nemoTyrant/manong
码农周刊整理
- Repository: https://github.com/nemoTyrant/manong
- Commit:
7c9e5228e133b9267ad3a415833bc9bb53193bb4 - Generated: 2026-11-13T23:32:41+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 56 | weak | 90% | 100% |
| Security | 46 | poor | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2014-11 | 1,544 | 0% |
| 2015-01 | 3 | 0% |
| 2015-03 | 4 | 0% |
| 2015-06 | 1 | 0% |
| 2015-10 | 21 | 0% |
| 2015-11 | 6,643 | 0% |
| 2016-05 | 186 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 3% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 90 |
| Duplication | 100 |
| Code smells (Opengrep) | 69 |
| Tests and CI | 0 |
| Documentation | 40 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 580; mean complexity 4.2, 90th percentile 10; 27 complex and 0 long functions
- Duplicated lines: 0.0% of 402 compared
- Tests: 0 test lines for 577 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- trigger in jquery2.1.1.js: complexity 52, 1 lines
- (anonymous) in jquery2.1.1.js: complexity 45, 1 lines
- fb in jquery2.1.1.js: complexity 39, 1 lines
- Vb in jquery2.1.1.js: complexity 35, 1 lines
- remove in jquery2.1.1.js: complexity 34, 1 lines
Security
Security posture is poor: 9 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 1 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] |
func.php:102 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
func.php:130 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
func.php:299 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
jquery2.1.1.js:3 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a f.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
jquery2.1.1.js:3 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
jquery2.1.1.js:3 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a b.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
jquery2.1.1.js:3 |
| high | opengrep/javascript.express.security.audit.remote-property-injection: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] |
jquery2.1.1.js:4 |
| high | opengrep/javascript.express.security.audit.remote-property-injection: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] |
jquery2.1.1.js:4 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a a function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop: Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop: Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment: Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment: Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low] |
jquery2.1.1.js:2 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a b function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] |
jquery2.1.1.js:3 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a b function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] |
jquery2.1.1.js:3 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
jquery2.1.1.js:3 |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html: JQuery's html function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider text instead. Otherwise, use a function that escapes HTML such as edX's HtmlUtils.setHtml(). [confidence low] |
jquery2.1.1.js:3 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 577; test lines: 0
| Language | Lines |
|---|---|
| PHP | 521 |
| SQL | 52 |
| JavaScript | 4 |