Scan report
quasar / Quasar
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 0
- Medium
- 2
- Low
- 2
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 4
- Uncertain
- 0
- Likely noise
- 0
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
4 findings likely need attention. Most notable: `aesProvider` is setup to use the CBC cipher mode. This mode is insecure because it is ... in /Quasar.Common/Cryptography/Aes256.cs (99% confidence).
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /Quasar.Common/Cryptography/Aes256.cs line 58
- Likely real
- Yes, 99% confidence
`aesProvider` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.
aesProvider.Mode = CipherMode.CBC; -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /Quasar.Common/Cryptography/Aes256.cs line 98
- Likely real
- Yes, 99% confidence
`aesProvider` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.
aesProvider.Mode = CipherMode.CBC; -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /Quasar.Common/Cryptography/Sha256.cs line 14
- Likely real
- Yes, 98% confidence
Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.
data = sha.ComputeHash(data); -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /Quasar.Common/Cryptography/Sha256.cs line 29
- Likely real
- Yes, 98% confidence
Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.
return sha.ComputeHash(input);
No findings match these filters.