parti-renaissance / espace-adherent

1. high Semgrep Generic Secret detected /.env.test:2 50%
2. high Semgrep Generic Secret detected /.env:21 50%
3. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /Dockerfile:92 22%
4. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /Dockerfile:90 22%
5. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /front/pages/procuration_manager_requests.js:24 2%
6. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /front/utils/text.js:7 2%
7. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /front/services/address/AddressForm.js:160 2%
8. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /front/pages/procuration_manager_proposals.js:24 2%
9. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /front/pages/assessor_manager_vote_places.js:24 2%
10. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /front/pages/assessor_manager_requests.js:24 2%
11. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /assets/services/utils/countdownClock.js:60 2%
12. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /assets/services/utils/countdownClock.js:59 2%
13. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /assets/services/utils/countdownClock.js:58 2%
14. high Semgrep User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities /assets/services/utils/countdownClock.js:57 2%
15. medium Semgrep CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`. /src/Controller/Renaissance/Adhesion/AdhesionController.php:57 100%
16. medium Semgrep CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`. /src/Form/EventFilterType.php:35 100%
17. medium Semgrep CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`. /src/Form/RetirementSimulatorType.php:78 100%
18. medium Semgrep RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /front/utils/url.js:2 76%
19. medium Semgrep Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. /src/Command/SyncEventInscriptionDuplicatesCommand.php:56 66%
20. medium Semgrep Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. /src/Repository/Pap/AddressRepository.php:147 66%
21. medium Semgrep Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. /front/listeners/em-datetime-picker.js:12 54%
22. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/EnMarche/ReportController.php:65 48%
23. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventCRUDController.php:82 48%
24. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventCRUDController.php:107 48%
25. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventCRUDController.php:129 48%
26. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventInscriptionCRUDController.php:31 48%
27. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventInscriptionCRUDController.php:38 48%
28. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventInscriptionCRUDController.php:45 48%
29. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminNationalEventInscriptionCRUDController.php:56 48%
30. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/EnMarche/Filesystem/AbstractFilesController.php:39 48%
31. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:502 48%
32. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/SecurityController.php:128 48%
33. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/OAuth/SsoController.php:38 48%
34. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/Donation/CancelDonationController.php:38 48%
35. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/Donation/CancelDonationController.php:62 48%
36. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/Formation/ContentController.php:51 48%
37. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/MagicLinkController.php:71 48%
38. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/MagicLinkController.php:85 48%
39. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/Newsletter/ConfirmNewsletterController.php:33 48%
40. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/Petition/SignatureValidateController.php:29 48%
41. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Renaissance/Petition/SignatureValidateController.php:40 48%
42. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminEmailCRUDController.php:152 48%
43. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:298 48%
44. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:328 48%
45. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:347 48%
46. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:374 48%
47. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:392 48%
48. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:398 48%
49. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:429 48%
50. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:454 48%
51. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:462 48%
52. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:473 48%
53. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentCRUDController.php:481 48%
54. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminAdherentMessageCRUDController.php:28 48%
55. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminCandidaciesGroupCandidateImportController.php:54 48%
56. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminCandidaciesGroupCandidateImportController.php:70 48%
57. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminCandidaciesGroupCandidateImportController.php:94 48%
58. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminEmailCRUDController.php:78 48%
59. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminEmailCRUDController.php:81 48%
60. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminEmailCRUDController.php:106 48%
61. medium Semgrep The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. /src/Controller/Admin/AdminFileController.php:47 48%
62. medium Semgrep Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. /front/components/DataGrid.js:270 46%
63. medium Semgrep Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. /front/components/DataGrid.js:318 46%
64. medium Semgrep This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. /public/maintenance.html:27 35%

No findings match these filters. Clear filters