{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:28:36.966442Z","repo":{"ref":{"host":"github.com","owner":"trogdoro","name":"xiki"},"default_branch":"master","clone_url":"https://github.com/trogdoro/xiki.git","html_url":"https://github.com/trogdoro/xiki","description":"A shell console with GUI features","stars":3749,"forks":206,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6494,"primary_language":"Ruby","license_spdx":"NOASSERTION","created_at":"2008-06-05T01:03:11Z","pushed_at":"2020-01-03T07:11:19Z","security_policy_url":null,"distribution":{"owner_created_at":"2008-05-24T02:25:51Z","owner_type":"User","release_assets":[]}},"commit_sha":"be9b5eb87fb6eac11c70adbbb602bb71895834a8","profile":{"lines_by_language":{"Ruby":61122,"Python":335,"JavaScript":314,"Shell":59},"files_by_category":{"source":363,"other":194,"test":62,"docs":13,"config":3,"binary":1},"source_lines":57312,"test_lines":4518},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":59.8,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":53.7,"duplication":89.7,"lint":98.6,"testing":25.4,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.08, no CI test run detected; 21% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing."},"security":{"score":70.5,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":90.5,"sast":80.7,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 17 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1072.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":144399.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2008-06":{"loc":10493,"attributed_loc":0},"2008-07":{"loc":1278,"attributed_loc":0},"2008-08":{"loc":667,"attributed_loc":0},"2008-09":{"loc":2098,"attributed_loc":0},"2008-10":{"loc":4970,"attributed_loc":0},"2008-11":{"loc":315,"attributed_loc":0},"2008-12":{"loc":492,"attributed_loc":0},"2009-01":{"loc":462,"attributed_loc":0},"2009-02":{"loc":384,"attributed_loc":0},"2009-03":{"loc":522,"attributed_loc":0},"2009-04":{"loc":535,"attributed_loc":0},"2009-05":{"loc":484,"attributed_loc":0},"2009-06":{"loc":877,"attributed_loc":0},"2009-07":{"loc":159,"attributed_loc":0},"2009-10":{"loc":394,"attributed_loc":0},"2010-01":{"loc":503,"attributed_loc":0},"2010-02":{"loc":392,"attributed_loc":0},"2010-03":{"loc":150,"attributed_loc":0},"2010-04":{"loc":487,"attributed_loc":0},"2010-05":{"loc":110,"attributed_loc":0},"2010-06":{"loc":141,"attributed_loc":0},"2010-09":{"loc":277,"attributed_loc":0},"2010-10":{"loc":1529,"attributed_loc":0},"2010-11":{"loc":269,"attributed_loc":0},"2011-02":{"loc":404,"attributed_loc":0},"2011-03":{"loc":89,"attributed_loc":0},"2011-04":{"loc":125,"attributed_loc":0},"2011-05":{"loc":85,"attributed_loc":0},"2011-07":{"loc":281,"attributed_loc":0},"2011-08":{"loc":397,"attributed_loc":0},"2011-09":{"loc":1472,"attributed_loc":0},"2011-10":{"loc":3085,"attributed_loc":0},"2011-11":{"loc":5283,"attributed_loc":0},"2011-12":{"loc":3926,"attributed_loc":0},"2012-01":{"loc":1952,"attributed_loc":0},"2012-02":{"loc":1911,"attributed_loc":0},"2012-04":{"loc":627,"attributed_loc":0},"2012-07":{"loc":8243,"attributed_loc":0},"2012-08":{"loc":2460,"attributed_loc":0},"2012-09":{"loc":257,"attributed_loc":0},"2012-10":{"loc":25,"attributed_loc":0},"2012-11":{"loc":0,"attributed_loc":0},"2012-12":{"loc":289,"attributed_loc":0},"2013-01":{"loc":109,"attributed_loc":0},"2013-03":{"loc":873,"attributed_loc":0},"2013-04":{"loc":4971,"attributed_loc":0},"2013-05":{"loc":31870,"attributed_loc":0},"2013-06":{"loc":882,"attributed_loc":0},"2013-07":{"loc":3520,"attributed_loc":0},"2013-08":{"loc":1,"attributed_loc":0},"2013-09":{"loc":78,"attributed_loc":0},"2013-11":{"loc":2664,"attributed_loc":0},"2014-05":{"loc":1,"attributed_loc":0},"2014-08":{"loc":760,"attributed_loc":0},"2014-09":{"loc":3090,"attributed_loc":0},"2014-10":{"loc":3335,"attributed_loc":0},"2014-11":{"loc":2345,"attributed_loc":0},"2014-12":{"loc":2751,"attributed_loc":0},"2015-01":{"loc":3604,"attributed_loc":0},"2015-02":{"loc":2287,"attributed_loc":0},"2015-03":{"loc":1910,"attributed_loc":0},"2015-04":{"loc":1516,"attributed_loc":0},"2015-05":{"loc":1454,"attributed_loc":0},"2016-08":{"loc":16072,"attributed_loc":0},"2016-09":{"loc":989,"attributed_loc":0},"2016-10":{"loc":286,"attributed_loc":0},"2016-11":{"loc":77,"attributed_loc":0},"2019-05":{"loc":4,"attributed_loc":0},"2020-01":{"loc":51,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":447.0,"flagged_units":0.0,"pre_ai_era_bursts":8.0,"pre_ai_era_measured_loc":106869.0,"pre_ai_era_burst_loc":30214.0,"measured_loc":106869.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":2297.107438016529,"median_loc_per_hour":69.61773588835659,"pr_timed_units":0.0,"excluded_import_loc":37530.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["26d3959bafe0d3169047025dd538d545cc2690f6","4d981f933d3b09131639092c0d0b5b911f39d6d9","a38c0a3bb6947be154f5ee4eefbf2ef07250d643"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":1.0,"flagged_releases":0.0,"max_loc_per_day":77.8},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.6.0","to":"0.6.3","loc":66,"days":0.85,"loc_per_day":77.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":57312.0,"index":0.087,"count:narrated_steps":5.0,"per_kloc:narrated_steps":0.087,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Then, remove backslashes before spaces...","ref":"lib/xiki/core/text_util.rb:181","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/text_util.rb#L181","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, make sure the current line is quoted (otherwise, .siblings will be pulling from somewhere else)","ref":"lib/xiki/core/tree.rb:610","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/tree.rb#L610","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1. Join to \"a/=b/c\"...","ref":"lib/xiki/core/tree.rb:2241","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/tree.rb#L2241","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 2. Split to \"a/\", \"b/c/\"...","ref":"lib/xiki/core/tree.rb:2247","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/tree.rb#L2247","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, maybe find code that does \"##\"","ref":"roots/filter.rb:1","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/roots/filter.rb#L1","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":3.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"roots/mail/oauth2.py","line":31,"fingerprint":"roots/mail/oauth2.py:generic-api-key:31"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"lib/xiki/core/xikihub_client.rb","line":483,"fingerprint":"lib/xiki/core/xikihub_client.rb:generic-api-key:483"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 8af8cf388d); removed from the current tree but still retrievable","path":"commands/mail/oauth2.py","line":31,"fingerprint":"8af8cf388d756930a0dbacdb48536f77ea1a53ab:commands/mail/oauth2.py:generic-api-key:31"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":66.0,"findings_high":17.0,"findings_medium":49.0,"findings_low":0.0,"weighted_findings":35.15,"scanned_lines":57312.0,"parse_errors":3.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":20,"fingerprint":"dockerfile.security.missing-user:Dockerfile:20"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/diff_log.rb","line":70,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/diff_log.rb:70"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/diff_log.rb","line":73,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/diff_log.rb:73"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/search.rb","line":570,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/search.rb:570"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/search.rb","line":572,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/search.rb:572"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/shell.rb","line":532,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/shell.rb:532"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/specs.rb","line":106,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/specs.rb:106"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-regex-dos","severity":"high","message":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium]","path":"lib/xiki/core/topic_expander.rb","line":530,"fingerprint":"ruby.rails.security.brakeman.check-regex-dos:lib/xiki/core/topic_expander.rb:530"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"lib/xiki/tools/memcache.rb","line":102,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:lib/xiki/tools/memcache.rb:102"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"lib/xiki/tools/riak_tree.rb","line":41,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:lib/xiki/tools/riak_tree.rb:41"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"lib/xiki/tools/riak_tree.rb","line":43,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:lib/xiki/tools/riak_tree.rb:43"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"lib/xiki/tools/riak_tree.rb","line":110,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:lib/xiki/tools/riak_tree.rb:110"},{"rule_id":"opengrep/ruby.lang.security.model-attributes-attr-accessible","severity":"high","message":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low]","path":"misc/www/xiki_web_server.rb","line":28,"fingerprint":"ruby.lang.security.model-attributes-attr-accessible:misc/www/xiki_web_server.rb:28"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"roots/couch.rb","line":156,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:roots/couch.rb:156"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"roots/face/face_index.rb","line":5,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:roots/face/face_index.rb:5"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"roots/models.rb","line":59,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:roots/models.rb:59"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"roots/mysql/mysql_index.rb","line":287,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:roots/mysql/mysql_index.rb:287"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/code.rb","line":118,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/code.rb:118"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/code.rb","line":726,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/code.rb:726"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/code.rb","line":728,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/code.rb:728"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/file_tree.rb","line":602,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/file_tree.rb:602"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/file_tree.rb","line":642,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/file_tree.rb:642"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/file_tree.rb","line":1660,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/file_tree.rb:1660"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/files.rb","line":219,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/files.rb:219"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/files.rb","line":286,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/files.rb:286"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/html.rb","line":110,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/html.rb:110"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/ol.rb","line":468,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/ol.rb:468"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/xiki/core/xikihub_client.rb","line":553,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/xiki/core/xikihub_client.rb:553"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/xiki/core/xikihub_client.rb","line":654,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/xiki/core/xikihub_client.rb:654"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/xiki/core/xikihub_client.rb","line":726,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/xiki/core/xikihub_client.rb:726"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/core/xsh.rb","line":271,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/core/xsh.rb:271"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/tools/browser.rb","line":162,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/tools/browser.rb:162"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/tools/head.rb","line":8,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/tools/head.rb:8"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/tools/info.rb","line":7,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/tools/info.rb:7"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/tools/qri.rb","line":9,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/tools/qri.rb:9"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"lib/xiki/tools/riak_tree.rb","line":175,"fingerprint":"ruby.lang.security.dangerous-subshell:lib/xiki/tools/riak_tree.rb:175"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/command/xiki_command.rb","line":259,"fingerprint":"ruby.lang.security.dangerous-subshell:misc/command/xiki_command.rb:259"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/core_patterns.rb","line":286,"fingerprint":"ruby.lang.security.dangerous-subshell:misc/core_patterns.rb:286"},{"rule_id":"opengrep/ruby.lang.security.dangerous-exec","severity":"medium","message":"Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium]","path":"misc/emacs/el4r/el4r-sub.rb","line":58,"fingerprint":"ruby.lang.security.dangerous-exec:misc/emacs/el4r/el4r-sub.rb:58"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/emacs/el4r/el4r-sub.rb","line":387,"fingerprint":"ruby.lang.security.dangerous-subshell:misc/emacs/el4r/el4r-sub.rb:387"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/emacs/el4r/el4r-sub.rb","line":543,"fingerprint":"ruby.lang.security.dangerous-open:misc/emacs/el4r/el4r-sub.rb:543"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/emacs/el4r/el4r-sub.rb","line":585,"fingerprint":"ruby.lang.security.dangerous-open:misc/emacs/el4r/el4r-sub.rb:585"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"misc/js/menu1.js","line":2,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:misc/js/menu1.js:2"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"misc/js/menu1.js","line":5,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:misc/js/menu1.js:5"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"misc/js/menu1.js","line":5,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:misc/js/menu1.js:5"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"misc/js/menu1.js","line":13,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:misc/js/menu1.js:13"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"misc/js/menu1.js","line":13,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:misc/js/menu1.js:13"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `txt` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"misc/js/xiki.js","line":109,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:misc/js/xiki.js:109"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `txt` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"misc/js/xiki.js","line":113,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:misc/js/xiki.js:113"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"misc/js/xiki.js","line":172,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:misc/js/xiki.js:172"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"misc/js/xiki.js","line":172,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:misc/js/xiki.js:172"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"misc/js/xiki.js","line":220,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:misc/js/xiki.js:220"},{"rule_id":"opengrep/ruby.lang.security.dangerous-exec","severity":"medium","message":"Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium]","path":"misc/libs/session.rb","line":636,"fingerprint":"ruby.lang.security.dangerous-exec:misc/libs/session.rb:636"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/libs/session.rb","line":638,"fingerprint":"ruby.lang.security.dangerous-open:misc/libs/session.rb:638"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/libs/session.rb","line":639,"fingerprint":"ruby.lang.security.dangerous-open:misc/libs/session.rb:639"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/libs/session.rb","line":640,"fingerprint":"ruby.lang.security.dangerous-open:misc/libs/session.rb:640"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"misc/www/xiki_web_server.rb","line":155,"fingerprint":"ruby.lang.security.dangerous-subshell:misc/www/xiki_web_server.rb:155"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/kill.rb","line":92,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/kill.rb:92"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"roots/mail/oauth2.py","line":208,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:roots/mail/oauth2.py:208"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"roots/mail/oauth2.py","line":232,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:roots/mail/oauth2.py:232"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/man.rb","line":11,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/man.rb:11"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/mkdir.rb","line":18,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/mkdir.rb:18"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/mongo.rb","line":70,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/mongo.rb:70"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/ri.rb","line":42,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/ri.rb:42"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/tail.rb","line":10,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/tail.rb:10"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"roots/tail.rb","line":20,"fingerprint":"ruby.lang.security.dangerous-subshell:roots/tail.rb:20"}],"evidence":[],"data":{"rulesets":["ruby","python","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Gemfile has no lockfile alongside it (unpinned dependencies)","ref":"Gemfile","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2477.0,"function_nloc":30345.0,"mean_ccn":3.32,"p90_ccn":7.0,"complex_functions":71.0,"long_functions":17.0,"many_param_functions":0.0,"risky_nloc_share":0.2074},"findings":[],"evidence":[{"kind":"complex-function","description":"self.run in lib/xiki/core/xsh.rb: complexity 72, 188 lines","ref":"lib/xiki/core/xsh.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/xsh.rb#L17","weight":1.0},{"kind":"complex-function","description":"self.expand in lib/xiki/core/topic_expander.rb: complexity 58, 145 lines","ref":"lib/xiki/core/topic_expander.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/topic_expander.rb#L271","weight":0.9666666666666667},{"kind":"complex-function","description":"self.invoke in lib/xiki/core/invoker.rb: complexity 52, 116 lines","ref":"lib/xiki/core/invoker.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/invoker.rb#L13","weight":0.8666666666666667},{"kind":"complex-function","description":"self.drill in lib/xiki/core/notes.rb: complexity 52, 183 lines","ref":"lib/xiki/core/notes.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/notes.rb#L1111","weight":0.8666666666666667},{"kind":"complex-function","description":"self.as_task in lib/xiki/core/notes.rb: complexity 43, 82 lines","ref":"lib/xiki/core/notes.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/notes.rb#L835","weight":0.7166666666666667},{"kind":"complex-function","description":"self.shell_command_per_prompt in lib/xiki/core/shell.rb: complexity 43, 96 lines","ref":"lib/xiki/core/shell.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/shell.rb#L668","weight":0.7166666666666667},{"kind":"complex-function","description":"self.go in lib/xiki/core/control_tab.rb: complexity 39, 91 lines","ref":"lib/xiki/core/control_tab.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/control_tab.rb#L26","weight":0.65},{"kind":"complex-function","description":"self.launch in lib/xiki/core/launcher.rb: complexity 39, 66 lines","ref":"lib/xiki/core/launcher.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/launcher.rb#L767","weight":0.65},{"kind":"complex-function","description":"examples in lib/xiki/core/expander.rb: complexity 37, 191 lines","ref":"lib/xiki/core/expander.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/expander.rb#L7","weight":0.6166666666666667},{"kind":"complex-function","description":"self.invoke in lib/xiki/core/launcher.rb: complexity 37, 79 lines","ref":"lib/xiki/core/launcher.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/launcher.rb#L340","weight":0.6166666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":35645.0,"duplicated_lines":649.0,"duplicated_share":0.0182,"files":363.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/code_tree.rb:443 and lib/xiki/core/tree.rb:2121","ref":"lib/xiki/core/code_tree.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/code_tree.rb#L443","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/command.rb:194 and lib/xiki/core/command.rb:218","ref":"lib/xiki/core/command.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/command.rb#L194","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/file_tree.rb:97 and lib/xiki/core/file_tree.rb:272","ref":"lib/xiki/core/file_tree.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/file_tree.rb#L97","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/file_tree.rb:2210 and lib/xiki/core/shell.rb:906","ref":"lib/xiki/core/file_tree.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/file_tree.rb#L2210","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/keys.rb:62 and lib/xiki/tools/conf.rb:24","ref":"lib/xiki/core/keys.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/keys.rb#L62","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/notes.rb:2072 and roots/active_links.rb:53","ref":"lib/xiki/core/notes.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/notes.rb#L2072","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/options.rb:50 and lib/xiki/core/options.rb:80","ref":"lib/xiki/core/options.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/options.rb#L50","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/topic.rb:71 and lib/xiki/core/xikihub_client.rb:304","ref":"lib/xiki/core/topic.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/topic.rb#L71","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/topic_expander.rb:581 and lib/xiki/core/topic_expander.rb:619","ref":"lib/xiki/core/topic_expander.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/topic_expander.rb#L581","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/xiki/core/tree.rb:1471 and lib/xiki/core/tree.rb:1496","ref":"lib/xiki/core/tree.rb","url":"https://github.com/trogdoro/xiki/blob/be9b5eb87fb6eac11c70adbbb602bb71895834a8/lib/xiki/core/tree.rb#L1471","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"weighted_findings":3.25,"scanned_lines":57312.0,"category:correctness":13.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"misc/install/el4r_setup.sh","line":1,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:misc/install/el4r_setup.sh:1"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":22,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:22"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":28,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:28"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"misc/install/install_source_dependency.sh","line":29,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:misc/install/install_source_dependency.sh:29"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":40,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:40"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":44,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:44"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":45,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:45"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"misc/install/install_source_dependency.sh","line":46,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:misc/install/install_source_dependency.sh:46"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"misc/install/install_source_dependency.sh","line":47,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:misc/install/install_source_dependency.sh:47"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1577,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.1468,"test_lines":4518.0,"source_lines":57312.0,"test_ratio":0.0788,"ci_files":0.0,"cochange_share":0.0367,"cochange_commits":218.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":27.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}