Leaderboard github.com

TideSec/Mars

Mars(战神)——资产发现、子域名枚举、C段扫描、资产变更监测、端口变更监测、域名解析变更监测、Awvs扫描、POC检测、web指纹探测、端口指纹探测、CDN探测、操作系统指纹探测、泛解析探测、WAF探测、敏感信息检测等等

View repository ↗
Ruby
★ 1,385
commit c834fba4f955
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

none-detected

Confidence: 45%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

38/100

poor

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

80/100

adequate

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.02

Lines added per month all AI-attributed share

2019-010 · 0% AI
2019-020 · 0% AI
2019-040 · 0% AI
2019-050 · 0% AI
2020-05127,777 · 0% AI
2020-060 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 21
effective_loc: 127,777
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 127,747
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 5.25
measured_loc: 30
median_loc_per_hour: 0
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 30
work_units: 3

Release velocityskipped

Coding styleok1 item

assistant-style phrasing left in code: { :text=>'<h2>ionCube Loader Wizard</h2><p class="alert">An updated version of this Wizard script is available <a href="

count:assistant_voice: 1
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 1
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0.02
lines_scanned: 101,927
per_kloc:assistant_voice: 0.01
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

38 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 23% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing.

How the score is built

Complexity50
Duplication56
Lint and smells68
Tests and CI0
Documentation40
Type safety40
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 75
function_nloc: 36,248
functions: 3,248
long_functions: 22
many_param_functions: 6
mean_ccn: 3.33
p90_ccn: 7
risky_nloc_share: 23.1%

Duplication (jscpd)ok10 items

compared_lines: 75,299
duplicated_lines: 7,257
duplicated_share: 9.6%
files: 1,917

Lintok

category:best-practice: 96
category:correctness: 27
category:maintainability: 1
findings: 124
scanned_lines: 116,311
weighted_findings: 179.25

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 0
cochange_commits: 5
cochange_share: 0.0%
source_lines: 116,311
test_lines: 0
test_ratio: 0

Documentationok1 item

README.md README.md

check:changelog: no
check:contributing: no
check:license: no
check:readme: yes
readme_lines: 156

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 0
escapes_per_kloc: 0

Security

80 adequate

Security posture is adequate: 50 high-severity SAST findings. Weakest area: posture.

How the score is built

Secrets97
Static analysis (SAST)78
Vulnerable dependencies100
CI workflowsnot measured
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 15
declared: 15
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 1
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 211
findings_high: 50
findings_low: 5
findings_medium: 156
parse_errors: 1
scanned_lines: 116,311
weighted_findings: 84.25

Dependencies (osv-scanner)ok

penalty: 0
vulnerabilities: 0
vulnerable_packages: 0
vulns_critical: 0
vulns_high: 0
vulns_low: 0
vulns_medium: 0
vulns_unknown: 0

CI workflows (zizmor)skipped

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 4.8%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

84 high229 medium23 low

Severity	Rule	Location	Message	Tool
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/asset_management.py:98	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:35	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:41	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:65	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_180612_180418_WebLogic_wls_all_RCE.py:71	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py:17	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py:27	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_0638_RCE.py:35	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py:16	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py:27	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_CVE_2016_3510_RCE.py:36	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:35	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:41	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:65	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_WebLogic_wls_all_RCE.py:71	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:25	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	mars/views/modules/scanner/pocsuite_plugin/_190528_wordpress_core_4_6_rce.py:86	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/asset_task_scan_v1.0.py:1528	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/asset_task_scan_v1.0.py:1539	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/asset_task_scan_v1.0.py:1673	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/asset_task_scan_v1.0.py:2036	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/asset_task_scan_v1.0.py:2089	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/asset_task_scan_v1.0.py:222	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/asset_task_scan_v1.0.py:469	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/asset_task_scan_v1.0.py:935	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/asset_task_scan_v1.0.py:948	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/check_cdn.py:64	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/check_cdn.py:90	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/libs/Sublist3r/subbrute/subbrute.py:603	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/libs/Sublist3r/subbrute/subbrute.py:610	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/libs/Sublist3r/sublist3r.py:306	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.correctness.list-modify-while-iterate`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:267	It appears that `all_process` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop.	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:276	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:56	file object opened without corresponding close	Lint
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/gtag.js:56	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/gtag.js:56	User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/dropzone.js:3062	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/dropzone.js:3062	User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/dropzone.js:776	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/dropzone.js:776	User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `a.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/plugins/laydate/laydate.js:2	User controlled data in a `S.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/server/auth-tester-tasks.js:10	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/server/auth-tester-tasks.js:10	User controlled data in a `document.getElementById("target_info_data").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/server/vul-scanner.js:124	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/server/vul-scanner.js:124	User controlled data in a `document.getElementById("report_download_html").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/server/vul-scanner.js:125	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/server/vul-scanner.js:125	User controlled data in a `document.getElementById("report_download_pdf").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/server/vul-scanner.js:78	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/server/vul-scanner.js:78	User controlled data in a `document.getElementById("report_download_html").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	mars/static/js/server/vul-scanner.js:79	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	mars/static/js/server/vul-scanner.js:79	User controlled data in a `document.getElementById("report_download_pdf").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	mars/views/asset_management.py:101	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.flask.security.open-redirect`	mars/views/asset_management.py:393	Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	mars/views/modules/auth_tester/hydra_plugin.py:121	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	mars/views/modules/auth_tester/hydra_plugin.py:34	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.use-defused-xml`	mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:7	The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause...	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:110	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:130	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:134	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:138	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:43	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:66	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:75	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.requests.security.disabled-cert-validation`	mars/views/modules/vul_scanner/awvs_api.py:98	Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`	taskpython/asset_task_scan_v1.0.py:1018	Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without...	Static analysis (opengrep)
high	`opengrep/python.lang.security.use-defused-xml`	taskpython/asset_task_scan_v1.0.py:12	The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`	taskpython/asset_task_scan_v1.0.py:1205	Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`	taskpython/asset_task_scan_v1.0.py:1350	Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	taskpython/asset_task_scan_v1.0.py:1518	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`	taskpython/asset_task_scan_v1.0.py:909	Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`	taskpython/asset_task_scan_v1.0.py:917	Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	mars/static/js/plugins/Chart.js:1419	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	mars/static/js/plugins/Chart.js:874	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-alert`	mars/static/js/server/checkbox.js:29	found alert() call; should this be in production code?	Lint
medium	`opengrep/python.lang.best-practice.pass-body-fn`	mars/views/dashboard.py:155	`pass` is the body of function asset_server. Consider removing this or raise NotImplementedError() if this is a TODO	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	mars/views/lib/get_title.py:19	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-timeout`	mars/views/lib/get_title.py:19	Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	mars/views/modules/auth_tester/hydra_plugin.py:48	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	mars/views/modules/auth_tester/hydra_plugin.py:54	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	mars/views/modules/auth_tester/hydra_plugin.py:60	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	mars/views/modules/scanner/parse_plugin.py:25	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	mars/views/modules/scanner/poc_scanner.py:57	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:22	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:35	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:40	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	mars/views/modules/scanner/pocsuite_plugin/_190528_Weblogic_File_Upload.py:76	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	mars/views/modules/scanner/pocsuite_plugin/_190528_thinkphp5__5_0_5_1_execute.py:55	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	mars/views/modules/vul_scanner/awvs_api.py:43	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	mars/views/modules/vul_scanner/awvs_api.py:66	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	mars/views/modules/vul_scanner/awvs_api.py:75	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	mars/views/subdomain_brute.py:44	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1021	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1208	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:1441	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1536	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1537	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1538	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1539	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1543	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1557	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1673	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1684	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1685	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:1688	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:1852	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:1858	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:191	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:2036	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:223	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:319	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	taskpython/asset_task_scan_v1.0.py:48	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:497	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:641	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:666	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:677	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:694	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:807	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:818	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:852	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:865	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:899	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:926	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:935	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:948	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/asset_task_scan_v1.0.py:961	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/asset_task_scan_v1.0.py:997	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	taskpython/check_cdn.py:138	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/check_cdn.py:252	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/Sublist3r/subbrute/subbrute.py:379	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/Sublist3r/subbrute/subbrute.py:534	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/Sublist3r/subbrute/subbrute.py:603	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/Sublist3r/subbrute/subbrute.py:610	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/Sublist3r/sublist3r.py:107	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.code-after-unconditional-return`	taskpython/libs/Sublist3r/sublist3r.py:568	code after return statement will not be executed	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	taskpython/libs/subDomainsBrute/lib/common.py:111	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/lib/common.py:45	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/lib/common.py:59	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/lib/common.py:77	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:218	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:288	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:290	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:56	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:68	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	taskpython/libs/subDomainsBrute/subDomainsBrute.py:75	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:116	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:1312	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/bootstrap/bootstrap-multiselect.js:1312	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:140	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:1402	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:198	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:199	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:253	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:253	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:352	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:363	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:402	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:430	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:458	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:502	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:505	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:52	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:544	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:647	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:671	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:681	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:686	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/bootstrap/bootstrap-multiselect.js:686	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:697	User controlled data in a jQuery's `.prepend(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:736	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:746	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:749	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:752	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/bootstrap/bootstrap-multiselect.js:752	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:764	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:791	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:794	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:798	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/bootstrap/bootstrap-multiselect.js:798	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/bootstrap/bootstrap-multiselect.js:805	User controlled data in a jQuery's `.prepend(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:835	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:840	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:897	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:900	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:908	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:913	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:942	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:945	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/bootstrap/bootstrap-multiselect.js:962	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/gtag.js:101	RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:155	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/gtag.js:61	RegExp() called with a `b` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:62	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:64	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	mars/static/js/gtag.js:68	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	mars/static/js/gtag.js:69	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:78	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:78	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:78	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:89	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/gtag.js:91	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/gtag.js:92	RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/gtag.js:97	RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:102	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:113	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:148	RegExp() called with a `$` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:148	RegExp() called with a `dualListbox` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:148	RegExp() called with a `selectIndex` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:181	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:181	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:380	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:41	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:453	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:454	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:539	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:541	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:551	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/jquery/jquery.bootstrap-duallistbox.js:553	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	mars/static/js/plugins/Chart.js:10473	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	mars/static/js/plugins/Chart.js:12843	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	mars/static/js/plugins/Chart.js:12844	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/plugins/Chart.js:1501	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/plugins/Chart.js:4343	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/plugins/Chart.js:4492	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	mars/static/js/plugins/Chart.js:710	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/FeedEk.js:20	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/FeedEk.js:30	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/plugins/FeedEk.js:63	User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/FeedEk.js:63	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:1004	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:1006	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:124	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	mars/static/js/plugins/bootstrap-datetimepicker.js:1594	Detected the use of a regular expression `^[-+]\d+[dmwy]([\s,]+[-+]\d+[dmwy])*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:1689	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:1689	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:1697	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:1697	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/plugins/bootstrap-datetimepicker.js:207	User controlled data in a jQuery's `.appendTo(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/bootstrap-datetimepicker.js:708	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	mars/static/js/plugins/bootstrap-datetimepicker.js:79	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/bootstrap-datetimepicker.js:826	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/bootstrap-datetimepicker.js:858	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/bootstrap-datetimepicker.js:895	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/plugins/laydate/laydate.js:2	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/plugins/laydate/laydate.js:2	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/plugins/laydate/laydate.js:2	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/plugins/laydate/laydate.js:2	RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/plugins/laydate/laydate.js:2	RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	mars/static/js/plugins/laydate/laydate.js:2	RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/plugins/laydate/laydate.js:2	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	mars/static/js/plugins/xss_filter.js:1018	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.eval-detected`	mars/static/js/server/asset-management.js:159	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.eval-detected`	mars/static/js/server/asset-management.js:194	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/server/asset-services-info.js:19	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/server/asset-services-info.js:19	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/server/asset-services-list.js:49	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/server/asset-services-list.js:49	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.eval-detected`	mars/static/js/server/cus-management.js:90	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/server/plugin-management.js:38	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/server/plugin-management.js:38	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.eval-detected`	mars/static/js/server/plugin-management.js:53	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/server/port-scanner.js:88	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/server/port-scanner.js:88	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.eval-detected`	mars/static/js/server/task-management.js:78	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/server/update.js:14	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/server/update.js:14	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`	mars/static/js/server/vulnerability.js:17	User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	mars/static/js/server/vulnerability.js:17	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.django.security.django-no-csrf-token`	mars/templates/base.html:27	Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.django.security.django-no-csrf-token`	mars/templates/login.html:24	Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	mars/views/modules/scanner/poc_scanner.py:32	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.flask.security.audit.xss.make-response-with-unknown-content`	mars/views/subdomain_brute.py:46	Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.eval-detected`	taskpython/asset_task_scan_v1.0.py:1022	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.eval-detected`	taskpython/asset_task_scan_v1.0.py:667	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	taskpython/asset_task_scan_v1.0.py:746	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-sha1`	taskpython/libs/Sublist3r/sublist3r.py:549	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.ssl-mode-no-verify`	taskpython/libs/WhatWeb/lib/extend-http_ruby1.9.rb:121	Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.ssl-mode-no-verify`	taskpython/libs/WhatWeb/lib/extend-http_ruby2.rb:132	Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.ssl-mode-no-verify`	taskpython/libs/WhatWeb/lib/target.rb:154	Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/lib/target.rb:93	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/lib/version_class.rb:20	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins-disabled/footer-hash.rb:24	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins-disabled/header-hash.rb:21	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins-disabled/tagpattern-hash.rb:28	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/contao.rb:71	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/fluxbb.rb:95	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/phpmyadmin.rb:198	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/punbb.rb:83	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/serendipity.rb:114	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/smf.rb:82	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	taskpython/libs/WhatWeb/plugins/typo3.rb:58	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:107	`Tf` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:109	`e` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:57	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:72	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:74	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:74	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:74	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:74	`a` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:74	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:82	`h` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:82	`k` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:86	`w` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/gtag.js:92	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/plugins/dropzone.js:2189	`files` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/plugins/laydate/laydate.js:2	`o` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/plugins/laydate/laydate.js:2	`M` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	mars/static/js/plugins/laydate/laydate.js:2	`b` is assigned twice; the first assignment is useless	Lint
low	`gitleaks/generic-api-key`	instance/config.py:25	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`	taskpython/asset_task_scan_v1.0.py:1441	Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	Static analysis (opengrep)
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`	taskpython/asset_task_scan_v1.0.py:641	Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	Static analysis (opengrep)
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`	taskpython/asset_task_scan_v1.0.py:666	Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	Static analysis (opengrep)
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`	taskpython/asset_task_scan_v1.0.py:677	Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	Static analysis (opengrep)
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`	taskpython/asset_task_scan_v1.0.py:694	Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	124
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	211
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	1

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`c834fba4f955`	`prov-5+qual-2+sec-2`	0%	38	80
2026-11-14	`c834fba4f955`	`prov-4+qual-2+sec-2`	0%	38	80

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/TideSec/Mars/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/TideSec/Mars/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/TideSec/Mars/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/TideSec/Mars/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/TideSec/Mars/security.svg)](https://repotrust.synapticcyber.com/r/github.com/TideSec/Mars/)

Full text report

Repository: https://github.com/TideSec/Mars
Commit: c834fba4f9557e99665f033663483eb5791085a6
Generated: 2026-11-14T14:52:01+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	45%	100%
Code quality	38	poor	90%	100%
Security	80	adequate	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 0.02 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 1, emoji 0). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2020-05	127,777	0%

Evidence

assistant-style phrasing left in code: { :text=>'<h2>ionCube Loader Wizard</h2><p class="alert">An updated version of this Wizard script is available <a href=" (taskpython/l)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 23% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	50
Duplication	56
Code smells (Opengrep)	68
Tests and CI	0
Documentation	40
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 3,248; mean complexity 3.3, 90th percentile 7; 75 complex and 22 long functions
Duplicated lines: 9.6% of 75,299 compared
Tests: 0 test lines for 116,311 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Most complex functions:

Security

Security posture is adequate: 50 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	78
Vulnerable dependencies (OSV)	100
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/gtag.js:56
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/gtag.js:56
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/dropzone.js:776
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/dropzone.js:776
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/dropzone.js:3062
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/dropzone.js:3062
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `i.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `a.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `S.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/plugins/laydate/laydate.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/server/auth-tester-tasks.js:10
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `document.getElementById("target_info_data").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/server/auth-tester-tasks.js:10
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/server/vul-scanner.js:78
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `document.getElementById("report_download_html").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/server/vul-scanner.js:78
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	mars/static/js/server/vul-scanner.js:79

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 116,311; test lines: 0

Language	Lines
Ruby	79,467
JavaScript	25,670
Python	11,169
Shell	5