Update 5.0.0 Major update #87
13 issue(s) found
Summary of Issues
| Type | Count | Severity |
|---|---|---|
| rules.njsscan.semantic_grep.traversal.join_resolve_path_traversal | 4 | MEDIUM |
| rules.njsscan.traversal.join_resolve_path_traversal | 4 | MEDIUM |
| rules.njsscan.dos.regex_dos | 1 | MEDIUM |
| rules.njsscan.crypto.node_insecure_random_generator | 1 | MEDIUM |
| rules.njsscan.semantic_grep.crypto.node_insecure_random_generator | 1 | MEDIUM |
| rules.njsscan.crypto.node_md5 | 1 | MEDIUM |
| rules.njsscan.semantic_grep.crypto.node_md5 | 1 | MEDIUM |
How do I clear all these issues?
If you suspect these issues are not actual issues, click “Clear All Issues” above. Click here for more details.
Details and Annotations
Details
semgrep version 1.102.0
Annotations
Check warning on line 784 in vs-code-extension/out/extension.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.semantic_grep.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 784 in vs-code-extension/out/extension.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 928 in vs-code-extension/out/extension.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.semantic_grep.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 928 in vs-code-extension/out/extension.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 737 in vs-code-extension/out/postRunner.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.dos.regex_dos
Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.
Check warning on line 935 in vs-code-extension/out/postRunner.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.semantic_grep.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 935 in vs-code-extension/out/postRunner.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 975 in vs-code-extension/out/postRunner.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.crypto.node_insecure_random_generator
crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.
Check warning on line 975 in vs-code-extension/out/postRunner.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.semantic_grep.crypto.node_insecure_random_generator
crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.
Check warning on line 471 in vs-code-extension/out/providers/fileTreeProvider.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.semantic_grep.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 471 in vs-code-extension/out/providers/fileTreeProvider.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.traversal.join_resolve_path_traversal
Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.
Check warning on line 135 in vs-code-extension/out/utils.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.crypto.node_md5
MD5 is a a weak hash which is known to have collision. Use a strong hashing function.
Check warning on line 135 in vs-code-extension/out/utils.js
autodesk-chorus / security/semgrep
app.chorus.semgrep.rules.njsscan.semantic_grep.crypto.node_md5
MD5 is a a weak hash which is known to have collision. Use a strong hashing function.