{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:29:46.088237Z","repo":{"ref":{"host":"github.com","owner":"Netflix-Skunkworks","name":"Scumblr"},"default_branch":"master","clone_url":"https://github.com/Netflix-Skunkworks/Scumblr.git","html_url":"https://github.com/Netflix-Skunkworks/Scumblr","description":"Web framework that allows performing periodic syncs of data sources and performing analysis on the identified results","stars":2636,"forks":307,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1914,"primary_language":"Ruby","license_spdx":"Apache-2.0","created_at":"2014-08-06T04:59:55Z","pushed_at":"2020-01-10T06:38:50Z","security_policy_url":null,"distribution":{"owner_created_at":"2012-05-10T22:02:37Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"66ed69a91c65527010f970a746a87557bf9b0856","profile":{"lines_by_language":{"Ruby":15004,"JavaScript":7311,"SQL":1625},"files_by_category":{"other":215,"source":152,"config":35,"test":28,"binary":11,"vendored":7,"docs":5,"generated":1},"source_lines":22574,"test_lines":1366},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":60.4,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":39.1,"duplication":45.5,"lint":86.4,"testing":62.7,"docs":80.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.06, CI runs tests; 31% of function code in complex or long functions; 13% duplicated lines. Weakest area: complexity."},"security":{"score":28.1,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":74.1,"sast":12.5,"dependencies":0.4,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 0 possible secret(s) in the tree, 1 only in history; 208 known vulnerabilities in 45 dependencies; 23 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":437.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":41608.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2014-08":{"loc":9749,"attributed_loc":0},"2014-09":{"loc":497,"attributed_loc":0},"2014-10":{"loc":36,"attributed_loc":0},"2014-11":{"loc":0,"attributed_loc":0},"2015-01":{"loc":142,"attributed_loc":0},"2015-03":{"loc":118,"attributed_loc":0},"2015-04":{"loc":2,"attributed_loc":0},"2015-05":{"loc":26,"attributed_loc":0},"2015-06":{"loc":786,"attributed_loc":0},"2015-09":{"loc":17,"attributed_loc":0},"2015-10":{"loc":1,"attributed_loc":0},"2015-12":{"loc":0,"attributed_loc":0},"2016-02":{"loc":46,"attributed_loc":0},"2016-04":{"loc":88,"attributed_loc":0},"2016-06":{"loc":15,"attributed_loc":0},"2016-07":{"loc":0,"attributed_loc":0},"2016-10":{"loc":19696,"attributed_loc":0},"2016-11":{"loc":1035,"attributed_loc":0},"2016-12":{"loc":4,"attributed_loc":0},"2017-01":{"loc":1010,"attributed_loc":0},"2017-02":{"loc":760,"attributed_loc":0},"2017-03":{"loc":475,"attributed_loc":0},"2017-04":{"loc":1135,"attributed_loc":0},"2017-05":{"loc":1166,"attributed_loc":0},"2017-06":{"loc":623,"attributed_loc":0},"2017-07":{"loc":1442,"attributed_loc":0},"2017-08":{"loc":1861,"attributed_loc":0},"2017-09":{"loc":91,"attributed_loc":0},"2017-10":{"loc":105,"attributed_loc":0},"2017-11":{"loc":116,"attributed_loc":0},"2017-12":{"loc":347,"attributed_loc":0},"2018-01":{"loc":61,"attributed_loc":0},"2018-02":{"loc":3,"attributed_loc":0},"2018-03":{"loc":69,"attributed_loc":0},"2018-04":{"loc":2,"attributed_loc":0},"2018-05":{"loc":70,"attributed_loc":0},"2018-07":{"loc":3,"attributed_loc":0},"2018-08":{"loc":0,"attributed_loc":0},"2018-11":{"loc":0,"attributed_loc":0},"2019-02":{"loc":11,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":214.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":12255.0,"pre_ai_era_burst_loc":0.0,"measured_loc":12255.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":568.0,"median_loc_per_hour":46.25,"pr_timed_units":2.0,"excluded_import_loc":29353.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["a7c09832ca8eb409ec7e04873baa60895437650d","dd1bd91c15a4961f0db2ba159001a02d7c2ff192"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":6.0,"flagged_releases":0.0,"max_loc_per_day":32.4},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0","to":"v1.1","loc":1811,"days":772.2,"loc_per_day":2.3,"flagged":false},{"from":"v1.1","to":"v2.0","loc":0,"days":11.66,"loc_per_day":0.0,"flagged":false},{"from":"v2.0","to":"v2.0.1","loc":654,"days":20.16,"loc_per_day":32.4,"flagged":false},{"from":"v2.0.1","to":"v2.0.1a","loc":399,"days":13.11,"loc_per_day":30.4,"flagged":false},{"from":"v2.0.1a","to":"v2.0.2","loc":7,"days":15.04,"loc_per_day":0.5,"flagged":false},{"from":"v2.0.2","to":"2.1.0","loc":8532,"days":293.71,"loc_per_day":29.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":22574.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":1.0,"secrets_nonprod":1.0,"secrets_low_confidence":3.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/fixtures/system_metadata.yml","line":38,"fingerprint":"test/fixtures/system_metadata.yml:generic-api-key:38"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"config/initializers/secret_token.rb","line":22,"fingerprint":"config/initializers/secret_token.rb:generic-api-key:22"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"config/secrets.yml","line":9,"fingerprint":"config/secrets.yml:generic-api-key:9"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"config/initializers/devise.rb","line":12,"fingerprint":"config/initializers/devise.rb:generic-api-key:12"},{"rule_id":"gitleaks/sidekiq-sensitive-url","severity":"medium","message":"Possible sidekiq-sensitive-url secret in history (commit b96786b59c); removed from the current tree but still retrievable","path":"Gemfile.lock","line":50,"fingerprint":"b96786b59c9810710c77d7693f6b42c20105dfa7:Gemfile.lock:sidekiq-sensitive-url:50"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":276.0,"findings_high":23.0,"findings_medium":253.0,"findings_low":0.0,"weighted_findings":124.6,"scanned_lines":20949.0,"parse_errors":81.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3011,"fingerprint":"javascript.browser.security.insecure-document-method:app/assets/javascripts/jquery_sparklines.js:3011"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3023,"fingerprint":"javascript.browser.security.insecure-document-method:app/assets/javascripts/jquery_sparklines.js:3023"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3048,"fingerprint":"javascript.browser.security.insecure-document-method:app/assets/javascripts/jquery_sparklines.js:3048"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.group.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3048,"fingerprint":"javascript.browser.security.insecure-innerhtml:app/assets/javascripts/jquery_sparklines.js:3048"},{"rule_id":"opengrep/ruby.lang.security.missing-csrf-protection","severity":"high","message":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. [confidence low]","path":"app/controllers/application_controller.rb","line":16,"fingerprint":"ruby.lang.security.missing-csrf-protection:app/controllers/application_controller.rb:16"},{"rule_id":"opengrep/ruby.rails.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"app/controllers/results_controller.rb","line":607,"fingerprint":"ruby.rails.security.injection.tainted-sql-string:app/controllers/results_controller.rb:607"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"app/controllers/system_metadata_controller.rb","line":42,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:app/controllers/system_metadata_controller.rb:42"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"app/controllers/system_metadata_controller.rb","line":44,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:app/controllers/system_metadata_controller.rb:44"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":27,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:27"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":27,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:27"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":28,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:28"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":28,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:28"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":29,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:29"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":29,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:29"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":30,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:30"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":30,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:30"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":44,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:44"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":46,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:46"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unsafe-reflection","severity":"high","message":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium]","path":"app/controllers/task_types_controller.rb","line":65,"fingerprint":"ruby.rails.security.brakeman.check-unsafe-reflection:app/controllers/task_types_controller.rb:65"},{"rule_id":"opengrep/ruby.rails.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"app/controllers/tasks_controller.rb","line":274,"fingerprint":"ruby.rails.security.injection.tainted-sql-string:app/controllers/tasks_controller.rb:274"},{"rule_id":"opengrep/ruby.rails.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"app/controllers/tasks_controller.rb","line":283,"fingerprint":"ruby.rails.security.injection.tainted-sql-string:app/controllers/tasks_controller.rb:283"},{"rule_id":"opengrep/ruby.rails.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"app/controllers/tasks_controller.rb","line":292,"fingerprint":"ruby.rails.security.injection.tainted-sql-string:app/controllers/tasks_controller.rb:292"},{"rule_id":"opengrep/ruby.rails.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"app/controllers/tasks_controller.rb","line":300,"fingerprint":"ruby.rails.security.injection.tainted-sql-string:app/controllers/tasks_controller.rb:300"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":116,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:116"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/application.js","line":116,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/application.js:116"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":116,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:116"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":216,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:216"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":298,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:298"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":361,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:361"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":369,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:369"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":369,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:369"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":384,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:384"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":385,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:385"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":386,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:386"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":389,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:389"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":456,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:456"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":509,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:509"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":659,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:659"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":666,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:666"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":672,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:672"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.after(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":739,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/application.js:739"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":759,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:759"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":761,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:761"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/application.js","line":773,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/application.js:773"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":41,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:41"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.appendTo(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":68,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/foundation_datepicker.js:68"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":90,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:90"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":393,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/foundation_datepicker.js:393"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":492,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/foundation_datepicker.js:492"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":532,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:532"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":532,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:532"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":536,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:536"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[\\-+]\\d+[dmwy]([\\s,]+[\\-+]\\d+[dmwy])*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible us [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":924,"fingerprint":"javascript.lang.security.audit.detect-redos:app/assets/javascripts/foundation_datepicker.js:924"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":974,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:974"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":986,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:986"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":986,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:986"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":994,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:994"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/foundation_datepicker.js","line":994,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/foundation_datepicker.js:994"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":573,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery.datetimepicker.js:573"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":601,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:601"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":602,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:602"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `mask` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":881,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:app/assets/javascripts/jquery.datetimepicker.js:881"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1146,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery.datetimepicker.js:1146"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1151,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery.datetimepicker.js:1151"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1151,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1151"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1370,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1370"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1373,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1373"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1399,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1399"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1402,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1402"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1540,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery.datetimepicker.js:1540"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1540,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery.datetimepicker.js:1540"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1565,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:app/assets/javascripts/jquery.datetimepicker.js:1565"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1596,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery.datetimepicker.js:1596"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1596,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery.datetimepicker.js:1596"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1604,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery.datetimepicker.js:1604"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1610,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery.datetimepicker.js:1610"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1611,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1611"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1819,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1819"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1821,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1821"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":1927,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery.datetimepicker.js:1927"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":2025,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:app/assets/javascripts/jquery.datetimepicker.js:2025"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":2025,"fingerprint":"javascript.browser.security.eval-detected:app/assets/javascripts/jquery.datetimepicker.js:2025"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":2025,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:app/assets/javascripts/jquery.datetimepicker.js:2025"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `format` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":2025,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:app/assets/javascripts/jquery.datetimepicker.js:2025"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"app/assets/javascripts/jquery.datetimepicker.js","line":2025,"fingerprint":"javascript.browser.security.eval-detected:app/assets/javascripts/jquery.datetimepicker.js:2025"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":690,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:690"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":711,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:711"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":735,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:735"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":736,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:736"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":749,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:749"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":868,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery_sparklines.js:868"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":881,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery_sparklines.js:881"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":952,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery_sparklines.js:952"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":965,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery_sparklines.js:965"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":965,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery_sparklines.js:965"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":966,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:966"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":966,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:966"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":967,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:967"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":1002,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery_sparklines.js:1002"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":1117,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:1117"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":2621,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:app/assets/javascripts/jquery_sparklines.js:2621"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":2621,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:app/assets/javascripts/jquery_sparklines.js:2621"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":2621,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:2621"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":2634,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:2634"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":2640,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:2640"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3009,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:3009"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3016,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:3016"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3025,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:3025"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3030,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:3030"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"app/assets/javascripts/jquery_sparklines.js","line":3036,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:app/assets/javascripts/jquery_sparklines.js:3036"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/events_controller.rb","line":58,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/events_controller.rb:58"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/events_controller.rb","line":84,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/events_controller.rb:84"},{"rule_id":"opengrep/ruby.rails.security.audit.avoid-session-manipulation","severity":"medium","message":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium]","path":"app/controllers/events_controller.rb","line":105,"fingerprint":"ruby.rails.security.audit.avoid-session-manipulation:app/controllers/events_controller.rb:105"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/flags_controller.rb","line":58,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/flags_controller.rb:58"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/flags_controller.rb","line":94,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/flags_controller.rb:94"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":31,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:31"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":39,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:39"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-render-text","severity":"medium","message":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text. [confidence low]","path":"app/controllers/results_controller.rb","line":54,"fingerprint":"ruby.rails.security.audit.xss.avoid-render-text:app/controllers/results_controller.rb:54"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-render-text","severity":"medium","message":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text. [confidence low]","path":"app/controllers/results_controller.rb","line":142,"fingerprint":"ruby.rails.security.audit.xss.avoid-render-text:app/controllers/results_controller.rb:142"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/results_controller.rb","line":259,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/results_controller.rb:259"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":287,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:287"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":322,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:322"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":335,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:335"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":341,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:341"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":364,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:364"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":390,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:390"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":391,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:391"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":406,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:406"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":587,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:587"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":603,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:603"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":624,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:624"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":636,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:636"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"app/controllers/results_controller.rb","line":654,"fingerprint":"ruby.lang.security.dangerous-open:app/controllers/results_controller.rb:654"},{"rule_id":"opengrep/ruby.lang.security.ssl-mode-no-verify","severity":"medium","message":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]","path":"app/controllers/results_controller.rb","line":654,"fingerprint":"ruby.lang.security.ssl-mode-no-verify:app/controllers/results_controller.rb:654"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"app/controllers/results_controller.rb","line":656,"fingerprint":"ruby.lang.security.dangerous-open:app/controllers/results_controller.rb:656"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"app/controllers/results_controller.rb","line":671,"fingerprint":"ruby.lang.security.dangerous-open:app/controllers/results_controller.rb:671"},{"rule_id":"opengrep/ruby.lang.security.ssl-mode-no-verify","severity":"medium","message":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]","path":"app/controllers/results_controller.rb","line":671,"fingerprint":"ruby.lang.security.ssl-mode-no-verify:app/controllers/results_controller.rb:671"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"app/controllers/results_controller.rb","line":673,"fingerprint":"ruby.lang.security.dangerous-open:app/controllers/results_controller.rb:673"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":929,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:929"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/results_controller.rb","line":968,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/results_controller.rb:968"},{"rule_id":"opengrep/ruby.rails.security.audit.avoid-session-manipulation","severity":"medium","message":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium]","path":"app/controllers/results_controller.rb","line":977,"fingerprint":"ruby.rails.security.audit.avoid-session-manipulation:app/controllers/results_controller.rb:977"},{"rule_id":"opengrep/ruby.rails.security.audit.avoid-session-manipulation","severity":"medium","message":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. [confidence medium]","path":"app/controllers/results_controller.rb","line":1011,"fingerprint":"ruby.rails.security.audit.avoid-session-manipulation:app/controllers/results_controller.rb:1011"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/saved_filters_controller.rb","line":46,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/saved_filters_controller.rb:46"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/saved_filters_controller.rb","line":49,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/saved_filters_controller.rb:49"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/saved_filters_controller.rb","line":111,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/saved_filters_controller.rb:111"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/saved_filters_controller.rb","line":119,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/saved_filters_controller.rb:119"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/saved_filters_controller.rb","line":170,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/saved_filters_controller.rb:170"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/statuses_controller.rb","line":63,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/statuses_controller.rb:63"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/statuses_controller.rb","line":122,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/statuses_controller.rb:122"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/system_metadata_controller.rb","line":64,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/system_metadata_controller.rb:64"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/system_metadata_controller.rb","line":100,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/system_metadata_controller.rb:100"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/task_types_controller.rb","line":21,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/task_types_controller.rb:21"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/task_types_controller.rb","line":41,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/task_types_controller.rb:41"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/tasks_controller.rb","line":133,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/tasks_controller.rb:133"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/tasks_controller.rb","line":381,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/tasks_controller.rb:381"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/tasks_controller.rb","line":448,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/tasks_controller.rb:448"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/users_controller.rb","line":55,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/users_controller.rb:55"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/users_controller.rb","line":101,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/users_controller.rb:101"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/application_helper.rb","line":45,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/application_helper.rb:45"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/application_helper.rb","line":52,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/application_helper.rb:52"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/application_helper.rb","line":67,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/application_helper.rb:67"},{"rule_id":"opengrep/ruby.lang.security.ssl-mode-no-verify","severity":"medium","message":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. [confidence medium]","path":"app/models/result.rb","line":210,"fingerprint":"ruby.lang.security.ssl-mode-no-verify:app/models/result.rb:210"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/devise/mailer/confirmation_instructions.html.erb","line":4,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/devise/mailer/confirmation_instructions.html.erb:4"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/devise/mailer/reset_password_instructions.html.erb","line":4,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/devise/mailer/reset_password_instructions.html.erb:4"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/devise/mailer/unlock_instructions.html.erb","line":5,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/devise/mailer/unlock_instructions.html.erb:5"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/flags/edit.html.erb","line":3,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/flags/edit.html.erb:3"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/flags/show.html.erb","line":24,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/flags/show.html.erb:24"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/kaminari/_first_page.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/kaminari/_first_page.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/kaminari/_gap.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/kaminari/_gap.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/kaminari/_last_page.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/kaminari/_last_page.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/kaminari/_next_page.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/kaminari/_next_page.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/kaminari/_prev_page.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/kaminari/_prev_page.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/layouts/layout.html.erb","line":29,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/layouts/layout.html.erb:29"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/layouts/layout.html.erb","line":30,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/layouts/layout.html.erb:30"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/layouts/layout.html.erb","line":31,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/layouts/layout.html.erb:31"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/layouts/layout.html.erb","line":32,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/layouts/layout.html.erb:32"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/layouts/layout.html.erb","line":33,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/layouts/layout.html.erb:33"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/notification_mailer/notification.html.erb","line":351,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/notification_mailer/notification.html.erb:351"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/_result_workflow.html.erb","line":11,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/_result_workflow.html.erb:11"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/_results_table.html.erb","line":5,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/_results_table.html.erb:5"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/results/_results_tiles.html.erb","line":15,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/results/_results_tiles.html.erb:15"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/_show_details.html.erb","line":19,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/_show_details.html.erb:19"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/results/_show_details.html.erb","line":19,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/results/_show_details.html.erb:19"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/_subscription.html.erb","line":3,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/_subscription.html.erb:3"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/_subscription.html.erb","line":6,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/_subscription.html.erb:6"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/results/_summary_data.html.erb","line":19,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/results/_summary_data.html.erb:19"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/actions/_repository_data_actions.html.erb","line":4,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/actions/_repository_data_actions.html.erb:4"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/actions/_repository_data_actions.html.erb","line":6,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/actions/_repository_data_actions.html.erb:6"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/dashboard.html.erb","line":99,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/results/dashboard.html.erb:99"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/dashboard.html.erb","line":129,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/results/dashboard.html.erb:129"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/dashboard.html.erb","line":156,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/results/dashboard.html.erb:156"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/index.html.erb","line":67,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/index.html.erb:67"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/results/index_columns/_link_data.html.erb","line":1,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/results/index_columns/_link_data.html.erb:1"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/results/index_columns/_screenshot_data.html.erb","line":6,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/results/index_columns/_screenshot_data.html.erb:6"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.var-in-href","severity":"medium","message":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= [confidence low]","path":"app/views/results/metadata/_response_analyzer_row.html.erb","line":5,"fingerprint":"ruby.rails.security.audit.xss.templates.var-in-href:app/views/results/metadata/_response_analyzer_row.html.erb:5"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_sketchy_ids_row.html.erb","line":6,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/results/metadata/_sketchy_ids_row.html.erb:6"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_vulnerabilities_details.html.erb","line":74,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/results/metadata/_vulnerabilities_details.html.erb:74"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_vulnerabilities_details.html.erb","line":78,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/results/metadata/_vulnerabilities_details.html.erb:78"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_vulnerabilities_details.html.erb","line":82,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/results/metadata/_vulnerabilities_details.html.erb:82"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_vulnerabilities_details.html.erb","line":86,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/results/metadata/_vulnerabilities_details.html.erb:86"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_vulnerabilities_details.html.erb","line":90,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/results/metadata/_vulnerabilities_details.html.erb:90"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/results/metadata/_vulnerabilities_details.html.erb","line":94,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/results/metadata/_vulnerabilities_details.html.erb:94"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":17,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/metadata/_vulnerability.html.erb:17"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":25,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/metadata/_vulnerability.html.erb:25"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":31,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/metadata/_vulnerability.html.erb:31"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":46,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/metadata/_vulnerability.html.erb:46"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":59,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/metadata/_vulnerability.html.erb:59"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.var-in-href","severity":"medium","message":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":75,"fingerprint":"ruby.rails.security.audit.xss.templates.var-in-href:app/views/results/metadata/_vulnerability.html.erb:75"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.var-in-href","severity":"medium","message":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= [confidence low]","path":"app/views/results/metadata/_vulnerability.html.erb","line":121,"fingerprint":"ruby.rails.security.audit.xss.templates.var-in-href:app/views/results/metadata/_vulnerability.html.erb:121"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/show.html.erb","line":44,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/show.html.erb:44"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/results/show.html.erb","line":96,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/results/show.html.erb:96"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/show.html.erb","line":98,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/show.html.erb:98"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/show.html.erb","line":110,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/show.html.erb:110"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/show.html.erb","line":114,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/show.html.erb:114"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/results/show.html.erb","line":119,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/results/show.html.erb:119"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/shared/_abstract_table.html.erb","line":53,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/shared/_abstract_table.html.erb:53"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-html-safe","severity":"medium","message":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/shared/_abstract_table.html.erb","line":82,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-html-safe:app/views/shared/_abstract_table.html.erb:82"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/statuses/show.html.erb","line":6,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/statuses/show.html.erb:6"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/summary_mailer/notification.html.erb","line":356,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/summary_mailer/notification.html.erb:356"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/summary_mailer/notification.html.erb","line":386,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/summary_mailer/notification.html.erb:386"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/system_metadata/show.html.erb","line":21,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/system_metadata/show.html.erb:21"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/task_types/_options_fields.html.erb","line":62,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/task_types/_options_fields.html.erb:62"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/task_types/_options_fields.html.erb","line":69,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/task_types/_options_fields.html.erb:69"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/tasks/_form.html.erb","line":43,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/tasks/_form.html.erb:43"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/tasks/_form.html.erb","line":55,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/tasks/_form.html.erb:55"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":21,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:21"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":33,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:33"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":48,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:48"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":60,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:60"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":75,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:75"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":87,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:87"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":102,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:102"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_summary_data.html.erb","line":114,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_summary_data.html.erb:114"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/tasks/_summary_data.html.erb","line":129,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/tasks/_summary_data.html.erb:129"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/tasks/_summary_data.html.erb","line":132,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/tasks/_summary_data.html.erb:132"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":34,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:34"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":42,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:42"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":50,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:50"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":58,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:58"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":66,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:66"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":74,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:74"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":82,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:82"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/_tasks_table.html.erb","line":90,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/_tasks_table.html.erb:90"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/metadata/_latest_results_link_row.html.erb","line":3,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/metadata/_latest_results_link_row.html.erb:3"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":28,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:28"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":28,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:28"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":40,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:40"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":40,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:40"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":55,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:55"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":55,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:55"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":67,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:67"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":67,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:67"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":82,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:82"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":82,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:82"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":94,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:94"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":94,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:94"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":109,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:109"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":109,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:109"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":121,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:121"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-reverse-tabnabbing","severity":"medium","message":"Setting an anchor target of `_blank` without the `noopener` or `noreferrer` attribute allows reverse tabnabbing on Internet Explorer, Opera, and Android Webview. [confidence medium]","path":"app/views/tasks/show.html.erb","line":121,"fingerprint":"ruby.rails.security.brakeman.check-reverse-tabnabbing:app/views/tasks/show.html.erb:121"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":142,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:142"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/tasks/show.html.erb","line":142,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/tasks/show.html.erb:142"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":145,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:145"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-raw","severity":"medium","message":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. [confidence low]","path":"app/views/tasks/show.html.erb","line":145,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-raw:app/views/tasks/show.html.erb:145"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":167,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:167"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/tasks/show.html.erb","line":169,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/tasks/show.html.erb:169"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/users/show.html.erb","line":15,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/users/show.html.erb:15"},{"rule_id":"opengrep/ruby.rails.security.audit.detailed-exceptions","severity":"medium","message":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off. [confidence low]","path":"config/environments/development.rb","line":50,"fingerprint":"ruby.rails.security.audit.detailed-exceptions:config/environments/development.rb:50"},{"rule_id":"opengrep/ruby.rails.security.audit.detailed-exceptions","severity":"medium","message":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off. [confidence low]","path":"config/environments/test.rb","line":42,"fingerprint":"ruby.rails.security.audit.detailed-exceptions:config/environments/test.rb:42"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-rails-session-secret-handling","severity":"medium","message":"Found a string literal assignment to a Rails session secret `secret_token`. Do not commit secret values to source control! Any user in possession of this value may falsify arbitrary session data in your application. Read this value from an environment variable, KMS, or file on disk outside of source [confidence medium]","path":"config/initializers/secret_token.rb","line":22,"fingerprint":"ruby.rails.security.brakeman.check-rails-session-secret-handling:config/initializers/secret_token.rb:22"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-rails-session-secret-handling","severity":"medium","message":"Found a string literal assignment to a Rails session secret `secret_key_base`. Do not commit secret values to source control! Any user in possession of this value may falsify arbitrary session data in your application. Read this value from an environment variable, KMS, or file on disk outside of sou [confidence medium]","path":"config/initializers/secret_token.rb","line":23,"fingerprint":"ruby.rails.security.brakeman.check-rails-session-secret-handling:config/initializers/secret_token.rb:23"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/scumblr_tasks/security/opengrok_analyzer.rb","line":171,"fingerprint":"ruby.lang.security.dangerous-open:lib/scumblr_tasks/security/opengrok_analyzer.rb:171"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/search_providers/ct.rb","line":48,"fingerprint":"ruby.lang.security.dangerous-open:lib/search_providers/ct.rb:48"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/search_providers/rss.rb","line":49,"fingerprint":"ruby.lang.security.dangerous-open:lib/search_providers/rss.rb:49"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"lib/workflowable/actions/status_change_notification.rb","line":17,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:lib/workflowable/actions/status_change_notification.rb:17"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"lib/workflowable/actions/status_change_notification.rb","line":20,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:lib/workflowable/actions/status_change_notification.rb:20"}],"evidence":[],"data":{"rulesets":["ruby","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":45.0,"vulnerabilities":208.0,"vulns_critical":8.0,"vulns_high":73.0,"vulns_medium":94.0,"vulns_low":16.0,"vulns_unknown":17.0,"penalty":329.0},"findings":[{"rule_id":"osv/GHSA-3hhc-qp5v-9p2j","severity":"critical","message":"activerecord@4.2.10 (RubyGems) is affected by GHSA-3hhc-qp5v-9p2j","path":"Gemfile.lock","line":null,"fingerprint":"activerecord@4.2.10 (RubyGems):GHSA-3hhc-qp5v-9p2j"},{"rule_id":"osv/GHSA-69p6-wvmq-27gg","severity":"critical","message":"git@1.3.0 (RubyGems) is affected by GHSA-69p6-wvmq-27gg","path":"Gemfile.lock","line":null,"fingerprint":"git@1.3.0 (RubyGems):GHSA-69p6-wvmq-27gg"},{"rule_id":"osv/GHSA-5c5f-7vfq-3732","severity":"critical","message":"jmespath@1.3.1 (RubyGems) is affected by GHSA-5c5f-7vfq-3732","path":"Gemfile.lock","line":null,"fingerprint":"jmespath@1.3.1 (RubyGems):GHSA-5c5f-7vfq-3732"},{"rule_id":"osv/GHSA-cr5j-953j-xw5p","severity":"critical","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-cr5j-953j-xw5p","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-cr5j-953j-xw5p"},{"rule_id":"osv/GHSA-qxcg-xjjg-66mj","severity":"critical","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-qxcg-xjjg-66mj","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-qxcg-xjjg-66mj"},{"rule_id":"osv/GHSA-wq4h-7r42-5hrr","severity":"critical","message":"rack@1.6.10 (RubyGems) is affected by GHSA-wq4h-7r42-5hrr","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-wq4h-7r42-5hrr"},{"rule_id":"osv/GHSA-r74q-gxcg-73hx","severity":"critical","message":"simple_form@3.2.1 (RubyGems) is affected by GHSA-r74q-gxcg-73hx","path":"Gemfile.lock","line":null,"fingerprint":"simple_form@3.2.1 (RubyGems):GHSA-r74q-gxcg-73hx"},{"rule_id":"osv/GHSA-34r7-q49f-h37c","severity":"critical","message":"uglifier@2.5.3 (RubyGems) is affected by GHSA-34r7-q49f-h37c","path":"Gemfile.lock","line":null,"fingerprint":"uglifier@2.5.3 (RubyGems):GHSA-34r7-q49f-h37c"},{"rule_id":"osv/GHSA-7wjx-3g7j-8584","severity":"high","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-7wjx-3g7j-8584","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-7wjx-3g7j-8584"},{"rule_id":"osv/GHSA-hjg4-8q5f-x6fm","severity":"high","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-hjg4-8q5f-x6fm","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-hjg4-8q5f-x6fm"},{"rule_id":"osv/GHSA-wm3x-v3qw-4jh3","severity":"high","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-wm3x-v3qw-4jh3","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-wm3x-v3qw-4jh3"},{"rule_id":"osv/GHSA-86g5-2wh3-gc9j","severity":"high","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-86g5-2wh3-gc9j","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-86g5-2wh3-gc9j"},{"rule_id":"osv/GHSA-cr3x-7m39-c6jq","severity":"high","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-cr3x-7m39-c6jq","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-cr3x-7m39-c6jq"},{"rule_id":"osv/GHSA-m63j-wh5w-c252","severity":"high","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-m63j-wh5w-c252","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-m63j-wh5w-c252"},{"rule_id":"osv/GHSA-q2qw-rmrh-vv42","severity":"high","message":"activejob@4.2.10 (RubyGems) is affected by GHSA-q2qw-rmrh-vv42","path":"Gemfile.lock","line":null,"fingerprint":"activejob@4.2.10 (RubyGems):GHSA-q2qw-rmrh-vv42"},{"rule_id":"osv/GHSA-579w-22j4-4749","severity":"high","message":"activerecord@4.2.10 (RubyGems) is affected by GHSA-579w-22j4-4749","path":"Gemfile.lock","line":null,"fingerprint":"activerecord@4.2.10 (RubyGems):GHSA-579w-22j4-4749"},{"rule_id":"osv/GHSA-8474-xrp6-wh69","severity":"high","message":"activesupport@4.2.10 (RubyGems) is affected by GHSA-8474-xrp6-wh69","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@4.2.10 (RubyGems):GHSA-8474-xrp6-wh69"},{"rule_id":"osv/GHSA-h27x-rffw-24p4","severity":"high","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-h27x-rffw-24p4","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-h27x-rffw-24p4"},{"rule_id":"osv/GHSA-jxhc-q857-3j6g","severity":"high","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-jxhc-q857-3j6g","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-jxhc-q857-3j6g"},{"rule_id":"osv/GHSA-5pm8-492c-92p5","severity":"high","message":"chartkick@2.1.1 (RubyGems) is affected by GHSA-5pm8-492c-92p5","path":"Gemfile.lock","line":null,"fingerprint":"chartkick@2.1.1 (RubyGems):GHSA-5pm8-492c-92p5"},{"rule_id":"osv/GHSA-h8w8-99g7-qmvj","severity":"high","message":"concurrent-ruby@1.0.5 (RubyGems) is affected by GHSA-h8w8-99g7-qmvj","path":"Gemfile.lock","line":null,"fingerprint":"concurrent-ruby@1.0.5 (RubyGems):GHSA-h8w8-99g7-qmvj"},{"rule_id":"osv/GHSA-6wmf-3r64-vcwv","severity":"high","message":"crass@1.0.3 (RubyGems) is affected by GHSA-6wmf-3r64-vcwv","path":"Gemfile.lock","line":null,"fingerprint":"crass@1.0.3 (RubyGems):GHSA-6wmf-3r64-vcwv"},{"rule_id":"osv/GHSA-2gw2-8q9w-cw8p","severity":"high","message":"ffi@1.9.10 (RubyGems) is affected by GHSA-2gw2-8q9w-cw8p","path":"Gemfile.lock","line":null,"fingerprint":"ffi@1.9.10 (RubyGems):GHSA-2gw2-8q9w-cw8p"},{"rule_id":"osv/GHSA-pfpr-3463-c6jh","severity":"high","message":"git@1.3.0 (RubyGems) is affected by GHSA-pfpr-3463-c6jh","path":"Gemfile.lock","line":null,"fingerprint":"git@1.3.0 (RubyGems):GHSA-pfpr-3463-c6jh"},{"rule_id":"osv/GHSA-pphf-gfrm-v32r","severity":"high","message":"git@1.3.0 (RubyGems) is affected by GHSA-pphf-gfrm-v32r","path":"Gemfile.lock","line":null,"fingerprint":"git@1.3.0 (RubyGems):GHSA-pphf-gfrm-v32r"},{"rule_id":"osv/GHSA-jphg-qwrw-7w9g","severity":"high","message":"json@1.8.6 (RubyGems) is affected by GHSA-jphg-qwrw-7w9g","path":"Gemfile.lock","line":null,"fingerprint":"json@1.8.6 (RubyGems):GHSA-jphg-qwrw-7w9g"},{"rule_id":"osv/GHSA-c32j-vqhx-rx3x","severity":"high","message":"jwt@1.5.2 (RubyGems) is affected by GHSA-c32j-vqhx-rx3x","path":"Gemfile.lock","line":null,"fingerprint":"jwt@1.5.2 (RubyGems):GHSA-c32j-vqhx-rx3x"},{"rule_id":"osv/GHSA-486f-hjj9-9vhh","severity":"high","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-486f-hjj9-9vhh","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-486f-hjj9-9vhh"},{"rule_id":"osv/GHSA-73v3-wf97-vpgj","severity":"high","message":"msgpack@1.0.0 (RubyGems) is affected by GHSA-73v3-wf97-vpgj","path":"Gemfile.lock","line":null,"fingerprint":"msgpack@1.0.0 (RubyGems):GHSA-73v3-wf97-vpgj"},{"rule_id":"osv/GHSA-242x-7cm6-4w8j","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-242x-7cm6-4w8j","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-242x-7cm6-4w8j"},{"rule_id":"osv/GHSA-2rr5-8q37-2w7h","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-2rr5-8q37-2w7h","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-2rr5-8q37-2w7h"},{"rule_id":"osv/GHSA-59gp-qqm7-cw4j","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-59gp-qqm7-cw4j","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-59gp-qqm7-cw4j"},{"rule_id":"osv/GHSA-6qvp-r6r3-9p7h","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-6qvp-r6r3-9p7h","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-6qvp-r6r3-9p7h"},{"rule_id":"osv/GHSA-7553-jr98-vx47","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-7553-jr98-vx47","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-7553-jr98-vx47"},{"rule_id":"osv/GHSA-c4rq-3m3g-8wgx","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-c4rq-3m3g-8wgx","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-c4rq-3m3g-8wgx"},{"rule_id":"osv/GHSA-cf46-6xxh-pc75","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-cf46-6xxh-pc75","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-cf46-6xxh-pc75"},{"rule_id":"osv/GHSA-cgx6-hpwq-fhv5","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-cgx6-hpwq-fhv5","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-cgx6-hpwq-fhv5"},{"rule_id":"osv/GHSA-crjr-9rc5-ghw8","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-crjr-9rc5-ghw8","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-crjr-9rc5-ghw8"},{"rule_id":"osv/GHSA-gx8x-g87m-h5q6","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-gx8x-g87m-h5q6","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-gx8x-g87m-h5q6"},{"rule_id":"osv/GHSA-jc36-42cf-vqwj","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-jc36-42cf-vqwj","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-jc36-42cf-vqwj"},{"rule_id":"osv/GHSA-jw9f-hh49-cvp9","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-jw9f-hh49-cvp9","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-jw9f-hh49-cvp9"},{"rule_id":"osv/GHSA-mrxw-mxhj-p664","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-mrxw-mxhj-p664","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-mrxw-mxhj-p664"},{"rule_id":"osv/GHSA-v4f8-2847-rwm7","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-v4f8-2847-rwm7","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-v4f8-2847-rwm7"},{"rule_id":"osv/GHSA-v6gp-9mmm-c6p5","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-v6gp-9mmm-c6p5","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-v6gp-9mmm-c6p5"},{"rule_id":"osv/GHSA-vmfx-gcfq-wvm2","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-vmfx-gcfq-wvm2","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-vmfx-gcfq-wvm2"},{"rule_id":"osv/GHSA-xh29-r2w5-wx8m","severity":"high","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-xh29-r2w5-wx8m","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-xh29-r2w5-wx8m"},{"rule_id":"osv/GHSA-7359-3c6r-hfc2","severity":"high","message":"oauth@0.5.1 (RubyGems) is affected by GHSA-7359-3c6r-hfc2","path":"Gemfile.lock","line":null,"fingerprint":"oauth@0.5.1 (RubyGems):GHSA-7359-3c6r-hfc2"},{"rule_id":"osv/GHSA-pp92-crg2-gfv9","severity":"high","message":"oauth2@1.2.0 (RubyGems) is affected by GHSA-pp92-crg2-gfv9","path":"Gemfile.lock","line":null,"fingerprint":"oauth2@1.2.0 (RubyGems):GHSA-pp92-crg2-gfv9"},{"rule_id":"osv/GHSA-2cw7-v8ff-p88r","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-2cw7-v8ff-p88r","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-2cw7-v8ff-p88r"},{"rule_id":"osv/GHSA-35w3-pjm6-wj95","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-35w3-pjm6-wj95","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-35w3-pjm6-wj95"},{"rule_id":"osv/GHSA-3m6q-jj5j-38c9","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-3m6q-jj5j-38c9","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-3m6q-jj5j-38c9"},{"rule_id":"osv/GHSA-3v45-f3vh-wg7m","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-3v45-f3vh-wg7m","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-3v45-f3vh-wg7m"},{"rule_id":"osv/GHSA-475m-ph3x-64gp","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-475m-ph3x-64gp","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-475m-ph3x-64gp"},{"rule_id":"osv/GHSA-9cv6-qcjw-4grx","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-9cv6-qcjw-4grx","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-9cv6-qcjw-4grx"},{"rule_id":"osv/GHSA-9ppp-w3g4-fh4q","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-9ppp-w3g4-fh4q","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-9ppp-w3g4-fh4q"},{"rule_id":"osv/GHSA-m578-w5vf-rfcm","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-m578-w5vf-rfcm","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-m578-w5vf-rfcm"},{"rule_id":"osv/GHSA-q2gm-54r6-8fwm","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-q2gm-54r6-8fwm","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-q2gm-54r6-8fwm"},{"rule_id":"osv/GHSA-vwm4-62gf-x745","severity":"high","message":"oj@2.17.1 (RubyGems) is affected by GHSA-vwm4-62gf-x745","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-vwm4-62gf-x745"},{"rule_id":"osv/GHSA-3h57-hmj3-gj3p","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-3h57-hmj3-gj3p","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-3h57-hmj3-gj3p"},{"rule_id":"osv/GHSA-5f9h-9pjv-v6j7","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-5f9h-9pjv-v6j7","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-5f9h-9pjv-v6j7"},{"rule_id":"osv/GHSA-5v64-555j-wjxm","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-5v64-555j-wjxm","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-5v64-555j-wjxm"},{"rule_id":"osv/GHSA-625h-95r8-8xpm","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-625h-95r8-8xpm","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-625h-95r8-8xpm"},{"rule_id":"osv/GHSA-65f5-mfpf-vfhj","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-65f5-mfpf-vfhj","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-65f5-mfpf-vfhj"},{"rule_id":"osv/GHSA-6xw4-3v39-52mm","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-6xw4-3v39-52mm","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-6xw4-3v39-52mm"},{"rule_id":"osv/GHSA-7wqh-767x-r66v","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-7wqh-767x-r66v","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-7wqh-767x-r66v"},{"rule_id":"osv/GHSA-8vqr-qjwx-82mw","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-8vqr-qjwx-82mw","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-8vqr-qjwx-82mw"},{"rule_id":"osv/GHSA-gjh7-p2fx-99vx","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-gjh7-p2fx-99vx","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-gjh7-p2fx-99vx"},{"rule_id":"osv/GHSA-h2jq-g4cq-5ppq","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-h2jq-g4cq-5ppq","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-h2jq-g4cq-5ppq"},{"rule_id":"osv/GHSA-hxqx-xwvh-44m2","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-hxqx-xwvh-44m2","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-hxqx-xwvh-44m2"},{"rule_id":"osv/GHSA-j6w9-fv6q-3q52","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-j6w9-fv6q-3q52","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-j6w9-fv6q-3q52"},{"rule_id":"osv/GHSA-mxw3-3hh2-x2mh","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-mxw3-3hh2-x2mh","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-mxw3-3hh2-x2mh"},{"rule_id":"osv/GHSA-p543-xpfm-54cp","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-p543-xpfm-54cp","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-p543-xpfm-54cp"},{"rule_id":"osv/GHSA-v569-hp3g-36wr","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-v569-hp3g-36wr","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-v569-hp3g-36wr"},{"rule_id":"osv/GHSA-w9pc-fmgc-vxvw","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-w9pc-fmgc-vxvw","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-w9pc-fmgc-vxvw"},{"rule_id":"osv/GHSA-wpv5-97wm-hp9c","severity":"high","message":"rack@1.6.10 (RubyGems) is affected by GHSA-wpv5-97wm-hp9c","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-wpv5-97wm-hp9c"},{"rule_id":"osv/GHSA-8c8q-2xw3-j869","severity":"high","message":"rack-contrib@1.1.0 (RubyGems) is affected by GHSA-8c8q-2xw3-j869","path":"Gemfile.lock","line":null,"fingerprint":"rack-contrib@1.1.0 (RubyGems):GHSA-8c8q-2xw3-j869"},{"rule_id":"osv/GHSA-5x79-w82f-gw8w","severity":"high","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-5x79-w82f-gw8w","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-5x79-w82f-gw8w"},{"rule_id":"osv/GHSA-jrfj-98qg-qjgv","severity":"high","message":"sidekiq@4.2.10 (RubyGems) is affected by GHSA-jrfj-98qg-qjgv","path":"Gemfile.lock","line":null,"fingerprint":"sidekiq@4.2.10 (RubyGems):GHSA-jrfj-98qg-qjgv"},{"rule_id":"osv/GHSA-qp49-3pvw-x4m5","severity":"high","message":"sinatra@1.4.7 (RubyGems) is affected by GHSA-qp49-3pvw-x4m5","path":"Gemfile.lock","line":null,"fingerprint":"sinatra@1.4.7 (RubyGems):GHSA-qp49-3pvw-x4m5"},{"rule_id":"osv/GHSA-pr3h-jjhj-573x","severity":"high","message":"sprockets@2.11.3 (RubyGems) is affected by GHSA-pr3h-jjhj-573x","path":"Gemfile.lock","line":null,"fingerprint":"sprockets@2.11.3 (RubyGems):GHSA-pr3h-jjhj-573x"},{"rule_id":"osv/GHSA-5cm2-9h8c-rvfx","severity":"high","message":"tzinfo@1.2.5 (RubyGems) is affected by GHSA-5cm2-9h8c-rvfx","path":"Gemfile.lock","line":null,"fingerprint":"tzinfo@1.2.5 (RubyGems):GHSA-5cm2-9h8c-rvfx"},{"rule_id":"osv/GHSA-h47h-mwp9-c6q6","severity":"medium","message":"actionmailer@4.2.10 (RubyGems) is affected by GHSA-h47h-mwp9-c6q6","path":"Gemfile.lock","line":null,"fingerprint":"actionmailer@4.2.10 (RubyGems):GHSA-h47h-mwp9-c6q6"},{"rule_id":"osv/GHSA-2586-8ghr-69fj","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-2586-8ghr-69fj","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-2586-8ghr-69fj"},{"rule_id":"osv/GHSA-4g8v-vg43-wpgf","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-4g8v-vg43-wpgf","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-4g8v-vg43-wpgf"},{"rule_id":"osv/GHSA-8xww-x3g3-6jcv","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-8xww-x3g3-6jcv","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-8xww-x3g3-6jcv"},{"rule_id":"osv/GHSA-p84v-45xj-wwqj","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-p84v-45xj-wwqj","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-p84v-45xj-wwqj"},{"rule_id":"osv/GHSA-r9jg-fmfx-2gv6","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-r9jg-fmfx-2gv6","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-r9jg-fmfx-2gv6"},{"rule_id":"osv/GHSA-rwvh-fw6r-pwvp","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-rwvh-fw6r-pwvp","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-rwvh-fw6r-pwvp"},{"rule_id":"osv/GHSA-vfg9-r3fq-jvx4","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-vfg9-r3fq-jvx4","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-vfg9-r3fq-jvx4"},{"rule_id":"osv/GHSA-x6mj-8jx9-qhqv","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-x6mj-8jx9-qhqv","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-x6mj-8jx9-qhqv"},{"rule_id":"osv/GHSA-x76w-6vjr-8xgj","severity":"medium","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-x76w-6vjr-8xgj","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-x76w-6vjr-8xgj"},{"rule_id":"osv/GHSA-2p2f-4rq4-gjwc","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-2p2f-4rq4-gjwc","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-2p2f-4rq4-gjwc"},{"rule_id":"osv/GHSA-65cv-r6x7-79hv","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-65cv-r6x7-79hv","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-65cv-r6x7-79hv"},{"rule_id":"osv/GHSA-68p9-83h6-5wpj","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-68p9-83h6-5wpj","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-68p9-83h6-5wpj"},{"rule_id":"osv/GHSA-cfjv-5498-mph5","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-cfjv-5498-mph5","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-cfjv-5498-mph5"},{"rule_id":"osv/GHSA-ch3h-j2vf-95pv","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-ch3h-j2vf-95pv","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-ch3h-j2vf-95pv"},{"rule_id":"osv/GHSA-rq8q-p985-fjq7","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-rq8q-p985-fjq7","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-rq8q-p985-fjq7"},{"rule_id":"osv/GHSA-v6rj-xm57-3p59","severity":"medium","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-v6rj-xm57-3p59","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-v6rj-xm57-3p59"},{"rule_id":"osv/GHSA-76r7-hhxj-r776","severity":"medium","message":"activerecord@4.2.10 (RubyGems) is affected by GHSA-76r7-hhxj-r776","path":"Gemfile.lock","line":null,"fingerprint":"activerecord@4.2.10 (RubyGems):GHSA-76r7-hhxj-r776"},{"rule_id":"osv/GHSA-cvw2-xj8r-mjf7","severity":"medium","message":"activerecord-session_store@1.0.0 (RubyGems) is affected by GHSA-cvw2-xj8r-mjf7","path":"Gemfile.lock","line":null,"fingerprint":"activerecord-session_store@1.0.0 (RubyGems):GHSA-cvw2-xj8r-mjf7"},{"rule_id":"osv/GHSA-2j26-frm8-cmj9","severity":"medium","message":"activesupport@4.2.10 (RubyGems) is affected by GHSA-2j26-frm8-cmj9","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@4.2.10 (RubyGems):GHSA-2j26-frm8-cmj9"},{"rule_id":"osv/GHSA-89vf-4333-qx8v","severity":"medium","message":"activesupport@4.2.10 (RubyGems) is affected by GHSA-89vf-4333-qx8v","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@4.2.10 (RubyGems):GHSA-89vf-4333-qx8v"},{"rule_id":"osv/GHSA-cg4j-q9v8-6v38","severity":"medium","message":"activesupport@4.2.10 (RubyGems) is affected by GHSA-cg4j-q9v8-6v38","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@4.2.10 (RubyGems):GHSA-cg4j-q9v8-6v38"},{"rule_id":"osv/GHSA-j6gc-792m-qgm2","severity":"medium","message":"activesupport@4.2.10 (RubyGems) is affected by GHSA-j6gc-792m-qgm2","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@4.2.10 (RubyGems):GHSA-j6gc-792m-qgm2"},{"rule_id":"osv/GHSA-pj73-v5mw-pm9j","severity":"medium","message":"activesupport@4.2.10 (RubyGems) is affected by GHSA-pj73-v5mw-pm9j","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@4.2.10 (RubyGems):GHSA-pj73-v5mw-pm9j"},{"rule_id":"osv/GHSA-8gmh-2hhj-2hv9","severity":"medium","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-8gmh-2hhj-2hv9","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-8gmh-2hhj-2hv9"},{"rule_id":"osv/GHSA-9crm-g4mf-wc5j","severity":"medium","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-9crm-g4mf-wc5j","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-9crm-g4mf-wc5j"},{"rule_id":"osv/GHSA-9f42-57jx-vpp3","severity":"medium","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-9f42-57jx-vpp3","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-9f42-57jx-vpp3"},{"rule_id":"osv/GHSA-j82w-28jv-3pmj","severity":"medium","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-j82w-28jv-3pmj","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-j82w-28jv-3pmj"},{"rule_id":"osv/GHSA-qq38-m9mg-xjj5","severity":"medium","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-qq38-m9mg-xjj5","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-qq38-m9mg-xjj5"},{"rule_id":"osv/GHSA-2xgq-q749-89fq","severity":"medium","message":"aws-sdk-s3@1.8.0 (RubyGems) is affected by GHSA-2xgq-q749-89fq","path":"Gemfile.lock","line":null,"fingerprint":"aws-sdk-s3@1.8.0 (RubyGems):GHSA-2xgq-q749-89fq"},{"rule_id":"osv/GHSA-f27w-vcwj-c954","severity":"medium","message":"bcrypt@3.1.11 (RubyGems) is affected by GHSA-f27w-vcwj-c954","path":"Gemfile.lock","line":null,"fingerprint":"bcrypt@3.1.11 (RubyGems):GHSA-f27w-vcwj-c954"},{"rule_id":"osv/GHSA-w3j4-76qw-wwjm","severity":"medium","message":"better_errors@1.1.0 (RubyGems) is affected by GHSA-w3j4-76qw-wwjm","path":"Gemfile.lock","line":null,"fingerprint":"better_errors@1.1.0 (RubyGems):GHSA-w3j4-76qw-wwjm"},{"rule_id":"osv/GHSA-3j95-fjv2-3m4p","severity":"medium","message":"chartkick@2.1.1 (RubyGems) is affected by GHSA-3j95-fjv2-3m4p","path":"Gemfile.lock","line":null,"fingerprint":"chartkick@2.1.1 (RubyGems):GHSA-3j95-fjv2-3m4p"},{"rule_id":"osv/GHSA-g45g-g52h-39rg","severity":"medium","message":"chartkick@2.1.1 (RubyGems) is affected by GHSA-g45g-g52h-39rg","path":"Gemfile.lock","line":null,"fingerprint":"chartkick@2.1.1 (RubyGems):GHSA-g45g-g52h-39rg"},{"rule_id":"osv/GHSA-wv3x-4vxv-whpp","severity":"medium","message":"concurrent-ruby@1.0.5 (RubyGems) is affected by GHSA-wv3x-4vxv-whpp","path":"Gemfile.lock","line":null,"fingerprint":"concurrent-ruby@1.0.5 (RubyGems):GHSA-wv3x-4vxv-whpp"},{"rule_id":"osv/GHSA-6jxj-px6v-747w","severity":"medium","message":"crass@1.0.3 (RubyGems) is affected by GHSA-6jxj-px6v-747w","path":"Gemfile.lock","line":null,"fingerprint":"crass@1.0.3 (RubyGems):GHSA-6jxj-px6v-747w"},{"rule_id":"osv/GHSA-8vfg-2r28-hvhj","severity":"medium","message":"crass@1.0.3 (RubyGems) is affected by GHSA-8vfg-2r28-hvhj","path":"Gemfile.lock","line":null,"fingerprint":"crass@1.0.3 (RubyGems):GHSA-8vfg-2r28-hvhj"},{"rule_id":"osv/GHSA-pq4g-8rxf-4g29","severity":"medium","message":"crass@1.0.3 (RubyGems) is affected by GHSA-pq4g-8rxf-4g29","path":"Gemfile.lock","line":null,"fingerprint":"crass@1.0.3 (RubyGems):GHSA-pq4g-8rxf-4g29"},{"rule_id":"osv/GHSA-wwpr-jff3-395c","severity":"medium","message":"crass@1.0.3 (RubyGems) is affected by GHSA-wwpr-jff3-395c","path":"Gemfile.lock","line":null,"fingerprint":"crass@1.0.3 (RubyGems):GHSA-wwpr-jff3-395c"},{"rule_id":"osv/GHSA-57hq-95w6-v4fc","severity":"medium","message":"devise@4.1.0 (RubyGems) is affected by GHSA-57hq-95w6-v4fc","path":"Gemfile.lock","line":null,"fingerprint":"devise@4.1.0 (RubyGems):GHSA-57hq-95w6-v4fc"},{"rule_id":"osv/GHSA-73rf-6mrf-759q","severity":"medium","message":"devise@4.1.0 (RubyGems) is affected by GHSA-73rf-6mrf-759q","path":"Gemfile.lock","line":null,"fingerprint":"devise@4.1.0 (RubyGems):GHSA-73rf-6mrf-759q"},{"rule_id":"osv/GHSA-fcjw-8rhj-gwwc","severity":"medium","message":"devise@4.1.0 (RubyGems) is affected by GHSA-fcjw-8rhj-gwwc","path":"Gemfile.lock","line":null,"fingerprint":"devise@4.1.0 (RubyGems):GHSA-fcjw-8rhj-gwwc"},{"rule_id":"osv/GHSA-jp94-3292-c3xv","severity":"medium","message":"devise@4.1.0 (RubyGems) is affected by GHSA-jp94-3292-c3xv","path":"Gemfile.lock","line":null,"fingerprint":"devise@4.1.0 (RubyGems):GHSA-jp94-3292-c3xv"},{"rule_id":"osv/GHSA-23c2-gwp5-pxw9","severity":"medium","message":"globalid@0.4.1 (RubyGems) is affected by GHSA-23c2-gwp5-pxw9","path":"Gemfile.lock","line":null,"fingerprint":"globalid@0.4.1 (RubyGems):GHSA-23c2-gwp5-pxw9"},{"rule_id":"osv/GHSA-r53w-g4xm-3gc6","severity":"medium","message":"haml@4.1.0.beta.1 (RubyGems) is affected by GHSA-r53w-g4xm-3gc6","path":"Gemfile.lock","line":null,"fingerprint":"haml@4.1.0.beta.1 (RubyGems):GHSA-r53w-g4xm-3gc6"},{"rule_id":"osv/GHSA-6wpv-cj6x-v3jw","severity":"medium","message":"http@0.6.2 (RubyGems) is affected by GHSA-6wpv-cj6x-v3jw","path":"Gemfile.lock","line":null,"fingerprint":"http@0.6.2 (RubyGems):GHSA-6wpv-cj6x-v3jw"},{"rule_id":"osv/GHSA-6c3j-c64m-qhgq","severity":"medium","message":"jquery-rails@3.1.4 (RubyGems) is affected by GHSA-6c3j-c64m-qhgq","path":"Gemfile.lock","line":null,"fingerprint":"jquery-rails@3.1.4 (RubyGems):GHSA-6c3j-c64m-qhgq"},{"rule_id":"osv/GHSA-gxr4-xjj5-5px2","severity":"medium","message":"jquery-rails@3.1.4 (RubyGems) is affected by GHSA-gxr4-xjj5-5px2","path":"Gemfile.lock","line":null,"fingerprint":"jquery-rails@3.1.4 (RubyGems):GHSA-gxr4-xjj5-5px2"},{"rule_id":"osv/GHSA-jpcq-cgw6-v4j6","severity":"medium","message":"jquery-rails@3.1.4 (RubyGems) is affected by GHSA-jpcq-cgw6-v4j6","path":"Gemfile.lock","line":null,"fingerprint":"jquery-rails@3.1.4 (RubyGems):GHSA-jpcq-cgw6-v4j6"},{"rule_id":"osv/GHSA-rmxg-73gg-4p98","severity":"medium","message":"jquery-rails@3.1.4 (RubyGems) is affected by GHSA-rmxg-73gg-4p98","path":"Gemfile.lock","line":null,"fingerprint":"jquery-rails@3.1.4 (RubyGems):GHSA-rmxg-73gg-4p98"},{"rule_id":"osv/GHSA-7r3j-qmr4-jfpj","severity":"medium","message":"kaminari@0.16.1 (RubyGems) is affected by GHSA-7r3j-qmr4-jfpj","path":"Gemfile.lock","line":null,"fingerprint":"kaminari@0.16.1 (RubyGems):GHSA-7r3j-qmr4-jfpj"},{"rule_id":"osv/GHSA-r5jw-62xg-j433","severity":"medium","message":"kaminari@0.16.1 (RubyGems) is affected by GHSA-r5jw-62xg-j433","path":"Gemfile.lock","line":null,"fingerprint":"kaminari@0.16.1 (RubyGems):GHSA-r5jw-62xg-j433"},{"rule_id":"osv/GHSA-228g-948r-83gx","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-228g-948r-83gx","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-228g-948r-83gx"},{"rule_id":"osv/GHSA-345x-3rq2-jfrm","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-345x-3rq2-jfrm","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-345x-3rq2-jfrm"},{"rule_id":"osv/GHSA-9wjq-cp2p-hrgf","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-9wjq-cp2p-hrgf","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-9wjq-cp2p-hrgf"},{"rule_id":"osv/GHSA-c3gv-9cxf-6f57","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-c3gv-9cxf-6f57","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-c3gv-9cxf-6f57"},{"rule_id":"osv/GHSA-g4xq-jx4w-4cjv","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-g4xq-jx4w-4cjv","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-g4xq-jx4w-4cjv"},{"rule_id":"osv/GHSA-m3x9-938q-5767","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-m3x9-938q-5767","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-m3x9-938q-5767"},{"rule_id":"osv/GHSA-mf2j-8f84-cc9q","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-mf2j-8f84-cc9q","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-mf2j-8f84-cc9q"},{"rule_id":"osv/GHSA-x7rv-cr6v-4vm4","severity":"medium","message":"loofah@2.1.1 (RubyGems) is affected by GHSA-x7rv-cr6v-4vm4","path":"Gemfile.lock","line":null,"fingerprint":"loofah@2.1.1 (RubyGems):GHSA-x7rv-cr6v-4vm4"},{"rule_id":"osv/GHSA-mvxr-6m87-mv2q","severity":"medium","message":"mail@2.7.0 (RubyGems) is affected by GHSA-mvxr-6m87-mv2q","path":"Gemfile.lock","line":null,"fingerprint":"mail@2.7.0 (RubyGems):GHSA-mvxr-6m87-mv2q"},{"rule_id":"osv/GHSA-286v-pcf5-25rc","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-286v-pcf5-25rc","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-286v-pcf5-25rc"},{"rule_id":"osv/GHSA-2qc6-mcvw-92cw","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-2qc6-mcvw-92cw","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-2qc6-mcvw-92cw"},{"rule_id":"osv/GHSA-353f-x4gh-cqq8","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-353f-x4gh-cqq8","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-353f-x4gh-cqq8"},{"rule_id":"osv/GHSA-4hm9-844j-jmxp","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-4hm9-844j-jmxp","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-4hm9-844j-jmxp"},{"rule_id":"osv/GHSA-5prr-v3j2-97mh","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-5prr-v3j2-97mh","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-5prr-v3j2-97mh"},{"rule_id":"osv/GHSA-5w6v-399v-w3cc","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-5w6v-399v-w3cc","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-5w6v-399v-w3cc"},{"rule_id":"osv/GHSA-7rrm-v45f-jp64","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-7rrm-v45f-jp64","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-7rrm-v45f-jp64"},{"rule_id":"osv/GHSA-fq42-c5rg-92c2","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-fq42-c5rg-92c2","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-fq42-c5rg-92c2"},{"rule_id":"osv/GHSA-pxvg-2qj5-37jq","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-pxvg-2qj5-37jq","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-pxvg-2qj5-37jq"},{"rule_id":"osv/GHSA-r95h-9x8f-r3f7","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-r95h-9x8f-r3f7","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-r95h-9x8f-r3f7"},{"rule_id":"osv/GHSA-v2fc-qm4h-8hqv","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-v2fc-qm4h-8hqv","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-v2fc-qm4h-8hqv"},{"rule_id":"osv/GHSA-vr8q-g5c7-m54m","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-vr8q-g5c7-m54m","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-vr8q-g5c7-m54m"},{"rule_id":"osv/GHSA-vvfq-8hwr-qm4m","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-vvfq-8hwr-qm4m","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-vvfq-8hwr-qm4m"},{"rule_id":"osv/GHSA-wfpw-mmfh-qq69","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-wfpw-mmfh-qq69","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-wfpw-mmfh-qq69"},{"rule_id":"osv/GHSA-wx95-c6cv-8532","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-wx95-c6cv-8532","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-wx95-c6cv-8532"},{"rule_id":"osv/GHSA-xc9x-jj77-9p9j","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-xc9x-jj77-9p9j","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-xc9x-jj77-9p9j"},{"rule_id":"osv/GHSA-xxx9-3xcr-gjj3","severity":"medium","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-xxx9-3xcr-gjj3","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-xxx9-3xcr-gjj3"},{"rule_id":"osv/GHSA-fm7p-mprw-wjm9","severity":"medium","message":"oj@2.17.1 (RubyGems) is affected by GHSA-fm7p-mprw-wjm9","path":"Gemfile.lock","line":null,"fingerprint":"oj@2.17.1 (RubyGems):GHSA-fm7p-mprw-wjm9"},{"rule_id":"osv/GHSA-22f2-v57c-j9cx","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-22f2-v57c-j9cx","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-22f2-v57c-j9cx"},{"rule_id":"osv/GHSA-54rr-7fvw-6x8f","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-54rr-7fvw-6x8f","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-54rr-7fvw-6x8f"},{"rule_id":"osv/GHSA-5r2p-j47h-mhpg","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-5r2p-j47h-mhpg","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-5r2p-j47h-mhpg"},{"rule_id":"osv/GHSA-7g2v-jj9q-g3rg","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-7g2v-jj9q-g3rg","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-7g2v-jj9q-g3rg"},{"rule_id":"osv/GHSA-7mqq-6cf9-v2qp","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-7mqq-6cf9-v2qp","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-7mqq-6cf9-v2qp"},{"rule_id":"osv/GHSA-8cgq-6mh2-7j6v","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-8cgq-6mh2-7j6v","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-8cgq-6mh2-7j6v"},{"rule_id":"osv/GHSA-hrqr-hxpp-chr3","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-hrqr-hxpp-chr3","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-hrqr-hxpp-chr3"},{"rule_id":"osv/GHSA-q2ww-5357-x388","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-q2ww-5357-x388","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-q2ww-5357-x388"},{"rule_id":"osv/GHSA-q4qf-9j86-f5mh","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-q4qf-9j86-f5mh","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-q4qf-9j86-f5mh"},{"rule_id":"osv/GHSA-qv7j-4883-hwh7","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-qv7j-4883-hwh7","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-qv7j-4883-hwh7"},{"rule_id":"osv/GHSA-r657-rxjc-j557","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-r657-rxjc-j557","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-r657-rxjc-j557"},{"rule_id":"osv/GHSA-vgpv-f759-9wx3","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-vgpv-f759-9wx3","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-vgpv-f759-9wx3"},{"rule_id":"osv/GHSA-vpfw-47h7-xj4g","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-vpfw-47h7-xj4g","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-vpfw-47h7-xj4g"},{"rule_id":"osv/GHSA-whrj-4476-wvmp","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-whrj-4476-wvmp","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-whrj-4476-wvmp"},{"rule_id":"osv/GHSA-wvg4-6p58-3gh3","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-wvg4-6p58-3gh3","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-wvg4-6p58-3gh3"},{"rule_id":"osv/GHSA-x8cg-fq8g-mxfx","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-x8cg-fq8g-mxfx","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-x8cg-fq8g-mxfx"},{"rule_id":"osv/GHSA-xj5v-6v4g-jfw6","severity":"medium","message":"rack@1.6.10 (RubyGems) is affected by GHSA-xj5v-6v4g-jfw6","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-xj5v-6v4g-jfw6"},{"rule_id":"osv/GHSA-688c-3x49-6rqj","severity":"medium","message":"rack-protection@1.5.3 (RubyGems) is affected by GHSA-688c-3x49-6rqj","path":"Gemfile.lock","line":null,"fingerprint":"rack-protection@1.5.3 (RubyGems):GHSA-688c-3x49-6rqj"},{"rule_id":"osv/GHSA-9h9g-93gc-623h","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-9h9g-93gc-623h","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-9h9g-93gc-623h"},{"rule_id":"osv/GHSA-cj75-f6xr-r4g7","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-cj75-f6xr-r4g7","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-cj75-f6xr-r4g7"},{"rule_id":"osv/GHSA-cpgf-5mjf-73p7","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-cpgf-5mjf-73p7","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-cpgf-5mjf-73p7"},{"rule_id":"osv/GHSA-h7wh-q2qr-458c","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-h7wh-q2qr-458c","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-h7wh-q2qr-458c"},{"rule_id":"osv/GHSA-mcvf-2q2m-x72m","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-mcvf-2q2m-x72m","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-mcvf-2q2m-x72m"},{"rule_id":"osv/GHSA-pg8v-g4xq-hww9","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-pg8v-g4xq-hww9","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-pg8v-g4xq-hww9"},{"rule_id":"osv/GHSA-px3r-jm9g-c8w8","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-px3r-jm9g-c8w8","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-px3r-jm9g-c8w8"},{"rule_id":"osv/GHSA-rrfc-7g8p-99q8","severity":"medium","message":"rails-html-sanitizer@1.0.3 (RubyGems) is affected by GHSA-rrfc-7g8p-99q8","path":"Gemfile.lock","line":null,"fingerprint":"rails-html-sanitizer@1.0.3 (RubyGems):GHSA-rrfc-7g8p-99q8"},{"rule_id":"osv/GHSA-jppv-gw3r-w3q8","severity":"medium","message":"rake@12.3.0 (RubyGems) is affected by GHSA-jppv-gw3r-w3q8","path":"Gemfile.lock","line":null,"fingerprint":"rake@12.3.0 (RubyGems):GHSA-jppv-gw3r-w3q8"},{"rule_id":"osv/GHSA-q3wr-qw3g-3p4h","severity":"medium","message":"redcarpet@3.3.4 (RubyGems) is affected by GHSA-q3wr-qw3g-3p4h","path":"Gemfile.lock","line":null,"fingerprint":"redcarpet@3.3.4 (RubyGems):GHSA-q3wr-qw3g-3p4h"},{"rule_id":"osv/GHSA-3qc2-v3hp-6cv8","severity":"medium","message":"sidekiq@4.2.10 (RubyGems) is affected by GHSA-3qc2-v3hp-6cv8","path":"Gemfile.lock","line":null,"fingerprint":"sidekiq@4.2.10 (RubyGems):GHSA-3qc2-v3hp-6cv8"},{"rule_id":"osv/GHSA-grh7-935j-hg6w","severity":"medium","message":"sidekiq@4.2.10 (RubyGems) is affected by GHSA-grh7-935j-hg6w","path":"Gemfile.lock","line":null,"fingerprint":"sidekiq@4.2.10 (RubyGems):GHSA-grh7-935j-hg6w"},{"rule_id":"osv/GHSA-hxx2-7vcw-mqr3","severity":"medium","message":"sinatra@1.4.7 (RubyGems) is affected by GHSA-hxx2-7vcw-mqr3","path":"Gemfile.lock","line":null,"fingerprint":"sinatra@1.4.7 (RubyGems):GHSA-hxx2-7vcw-mqr3"},{"rule_id":"osv/GHSA-4fqr-96q8-xrfx","severity":"medium","message":"sqlite3@1.3.9 (RubyGems) is affected by GHSA-4fqr-96q8-xrfx","path":"Gemfile.lock","line":null,"fingerprint":"sqlite3@1.3.9 (RubyGems):GHSA-4fqr-96q8-xrfx"},{"rule_id":"osv/GHSA-gmj8-hvj3-49mw","severity":"low","message":"actionpack@4.2.10 (RubyGems) is affected by GHSA-gmj8-hvj3-49mw","path":"Gemfile.lock","line":null,"fingerprint":"actionpack@4.2.10 (RubyGems):GHSA-gmj8-hvj3-49mw"},{"rule_id":"osv/GHSA-v55j-83pf-r9cq","severity":"low","message":"actionview@4.2.10 (RubyGems) is affected by GHSA-v55j-83pf-r9cq","path":"Gemfile.lock","line":null,"fingerprint":"actionview@4.2.10 (RubyGems):GHSA-v55j-83pf-r9cq"},{"rule_id":"osv/GHSA-539f-xcgw-2gjg","severity":"low","message":"addressable@2.4.0 (RubyGems) is affected by GHSA-539f-xcgw-2gjg","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.4.0 (RubyGems):GHSA-539f-xcgw-2gjg"},{"rule_id":"osv/GHSA-6wx8-w4f5-wwcr","severity":"low","message":"concurrent-ruby@1.0.5 (RubyGems) is affected by GHSA-6wx8-w4f5-wwcr","path":"Gemfile.lock","line":null,"fingerprint":"concurrent-ruby@1.0.5 (RubyGems):GHSA-6wx8-w4f5-wwcr"},{"rule_id":"osv/GHSA-4mrv-5p47-p938","severity":"low","message":"msgpack@1.0.0 (RubyGems) is affected by GHSA-4mrv-5p47-p938","path":"Gemfile.lock","line":null,"fingerprint":"msgpack@1.0.0 (RubyGems):GHSA-4mrv-5p47-p938"},{"rule_id":"osv/GHSA-3w22-6jfg-527w","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-3w22-6jfg-527w","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-3w22-6jfg-527w"},{"rule_id":"osv/GHSA-5v8h-3h3q-446p","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-5v8h-3h3q-446p","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-5v8h-3h3q-446p"},{"rule_id":"osv/GHSA-8678-w3jw-xfc2","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-8678-w3jw-xfc2","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-8678-w3jw-xfc2"},{"rule_id":"osv/GHSA-9cv2-cfxc-v4v2","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-9cv2-cfxc-v4v2","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-9cv2-cfxc-v4v2"},{"rule_id":"osv/GHSA-p67v-3w7g-wjg7","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-p67v-3w7g-wjg7","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-p67v-3w7g-wjg7"},{"rule_id":"osv/GHSA-phwj-rprq-35pp","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-phwj-rprq-35pp","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-phwj-rprq-35pp"},{"rule_id":"osv/GHSA-v995-44v6-5fqm","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-v995-44v6-5fqm","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-v995-44v6-5fqm"},{"rule_id":"osv/GHSA-wjv4-x9w8-wm3h","severity":"low","message":"nokogiri@1.8.4 (RubyGems) is affected by GHSA-wjv4-x9w8-wm3h","path":"Gemfile.lock","line":null,"fingerprint":"nokogiri@1.8.4 (RubyGems):GHSA-wjv4-x9w8-wm3h"},{"rule_id":"osv/GHSA-p8x9-v4hv-2w4g","severity":"low","message":"rack@1.6.10 (RubyGems) is affected by GHSA-p8x9-v4hv-2w4g","path":"Gemfile.lock","line":null,"fingerprint":"rack@1.6.10 (RubyGems):GHSA-p8x9-v4hv-2w4g"},{"rule_id":"osv/GHSA-mr3q-g2mv-mr4q","severity":"low","message":"sinatra@1.4.7 (RubyGems) is affected by GHSA-mr3q-g2mv-mr4q","path":"Gemfile.lock","line":null,"fingerprint":"sinatra@1.4.7 (RubyGems):GHSA-mr3q-g2mv-mr4q"},{"rule_id":"osv/GHSA-28hh-pr2h-2w89","severity":"low","message":"sqlite3@1.3.9 (RubyGems) is affected by GHSA-28hh-pr2h-2w89","path":"Gemfile.lock","line":null,"fingerprint":"sqlite3@1.3.9 (RubyGems):GHSA-28hh-pr2h-2w89"}],"evidence":[],"data":{"ecosystems":["RubyGems"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.04,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":921.0,"function_nloc":13266.0,"mean_ccn":3.69,"p90_ccn":9.0,"complex_functions":39.0,"long_functions":19.0,"many_param_functions":4.0,"risky_nloc_share":0.3128},"findings":[],"evidence":[{"kind":"complex-function","description":"render in app/assets/javascripts/jquery_sparklines.js: complexity 62, 161 lines","ref":"app/assets/javascripts/jquery_sparklines.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery_sparklines.js#L1512","weight":1.0},{"kind":"complex-function","description":"(anonymous) in app/assets/javascripts/jquery.datetimepicker.js: complexity 51, 139 lines","ref":"app/assets/javascripts/jquery.datetimepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery.datetimepicker.js#L1412","weight":0.85},{"kind":"complex-function","description":"init in app/assets/javascripts/jquery_sparklines.js: complexity 47, 124 lines","ref":"app/assets/javascripts/jquery_sparklines.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery_sparklines.js#L1706","weight":0.7833333333333333},{"kind":"complex-function","description":"Datepicker in app/assets/javascripts/foundation_datepicker.js: complexity 43, 93 lines","ref":"app/assets/javascripts/foundation_datepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/foundation_datepicker.js#L38","weight":0.7166666666666667},{"kind":"complex-function","description":"datetimepicker.setOptions in app/assets/javascripts/jquery.datetimepicker.js: complexity 41, 105 lines","ref":"app/assets/javascripts/jquery.datetimepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery.datetimepicker.js#L840","weight":0.6833333333333333},{"kind":"complex-function","description":"fill in app/assets/javascripts/foundation_datepicker.js: complexity 40, 94 lines","ref":"app/assets/javascripts/foundation_datepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/foundation_datepicker.js#L396","weight":0.6666666666666666},{"kind":"complex-function","description":"update_vulnerabilities in lib/helpers/vulnerability_helpers.rb: complexity 38, 110 lines","ref":"lib/helpers/vulnerability_helpers.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/lib/helpers/vulnerability_helpers.rb#L143","weight":0.6333333333333333},{"kind":"complex-function","description":"self.filter_search_with_metadata in app/models/result.rb: complexity 37, 112 lines","ref":"app/models/result.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/models/result.rb#L326","weight":0.6166666666666667},{"kind":"complex-function","description":"initialize in lib/scumblr_tasks/security/github_analyzer.rb: complexity 36, 157 lines","ref":"lib/scumblr_tasks/security/github_analyzer.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/lib/scumblr_tasks/security/github_analyzer.rb#L126","weight":0.6},{"kind":"complex-function","description":"(anonymous) in app/assets/javascripts/jquery.datetimepicker.js: complexity 33, 44 lines","ref":"app/assets/javascripts/jquery.datetimepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery.datetimepicker.js#L1031","weight":0.55}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":14774.0,"duplicated_lines":1937.0,"duplicated_share":0.1311,"files":152.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: app/assets/javascripts/foundation_datepicker.js:624 and app/assets/javascripts/foundation_datepicker.js:763","ref":"app/assets/javascripts/foundation_datepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/foundation_datepicker.js#L624","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/assets/javascripts/jquery.datetimepicker.js:899 and app/assets/javascripts/jquery.datetimepicker.js:928","ref":"app/assets/javascripts/jquery.datetimepicker.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery.datetimepicker.js#L899","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/assets/javascripts/jquery_sparklines.js:1832 and app/assets/javascripts/jquery_sparklines.js:1974","ref":"app/assets/javascripts/jquery_sparklines.js","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/assets/javascripts/jquery_sparklines.js#L1832","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/controllers/application_controller.rb:1 and app/controllers/events_controller.rb:1","ref":"app/controllers/application_controller.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/controllers/application_controller.rb#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/controllers/events_controller.rb:28 and app/controllers/results_controller.rb:121","ref":"app/controllers/events_controller.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/controllers/events_controller.rb#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/controllers/results_controller.rb:9 and config/initializers/tasks.rb:9","ref":"app/controllers/results_controller.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/controllers/results_controller.rb#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/controllers/results_controller.rb:87 and app/controllers/results_controller.rb:95","ref":"app/controllers/results_controller.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/controllers/results_controller.rb#L87","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/controllers/tasks_controller.rb:115 and app/controllers/tasks_controller.rb:146","ref":"app/controllers/tasks_controller.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/controllers/tasks_controller.rb#L115","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/models/result.rb:556 and app/models/result.rb:701","ref":"app/models/result.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/app/models/result.rb#L556","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: config/boot.rb:9 and lib/search_providers/play.rb:9","ref":"config/boot.rb","url":"https://github.com/Netflix-Skunkworks/Scumblr/blob/66ed69a91c65527010f970a746a87557bf9b0856/config/boot.rb#L9","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"weighted_findings":12.25,"scanned_lines":20949.0,"category:best-practice":12.0,"category:correctness":1.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/application.js","line":285,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/application.js:285"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/application.js","line":717,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/application.js:717"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/application.js","line":727,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/application.js:727"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":988,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:988"},{"rule_id":"opengrep/javascript.lang.best-practice.assigned-undefined","severity":"medium","message":"`undefined` is not a reserved keyword in Javascript, so this is \"valid\" Javascript but highly confusing and likely to result in bugs.","path":"app/assets/javascripts/jquery_sparklines.js","line":2447,"fingerprint":"javascript.lang.best-practice.assigned-undefined:app/assets/javascripts/jquery_sparklines.js:2447"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2617,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2617"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2657,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2657"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2664,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2664"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2671,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2671"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2678,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2678"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2685,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2685"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"app/assets/javascripts/jquery_sparklines.js","line":2692,"fingerprint":"javascript.lang.best-practice.javascript-alert:app/assets/javascripts/jquery_sparklines.js:2692"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`d` is assigned twice; the first assignment is useless","path":"app/assets/javascripts/jquery.datetimepicker.js","line":2009,"fingerprint":"javascript.lang.correctness.useless-assignment:app/assets/javascripts/jquery.datetimepicker.js:2009"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.121,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.4706,"test_lines":1366.0,"source_lines":22574.0,"test_ratio":0.0605,"ci_files":1.0,"cochange_share":0.1176,"cochange_commits":204.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (rake test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["rake test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":99.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}