:changelog
no
check:contributing
yes
check:license
yes
check:readme
yes
readme_lines
35
Type safetyok
check:low_escape_density
yes
check:strict_config
no
escapes
99
escapes_per_kloc
1.42

Security

48 poor

Security posture is poor: 1 possible secret(s) in the tree, 2 only in history; 9 known vulnerabilities in 6 dependencies; 142 high-severity SAST findings; 121 high-severity workflow issues. Weakest area: ci actions.

How the score is built

  • Secrets21
  • Static analysis (SAST)80
  • Vulnerable dependencies68
  • CI workflows0
  • Security posture80
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
47
declared
47
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
1
secrets_history
2
secrets_low_confidence
20
secrets_nonprod
4
Static analysis (opengrep)ok
findings
5,610
findings_high
142
findings_low
4,788
findings_medium
680
parse_errors
1,167
scanned_lines
2,397,848
weighted_findings
1,500.61
Dependencies (osv-scanner)ok
penalty
23
vulnerabilities
9
vulnerable_packages
6
vulns_critical
0
vulns_high
3
vulns_low
0
vulns_medium
2
vulns_unknown
4
CI workflows (zizmor)ok
findings
208
findings_high
121
findings_low
71
findings_medium
16
penalty
1,374.80
workflows
19
Security postureok22 items
  • Security policy: SECURITY.md SECURITY.md
  • Dependency updates: .github/dependabot.yml .github/dependabot.yml
  • AK/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) AK/Rust/Cargo.toml
  • Libraries/LibCompositing/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibCompositing/Rust/Cargo.toml
  • Libraries/LibCompress/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibCompress/Rust/Cargo.toml
  • Libraries/LibCrypto/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibCrypto/Rust/Cargo.toml
  • Libraries/LibGfx/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibGfx/Rust/Cargo.toml
  • Libraries/LibHTTP/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibHTTP/Rust/Cargo.toml
  • Libraries/LibIPC/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibIPC/Rust/Cargo.toml
  • Libraries/LibImageDecoders/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibImageDecoders/Rust/Cargo.toml
  • Libraries/LibJS/ABI/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibJS/ABI/Cargo.toml
  • Libraries/LibJS/JIT/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibJS/JIT/Rust/Cargo.toml
  • Libraries/LibJS/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibJS/Rust/Cargo.toml
  • Libraries/LibJS/Rust/embedding_headers/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibJS/Rust/embedding_headers/Cargo.toml
  • Libraries/LibJS/Rust/macros/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibJS/Rust/macros/Cargo.toml
  • Libraries/LibRegex/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibRegex/Rust/Cargo.toml
  • Libraries/LibTextCodec/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibTextCodec/Rust/Cargo.toml
  • Libraries/LibURL/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibURL/Rust/Cargo.toml
  • Libraries/LibUnicode/Rust/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibUnicode/Rust/Cargo.toml
  • Libraries/LibWasm/Engine/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibWasm/Engine/Cargo.toml
  • Libraries/LibWasm/JIT/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibWasm/JIT/Cargo.toml
  • Libraries/LibWasm/Module/Cargo.toml has no lockfile alongside it (unpinned dependencies) Libraries/LibWasm/Module/Cargo.toml
check:dependency_updates
yes
check:lockfiles
no
check:security_policy
yes
check:signed_commits
no
signed_commit_share
0.0%
unpinned_manifests
30
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

320 high329 medium73 low14 info

SeverityRuleLocationMessageTool
high opengrep/python.lang.best-practice.arbitrary-sleep Meta/Utils/python_environment.py:40 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Meta/measure-css-value-parsing.py:79 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Meta/measure-style-scale.py:120 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Meta/style-update-capture.py:189 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Meta/style-update-capture.py:338 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Meta/wpt_scheduler.py:501 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibJS/JIT/machine.py:26 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/AccessibilityBridge/harness/events.py:48 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.open-never-closed Tests/LibWeb/AccessibilityBridge/harness/ladybird.py:131 file object opened without corresponding close Lint
high opengrep/python.lang.correctness.tempfile.tempfile-without-flush Tests/LibWeb/AccessibilityBridge/harness/ladybird.py:207 Using 'self._stderr_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'self._stderr_file.name' is used. Use '.flush()' or close the file before using 'self._stderr_file.name'. Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/AccessibilityBridge/harness/ladybird.py:46 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.maintainability.useless-inner-function Tests/LibWeb/AccessibilityBridge/harness/tree.py:117 function `_matches` is defined inside a function but never used Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/AccessibilityBridge/harness/tree.py:146 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.open-never-closed Tests/LibWeb/AccessibilityBridgeMac/diagnose.py:508 file object opened without corresponding close Lint
high opengrep/python.lang.best-practice.open-never-closed Tests/LibWeb/AccessibilityBridgeMac/diagnose.py:509 file object opened without corresponding close Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/AccessibilityBridgeMac/diagnose.py:850 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.open-never-closed Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:178 file object opened without corresponding close Lint
high opengrep/python.lang.correctness.tempfile.tempfile-without-flush Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:203 Using 'self._stderr_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'self._stderr_file.name' is used. Use '.flush()' or close the file before using 'self._stderr_file.name'. Lint
high opengrep/python.lang.correctness.tempfile.tempfile-without-flush Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:232 Using 'self._stderr_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'self._stderr_file.name' is used. Use '.flush()' or close the file before using 'self._stderr_file.name'. Lint
high opengrep/python.lang.correctness.tempfile.tempfile-without-flush Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:269 Using 'self._stderr_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'self._stderr_file.name' is used. Use '.flush()' or close the file before using 'self._stderr_file.name'. Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:67 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/AccessibilityBridgeMac/harness/tree.py:133 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.open-never-closed Tests/LibWeb/Text/input/wpt-import/_wpttools/wptserve/wptserve/cgi/cgi.py:95 file object opened without corresponding close Lint
high opengrep/python.lang.correctness.no-strings-as-booleans Tests/LibWeb/Text/input/wpt-import/_wpttools/wptserve/wptserve/handlers.py:158 Using strings as booleans in Python has unexpected results. `"one" and "two"` will return "two". `"one" or "two"` will return "one". In Python, strings are truthy, and strings with a non-zero length evaluate to True. Lint
high opengrep/python.lang.best-practice.open-never-closed Tests/LibWeb/Text/input/wpt-import/_wpttools/wptserve/wptserve/request.py:59 file object opened without corresponding close Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWeb/Text/input/wpt-import/fetch/api/resources/infinite-slow-response.py:32 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-devtools-client-follows-the-tab.py:173 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-devtools-client-follows-the-tab.py:67 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-devtools-client-follows-the-tab.py:78 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-message-port-collection.py:89 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-shared-stylesheet-memory.py:151 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-shared-stylesheet-memory.py:161 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-bidi.py:1449 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.correctness.common-mistakes.is-not-is-not Tests/LibWebView/test-webdriver-bidi.py:2602 In Python 'X is not ...' is different from 'X is (not ...)'. In the latter the 'not' converts the '...' directly to boolean. Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-browser-crash-recovery.py:77 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-compositor-reconnect.py:97 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-crash-report.py:127 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-crash-report.py:34 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-delete-session.py:130 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-delete-session.py:57 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-element-screenshot.py:90 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-force-dark.py:130 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-force-dark.py:200 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-pdf-viewer-ignores-the-csp-of-its-pdf.py:63 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-permissions-settings.py:87 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-session-history.py:1127 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-session-history.py:1205 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-session-history.py:1482 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-session-history.py:1508 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-session-history.py:1606 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-session-history.py:919 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-site-zoom.py:81 time.sleep() call; did you mean to leave this in? Lint
high opengrep/python.lang.best-practice.arbitrary-sleep Tests/LibWebView/test-webdriver-worker-terminated-while-starting.py:75 time.sleep() call; did you mean to leave this in? Lint
high zizmor/unpinned-uses .github/actions/build/action.yml:110 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/github-env .github/actions/build/action.yml:118 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/github-env .github/actions/build/action.yml:118 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/template-injection .github/actions/build/action.yml:132 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/build/action.yml:147 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/build/action.yml:158 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/build/action.yml:178 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/build/action.yml:85 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/build/action.yml:85 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/cache-restore/action.yml:49 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/cache-restore/action.yml:66 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/cache-restore/action.yml:80 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/cache-restore/action.yml:89 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/cache-restore/action.yml:98 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/cache-save/action.yml:40 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/cache-save/action.yml:61 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/cache-save/action.yml:68 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:123 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/setup/action.yml:156 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/setup/action.yml:158 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:173 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:209 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:217 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:222 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:247 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/actions/setup/action.yml:262 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:46 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:46 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:46 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:46 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:46 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:60 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:71 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/github-env .github/actions/setup/action.yml:71 dangerous use of environment file [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/actions/setup/action.yml:78 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/backport.yml:11 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/github-app .github/workflows/backport.yml:126 dangerous use of GitHub App tokens [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/backport.yml:126 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/backport.yml:132 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/backport.yml:138 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/bench-pr.yml:15 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/bench-pr.yml:153 unpinned image references [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:167 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:172 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:215 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:295 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:304 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:325 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/bench-pr.yml:68 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/workflows/build-and-test.yml:152 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-and-test.yml:171 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/build-and-test.yml:36 unpinned image references [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-and-test.yml:42 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-and-test.yml:45 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-and-test.yml:72 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:131 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:177 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:186 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:196 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:204 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:212 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:220 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:230 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:250 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:288 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:327 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:338 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:345 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:35 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:352 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:50 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/build-release.yml:56 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/build-release.yml:67 unpinned image references [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:100 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:121 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:128 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/excessive-permissions .github/workflows/ci-image.yml:22 overly broad permissions [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:37 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:82 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:90 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci-image.yml:97 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/dev-container.yml:26 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/dev-container.yml:29 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/dev-container.yml:36 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-artifacts.yml:172 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-artifacts.yml:179 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/js-and-wasm-artifacts.yml:22 unpinned image references [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-artifacts.yml:51 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/workflows/js-and-wasm-benchmarks.yml:106 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-benchmarks.yml:114 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/js-and-wasm-benchmarks.yml:14 unpinned image references [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-benchmarks.yml:38 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/js-and-wasm-benchmarks.yml:4 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-benchmarks.yml:52 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/js-and-wasm-benchmarks.yml:72 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:159 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:169 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:30 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:35 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:41 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:47 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/libjs-test262.yml:53 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/lint-code.yml:16 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/lint-code.yml:41 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/lint-commits.yml:15 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/lint-commits.yml:3 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/macos-accessibility-tests.yml:40 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/macos-accessibility-tests.yml:407 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/macos-accessibility-tests.yml:48 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/macos-accessibility-tests.yml:56 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/merge-conflict-labeler.yml:22 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/merge-conflict-labeler.yml:9 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/nightly-android.yml:29 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/nightly-android.yml:40 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/nightly-android.yml:46 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/notes-push.yml:17 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/notes-push.yml:20 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/web-benchmarks.yml:136 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/web-benchmarks.yml:16 unpinned image references [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/web-benchmarks.yml:38 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/web-benchmarks.yml:49 unpinned action reference [confidence high] CI workflows (zizmor)
high opengrep/javascript.browser.security.insecure-document-method Base/res/ladybird/about-pages/settings/languages.js:63 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Base/res/ladybird/about-pages/settings/languages.js:63 User controlled data in a `moveUp.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Base/res/ladybird/about-pages/settings/languages.js:76 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Base/res/ladybird/about-pages/settings/languages.js:76 User controlled data in a `moveDown.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high gitleaks/private-key Libraries/LibCrypto/ASN1/PEM.cpp:96 Possible private-key secret in the current tree Secrets (gitleaks)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Libraries/LibWasm/Tests/differential-fuzz.py:221 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Libraries/LibWasm/Tests/differential-fuzz.py:240 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/dockerfile.security.missing-user Meta/Fuzzers/FuzzilliJs.dockerfile:50 By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Linters/check_flatpak.py:230 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Linters/run.py:42 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args Meta/Linters/run.py:42 Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/build_vcpkg.py:34 Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/build_vcpkg.py:45 Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/build_vcpkg.py:46 Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/build_vcpkg.py:57 Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/python_environment.py:77 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/utils.py:26 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:165 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:323 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:361 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:433 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:451 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:512 Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/Utils/vcpkg_deps.py:558 Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.use-defused-xml Meta/analyze-xctrace-time-profile.py:11 The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/check-dead-rust-exports.py:91 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/check-dead-rust-exports.py:98 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/check-test-flakiness.py:118 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/check-test-flakiness.py:272 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/compare-flap-codegen.py:61 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/measure-css-value-parsing.py:103 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/measure-style-scale.py:139 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/package-macos-test-bundle.py:264 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/package-macos-test-bundle.py:62 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/style-update-capture.py:162 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/style-update-capture.py:368 Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/wpt_scheduler.py:417 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Meta/wpt_scheduler.py:589 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibHTTP/TestProxy.cpp:69 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/irtest.py:219 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/irtest.py:270 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args Tests/LibJS/JIT/irtest.py:270 Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/matrix.py:111 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/matrix.py:177 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/matrix.py:215 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/matrix.py:358 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args Tests/LibJS/JIT/matrix.py:359 Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/JIT/reduce.py:74 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/test-js-debugger.py:89 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/test-js-module-hosts.py:36 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/test-js.py:139 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/test-js.py:152 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/test-js.py:161 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibJS/test-js.py:41 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/AccessibilityBridge/harness/ladybird.py:140 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/AccessibilityBridgeMac/diagnose.py:134 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/AccessibilityBridgeMac/diagnose.py:510 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/AccessibilityBridgeMac/diagnose.py:882 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:214 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/AccessibilityBridgeMac/harness/ladybird.py:236 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Ref/input/wpt-import/resources/testdriver.js:1182 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Ref/input/wpt-import/resources/testdriver.js:1182 User controlled data in a `button.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/TestSecureContexts.cpp:59 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/WebSocket/handshake-cookie.html:16 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/css/style-invalidation/structural-matrix.js:140 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/css/style-invalidation/structural-matrix.js:140 User controlled data in a `fixture.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/layout-tree-update/resources/full-rebuild-comparison.js:2118 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/layout-tree-update/resources/full-rebuild-comparison.js:2118 User controlled data in a `fixture.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/layout-tree-update/resources/full-rebuild-comparison.js:2131 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/layout-tree-update/resources/full-rebuild-comparison.js:2131 User controlled data in a `fixture.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/layout-tree-update/resources/full-rebuild-comparison.js:702 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/layout-tree-update/resources/full-rebuild-comparison.js:702 User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/work-test.js:35 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/work-test.js:35 User controlled data in a `template.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/Text/input/wpt-import/_wpttools/wptserve/wptserve/sslutils/openssl.py:74 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/css/css-flexbox/support/scrollbars.js:36 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/css/css-flexbox/support/scrollbars.js:36 User controlled data in a `rowLabel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/css/css-flexbox/support/scrollbars.js:9 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/css/css-flexbox/support/scrollbars.js:9 User controlled data in a `contentItem.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/editing/include/editor-test-utils.js:194 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/editing/include/editor-test-utils.js:194 User controlled data in a `this.editingHost.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:4974 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:4974 User controlled data in a `inputCell.firstChild.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:5035 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:5035 User controlled data in a `compareDiv2.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:5242 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:5242 User controlled data in a `div.firstChild.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:5306 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/editing/include/tests.js:5306 User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/html/browsers/origin/api/resources/serializations.js:23 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/html/resources/common.js:191 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/html/resources/common.js:191 User controlled data in a `obj.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/html/syntax/parsing/resources/test.js:127 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/html/syntax/parsing/resources/test.js:127 User controlled data in a `containerEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/largest-contentful-paint/resources/largest-contentful-paint-helpers.js:131 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/largest-contentful-paint/resources/largest-contentful-paint-helpers.js:131 User controlled data in a `paragraph.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/pointerevents/pointerevent_support.js:148 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/pointerevents/pointerevent_support.js:148 User controlled data in a `pointertype_log.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/pointerevents/pointerevent_support.js:155 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/pointerevents/pointerevent_support.js:155 User controlled data in a `event_log_elem.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/pointerevents/pointerevent_support.js:237 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/pointerevents/pointerevent_support.js:237 User controlled data in a `document.getElementById('pointerTypeDescription').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/resource-timing/resources/resource-loaders.js:40 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/resource-timing/resources/resource-loaders.js:40 User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Tests/LibWeb/Text/input/wpt-import/resources/testdriver.js:1182 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Tests/LibWeb/Text/input/wpt-import/resources/testdriver.js:1182 User controlled data in a `button.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:1204 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:1205 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:1369 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:1370 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2722 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2724 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2725 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2737 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2739 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2740 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2752 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2754 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2755 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2767 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2769 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2770 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2948 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:2949 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:3113 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:3114 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:783 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:785 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:786 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:8346 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:8348 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/url/resources/urltestdata.json:8356 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/javascript.lang.security.detect-insecure-websocket Tests/LibWeb/Text/input/wpt-import/websockets/idlharness.any.js:13 Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/test-web/test-history-rate-limit-reset.py:73 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args Tests/LibWeb/test-web/test-history-rate-limit-reset.py:74 Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWeb/test-web/test-manual-rendering-reset.py:55 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWebView/test-devtools-client-follows-the-tab.py:197 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWebView/test-user-agent-preset-reaches-child-frames.py:64 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWebView/test-webdriver-delete-session.py:32 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/LibWebView/test-webdriver-delete-session.py:37 Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/Meta/test-js-runner.py:62 Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/Meta/test-js-runner.py:83 Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... Static analysis (opengrep)
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit Tests/UI/Qt/run-native-text-editing-tests.py:35 Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... Static analysis (opengrep)
high osv/GHSA-537c-gmf6-5ccf requirements.txt [email protected] (PyPI) is affected by GHSA-537c-gmf6-5ccf Dependencies (osv-scanner)
high osv/GHSA-g6cj-pr64-35w5 requirements.txt [email protected] (PyPI) is affected by PYSEC-2026-3552, GHSA-g6cj-pr64-35w5 Dependencies (osv-scanner)
high osv/GHSA-jwv3-5hgf-82ww requirements.txt [email protected] (PyPI) is affected by PYSEC-2026-3553, GHSA-jwv3-5hgf-82ww Dependencies (osv-scanner)
medium opengrep/python.lang.maintainability.is-function-without-parentheses Libraries/LibGfx/TIFFGenerator.py:547 Is "is_required" a function or an attribute? If it is a function, you may have meant tag.is_required() because tag.is_required is always true. Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Libraries/LibWasm/Tests/differential-fuzz.py:277 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1123 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1132 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1153 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1181 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1307 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1308 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1328 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:134 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:148 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1870 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1893 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1924 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:1931 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:511 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:513 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:519 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:696 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:942 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:943 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_ipc_definitions.py:978 Is "is_synchronous" a function or an attribute? If it is a function, you may have meant message.is_synchronous() because message.is_synchronous is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_bindings.py:195 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:109 Is "is_terminal" a function or an attribute? If it is a function, you may have meant self.is_terminal() because self.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:125 Is "is_terminal" a function or an attribute? If it is a function, you may have meant node.is_terminal() because node.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:135 Is "is_terminal" a function or an attribute? If it is a function, you may have meant n.is_terminal() because n.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:168 Is "is_terminal" a function or an attribute? If it is a function, you may have meant node.is_terminal() because node.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:200 Is "is_terminal" a function or an attribute? If it is a function, you may have meant node.is_terminal() because node.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:241 Is "is_terminal" a function or an attribute? If it is a function, you may have meant child.is_terminal() because child.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/generate_libweb_html_named_character_references.py:501 Is "is_terminal" a function or an attribute? If it is a function, you may have meant second_layer_node.is_terminal() because second_layer_node.is_terminal is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/attributes.py:73 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant target_interface.is_callback_interface() because target_interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/cpp_types.py:160 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/cpp_types.py:339 Is "is_nullable" a function or an attribute? If it is a function, you may have meant cpp_type.is_nullable() because cpp_type.is_nullable is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/cpp_types.py:356 Is "is_nullable" a function or an attribute? If it is a function, you may have meant cpp_type.is_nullable() because cpp_type.is_nullable is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/cpp_types.py:391 Is "is_nullable" a function or an attribute? If it is a function, you may have meant cpp_type.is_nullable() because cpp_type.is_nullable is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/cpp_types.py:532 Is "is_optional_presence" a function or an attribute? If it is a function, you may have meant member_cpp_type.is_optional_presence() because member_cpp_type.is_optional_presence is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/cpp_types.py:532 Is "is_nullable" a function or an attribute? If it is a function, you may have meant member_cpp_type.is_nullable() because member_cpp_type.is_nullable is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/interface_declaration.py:42 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/interface_declaration.py:46 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/interfaces.py:212 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/interfaces.py:216 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/intrinsics.py:143 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/intrinsics.py:149 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/intrinsics.py:149 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/intrinsics.py:328 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/intrinsics.py:484 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/intrinsics.py:628 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/operations.py:313 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/operations.py:445 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/operations.py:454 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/operations.py:526 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/operations.py:533 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/realms.py:25 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:1360 Is "is_default_to_json" a function or an attribute? If it is a function, you may have meant operation_set.overloads[0].is_default_to_json() because operation_set.overloads[0].is_default_to_json is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:1423 Is "is_cached" a function or an attribute? If it is a function, you may have meant attribute.is_cached() because attribute.is_cached is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:145 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:1455 Is "is_secure_context_only" a function or an attribute? If it is a function, you may have meant operation_set.is_secure_context_only() because operation_set.is_secure_context_only is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:150 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:1559 Is "is_secure_context_only" a function or an attribute? If it is a function, you may have meant operation_set.is_secure_context_only() because operation_set.is_secure_context_only is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:1704 Is "is_secure_context_only" a function or an attribute? If it is a function, you may have meant operation_set.is_secure_context_only() because operation_set.is_secure_context_only is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:173 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:2655 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:348 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:614 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_bindings.py:840 Is "is_default_to_json" a function or an attribute? If it is a function, you may have meant overload.is_default_to_json() because overload.is_default_to_json is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_members.py:689 Is "is_default_to_json" a function or an attribute? If it is a function, you may have meant overload.is_default_to_json() because overload.is_default_to_json is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_types.py:182 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_types.py:182 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/rust_types.py:192 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/to_idl_value.py:1526 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/to_idl_value.py:95 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/to_js_value.py:337 Is "is_optional_presence" a function or an attribute? If it is a function, you may have meant cpp_type.is_optional_presence() because cpp_type.is_optional_presence is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/to_js_value.py:696 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/wrappers.py:37 Is "is_namespace" a function or an attribute? If it is a function, you may have meant interface.is_namespace() because interface.is_namespace is always true. Lint
medium opengrep/python.lang.maintainability.is-function-without-parentheses Meta/Generators/libweb_bindings/wrappers.py:37 Is "is_callback_interface" a function or an attribute? If it is a function, you may have meant interface.is_callback_interface() because interface.is_callback_interface is always true. Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_flatpak.py:160 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_flatpak.py:173 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_flatpak.py:179 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_html_doctype.py:39 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_idl_files.py:54 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_idl_files.py:75 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Linters/check_newlines_at_eof.py:49 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Utils/build_vcpkg.py:24 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Utils/vcpkg_deps.py:251 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.correctness.common-mistakes.string-concat-in-list Meta/Utils/vcpkg_deps.py:269 Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Utils/vcpkg_deps.py:33 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Utils/vcpkg_deps.py:430 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/Utils/vcpkg_deps.py:450 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.correctness.common-mistakes.string-concat-in-list Meta/check-test-flakiness.py:330 Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/import-v8-regexp-tests.py:208 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/import-v8-regexp-tests.py:283 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/import-webkit-regexp-tests.py:136 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/import-webkit-regexp-tests.py:205 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/ladybird.py:303 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/ladybird.py:397 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:113 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:120 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:33 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:357 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:53 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:600 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:619 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:627 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:63 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:654 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Meta/wpt_scheduler.py:97 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Bytecode/input/debugger-statement.js:2 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Debugger/input/block-scopes.js:5 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Debugger/input/block-scopes.js:7 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Debugger/input/pause-on-unhandled-exceptions.js:11 found debugger call; should this be in production code? Lint
medium opengrep/python.lang.best-practice.unspecified-open-encoding Tests/LibJS/JIT/fuzz.py:145 Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/JIT/ir/legacy-arguments-eligibility.js:7 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys Tests/LibJS/Runtime/builtins/JSON/JSON.parse.js:202 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys Tests/LibJS/Runtime/builtins/JSON/JSON.parse.js:203 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys Tests/LibJS/Runtime/builtins/JSON/JSON.parse.js:265 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys Tests/LibJS/Runtime/builtins/JSON/JSON.parse.js:266 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys Tests/LibJS/Runtime/builtins/JSON/JSON.stringify.js:37 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:117 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:148 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:149 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:150 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:151 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:152 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:18 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:19 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:20 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:21 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:23 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:24 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:25 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:26 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:27 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:28 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:29 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:34 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:40 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:44 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:47 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:63 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:64 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:65 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Tests/LibJS/Runtime/builtins/String/String.prototype.replaceAll.js:66 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys Tests/LibJS/Runtime/jit/array-literals.js:65 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Runtime/jit/legacy-arguments-of-virtual-objects.js:10 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Runtime/jit/legacy-arguments-of-virtual-objects.js:54 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Runtime/jit/legacy-arguments-of-virtual-objects.js:72 found debugger call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-debugger Tests/LibJS/Runtime/jit/legacy-arguments-of-virtual-objects.js:89 found debugger call; should this be in production code? Lint
medium zizmor/dependabot-cooldown .github/dependabot.yml:5 insufficient cooldown in Dependabot updates [confidence high] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/ci.yml:1 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/ci.yml:108 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/ci.yml:14 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/secrets-inherit .github/workflows/ci.yml:79 secrets unconditionally inherited by called workflow [confidence high] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/ci.yml:91 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/secrets-inherit .github/workflows/ci.yml:95 secrets unconditionally inherited by called workflow [confidence high] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/js-and-wasm-artifacts.yml:18 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/libjs-test262.yml:17 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/lint-code.yml:1 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/lint-code.yml:9 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/lint-commits.yml:9 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/nightly-android.yml:19 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/nightly-lagom.yml:1 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/nightly-lagom.yml:14 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/secrets-inherit .github/workflows/nightly-lagom.yml:39 secrets unconditionally inherited by called workflow [confidence high] CI workflows (zizmor)
medium opengrep/c.lang.security.insecure-use-memset AK/Vector.h:894 When handling sensitive information in a buffer, it's important to ensure that the data is securely erased before the buffer is deleted or reused. While `memset()` is commonly used for this purpose, it can leave sensitive information... Static analysis (opengrep)
medium osv/RUSTSEC-2026-0150 Cargo.lock [email protected] (crates.io) is affected by RUSTSEC-2026-0150 Dependencies (osv-scanner)
medium osv/RUSTSEC-2026-0387 Cargo.lock [email protected] (crates.io) is affected by RUSTSEC-2026-0387 Dependencies (osv-scanner)
medium osv/RUSTSEC-2026-0441 Cargo.lock [email protected] (crates.io) is affected by RUSTSEC-2026-0441 Dependencies (osv-scanner)
medium osv/RUSTSEC-2026-0486 Cargo.lock [email protected] (crates.io) is affected by RUSTSEC-2026-0486 Dependencies (osv-scanner)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/Linters/check_flatpak.py:103 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/import-wpt-test.py:306 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/import-wpt-test.py:337 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/import-wpt-test.py:383 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/import-wpt-test.py:435 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/measure-css-value-parsing.py:61 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/measure-style-load.py:27 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/measure-style-scale.py:102 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/style-update-capture.py:130 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.audit.dynamic-urllib-use-detected Meta/style-update-capture.py:473 Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... Static analysis (opengrep)
medium opengrep/python.lang.security.insecure-hash-algorithm-sha1 Tests/LibJS/JIT/fuzz.py:131 Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/array-concat-spreadable-regexp.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/array-concat-spreadable-regexp.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-constructor.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-constructor.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-flags.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-flags.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-match-lastindex.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-match-lastindex.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-prototype.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-prototype.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-replace-lastindex.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-replace-lastindex.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-sticky.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-sticky.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-tolength.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/regexp-tolength.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-escapes-in-regexps.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-escapes-in-regexps.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-backrefs.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-backrefs.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-backrefs.js:82 RegExp() called with a `regexp_source` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-ignore-case.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-ignore-case.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-last-index.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-last-index.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-restricted-syntax.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-restricted-syntax.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-unanchored-advance.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-unanchored-advance.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-zero-length.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/es6/unicode-regexp-zero-length.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-change-exec.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-change-exec.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-dotall.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-dotall.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-binary.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-binary.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-char-class.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-char-class.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-enumerated.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-enumerated.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-exact-match.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-exact-match.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-general-category.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-general-category.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-invalid.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-invalid.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-lu-ui.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-lu-ui.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-script-extensions.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-script-extensions.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-scripts.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-scripts.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-special.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/harmony/regexp-property-special.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-UC16.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-UC16.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-boyer-moore.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-boyer-moore.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-cache-replace.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-cache-replace.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-call-as-function.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-call-as-function.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-capture-3.js:167 RegExp() called with a `re_src` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-capture-3.js:168 RegExp() called with a `re_src` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-capture-3.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-capture-3.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-capture-4.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-capture-4.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-capture.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-capture.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-captures.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-captures.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-compile.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-compile.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-duplicate-named-groups.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-duplicate-named-groups.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-global.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-global.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-indexof.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-indexof.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-lastIndex.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-lastIndex.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-lookahead.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-lookahead.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-loop-capture.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-loop-capture.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-modifiers.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-modifiers.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:150 RegExp() called with a `lc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:152 RegExp() called with a `lc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:155 RegExp() called with a `uc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:157 RegExp() called with a `uc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:160 RegExp() called with a `lc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:162 RegExp() called with a `lc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:165 RegExp() called with a `uc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:167 RegExp() called with a `uc` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-multiline.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-exec.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-exec.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-match-all.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-match-all.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-match.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-match.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-replace.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-replace.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-search.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-search.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-split.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-override-symbol-split.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-peephole.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-peephole.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-regexpexec.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-regexpexec.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-results-cache.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-results-cache.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:79 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:79 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:80 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:80 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:81 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:81 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:82 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:82 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:90 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:90 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:91 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:91 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:92 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:92 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:93 RegExp() called with a `lower` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-sort.js:93 RegExp() called with a `upper` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-stack-overflow.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-stack-overflow.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-standalones.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-standalones.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-static.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-static.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-string-methods.js:61 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-string-methods.js:69 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Tests/LibJS/Runtime/3rdparty/v8/regexp-unicode-sets.js:172 RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-unicode-sets.js:38 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium opengrep/javascript.browser.security.eval-detected Tests/LibJS/Runtime/3rdparty/v8/regexp-unicode-sets.js:46 Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by... Static analysis (opengrep)
medium gitleaks/private-key Userland/Utilities/test-crypto.cpp:1997 Possible private-key secret in history (commit 3fe7ac0924); removed from the current tree but still retrievable Secrets (gitleaks)
medium gitleaks/private-key Userland/test-crypto.cpp:908 Possible private-key secret in history (commit 7adb93ede9); removed from the current tree but still retrievable Secrets (gitleaks)
medium osv/GHSA-gc5v-m9x4-r6x2 requirements.txt [email protected] (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2 Dependencies (osv-scanner)
medium osv/GHSA-m2h6-j472-rp4c requirements.txt [email protected] (PyPI) is affected by PYSEC-2026-3554, GHSA-m2h6-j472-rp4c Dependencies (osv-scanner)
low zizmor/template-injection .github/actions/build/action.yml:134 code injection via template expansion [confidence high] CI workflows (zizmor)
low zizmor/template-injection .github/actions/build/action.yml:160 code injection via template expansion [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/actions/build/action.yml:185 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/actions/build/action.yml:39 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/actions/build/action.yml:96 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/backport.yml:131 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/bench-pr.yml:182 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/template-injection .github/workflows/build-and-test.yml:106 code injection via template expansion [confidence high] CI workflows (zizmor)
low zizmor/template-injection .github/workflows/build-and-test.yml:110 code injection via template expansion [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/build-and-test.yml:42 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/build-and-test.yml:45 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/build-and-test.yml:51 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/template-injection .github/workflows/build-and-test.yml:67 code injection via template expansion [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/build-release.yml:151 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/build-release.yml:35 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/ci-image.yml:36 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/ci-image.yml:81 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/ci.yml:111 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/ci.yml:79 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/ci.yml:95 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/dev-container.yml:25 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/js-and-wasm-artifacts.yml:135 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/js-and-wasm-artifacts.yml:50 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/js-and-wasm-artifacts.yml:70 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/js-and-wasm-artifacts.yml:77 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/js-and-wasm-benchmarks.yml:37 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/libjs-test262.yml:103 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/libjs-test262.yml:34 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/libjs-test262.yml:40 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/libjs-test262.yml:46 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/libjs-test262.yml:52 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/libjs-test262.yml:60 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/libjs-test262.yml:72 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/lint-code.yml:16 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/lint-code.yml:19 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/lint-code.yml:46 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/nightly-android.yml:103 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/nightly-android.yml:29 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/nightly-android.yml:33 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/nightly-android.yml:51 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/nightly-lagom.yml:39 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/nightly-lagom.yml:59 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/notes-push.yml:17 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/template-injection .github/workflows/web-benchmarks.yml:100 code injection via template expansion [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/web-benchmarks.yml:109 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/web-benchmarks.yml:37 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/web-benchmarks.yml:48 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/web-benchmarks.yml:64 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/web-benchmarks.yml:72 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low gitleaks/generic-api-key Base/etc/ca_certs.ini:163 Possible generic-api-key secret in history (commit 2b416e5faa); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Libraries/LibJS/RustIntegration.cpp:218 Possible generic-api-key secret in history (commit 6cdfbd01a6); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/bc/package.sh:9 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/byacc/package.sh:8 Possible generic-api-key secret in history (commit 5c75216361); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/curl/package.sh:11 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/dialog/package.sh:8 Possible generic-api-key secret in history (commit 9c3948ef3e); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/dos2unix/package.sh:9 Possible generic-api-key secret in history (commit a1580a1d00); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/flex/package.sh:10 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/libarchive/package.sh:10 Possible generic-api-key secret in history (commit 84f0d2aece); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/libexpat/package.sh:9 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/libmpg123/package.sh:12 Possible generic-api-key secret in history (commit 7dfb167b18); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/libssh2/package.sh:9 Possible generic-api-key secret in history (commit 196bd11743); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/libtiff/package.sh:8 Possible generic-api-key secret in history (commit 6e1117a688); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/mawk/package.sh:8 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/nano/package.sh:10 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/openssl/package.sh:9 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/pcre/package.sh:9 Possible generic-api-key secret in history (commit 97471030e7); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/pcre2/package.sh:9 Possible generic-api-key secret in history (commit f46d80ac4f); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/python3/package.sh:12 Possible generic-api-key secret in history (commit 39af1f8519); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/generic-api-key Ports/yasm/package.sh:5 Possible generic-api-key secret in history (commit ad4a4ba1c6); removed from the current tree but still retrievable Secrets (gitleaks)
low gitleaks/private-key Tests/LibCrypto/TestRSA.cpp:74 Possible private-key secret in the current tree (test/docs/example file) Secrets (gitleaks)
low gitleaks/generic-api-key Tests/LibTLS/TestTLSCertificateParser.cpp:34 Possible generic-api-key secret in the current tree (test/docs/example file) Secrets (gitleaks)
low gitleaks/generic-api-key Tests/LibWeb/Text/input/Crypto/SubtleCrypto-indexeddb-cryptokey-round-trip.html:29 Possible generic-api-key secret in the current tree (test/docs/example file) Secrets (gitleaks)
low gitleaks/generic-api-key Tests/LibWebSocket/TestWebSocket.cpp:580 Possible generic-api-key secret in the current tree (test/docs/example file) Secrets (gitleaks)
info zizmor/template-injection .github/actions/build/action.yml:120 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:121 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:133 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:135 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:136 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:159 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:161 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/build/action.yml:162 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/setup/action.yml:182 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/setup/action.yml:183 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/setup/action.yml:197 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/actions/setup/action.yml:203 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/ci-image.yml:134 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/ci-image.yml:137 code injection via template expansion [confidence low] CI workflows (zizmor)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceokprov-50
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-50
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b414200
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityokzizmor 1.32.0200
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.19
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b414300
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.127

Score history

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-14ad7dc478bac0prov-5+qual-2+sec-20%7048

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/LadybirdBrowser/ladybird/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/LadybirdBrowser/ladybird/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/LadybirdBrowser/ladybird/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/LadybirdBrowser/ladybird/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/LadybirdBrowser/ladybird/security.svg)](https://repotrust.synapticcyber.com/r/github.com/LadybirdBrowser/ladybird/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 explicit 95% 100%
Code quality 70 adequate 90% 100%
Security 48 poor 85% 100%

AI provenance

Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.

  • Explicitly attributed share (lower bound): 0.0%
  • Unattributed share in AI-consistent velocity bursts: 37.5%
  • Estimated AI-generated share: 0.0%
AI tool Attributed commits Lines added
Claude Code 9 244

Current source lines last changed by AI-attributed commits: 8 of 316,925 (sampled).

Too few lines in one group to compare finding densities.

  • Stylometry index: 0.14 per 1,000 lines (narrated steps 83, placeholders 1, assistant phrasing 1, emoji 495). Reported as a signal, not scored.
Month Lines added Attributed to AI
2025-12 23,198 0%
2026-01 46,828 0%
2026-02 85,871 0%
2026-03 103,170 0%
2026-04 104,091 0%
2026-05 116,440 0%
2026-06 125,465 0%
2026-07 298,590 0%
2026-08 435,045 0%
2026-09 320,036 0%
2026-10 1,056,238 0%
2026-11 465,010 0%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (410f54abe277)
  • Claude Code: message 'claude.ai/code' (5b3127f9f485)
  • Claude Code: message 'claude.ai/code' (9a444ea267bf)
  • Claude Code: message 'claude.ai/code' (5ed2c10454ec)
  • Claude Code: message 'claude.ai/code' (e278cdf64bc7)
  • Claude Code: trailer 'Co-Authored-By: Claude' (c710ff5afa81)
  • Claude Code: trailer 'Co-Authored-By: Claude' (1354eb1ac221)
  • Claude Code: trailer 'Co-Authored-By: Claude' (9be298e39ca5)
  • Claude Code: trailer 'Co-Authored-By: Claude' (29355a0e33fe)
  • 36,482 lines of first-party code in ~0.5h (72,964 lines/hour, 4 commit session) (c17ef94da7fc)
  • 23,619 lines of first-party code in ~0.6h (37,474 lines/hour, 23 commit session) (77a4fdff7c34)
  • 16,953 lines of first-party code in ~0.5h (33,906 lines/hour, 10 commit session) (0b9e82c852a6)
  • 69,538 lines of first-party code in ~2.9h (24,131 lines/hour, 8 commit session) (fcd205977f83)
  • 11,342 lines of first-party code in ~0.5h (22,684 lines/hour, 19 commit session) (07f56972e457)
  • 10,183 lines of first-party code in ~0.5h (20,366 lines/hour, 2 commit session) (5af1d39c3ad1)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.01, CI runs tests; 18% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.

Area Score
Complexity (lizard) 58
Duplication 70
Code smells (Opengrep) 95
Tests and CI 66
Documentation 80
Type safety 40
Process (Scorecard review/maintenance) n/a
  • Functions: 136,603; mean complexity 2.6, 90th percentile 5; 2398 complex and 979 long functions
  • Duplicated lines: 6.1% of 1,668,742 compared
  • Tests: 18,748 test lines for 2,397,848 source lines (ratio 0.01); CI test commands: ctest, unittest; 2% of recent source commits also change tests
  • Docs missing or thin: changelog

Most complex functions:

Security

Security posture is poor: 1 possible secret(s) in the tree, 2 only in history; 9 known vulnerabilities in 6 dependencies; 142 high-severity SAST findings; 121 high-severity workflow issues. Weakest area: ci actions.

Area Score
Secrets (gitleaks, tree + history) 21
Static analysis (Opengrep) 80
Vulnerable dependencies (OSV) 68
CI workflows (zizmor) 0
Posture (policy, updates, signing, lockfiles) 80
OpenSSF Scorecard n/a

  • Known vulnerabilities: 9 in 6 packages (critical 0, high 3, medium 2, low 0)

  • Posture checks passed: security policy, dependency updates; missing: signed commits, lockfiles

Top findings

Severity Finding Location
high gitleaks/private-key: Possible private-key secret in the current tree Libraries/LibCrypto/ASN1/PEM.cpp:96
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Base/res/ladybird/about-pages/settings/languages.js:63
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a moveUp.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Base/res/ladybird/about-pages/settings/languages.js:63
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Base/res/ladybird/about-pages/settings/languages.js:76
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a moveDown.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Base/res/ladybird/about-pages/settings/languages.js:76
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Libraries/LibWasm/Tests/differential-fuzz.py:221
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Libraries/LibWasm/Tests/differential-fuzz.py:240
high opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] Meta/Fuzzers/FuzzilliJs.dockerfile:50
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Linters/check_flatpak.py:230
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Linters/run.py:42
high opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] Meta/Linters/run.py:42
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/build_vcpkg.py:34
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/build_vcpkg.py:45
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/build_vcpkg.py:46
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/build_vcpkg.py:57
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/python_environment.py:77
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/utils.py:26
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:165
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:323
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:361
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:433
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:451
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:512
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] Meta/Utils/vcpkg_deps.py:558
high opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] Meta/analyze-xctrace-time-profile.py:11

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 2,397,848; test lines: 18,748
Language Lines
Rust 1,029,640
C++ 735,249
JavaScript 344,095
C 227,014
Python 77,029
Shell 2,455
Kotlin 730
Swift 206
TypeScript 115
Java 63