Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

modified: Dockerfile #6

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

modified: Dockerfile #6

wants to merge 5 commits into from

Conversation

PavelLinearB
Copy link
Member

workerB
workerB

@PavelLinearB
modified: Dockerfile
7d2f96c 
modified:   README.md
	modified:   introduction/apis.py
	modified:   introduction/mitre.py
	modified:   introduction/static/css/dark-theme.css
	modified:   introduction/views.py
github-advanced-security[bot]
github-advanced-security bot found potential problems May 21, 2023
View reviewed changes
introduction/views.py Fixed Show fixed Hide fixed
introduction/views.py Fixed Show fixed Hide fixed
introduction/views.py Fixed Show fixed Hide fixed
introduction/mitre.py Fixed Show fixed Hide fixed
@gitstream-cm gitstream-cm bot requested a review from Dudu-linb May 21, 2023 09:00
jit-ci[bot]
jit-ci bot reviewed May 21, 2023
View reviewed changes
Copy link

@jit-ci jit-ci bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Jit has detected 3 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

introduction/views.py
@@ -156,7 +156,9 @@
print(sql_query)
try:
print("\nin try\n")
val=""
val=login.objects.raw(sql_query)
val=login.objects.raw(sql_query)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Type: Gitlab.Bandit.B611

Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_undo_ignore Undo ignore command

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#jit_ignore_fp

introduction/views.py
val=""
val=login.objects.raw(sql_query)
val=login.objects.raw(sql_query)
val=login.objects.raw(sql_query)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Type: Gitlab.Bandit.B611

Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_undo_ignore Undo ignore command

introduction/views.py
@@ -156,7 +156,9 @@
print(sql_query)
try:
print("\nin try\n")
val=""
val=login.objects.raw(sql_query)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Python Semgrep

Type: Gitlab.Bandit.B611

Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_undo_ignore Undo ignore command

@sonarqubecloud
Copy link

sonarqubecloud bot commented May 21, 2023 •
edited
Loading

SonarCloud Quality Gate failed.    Quality Gate failed

Bug C 6 Bugs
Vulnerability E 3 Vulnerabilities
Security Hotspot E 1 Security Hotspot
Code Smell A 3 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

jit-ci[bot]
jit-ci bot reviewed Jun 5, 2023
View reviewed changes
Copy link

@jit-ci jit-ci bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Jit has detected 2 important findings in this PR that you should review.
The findings are detailed as separate comments.
It’s highly recommended that you fix these security issues before merge.

Until now, you ignored/fixed 1 finding.

orca-security-us[bot]
orca-security-us bot reviewed Jan 8, 2024
View reviewed changes
Copy link

@orca-security-us orca-security-us bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Orca Security Scan Summary

Status Check Issues by priority
Passed Passed Infrastructure as Code high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Vulnerabilities high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Secrets high 0   medium 0   low 0   info 0 View in Orca

@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Jan 8, 2024

Quality Gate Failed Quality Gate failed

Failed conditions

1 Security Hotspot
C Reliability Rating on New Code (required ≥ A)
E Security Rating on New Code (required ≥ A)

See analysis details on SonarCloud

idea Catch issues before they fail your Quality Gate with our IDE extension SonarLint SonarLint

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 8, 2024
View reviewed changes
introduction/mitre.py
@@ -210,6 +210,11 @@
# @authentication_decorator
@csrf_exempt
def mitre_lab_25_api(request):
if request.method == "POST":
expression = request.POST.get('expression')
result = eval(expression)

Check failure

Code scanning / SonarCloud

Dynamic code execution should not be vulnerable to injection attacks High

Change this code to not dynamically execute code influenced by user-controlled data. See more on SonarCloud
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@orca-security-us orca-security-us[bot] orca-security-us[bot] left review comments

@jit-ci jit-ci[bot] jit-ci[bot] left review comments

@Dudu-linb Dudu-linb Awaiting requested review from Dudu-linb

Assignees
No one assigned
Labels
1 min review Blue label 🌶️ x 1 Security hotspots 🌶️ x 1 Security Hotspots 1 💩 x 3 Code Smells 💩 x 3 Code Smells 1 🛡️ x 3 Vulnerabilities 1 🛡️ x 4 Vulnerabilities 🐞 x 6 Bugs 🐞 x 6 Bugs 1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@PavelLinearB @Dudu-linb