{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:39:19.903580Z","repo":{"ref":{"host":"github.com","owner":"brookshi","name":"Hitchhiker"},"default_branch":"master","clone_url":"https://github.com/brookshi/Hitchhiker.git","html_url":"https://github.com/brookshi/Hitchhiker","description":"a Restful Api test tool","stars":2204,"forks":398,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3989,"primary_language":"TypeScript","license_spdx":"NOASSERTION","created_at":"2016-09-26T02:47:43Z","pushed_at":"2019-02-09T13:47:16Z","security_policy_url":null,"distribution":{"owner_created_at":"2015-08-02T06:15:07Z","owner_type":"User","release_assets":[{"name":"Hitchhiker.zip","size":23684819,"download_count":1548,"release_tag":"v0.14","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.14/Hitchhiker.zip"},{"name":"Hitchhiker.zip","size":22835211,"download_count":171,"release_tag":"v0.13","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.13/Hitchhiker.zip"},{"name":"Hitchhiker.zip","size":21867116,"download_count":56,"release_tag":"v0.12.1","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.12.1/Hitchhiker.zip"},{"name":"Hitchhiker.zip","size":21582096,"download_count":32,"release_tag":"v0.12","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.12/Hitchhiker.zip"},{"name":"Hitchhiker.zip","size":21552347,"download_count":238,"release_tag":"v0.10","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.10/Hitchhiker.zip"},{"name":"Hitchhiker.zip","size":21310755,"download_count":55027,"release_tag":"v0.9","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.9/Hitchhiker.zip"},{"name":"Hitchhiker.zip","size":21090048,"download_count":144,"release_tag":"v0.8","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.8/Hitchhiker.zip"}]}},"commit_sha":"318bc47d4041b32d0e2ffb1716be053abd28b456","profile":{"lines_by_language":{"TypeScript":27016,"JavaScript":5446,"Shell":42},"files_by_category":{"source":305,"docs":90,"other":65,"config":28,"binary":16,"test":10,"generated":1,"vendored":1},"source_lines":31167,"test_lines":1337},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":49.7,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":74.4,"duplication":57.5,"lint":59.4,"testing":23.3,"docs":65.0,"type_safety":0.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.04, no CI test run detected; 10% of function code in complex or long functions; 9% duplicated lines. Weakest area: type safety."},"security":{"score":49.3,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":96.7,"sast":62.3,"dependencies":1.5,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 70 known vulnerabilities in 32 dependencies; 12 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":125.0,"checked":125.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":891.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":58580.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2016-09":{"loc":0,"attributed_loc":0},"2016-12":{"loc":294,"attributed_loc":0},"2017-01":{"loc":154,"attributed_loc":0},"2017-02":{"loc":0,"attributed_loc":0},"2017-03":{"loc":1703,"attributed_loc":0},"2017-04":{"loc":4327,"attributed_loc":0},"2017-05":{"loc":7385,"attributed_loc":0},"2017-06":{"loc":6454,"attributed_loc":0},"2017-07":{"loc":4251,"attributed_loc":0},"2017-08":{"loc":2664,"attributed_loc":0},"2017-09":{"loc":2257,"attributed_loc":0},"2017-10":{"loc":3168,"attributed_loc":0},"2017-11":{"loc":12041,"attributed_loc":0},"2017-12":{"loc":2351,"attributed_loc":0},"2018-01":{"loc":1725,"attributed_loc":0},"2018-02":{"loc":105,"attributed_loc":0},"2018-03":{"loc":1023,"attributed_loc":0},"2018-04":{"loc":724,"attributed_loc":0},"2018-05":{"loc":1071,"attributed_loc":0},"2018-06":{"loc":829,"attributed_loc":0},"2018-07":{"loc":3960,"attributed_loc":0},"2018-08":{"loc":1079,"attributed_loc":0},"2018-09":{"loc":12,"attributed_loc":0},"2018-10":{"loc":1003,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":614.0,"flagged_units":0.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":58580.0,"pre_ai_era_burst_loc":9594.0,"measured_loc":58580.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":2196.260969095765,"median_loc_per_hour":44.25,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":18.0,"flagged_releases":0.0,"max_loc_per_day":769.6},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1","to":"v0.1.1","loc":2762,"days":33.25,"loc_per_day":83.1,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":366,"days":13.86,"loc_per_day":26.4,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":1154,"days":15.04,"loc_per_day":76.7,"flagged":false},{"from":"v0.1.3","to":"v0.3","loc":4049,"days":35.27,"loc_per_day":114.8,"flagged":false},{"from":"v0.3","to":"v0.4","loc":11405,"days":14.82,"loc_per_day":769.6,"flagged":false},{"from":"v0.4","to":"v0.4.1","loc":65,"days":2.21,"loc_per_day":29.4,"flagged":false},{"from":"v0.4.1","to":"v0.4.2","loc":7,"days":2.01,"loc_per_day":3.5,"flagged":false},{"from":"v0.4.2","to":"v0.5","loc":530,"days":11.66,"loc_per_day":45.5,"flagged":false},{"from":"v0.5","to":"v0.6","loc":1152,"days":19.23,"loc_per_day":59.9,"flagged":false},{"from":"v0.6","to":"v0.7","loc":1264,"days":12.63,"loc_per_day":100.1,"flagged":false},{"from":"v0.7","to":"v0.8","loc":1079,"days":16.04,"loc_per_day":67.3,"flagged":false},{"from":"v0.8","to":"v0.9","loc":701,"days":18.12,"loc_per_day":38.7,"flagged":false},{"from":"v0.9","to":"v0.10","loc":1042,"days":37.28,"loc_per_day":27.9,"flagged":false},{"from":"v0.10","to":"v0.11","loc":755,"days":46.94,"loc_per_day":16.1,"flagged":false},{"from":"v0.11","to":"v0.12","loc":1013,"days":25.5,"loc_per_day":39.7,"flagged":false},{"from":"v0.12","to":"v0.12.1","loc":63,"days":8.37,"loc_per_day":7.5,"flagged":false},{"from":"v0.12.1","to":"v0.13","loc":725,"days":14.12,"loc_per_day":51.4,"flagged":false},{"from":"v0.13","to":"v0.14","loc":2187,"days":44.08,"loc_per_day":49.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":31145.0,"index":0.064,"count:narrated_steps":2.0,"per_kloc:narrated_steps":0.064,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, read the current file sizes in build directory.","ref":"client/scripts/build.js:43","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/client/scripts/build.js#L43","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Finally, by now we have certainly resolved the URL.","ref":"client/scripts/start.js:219","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/client/scripts/start.js#L219","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit dc82a170a0); removed from the current tree but still retrievable","path":"mail.json","line":4,"fingerprint":"dc82a170a05de8b808b48bfbbc5ae0c0388fa940:mail.json:generic-api-key:4"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":123.0,"findings_high":12.0,"findings_medium":110.0,"findings_low":1.0,"weighted_findings":42.112,"scanned_lines":31167.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"api/src/utils/setting.ts","line":116,"fingerprint":"javascript.lang.security.detect-insecure-websocket:api/src/utils/setting.ts:116"},{"rule_id":"opengrep/javascript.node-crypto.security.create-de-cipher-no-iv","severity":"high","message":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength,  [confidence high]","path":"api/src/utils/string_util.ts","line":24,"fingerprint":"javascript.node-crypto.security.create-de-cipher-no-iv:api/src/utils/string_util.ts:24"},{"rule_id":"opengrep/javascript.node-crypto.security.create-de-cipher-no-iv","severity":"high","message":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength,  [confidence high]","path":"api/src/utils/string_util.ts","line":31,"fingerprint":"javascript.node-crypto.security.create-de-cipher-no-iv:api/src/utils/string_util.ts:31"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.browser.security.insecure-document-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `o.appendChild(a).innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.browser.security.insecure-innerhtml:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.browser.security.insecure-document-method:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `f.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.browser.security.insecure-innerhtml:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.browser.security.insecure-document-method:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.browser.security.insecure-innerhtml:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.express.security.audit.remote-property-injection","severity":"high","message":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]","path":"client/public/jq.js","line":4,"fingerprint":"javascript.express.security.audit.remote-property-injection:client/public/jq.js:4"},{"rule_id":"opengrep/javascript.express.security.audit.remote-property-injection","severity":"high","message":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]","path":"client/public/jq.js","line":4,"fingerprint":"javascript.express.security.audit.remote-property-injection:client/public/jq.js:4"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"deploy/docker/Dockerfile","line":28,"fingerprint":"dockerfile.security.missing-user:deploy/docker/Dockerfile:28"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":38,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:api/src/global_data/lib/lodash/index.js:38"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":46,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":46,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/global_data/lib/lodash/index.js:46"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":51,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:51"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":53,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/global_data/lib/lodash/index.js:53"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":59,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:api/src/global_data/lib/lodash/index.js:59"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":72,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:72"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":73,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/global_data/lib/lodash/index.js:73"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":105,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:105"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":124,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:124"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":124,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:124"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":125,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:125"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":125,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:125"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":125,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:125"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":125,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:125"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":125,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:api/src/global_data/lib/lodash/index.js:125"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/global_data/lib/lodash/index.js","line":128,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/global_data/lib/lodash/index.js:128"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"api/src/global_data/lib/request/index.js","line":1570,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:api/src/global_data/lib/request/index.js:1570"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"api/src/mail/mail.ts","line":85,"fingerprint":"javascript.lang.security.html-in-template-string:api/src/mail/mail.ts:85"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"api/src/mail/mail.ts","line":86,"fingerprint":"javascript.lang.security.html-in-template-string:api/src/mail/mail.ts:86"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"api/src/mail/mail.ts","line":90,"fingerprint":"javascript.lang.security.html-in-template-string:api/src/mail/mail.ts:90"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"api/src/mail/mail.ts","line":91,"fingerprint":"javascript.lang.security.html-in-template-string:api/src/mail/mail.ts:91"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/mail/mail.ts","line":118,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/mail/mail.ts:118"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lang` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/mail/mail.ts","line":119,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/mail/mail.ts:119"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `type` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/mail/mail.ts","line":119,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/mail/mail.ts:119"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lang` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/mail/mail.ts","line":122,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/mail/mail.ts:122"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `type` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/mail/mail.ts","line":122,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/mail/mail.ts:122"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":24,"fingerprint":"javascript.browser.security.eval-detected:api/src/run_engine/assert_runner.ts:24"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":27,"fingerprint":"javascript.browser.security.eval-detected:api/src/run_engine/assert_runner.ts:27"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":29,"fingerprint":"javascript.browser.security.eval-detected:api/src/run_engine/assert_runner.ts:29"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":32,"fingerprint":"javascript.browser.security.eval-detected:api/src/run_engine/assert_runner.ts:32"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":37,"fingerprint":"javascript.browser.security.eval-detected:api/src/run_engine/assert_runner.ts:37"},{"rule_id":"opengrep/javascript.browser.security.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":39,"fingerprint":"javascript.browser.security.eval-detected:api/src/run_engine/assert_runner.ts:39"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":39,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/run_engine/assert_runner.ts:39"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"api/src/run_engine/assert_runner.ts","line":56,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:api/src/run_engine/assert_runner.ts:56"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/run_engine/process/stress_process_handler.ts","line":13,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/run_engine/process/stress_process_handler.ts:13"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"api/src/run_engine/record_runner.ts","line":270,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:api/src/run_engine/record_runner.ts:270"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lib` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":102,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/run_engine/sandbox.ts:102"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lib` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":105,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/run_engine/sandbox.ts:105"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lib` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":107,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/run_engine/sandbox.ts:107"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lib` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":108,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/run_engine/sandbox.ts:108"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":108,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/run_engine/sandbox.ts:108"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":108,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/run_engine/sandbox.ts:108"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":109,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/run_engine/sandbox.ts:109"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":109,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/run_engine/sandbox.ts:109"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":112,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:api/src/run_engine/sandbox.ts:112"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/run_engine/sandbox.ts","line":116,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/run_engine/sandbox.ts:116"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/backup_service.ts","line":29,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/backup_service.ts:29"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/backup_service.ts","line":72,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/backup_service.ts:72"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"api/src/services/connection_manager.ts","line":18,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:api/src/services/connection_manager.ts:18"},{"rule_id":"opengrep/javascript.lang.security.audit.incomplete-sanitization","severity":"medium","message":"`path.replace` method will only replace the first occurrence when used with a string argument ('{'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. [confidence low]","path":"api/src/services/importer/swagger_import.ts","line":122,"fingerprint":"javascript.lang.security.audit.incomplete-sanitization:api/src/services/importer/swagger_import.ts:122"},{"rule_id":"opengrep/javascript.lang.security.audit.incomplete-sanitization","severity":"medium","message":"`path.replace('{', ':').replace` method will only replace the first occurrence when used with a string argument ('}'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. [confidence low]","path":"api/src/services/importer/swagger_import.ts","line":122,"fingerprint":"javascript.lang.security.audit.incomplete-sanitization:api/src/services/importer/swagger_import.ts:122"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":147,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":147,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":165,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:165"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":165,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:165"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":169,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:169"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":171,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:171"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":172,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:172"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":186,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:186"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":186,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:186"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":194,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:194"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/services/project_data_service.ts","line":198,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/services/project_data_service.ts:198"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `o` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"api/src/services/session_service.ts","line":64,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:api/src/services/session_service.ts:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `value` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/utils/setting.ts","line":21,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/utils/setting.ts:21"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/utils/setting.ts","line":21,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/utils/setting.ts:21"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"api/src/utils/setting.ts","line":23,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:api/src/utils/setting.ts:23"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/utils/setting.ts","line":24,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/utils/setting.ts:24"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"api/src/utils/setting.ts","line":26,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:api/src/utils/setting.ts:26"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^(([^<>()\\[\\]\\\\.,;:\\s@\"]+(\\.[^<>()\\[\\]\\\\.,;:\\s@\"]+)*)|(\".+\"))@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}])|(([a-zA-Z\\-0-9]+\\.)+[a-zA-Z]{2,}))$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is r [confidence low]","path":"api/src/utils/validate_util.ts","line":9,"fingerprint":"javascript.lang.security.audit.detect-redos:api/src/utils/validate_util.ts:9"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"client/config/paths.js","line":12,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:client/config/paths.js:12"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"client/config/paths.js","line":50,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:client/config/paths.js:50"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.easing.js","line":1,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.easing.js:1"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `b` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `b` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":4,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:4"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/public/jq.js","line":4,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/public/jq.js:4"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"client/public/jq.js","line":4,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:client/public/jq.js:4"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/setup.js","line":10,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:client/public/setup.js:10"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/setup.js","line":28,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:client/public/setup.js:28"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"client/public/setup.js","line":167,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:client/public/setup.js:167"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/components/collection_tree/collection_item.tsx","line":115,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/components/collection_tree/collection_item.tsx:115"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/components/collection_tree/record_folder.tsx","line":77,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/components/collection_tree/record_folder.tsx:77"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/components/collection_tree/record_item.tsx","line":72,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/components/collection_tree/record_item.tsx:72"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/components/environment_select/index.tsx","line":69,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/components/environment_select/index.tsx:69"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/modules/collection/req_res_panel/request_url_panel.tsx","line":113,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/modules/collection/req_res_panel/request_url_panel.tsx:113"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"client/src/modules/collection/req_res_panel/request_url_panel.tsx","line":218,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:client/src/modules/collection/req_res_panel/request_url_panel.tsx:218"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/modules/project/project_item.tsx","line":67,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/modules/project/project_item.tsx:67"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/modules/schedule/schedule_item.tsx","line":71,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/modules/schedule/schedule_item.tsx:71"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"client/src/modules/schedule/schedule_run_history_grid.tsx","line":595,"fingerprint":"javascript.lang.security.html-in-template-string:client/src/modules/schedule/schedule_run_history_grid.tsx:595"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"client/src/modules/stress_test/stress_item.tsx","line":62,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:client/src/modules/stress_test/stress_item.tsx:62"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"client/src/utils/download_util.ts","line":39,"fingerprint":"javascript.lang.security.html-in-template-string:client/src/utils/download_util.ts:39"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^(([^<>()\\[\\]\\\\.,;:\\s@\"]+(\\.[^<>()\\[\\]\\\\.,;:\\s@\"]+)*)|(\".+\"))@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}])|(([a-zA-Z\\-0-9]+\\.)+[a-zA-Z]{2,}))$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is r [confidence low]","path":"client/src/utils/string_util.ts","line":177,"fingerprint":"javascript.lang.security.audit.detect-redos:client/src/utils/string_util.ts:177"},{"rule_id":"opengrep/javascript.browser.security.js-open-redirect-from-function","severity":"low","message":"The application accepts potentially user-controlled input `f` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before al [confidence low]","path":"client/public/setup.js","line":151,"fingerprint":"javascript.browser.security.js-open-redirect-from-function:client/public/setup.js:151"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":32.0,"vulnerabilities":70.0,"vulns_critical":8.0,"vulns_high":33.0,"vulns_medium":21.0,"vulns_low":4.0,"vulns_unknown":4.0,"penalty":253.0},"findings":[{"rule_id":"osv/GHSA-fjxv-7rqg-78g4","severity":"critical","message":"form-data@2.1.4 (npm) is affected by GHSA-fjxv-7rqg-78g4","path":"api/yarn.lock","line":null,"fingerprint":"form-data@2.1.4 (npm):GHSA-fjxv-7rqg-78g4"},{"rule_id":"osv/GHSA-896r-f27r-55mw","severity":"critical","message":"json-schema@0.2.3 (npm) is affected by GHSA-896r-f27r-55mw","path":"api/yarn.lock","line":null,"fingerprint":"json-schema@0.2.3 (npm):GHSA-896r-f27r-55mw"},{"rule_id":"osv/GHSA-593f-38f6-jp5m","severity":"critical","message":"koa@2.2.0 (npm) is affected by GHSA-593f-38f6-jp5m","path":"api/yarn.lock","line":null,"fingerprint":"koa@2.2.0 (npm):GHSA-593f-38f6-jp5m"},{"rule_id":"osv/GHSA-jf85-cpcp-j695","severity":"critical","message":"lodash@4.17.4 (npm) is affected by GHSA-jf85-cpcp-j695","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-jf85-cpcp-j695"},{"rule_id":"osv/GHSA-xvch-5gv4-984h","severity":"critical","message":"minimist@0.0.8 (npm) is affected by GHSA-xvch-5gv4-984h","path":"api/yarn.lock","line":null,"fingerprint":"minimist@0.0.8 (npm):GHSA-xvch-5gv4-984h"},{"rule_id":"osv/GHSA-fx4w-v43j-vc45","severity":"critical","message":"typeorm@0.0.9 (npm) is affected by GHSA-fx4w-v43j-vc45","path":"api/yarn.lock","line":null,"fingerprint":"typeorm@0.0.9 (npm):GHSA-fx4w-v43j-vc45"},{"rule_id":"osv/GHSA-pf2j-9qmp-jqr2","severity":"critical","message":"typeorm@0.0.9 (npm) is affected by GHSA-pf2j-9qmp-jqr2","path":"api/yarn.lock","line":null,"fingerprint":"typeorm@0.0.9 (npm):GHSA-pf2j-9qmp-jqr2"},{"rule_id":"osv/GHSA-w7q7-vjp8-7jv4","severity":"critical","message":"typeorm@0.0.9 (npm) is affected by GHSA-w7q7-vjp8-7jv4","path":"api/yarn.lock","line":null,"fingerprint":"typeorm@0.0.9 (npm):GHSA-w7q7-vjp8-7jv4"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-9vvw-cc9w-f27h","severity":"high","message":"debug@0.7.4 (npm) is affected by GHSA-9vvw-cc9w-f27h","path":"api/yarn.lock","line":null,"fingerprint":"debug@0.7.4 (npm):GHSA-9vvw-cc9w-f27h"},{"rule_id":"osv/GHSA-9vvw-cc9w-f27h","severity":"high","message":"debug@2.6.4 (npm) is affected by GHSA-9vvw-cc9w-f27h","path":"api/yarn.lock","line":null,"fingerprint":"debug@2.6.4 (npm):GHSA-9vvw-cc9w-f27h"},{"rule_id":"osv/GHSA-62ch-8vmq-8xm7","severity":"high","message":"figlet@1.2.0 (npm) is affected by GHSA-62ch-8vmq-8xm7","path":"api/yarn.lock","line":null,"fingerprint":"figlet@1.2.0 (npm):GHSA-62ch-8vmq-8xm7"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@2.1.4 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"api/yarn.lock","line":null,"fingerprint":"form-data@2.1.4 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-9qj9-36jm-prpv","severity":"high","message":"fresh@0.5.0 (npm) is affected by GHSA-9qj9-36jm-prpv","path":"api/yarn.lock","line":null,"fingerprint":"fresh@0.5.0 (npm):GHSA-9qj9-36jm-prpv"},{"rule_id":"osv/GHSA-44pw-h2cw-w3vq","severity":"high","message":"hawk@3.1.3 (npm) is affected by GHSA-44pw-h2cw-w3vq","path":"api/yarn.lock","line":null,"fingerprint":"hawk@3.1.3 (npm):GHSA-44pw-h2cw-w3vq"},{"rule_id":"osv/GHSA-c429-5p7v-vgjp","severity":"high","message":"hoek@2.16.3 (npm) is affected by GHSA-c429-5p7v-vgjp","path":"api/yarn.lock","line":null,"fingerprint":"hoek@2.16.3 (npm):GHSA-c429-5p7v-vgjp"},{"rule_id":"osv/GHSA-jp4x-w63m-7wgm","severity":"high","message":"hoek@2.16.3 (npm) is affected by GHSA-jp4x-w63m-7wgm","path":"api/yarn.lock","line":null,"fingerprint":"hoek@2.16.3 (npm):GHSA-jp4x-w63m-7wgm"},{"rule_id":"osv/GHSA-7gcc-r8m5-44qm","severity":"high","message":"koa@2.2.0 (npm) is affected by GHSA-7gcc-r8m5-44qm","path":"api/yarn.lock","line":null,"fingerprint":"koa@2.2.0 (npm):GHSA-7gcc-r8m5-44qm"},{"rule_id":"osv/GHSA-35jh-r3h4-6jhm","severity":"high","message":"lodash@4.17.4 (npm) is affected by GHSA-35jh-r3h4-6jhm","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-35jh-r3h4-6jhm"},{"rule_id":"osv/GHSA-p6mc-m468-83gw","severity":"high","message":"lodash@4.17.4 (npm) is affected by GHSA-p6mc-m468-83gw","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-p6mc-m468-83gw"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.4 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.0.3 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"api/yarn.lock","line":null,"fingerprint":"minimatch@3.0.3 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.0.3 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"api/yarn.lock","line":null,"fingerprint":"minimatch@3.0.3 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.0.3 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"api/yarn.lock","line":null,"fingerprint":"minimatch@3.0.3 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-f8q6-p94x-37v3","severity":"high","message":"minimatch@3.0.3 (npm) is affected by GHSA-f8q6-p94x-37v3","path":"api/yarn.lock","line":null,"fingerprint":"minimatch@3.0.3 (npm):GHSA-f8q6-p94x-37v3"},{"rule_id":"osv/GHSA-446m-mv8f-q348","severity":"high","message":"moment@2.11.2 (npm) is affected by GHSA-446m-mv8f-q348","path":"api/yarn.lock","line":null,"fingerprint":"moment@2.11.2 (npm):GHSA-446m-mv8f-q348"},{"rule_id":"osv/GHSA-8hfj-j24r-96c4","severity":"high","message":"moment@2.11.2 (npm) is affected by GHSA-8hfj-j24r-96c4","path":"api/yarn.lock","line":null,"fingerprint":"moment@2.11.2 (npm):GHSA-8hfj-j24r-96c4"},{"rule_id":"osv/GHSA-9wv6-86v2-598j","severity":"high","message":"path-to-regexp@1.7.0 (npm) is affected by GHSA-9wv6-86v2-598j","path":"api/yarn.lock","line":null,"fingerprint":"path-to-regexp@1.7.0 (npm):GHSA-9wv6-86v2-598j"},{"rule_id":"osv/GHSA-gqgv-6jq5-jjj9","severity":"high","message":"qs@4.0.0 (npm) is affected by GHSA-gqgv-6jq5-jjj9","path":"api/yarn.lock","line":null,"fingerprint":"qs@4.0.0 (npm):GHSA-gqgv-6jq5-jjj9"},{"rule_id":"osv/GHSA-hrpp-h998-j3pp","severity":"high","message":"qs@4.0.0 (npm) is affected by GHSA-hrpp-h998-j3pp","path":"api/yarn.lock","line":null,"fingerprint":"qs@4.0.0 (npm):GHSA-hrpp-h998-j3pp"},{"rule_id":"osv/GHSA-hrpp-h998-j3pp","severity":"high","message":"qs@6.4.0 (npm) is affected by GHSA-hrpp-h998-j3pp","path":"api/yarn.lock","line":null,"fingerprint":"qs@6.4.0 (npm):GHSA-hrpp-h998-j3pp"},{"rule_id":"osv/GHSA-c2qf-rxjj-qqgw","severity":"high","message":"semver@5.3.0 (npm) is affected by GHSA-c2qf-rxjj-qqgw","path":"api/yarn.lock","line":null,"fingerprint":"semver@5.3.0 (npm):GHSA-c2qf-rxjj-qqgw"},{"rule_id":"osv/GHSA-2m39-62fm-q8r3","severity":"high","message":"sshpk@1.13.0 (npm) is affected by GHSA-2m39-62fm-q8r3","path":"api/yarn.lock","line":null,"fingerprint":"sshpk@1.13.0 (npm):GHSA-2m39-62fm-q8r3"},{"rule_id":"osv/GHSA-g7q5-pjjr-gqvp","severity":"high","message":"tough-cookie@2.3.2 (npm) is affected by GHSA-g7q5-pjjr-gqvp","path":"api/yarn.lock","line":null,"fingerprint":"tough-cookie@2.3.2 (npm):GHSA-g7q5-pjjr-gqvp"},{"rule_id":"osv/GHSA-q2pj-6v73-8rgj","severity":"high","message":"typeorm@0.0.9 (npm) is affected by GHSA-q2pj-6v73-8rgj","path":"api/yarn.lock","line":null,"fingerprint":"typeorm@0.0.9 (npm):GHSA-q2pj-6v73-8rgj"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@3.0.1 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"api/yarn.lock","line":null,"fingerprint":"uuid@3.0.1 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-c4w7-xm78-47vh","severity":"high","message":"y18n@3.2.1 (npm) is affected by GHSA-c4w7-xm78-47vh","path":"api/yarn.lock","line":null,"fingerprint":"y18n@3.2.1 (npm):GHSA-c4w7-xm78-47vh"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@4.11.7 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"api/yarn.lock","line":null,"fingerprint":"ajv@4.11.7 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-v88g-cgmw-v5xw","severity":"medium","message":"ajv@4.11.7 (npm) is affected by GHSA-v88g-cgmw-v5xw","path":"api/yarn.lock","line":null,"fingerprint":"ajv@4.11.7 (npm):GHSA-v88g-cgmw-v5xw"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-qrmc-fj45-qfc2","severity":"medium","message":"extend@3.0.0 (npm) is affected by GHSA-qrmc-fj45-qfc2","path":"api/yarn.lock","line":null,"fingerprint":"extend@3.0.0 (npm):GHSA-qrmc-fj45-qfc2"},{"rule_id":"osv/GHSA-43f8-2h32-f4cj","severity":"medium","message":"hosted-git-info@2.4.2 (npm) is affected by GHSA-43f8-2h32-f4cj","path":"api/yarn.lock","line":null,"fingerprint":"hosted-git-info@2.4.2 (npm):GHSA-43f8-2h32-f4cj"},{"rule_id":"osv/GHSA-x2rg-q646-7m2v","severity":"medium","message":"koa@2.2.0 (npm) is affected by GHSA-x2rg-q646-7m2v","path":"api/yarn.lock","line":null,"fingerprint":"koa@2.2.0 (npm):GHSA-x2rg-q646-7m2v"},{"rule_id":"osv/GHSA-29mw-wpgm-hmr9","severity":"medium","message":"lodash@4.17.4 (npm) is affected by GHSA-29mw-wpgm-hmr9","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-29mw-wpgm-hmr9"},{"rule_id":"osv/GHSA-4xc9-xhrj-v574","severity":"medium","message":"lodash@4.17.4 (npm) is affected by GHSA-4xc9-xhrj-v574","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-4xc9-xhrj-v574"},{"rule_id":"osv/GHSA-fvqr-27wr-82fm","severity":"medium","message":"lodash@4.17.4 (npm) is affected by GHSA-fvqr-27wr-82fm","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-fvqr-27wr-82fm"},{"rule_id":"osv/GHSA-x5rq-j2xg-h7qm","severity":"medium","message":"lodash@4.17.4 (npm) is affected by GHSA-x5rq-j2xg-h7qm","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-x5rq-j2xg-h7qm"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.4 (npm) is affected by GHSA-xxjr-mmjv-4gpg","path":"api/yarn.lock","line":null,"fingerprint":"lodash@4.17.4 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-82v2-mx6x-wq7q","severity":"medium","message":"log4js@1.1.1 (npm) is affected by GHSA-82v2-mx6x-wq7q","path":"api/yarn.lock","line":null,"fingerprint":"log4js@1.1.1 (npm):GHSA-82v2-mx6x-wq7q"},{"rule_id":"osv/GHSA-vh95-rmgr-6w4m","severity":"medium","message":"minimist@0.0.8 (npm) is affected by GHSA-vh95-rmgr-6w4m","path":"api/yarn.lock","line":null,"fingerprint":"minimist@0.0.8 (npm):GHSA-vh95-rmgr-6w4m"},{"rule_id":"osv/GHSA-w9mr-4mfr-499f","severity":"medium","message":"ms@0.7.3 (npm) is affected by GHSA-w9mr-4mfr-499f","path":"api/yarn.lock","line":null,"fingerprint":"ms@0.7.3 (npm):GHSA-w9mr-4mfr-499f"},{"rule_id":"osv/GHSA-5f7m-mmpc-qhh4","severity":"medium","message":"mysql@2.13.0 (npm) is affected by GHSA-5f7m-mmpc-qhh4","path":"api/yarn.lock","line":null,"fingerprint":"mysql@2.13.0 (npm):GHSA-5f7m-mmpc-qhh4"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@4.0.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"api/yarn.lock","line":null,"fingerprint":"qs@4.0.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6rw7-vpxm-498p","severity":"medium","message":"qs@4.0.0 (npm) is affected by GHSA-6rw7-vpxm-498p","path":"api/yarn.lock","line":null,"fingerprint":"qs@4.0.0 (npm):GHSA-6rw7-vpxm-498p"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.4.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"api/yarn.lock","line":null,"fingerprint":"qs@6.4.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6rw7-vpxm-498p","severity":"medium","message":"qs@6.4.0 (npm) is affected by GHSA-6rw7-vpxm-498p","path":"api/yarn.lock","line":null,"fingerprint":"qs@6.4.0 (npm):GHSA-6rw7-vpxm-498p"},{"rule_id":"osv/GHSA-p8p7-x288-28g6","severity":"medium","message":"request@2.81.0 (npm) is affected by GHSA-p8p7-x288-28g6","path":"api/yarn.lock","line":null,"fingerprint":"request@2.81.0 (npm):GHSA-p8p7-x288-28g6"},{"rule_id":"osv/GHSA-mf6x-7mm4-x2g7","severity":"medium","message":"stringstream@0.0.5 (npm) is affected by GHSA-mf6x-7mm4-x2g7","path":"api/yarn.lock","line":null,"fingerprint":"stringstream@0.0.5 (npm):GHSA-mf6x-7mm4-x2g7"},{"rule_id":"osv/GHSA-72xf-g2v4-qvf3","severity":"medium","message":"tough-cookie@2.3.2 (npm) is affected by GHSA-72xf-g2v4-qvf3","path":"api/yarn.lock","line":null,"fingerprint":"tough-cookie@2.3.2 (npm):GHSA-72xf-g2v4-qvf3"},{"rule_id":"osv/GHSA-2rp8-mm9q-fp49","severity":"medium","message":"typeorm@0.0.9 (npm) is affected by GHSA-2rp8-mm9q-fp49","path":"api/yarn.lock","line":null,"fingerprint":"typeorm@0.0.9 (npm):GHSA-2rp8-mm9q-fp49"},{"rule_id":"osv/GHSA-p9pc-299p-vxgp","severity":"medium","message":"yargs-parser@4.2.1 (npm) is affected by GHSA-p9pc-299p-vxgp","path":"api/yarn.lock","line":null,"fingerprint":"yargs-parser@4.2.1 (npm):GHSA-p9pc-299p-vxgp"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@1.1.7 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"api/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.7 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-gxpj-cx7g-858c","severity":"low","message":"debug@0.7.4 (npm) is affected by GHSA-gxpj-cx7g-858c","path":"api/yarn.lock","line":null,"fingerprint":"debug@0.7.4 (npm):GHSA-gxpj-cx7g-858c"},{"rule_id":"osv/GHSA-gxpj-cx7g-858c","severity":"low","message":"debug@2.6.4 (npm) is affected by GHSA-gxpj-cx7g-858c","path":"api/yarn.lock","line":null,"fingerprint":"debug@2.6.4 (npm):GHSA-gxpj-cx7g-858c"},{"rule_id":"osv/GHSA-jgmv-j7ww-jx2x","severity":"low","message":"koa@2.2.0 (npm) is affected by GHSA-jgmv-j7ww-jx2x","path":"api/yarn.lock","line":null,"fingerprint":"koa@2.2.0 (npm):GHSA-jgmv-j7ww-jx2x"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.01,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"client/package.json has no lockfile alongside it (unpinned dependencies)","ref":"client/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":7.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.14 ships Hitchhiker.zip (1548 downloads)","ref":"Hitchhiker.zip","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.14/Hitchhiker.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v0.13 ships Hitchhiker.zip (171 downloads)","ref":"Hitchhiker.zip","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.13/Hitchhiker.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v0.12.1 ships Hitchhiker.zip (56 downloads)","ref":"Hitchhiker.zip","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.12.1/Hitchhiker.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v0.12 ships Hitchhiker.zip (32 downloads)","ref":"Hitchhiker.zip","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.12/Hitchhiker.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v0.10 ships Hitchhiker.zip (238 downloads)","ref":"Hitchhiker.zip","url":"https://github.com/brookshi/Hitchhiker/releases/download/v0.10/Hitchhiker.zip","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":5570.0,"function_nloc":22474.0,"mean_ccn":3.75,"p90_ccn":6.0,"complex_functions":169.0,"long_functions":7.0,"many_param_functions":11.0,"risky_nloc_share":0.0984},"findings":[],"evidence":[{"kind":"complex-function","description":"Dp in api/src/global_data/lib/xlsx/index.js: complexity 476, 1 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L19","weight":1.0},{"kind":"complex-function","description":"vp in api/src/global_data/lib/xlsx/index.js: complexity 468, 2 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L18","weight":1.0},{"kind":"complex-function","description":"t in api/src/global_data/lib/xlsx/index.js: complexity 320, 2 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L20","weight":1.0},{"kind":"complex-function","description":"(anonymous) in api/src/global_data/lib/xlsx/index.js: complexity 255, 2 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L5","weight":1.0},{"kind":"complex-function","description":"(anonymous) in api/src/global_data/lib/xlsx/index.js: complexity 251, 3 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L6","weight":1.0},{"kind":"complex-function","description":"ge in api/src/global_data/lib/xlsx/index.js: complexity 223, 2 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L3","weight":1.0},{"kind":"complex-function","description":"R in api/src/global_data/lib/xlsx/index.js: complexity 214, 1 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L11","weight":1.0},{"kind":"complex-function","description":"(anonymous) in api/src/global_data/lib/xlsx/index.js: complexity 177, 2 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L8","weight":1.0},{"kind":"complex-function","description":"(anonymous) in api/src/global_data/lib/xlsx/index.js: complexity 165, 2 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L9","weight":1.0},{"kind":"complex-function","description":"N in api/src/global_data/lib/xlsx/index.js: complexity 142, 1 lines","ref":"api/src/global_data/lib/xlsx/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/xlsx/index.js#L17","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":19510.0,"duplicated_lines":1796.0,"duplicated_share":0.0921,"files":305.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: api/gulpfile.js:21 and api/src/utils/script_transform.ts:22","ref":"api/gulpfile.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/gulpfile.js#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/global_data/lib/request/index.js:1 and api/src/global_data/lib/uuid/index.js:1","ref":"api/src/global_data/lib/request/index.js","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/global_data/lib/request/index.js#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/models/body_form_data.ts:7 and api/src/models/header.ts:8","ref":"api/src/models/body_form_data.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/models/body_form_data.ts#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/models/body_form_data.ts:11 and api/src/models/query_string.ts:11","ref":"api/src/models/body_form_data.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/models/body_form_data.ts#L11","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/models/collection.ts:29 and api/src/models/mock_collection.ts:21","ref":"api/src/models/collection.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/models/collection.ts#L29","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/models/mock.ts:44 and api/src/models/record.ts:59","ref":"api/src/models/mock.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/models/mock.ts#L44","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/models/schedule.ts:9 and api/src/models/stress.ts:8","ref":"api/src/models/schedule.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/models/schedule.ts#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/run_engine/record_runner.ts:265 and client/src/modules/collection/req_res_panel/request_url_panel.tsx:213","ref":"api/src/run_engine/record_runner.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/run_engine/record_runner.ts#L265","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/run_engine/schedule_runner.ts:197 and client/src/modules/schedule/schedule_run_history_grid.tsx:406","ref":"api/src/run_engine/schedule_runner.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/run_engine/schedule_runner.ts#L197","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/src/services/collection_service.ts:85 and api/src/services/collection_service.ts:121","ref":"api/src/services/collection_service.ts","url":"https://github.com/brookshi/Hitchhiker/blob/318bc47d4041b32d0e2ffb1716be053abd28b456/api/src/services/collection_service.ts#L85","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":95.0,"weighted_findings":65.0,"scanned_lines":31167.0,"category:best-practice":45.0,"category:correctness":50.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"api/src/mail/template_setting.ts","line":7,"fingerprint":"javascript.lang.best-practice.lazy-load-module:api/src/mail/template_setting.ts:7"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"api/src/run_engine/process/stress_process.ts","line":125,"fingerprint":"javascript.lang.correctness.no-stringify-keys:api/src/run_engine/process/stress_process.ts:125"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"api/src/run_engine/record_runner.ts","line":342,"fingerprint":"javascript.lang.correctness.no-stringify-keys:api/src/run_engine/record_runner.ts:342"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"api/src/run_engine/sandbox.ts","line":112,"fingerprint":"javascript.lang.best-practice.lazy-load-module:api/src/run_engine/sandbox.ts:112"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"api/src/services/sample_service.ts","line":18,"fingerprint":"javascript.lang.best-practice.lazy-load-module:api/src/services/sample_service.ts:18"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"api/src/utils/setting.ts","line":12,"fingerprint":"javascript.lang.best-practice.lazy-load-module:api/src/utils/setting.ts:12"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/config/env.js","line":30,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/config/env.js:30"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/config/env.js","line":30,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/config/env.js:30"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client/config/paths.js","line":50,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client/config/paths.js:50"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client/scripts/build.js","line":129,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client/scripts/build.js:129"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client/scripts/start.js","line":162,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client/scripts/start.js:162"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/components/code_snippet_dialog/index.tsx","line":66,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/components/code_snippet_dialog/index.tsx:66"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/components/common_setting_dialog/index.tsx","line":49,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/components/common_setting_dialog/index.tsx:49"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/components/editor/index.tsx","line":112,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/components/editor/index.tsx:112"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client/src/components/highlight_code/index.tsx","line":17,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client/src/components/highlight_code/index.tsx:17"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client/src/components/highlight_code/index.tsx","line":18,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client/src/components/highlight_code/index.tsx:18"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client/src/components/highlight_code/index.tsx","line":19,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client/src/components/highlight_code/index.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillMount.","path":"client/src/components/key_value/key_value_list.tsx","line":172,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/components/key_value/key_value_list.tsx:172"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/components/key_value/key_value_list.tsx","line":176,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/components/key_value/key_value_list.tsx:176"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/components/script_dialog/index.tsx","line":34,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/components/script_dialog/index.tsx:34"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/components/validated_name/index.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/components/validated_name/index.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/locales/input.tsx","line":19,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/locales/input.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/collection/req_res_panel/index.tsx","line":113,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/collection/req_res_panel/index.tsx:113"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/src/modules/collection/req_res_panel/request_option_panel.tsx","line":299,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/src/modules/collection/req_res_panel/request_option_panel.tsx:299"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/src/modules/collection/req_res_panel/request_url_panel.tsx","line":184,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/src/modules/collection/req_res_panel/request_url_panel.tsx:184"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/src/modules/collection/req_res_panel/request_url_panel.tsx","line":186,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/src/modules/collection/req_res_panel/request_url_panel.tsx:186"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/src/modules/collection/req_res_panel/response_panel.tsx","line":198,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/src/modules/collection/req_res_panel/response_panel.tsx:198"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/src/modules/collection/req_res_panel/response_panel.tsx","line":216,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/src/modules/collection/req_res_panel/response_panel.tsx:216"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"client/src/modules/collection/req_res_panel/response_panel.tsx","line":280,"fingerprint":"javascript.lang.correctness.no-stringify-keys:client/src/modules/collection/req_res_panel/response_panel.tsx:280"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/header/change_password_dialog.tsx","line":42,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/header/change_password_dialog.tsx:42"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/header/change_password_dialog.tsx","line":121,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/header/change_password_dialog.tsx:121"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/header/change_password_dialog.tsx","line":135,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/header/change_password_dialog.tsx:135"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/header/change_password_dialog.tsx","line":150,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/header/change_password_dialog.tsx:150"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/login/find_password.tsx","line":32,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/login/find_password.tsx:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/login/loading_screen.tsx","line":21,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/login/loading_screen.tsx:21"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/login/register.tsx","line":46,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/login/register.tsx:46"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/project/environments.tsx","line":65,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/project/environments.tsx:65"},{"rule_id":"opengrep/typescript.react.best-practice.react-find-dom","severity":"medium","message":"findDOMNode is an escape hatch used to access the underlying DOM node. In most cases, use of this escape hatch is discouraged because it pierces the component abstraction.","path":"client/src/modules/project/members.tsx","line":77,"fingerprint":"typescript.react.best-practice.react-find-dom:client/src/modules/project/members.tsx:77"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":76,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/schedule/schedule_edit_dialog.tsx:76"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":353,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:353"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":361,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:361"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":402,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:402"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":435,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:435"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":476,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:476"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":483,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:483"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/schedule/schedule_edit_dialog.tsx","line":491,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/schedule/schedule_edit_dialog.tsx:491"},{"rule_id":"opengrep/typescript.react.best-practice.react-find-dom","severity":"medium","message":"findDOMNode is an escape hatch used to access the underlying DOM node. In most cases, use of this escape hatch is discouraged because it pierces the component abstraction.","path":"client/src/modules/schedule/schedule_run_console.tsx","line":32,"fingerprint":"typescript.react.best-practice.react-find-dom:client/src/modules/schedule/schedule_run_console.tsx:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-legacy-component","severity":"medium","message":"Legacy component lifecycle was detected - componentWillReceiveProps.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":68,"fingerprint":"typescript.react.best-practice.react-legacy-component:client/src/modules/stress_test/stress_edit_dialog.tsx:68"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":289,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:289"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":297,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:297"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":305,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:305"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":317,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:317"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":371,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:371"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":378,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:378"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"client/src/modules/stress_test/stress_edit_dialog.tsx","line":385,"fingerprint":"typescript.react.best-practice.react-props-spreading:client/src/modules/stress_test/stress_edit_dialog.tsx:385"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`o` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/crypto-js/index.js","line":16,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/crypto-js/index.js:16"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`s` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/crypto-js/index.js","line":16,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/crypto-js/index.js:16"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`o` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/crypto-js/index.js","line":16,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/crypto-js/index.js:16"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":37,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:37"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`c` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":44,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:44"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`r` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":51,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:51"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`i` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":63,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:63"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`i` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":76,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:76"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`yo` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":83,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:83"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`r` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":86,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:86"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`r` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":86,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:86"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":87,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:87"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":87,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:87"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`i` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":119,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:119"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`l` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/lodash/index.js","line":130,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/lodash/index.js:130"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":200,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:200"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":201,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:201"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":202,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:202"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":207,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:207"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":208,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:208"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":211,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:211"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":212,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:212"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b[i++]` is assigned twice; the first assignment is useless","path":"api/src/global_data/lib/uuid/index.js","line":215,"fingerprint":"javascript.lang.correctness.useless-assignment:api/src/global_data/lib/uuid/index.js:215"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"api/src/run_engine/script_runner.ts","line":60,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:api/src/run_engine/script_runner.ts:60"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`d` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`f` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`g` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`c` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`d` is assigned twice; the first assignment is useless","path":"client/public/jq.js","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:client/public/jq.js:4"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"client/src/common/link.sh","line":1,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:client/src/common/link.sh:1"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/src/common/link.sh","line":1,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/src/common/link.sh:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client/src/modules/document/templates/default.ts","line":1,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client/src/modules/document/templates/default.ts:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client/src/modules/document/templates/default.ts","line":1,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client/src/modules/document/templates/default.ts:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client/src/utils/string_util.ts","line":28,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client/src/utils/string_util.ts:28"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client/src/utils/string_util.ts","line":28,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client/src/utils/string_util.ts:28"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"deploy/docker/push_docker.sh","line":2,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:deploy/docker/push_docker.sh:2"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"deploy/docker/push_docker.sh","line":3,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:deploy/docker/push_docker.sh:3"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"deploy/docker/push_docker.sh","line":4,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:deploy/docker/push_docker.sh:4"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0858,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.1143,"test_lines":1337.0,"source_lines":31167.0,"test_ratio":0.0429,"ci_files":0.0,"cochange_share":0.0286,"cochange_commits":245.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":50.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":371.0,"escapes_per_kloc":14.448},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}