MalDet · Static Security Report
This repository has two major security issues that require immediate attention before it can be used in production. The most critical finding is a high vulnerability risk score of 716.0, which indicates the code contains dangerous patterns like SQL injection and insecure file downloads that an attacker could exploit to steal data or run malicious scripts. While there are also signs of potential malicious intent flagged by tools like YARA and GuardDog, these findings appear to be related to known malware techniques rather than intentional attacks on your own system. However, the code still contains several other serious problems, including a high score of 44.0 for suspicious patterns that might indicate an attempt to bypass security checks or execute remote files. Because of these combined issues, you should not use this repository in any production environment without first fixing all the identified vulnerabilities and removing the dangerous code patterns.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 6 | 256 | 0 | 262 |
| yara | Signatures of malicious behaviour in source files | 8 | 1 | 19 | 28 |
| guarddog | Malicious package and install-time behaviour | 3 | 4 | 0 | 7 |
264 of 297 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use pre | 1 | /apps/dashboard/app/controllers/widgets_controller.rb:13 |
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 3 | /apps/dashboard/app/javascript/files/file_ops.js:402 |
| high | semgrep | Generic Secret detected | 1 | /ood-portal-generator/share/ood_portal_example.yml:425 |
| high | semgrep | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. | 1 | /mod_ood_proxy/lib/ood/proxy.lua:13 |
| high | semgrep | bcrypt hash detected | 3 | /ood-portal-generator/spec/application_spec.rb:312 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 1 | /apps/shell/public/javascripts/hterm_all_1.92.1.mod_1.js |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 1 | /lib/tasks/test.rb |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 2 | /apps/dashboard/public/noVNC-1.3.0/legacy/app.js |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 4 | /spec/e2e/00_package_spec.rb |
| medium | semgrep | RegExp() called with a `prefix` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll | 1 | /apps/dashboard/app/javascript/dynamic_forms.js:130 |
| medium | semgrep | RegExp() called with a `optionForType` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-c | 1 | /apps/dashboard/app/javascript/dynamic_forms.js:938 |
| medium | semgrep | 'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. | 3 | /apps/dashboard/app/views/support_ticket/email_service_template.html.erb:5 |
| medium | semgrep | 'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify. | 2 | /apps/myjobs/app/views/layouts/application.html.erb:38 |
| medium | semgrep | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protec | 8 | /apps/dashboard/app/views/layouts/application.html.erb:13 |
| medium | semgrep | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find | 17 | /apps/dashboard/app/controllers/products_controller.rb:65 |
| medium | semgrep | Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. | 1 | /apps/shell/views/index.hbs:90 |
| medium | semgrep | 'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it i | 21 | /apps/dashboard/app/views/dashboard/_motd_rss.html.erb:6 |
| medium | semgrep | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. | 17 | /apps/dashboard/app/helpers/products_helper.rb:59 |
| medium | semgrep | Detected non-static command inside Open3.capture2e. Audit the input to 'Open3.capture2e'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 2 | /apps/dashboard/app/models/product.rb:279 |
| medium | semgrep | Detected non-static command inside Open3.capture3. Audit the input to 'Open3.capture3'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 2 | /apps/myjobs/app/models/filesystem.rb:79 |
| medium | semgrep | Detected non-static command inside Open3.popen2e. Audit the input to 'Open3.popen2e'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /apps/dashboard/app/controllers/products_controller.rb:122 |
| medium | semgrep | Detected non-static command inside Open3.popen3. Audit the input to 'Open3.popen3'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /apps/dashboard/lib/rclone_util.rb:319 |
| medium | semgrep | Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_acces | 2 | /apps/myjobs/app/controllers/templates_controller.rb:14 |
| medium | semgrep | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d | 27 | /apps/dashboard/app/helpers/dashboard_helper.rb:97 |
| medium | semgrep | Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead. | 2 | /apps/dashboard/app/models/batch_connect/session.rb:648 |
| medium | semgrep | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". | 20 | /apps/dashboard/app/views/batch_connect/session_contexts/_form.html.erb:26 |
| medium | semgrep | Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 4 | /apps/dashboard/app/controllers/products_controller.rb:119 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 21 | /.github/dependabot.yml:12 |
| medium | semgrep | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= | 23 | /apps/myjobs/app/views/layouts/application.html.erb:36 |
| medium | semgrep | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. | 18 | /apps/dashboard/app/controllers/products_controller.rb:96 |
| medium | yara | YARA rule matched: detect_clipboard_hijack — Reads the clipboard alongside crypto-wallet-address-shaped patterns - a known \'clipper\' malware technique that swaps a copied address for the attacker\'s own | 1 | /apps/shell/public/javascripts/hterm_all_1.92.1.mod_1.js |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 4 | /apps/dashboard/app/controllers/products_controller.rb:84 |
| medium | semgrep | Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off. | 4 | /apps/myjobs/config/environments/development.rb:15 |
| medium | semgrep | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 2 | /apps/dashboard/public/noVNC-1.3.0/app/webutil.js:34 |
| medium | semgrep | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'. | 11 | /apps/dashboard/app/models/batch_connect/session.rb:81 |
| medium | semgrep | Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 12 | /apps/myjobs/app/models/filesystem.rb:88 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 29 | /.github/workflows/tests.yml:90 |
| medium | semgrep | Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information. | 1 | /apps/shell/app.js:94 |
| medium | semgrep | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. | 3 | /apps/shell/app.js:53 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 19 | /spec/e2e/nodesets/amzn2023.yml |