vulnerabilities #2
Conversation
![jit-ci[bot]](https://avatars.githubusercontent.com/in/142441?s=60&v=4){kind=small}
routes/likeProductReviews.ts
Outdated
| @@ -15,7 +15,7 @@ module.exports = function productReviews () { | |||
| return (req: Request, res: Response, next: NextFunction) => { | |||
| const id = req.body.id | |||
| const user = security.authenticatedUsers.from(req) | |||
| db.reviews.findOne({ _id: "a" }).then((review: Review) => { | |||
| db.reviews.findOne({ _id: id }).then((review: Review) => { | |||
There was a problem hiding this comment.
Security control: Static Code Analysis Js
Type: Codsec.Javascriptnosql-Injection.Nosql-Injection
Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
There was a problem hiding this comment.
#jit_ignore_fp this is false positive
routes/updateProductReviews.ts
Outdated
| { _id: req.body.id }, // vuln-code-snippet vuln-line noSqlReviewsChallenge forgedReviewChallenge | ||
| { $set: { message: req.body.message } }, | ||
| { multi: true } // vuln-code-snippet vuln-line noSqlReviewsChallenge | ||
| ).then( |
There was a problem hiding this comment.
Security control: Static Code Analysis Js
Type: Codsec.Javascriptnosql-Injection.Nosql-Injection
Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
test/smoke/Dockerfile
Outdated
| @@ -1,3 +1,4 @@ | |||
| FROM alpine | |||
There was a problem hiding this comment.
Security control: Docker Scan
Type: Image User Should Not Be 'Root'
Description: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
- First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this:
docker run <image> whoami. If it returnsroot, then you should consider using a non-root user, by following one of the next steps:- If a non-root user already exists in your container, consider using it.
- If not, you can create a new user by adding a
USERcommand to the Dockerfile, with a non-root user as argument, for example:USER <non-root-user-name>.
| FROM alpine | |
| FROM alpine | |
| RUN addgroup --system <group> | |
| RUN adduser --system <user> --ingroup <group> | |
| USER <user>:<group> | |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "errorhandler": "^1.5.1", | ||
| "exif": "^0.6.0", | ||
| "express": "^4.17.1", | ||
| "express-ipfilter": "^1.2.0", | ||
| "express-jwt": "0.1.3", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Regular Expression Denial Of Service In Moment
Description: express-jwt>jsonwebtoken>moment
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| @@ -119,17 +119,20 @@ | |||
| "cookie-parser": "^1.4.5", | |||
| "cors": "^2.8.5", | |||
| "dottie": "^2.0.2", | |||
| "download": "^8.0.0", | |||
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service
Description: download>got>cacheable-request>http-cache-semantics
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "errorhandler": "^1.5.1", | ||
| "exif": "^0.6.0", | ||
| "express": "^4.17.1", | ||
| "express-ipfilter": "^1.2.0", | ||
| "express-jwt": "0.1.3", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Forgeable Public/Private Tokens In Jws
Description: express-jwt>jsonwebtoken>jws
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| @@ -119,17 +119,20 @@ | |||
| "cookie-parser": "^1.4.5", | |||
| "cors": "^2.8.5", | |||
| "dottie": "^2.0.2", | |||
| "download": "^8.0.0", | |||
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Got Allows A Redirect To A Unix Socket
Description: download>got
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "errorhandler": "^1.5.1", | ||
| "exif": "^0.6.0", | ||
| "express": "^4.17.1", | ||
| "express-ipfilter": "^1.2.0", | ||
| "express-jwt": "0.1.3", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage
Description: express-jwt>jsonwebtoken
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
data/static/users.yml
Outdated
| @@ -147,6 +147,8 @@ | |||
| email: wurstbrot | |||
| username: wurstbrot | |||
| password: 'EinBelegtesBrotMitSchinkenSCHINKEN!' | |||
| totpSecret: IFTXE3SPOEYVURT2MRYGI52TKJ4HC3KH | |||
| key: timo | |||
There was a problem hiding this comment.
Security control: Secret Detection
Type: Generic-Api-Key
Description: Generic API Key
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
lib/insecurity.ts
Outdated
| @@ -20,6 +20,7 @@ import * as utils from './utils' | |||
| import * as z85 from 'z85' | |||
|
|
|||
| export const publicKey = fs ? fs.readFileSync('encryptionkeys/jwt.pub', 'utf8') : 'placeholder-public-key' | |||
| const privateKey = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----' | |||
There was a problem hiding this comment.
Security control: Secret Detection
Type: Private-Key
Description: Private Key
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
gitstream-cm
bot
added
1 High vulnerabilities
jit_ignore_accept
and removed
🌶️ x 2 Security Hotspots
labels
gitstream-cm
bot
added
🛡️ x 1 High vulnerabilities
🙈 jit_ignore_accept
and removed
1 High vulnerabilities
jit_ignore_accept
labels
gitstream-cm
bot
added
🛡️ x 13 High vulnerabilities
and removed
🛡️ x 1 High vulnerabilities
labels
|
PR: {"isFullyInstalled":false,"title":"vulnerabilities","approvals":[],"requested_changes":[],"author":"PavelLinearB","description":"","checks":[],"created_at":"2023-05-21T13:40:04Z","draft":false,"mergeable":false,"labels":["🙈 jit_ignore_accept","🤫 PR with secrets","2 Security hotspots 🌶️","🛡️ x 13 High vulnerabilities"],"reviewers":["Dudu-linb"],"status":"open","updated_at":"2023-06-06T09:58:10Z","assignees":[],"contributors":[{"login":"vim-zz","name":"Ofer Affias"},{"login":"almog27","name":"Almog Ben David"},{"login":"yishaibeeri","name":"Yishai Beeri"},{"login":"orielz","name":"Oriel Zaken"},{"login":"amitmohleji","name":"Amit Mohleji"},{"login":"vscabral","name":"Val Cabral"},{"login":"BenLloydPearson","name":"Ben Lloyd Pearson"},{"login":"flomermer","name":"Tomer Flom"},{"login":"Yaarash","name":"Yaara Shoham"},{"login":"omarcovitch","name":"Omri Marcovitch"},{"login":"ShakedZrihen","name":"shaked zohar"},{"login":"Fadikhayo1995","name":"Fadi Khayo"},{"login":"emasuary","name":"Eitan Masuary"},{"login":"orikrn","name":"Ori Keren"},{"login":"linknfg182","name":"Dan Lines"},{"login":"saharavishag","name":"Avishag Sahar"},{"login":"linearbci","name":"LinearB Automation"},{"login":"ariel-linearb","name":"Ariel Illouz"},{"login":"yeelali14","name":"Yeela Lifshitz"},{"login":"zuki-linB","name":"Zuki Sarusi"},{"login":"mavery-linb","name":"Mike Avery"},{"login":"KerenLinearB","name":"Keren Shiloah"},{"login":"LiorF-BDBQ","name":null},{"login":"lisa-linearb","name":"Lisa Messelt"},{"login":"lb-ronyeh","name":"Ron Yehuda"},{"login":"YovelElad","name":"Yovel Elad"},{"login":"stas-linearb","name":"Stas Onichak "},{"login":"BetsyRogers","name":"Betsy Rogers"},{"login":"Hadarbitan149","name":"hadar bitan"},{"login":"shirels","name":"Shirel Lugasi"},{"login":"negevyoav","name":"Yoav Negev"},{"login":"RoyKulik","name":"Roy Kulik"},{"login":"yoni-amikam","name":"Yoni Amikam"},{"login":"alexChernovLinearB","name":"Alexander Chernov"},{"login":"ZWLinearB","name":"Zach Westall"},{"login":"urikochav","name":"Uri Kochavi"},{"login":"ShaniBelisha","name":"Shani"},{"login":"orenylinearb","name":"oren yosef"},{"login":"alongalperin-lb","name":"Alon Galperin"},{"login":"GuyRahamim","name":null},{"login":"Dudu-linb","name":"Dudu Yosef"},{"login":"EladKohavi","name":"Elad Kohavi"},{"login":"nivSwisa1","name":null},{"login":"b-sims","name":"Brandon Sims"},{"login":"rotemshynes","name":"Rotem Shynes"},{"login":"mark-linearb","name":"Mark Bulgakov"},{"login":"shaisorek","name":null},{"login":"chen-weizmann","name":"Chen Weizmann"},{"login":"ZionSoferLinearB","name":"Zion Sofer"},{"login":"GabiC-LinearB","name":"Gabriel Cherniavsky"},{"login":"imanuel-leibo","name":"Imanuel Leibovitch"},{"login":"mosheia","name":null},{"login":"PavelLinearB","name":null},{"login":"eidellav","name":"Lev Eidelman Nagar"},{"login":"avielLB","name":null},{"login":"mikolinearb","name":null},{"login":"OferSmart","name":null}],"paths":[{"name":"jit.cm"}],"author_teams":["Developers"],"comments":[{"commenter":"gitstream-cm","content":"PR: {"isFullyInstalled":false,"title":"vulnerabilities","approvals":[],"requested_changes":[],"author":"PavelLinearB","description":"","checks":[],"created_at":"2023-05-21T13:40:04Z","draft":false,"mergeable":true,"labels":["🙈 jit_ignore_accept","🤫 PR with secrets","2 Security hotspots 🌶️","🛡️ x 13 High vulnerabilities"],"reviewers":["Dudu-linb"],"status":"open","updated_at":"2023-06-06T09:53:41Z","assignees":[],"contributors":[{"login":"vim-zz","name":"Ofer Affias"},{"login":"almog27","name":"Almog Ben David"},{"login":"yishaibeeri","name":"Yishai Beeri"},{"login":"orielz","name":"Oriel Zaken"},{"login":"amitmohleji","name":"Amit Mohleji"},{"login":"vscabral","name":"Val Cabral"},{"login":"BenLloydPearson","name":"Ben Lloyd Pearson"},{"login":"flomermer","name":"Tomer Flom"},{"login":"Yaarash","name":"Yaara Shoham"},{"login":"omarcovitch","name":"Omri Marcovitch"},{"login":"ShakedZrihen","name":"shaked zohar"},{"login":"Fadikhayo1995","name":"Fadi Khayo"},{"login":"emasuary","name":"Eitan Masuary"},{"login":"orikrn","name":"Ori Keren"},{"login":"linknfg182","name":"Dan Lines"},{"login":"saharavishag","name":"Avishag Sahar"},{"login":"linearbci","name":"LinearB Automation"},{"login":"ariel-linearb","name":"Ariel Illouz"},{"login":"yeelali14","name":"Yeela Lifshitz"},{"login":"zuki-linB","name":"Zuki Sarusi"},{"login":"mavery-linb","name":"Mike Avery"},{"login":"KerenLinearB","name":"Keren Shiloah"},{"login":"LiorF-BDBQ","name":null},{"login":"lisa-linearb","name":"Lisa Messelt"},{"login":"lb-ronyeh","name":"Ron Yehuda"},{"login":"YovelElad","name":"Yovel Elad"},{"login":"stas-linearb","name":"Stas Onichak "},{"login":"BetsyRogers","name":"Betsy Rogers"},{"login":"Hadarbitan149","name":"hadar bitan"},{"login":"shirels","name":"Shirel Lugasi"},{"login":"negevyoav","name":"Yoav Negev"},{"login":"RoyKulik","name":"Roy Kulik"},{"login":"yoni-amikam","name":"Yoni Amikam"},{"login":"alexChernovLinearB","name":"Alexander Chernov"},{"login":"ZWLinearB","name":"Zach Westall"},{"login":"urikochav","name":"Uri Kochavi"},{"login":"ShaniBelisha","name":"Shani"},{"login":"orenylinearb","name":"oren yosef"},{"login":"alongalperin-lb","name":"Alon Galperin"},{"login":"GuyRahamim","name":null},{"login":"Dudu-linb","name":"Dudu Yosef"},{"login":"EladKohavi","name":"Elad Kohavi"},{"login":"nivSwisa1","name":null},{"login":"b-sims","name":"Brandon Sims"},{"login":"rotemshynes","name":"Rotem Shynes"},{"login":"mark-linearb","name":"Mark Bulgakov"},{"login":"shaisorek","name":null},{"login":"chen-weizmann","name":"Chen Weizmann"},{"login":"ZionSoferLinearB","name":"Zion Sofer"},{"login":"GabiC-LinearB","name":"Gabriel Cherniavsky"},{"login":"imanuel-leibo","name":"Imanuel Leibovitch"},{"login":"mosheia","name":null},{"login":"PavelLinearB","name":null},{"login":"eidellav","name":"Lev Eidelman Nagar"},{"login":"avielLB","name":null},{"login":"mikolinearb","name":null},{"login":"OferSmart","name":null}],"paths":[{"name":"jit.cm"}],"author_teams":["Developers"],"comments":[{"commenter":"sonarcloud","content":"SonarCloud Quality Gate failed. \n \n\n","created_at":"2023-05-21T13:42:39Z","state":"submitted","id":1199769392},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:39Z","state":"submitted","id":1199769394},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\\nFROM alpine\\n\\nRUN addgroup --system <group>\\nRUN adduser --system <user> --ingroup <group>\\nUSER <user>:<group>\\n\\n\n\n---\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769396},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: express-jwt>jsonwebtoken>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769397},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n
Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore U","created_at":"2023-06-06T09:54:51Z","id":1578323749},{"commenter":"gitstream-cm","content":"This PR failed due to High severity vulnerability finding, if you don't fix it please select:\n[] I need help with that fix.\n[] I want to accept the risk, please approve. \n[] This is false positive, please approve.\n[] This is a test / simulator environment, please exclude.\n","created_at":"2023-06-06T09:55:05Z","id":1578324348},{"commenter":"sonarcloud","content":"SonarCloud Quality Gate failed.  \n\n  0 Bugs \n 0 Vulnerabilities \n  2 Security Hotspots \n 0 Code Smells\n\n No Coverage information \n 0.0% Duplication\n\n","created_at":"2023-06-06T09:56:20Z","id":1578327981}],"reviews":[{"commenter":"jit-ci","content":"❌ Jit has detected 13 important findings in this PR that you should review.\n_The findings are detailed below as separate comments.\n_It’s highly recommended that you fix these security issues before merge.","state":"commented","conversations":[{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\n\n \n\n","created_at":"2023-05-21T13:42:39Z","state":"submitted","id":1199769392},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:39Z","state":"submitted","id":1199769394},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769396},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: express-jwt>jsonwebtoken>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769397},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769398},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769400},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769402},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:40Z","state":"submitted","id":1199769403},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:41Z","state":"submitted","id":1199769404},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:41Z","state":"submitted","id":1199769405},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:41Z","state":"submitted","id":1199769406},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:41Z","state":"submitted","id":1199769407},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-05-21T13:42:41Z","state":"submitted","id":1199769408}]},{"commenter":"PavelLinearB","content":"","state":"commented","conversations":[{"commenter":"PavelLinearB","content":"#jit_ignore_accept","created_at":"2023-05-22T07:47:01Z","state":"submitted","id":1200095941}]},{"commenter":"jit-ci","content":"❌ Jit has detected 12 important findings in this PR that you should review.\n_The findings are detailed as separate comments.\n_It’s highly recommended that you fix these security issues before merge.\n\nUntil now, you ignored/fixed 1 finding.","state":"commented","conversations":[]},{"commenter":"PavelLinearB","content":"","state":"commented","conversations":[{"commenter":"PavelLinearB","content":"#jit_ignore_fp this is false positive","created_at":"2023-05-23T12:00:00Z","state":"submitted","id":1202175421}]},{"commenter":"jit-ci","content":"❌ Jit has detected 11 important findings in this PR that you should review.\n_The findings are detailed as separate comments.\n_It’s highly recommended that you fix these security issues before merge.\n\nUntil now, you ignored/fixed 2 findings.","state":"commented","conversations":[]}],"conversations":[{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":18,"is_resolved":false},{"commenter":"PavelLinearB","content":"#jit_ignore_fp this is false positive","start_line":null,"end_line":18,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":21,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","start_line":null,"end_line":1,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: express-jwt>jsonwebtoken>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"PavelLinearB","content":"#jit_ignore_accept","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":151,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":23,"is_resolved":false}],"isPrivate":false,"target":"master"}Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n |
|
SonarCloud Quality Gate failed.
|
PavelLinearB
force-pushed
the
master
branch
from
95de275
to
39b4686
Compare
More translation and improved consistency
No description provided.