fix bug #93

[darcosion]

fix le bug #93

[darcosion]

Checkmarx One – Scan Summary & Details – db4c76be-64b6-4dd0-ac1c-ff26270a8924

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2022-25844	Npm-angular-1.8.2	Vulnerable Package
	CVE-2024-21490	Npm-angular-1.8.2	Vulnerable Package
	Reflected_XSS_All_Clients	/webchosounder.py: 118	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 110	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 102	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 89	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 80	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 62	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 62	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 198	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 191	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 184	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 177	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 170	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 163	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 156	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 149	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 142	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 135	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 135	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 135	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 133	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 126	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 90	Attack Vector
	Reflected_XSS_All_Clients	/webchosounder.py: 81	Attack Vector
	Stored_XSS	/webchosounder.py: 205	Attack Vector
	CSRF	/webchosounder.py: 93	Attack Vector
	CSRF	/webchosounder.py: 201	Attack Vector
	CVE-2022-25869	Npm-angular-1.8.2	Vulnerable Package
	CVE-2023-26116	Npm-angular-1.8.2	Vulnerable Package
	CVE-2023-26117	Npm-angular-1.8.2	Vulnerable Package
	CVE-2023-26118	Npm-angular-1.8.2	Vulnerable Package
	Client_DoS_By_Sleep	/static/js/cytoscape.min.js: 12842	Attack Vector
	Client_DoS_By_Sleep	/static/js/cytoscape.min.js: 12924	Attack Vector
	Client_DoS_By_Sleep	/static/js/cytoscape.min.js: 12566	Attack Vector
	Communication_Over_HTTP	/ouiinfo/collectoui.py: 6	Attack Vector
	Missing_HSTS_Header	/webchosounder.py: 34	Attack Vector
	Client_JQuery_Deprecated_Symbols	/static/js/cytoscape.min.js: 94	Attack Vector
	Client_JQuery_Deprecated_Symbols	/static/js/angular-animate.min.js: 43	Attack Vector
	Client_Password_In_Comment	/static/main.js: 1171	Attack Vector
	Client_Password_In_Comment	/static/main.js: 1143	Attack Vector
	Client_Password_In_Comment	/static/main.js: 1121	Attack Vector
	Client_Password_In_Comment	/static/main.js: 763	Attack Vector
	Client_Password_In_Comment	/static/main.js: 715	Attack Vector
	Debug_Enabled	/webchosounder.py: 218	Attack Vector
	Missing_Content_Security_Policy	/webchosounder.py: 34	Attack Vector
	Missing_Content_Security_Policy	/templates/index.html: 6	Attack Vector
	Potential_Clickjacking_on_Legacy_Browsers	/templates/index.html: 1	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CVE-2024-38081	Nuget-Microsoft.IO.Redist-6.0.0
	Client_DOM_Code_Injection	/CommonExtensions/Platform/Debugger/WebViews/BptDiagnosticCommon/MicrosoftAjax-4.0.0.0.debug.js: 6511
	Client_DOM_XSS	/CommonExtensions/Platform/Debugger/WebViews/BptDiagnosticCommon/MicrosoftAjax-4.0.0.0.debug.js: 5491
	Client_DOM_XSS	/CommonExtensions/Platform/Debugger/WebViews/BptDiagnosticCommon/MicrosoftAjax-4.0.0.0.debug.js: 5502
	Code_Injection	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/_pydevd_bundle/pydevconsole_code.py: 467
	Code_Injection	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_run_in_console.py: 106
	Code_Injection	/Extensions/Microsoft/Python/Core/ptvsd/__main__.py: 36
	Code_Injection	/Extensions/Microsoft/Python/Core/ptvsd_launcher.py: 66
	Code_Injection	/Extensions/Microsoft/Python/Profiling/proflaun.py: 28
	Code_Injection	/Extensions/Microsoft/Python/Profiling/proflaun.py: 28
	Code_Injection	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_sitecustomize/sitecustomize.py: 179
	Command_Injection	/Extensions/Microsoft/Python/Core/testlauncher.py: 93
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd_repl_launcher.py: 44
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd_repl_launcher.py: 127
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd_launcher.py: 112
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd/repl/jupyter_client.py: 419
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd/repl/jupyter_client.py: 379
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd/repl/jupyter_client.py: 233
	Command_Injection	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/_pydev_bundle/pydev_ipython_console_011.py: 73
	Command_Injection	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_coverage.py: 38
	Command_Injection	/Extensions/Microsoft/Python/Core/debugpy/launcher/handlers.py: 73
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd/__main__.py: 36
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd_launcher.py: 66
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd/__main__.py: 36
	Command_Injection	/Extensions/Microsoft/Python/Core/ptvsd_launcher.py: 66
	Cxdca8e59f-8bfe	Npm-inflight-1.0.6
	Local_File_Inclusion	/Extensions/Microsoft/Python/Core/pylance/dist/scripts/scrape_module.py: 1288
	Local_File_Inclusion	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_run_in_console.py: 106
	Local_File_Inclusion	/Extensions/Microsoft/Python/Core/ptvsd_repl_launcher.py: 72
	Local_File_Inclusion	/Extensions/Microsoft/Python/Core/pylance/dist/scripts/scrape_module.py: 1288
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 30
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/adapter/__main__.py: 227
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 28
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 28
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 28
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 30
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/testlauncher.py: 44
	OS_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 28
	Prototype_Pollution	/CommonExtensions/Platform/Debugger/WebViews/BptDiagnosticCommon/MicrosoftAjax-4.0.0.0.debug.js: 5491
	Prototype_Pollution	/CommonExtensions/Platform/Debugger/WebViews/BptDiagnosticCommon/MicrosoftAjax-4.0.0.0.debug.js: 5502
	Reflected_XSS	/PrivateAssemblies/plugin.vs.v2.js: 2272
	Resource_Injection	/Extensions/Microsoft/Python/Core/debugpy/adapter/__main__.py: 227
	Unsafe_Deserialization	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/_pydev_runfiles/pydev_runfiles_pytest2.py: 21
	Buffer_Overflow_AddressOfLocalVarReturned	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/windows/attach.cpp: 101
	CGI_XSS	/CommonExtensions/Platform/Guide/Content/Projects/Welcome.CSharp/Welcome.CSharp/Program.cs: 7
	CVE-2019-14862	Npm-knockout-3.4.0
	CVE-2024-29992	Nuget-Azure.Identity-1.10.2
	CVE-2024-4067	Npm-micromatch-4.0.7
	Client_Potential_XSS	/CommonExtensions/Platform/DiagnosticsHub/EdgeWebViews/summaryView.html: 47
	Client_Potential_XSS	/CommonExtensions/Platform/DiagnosticsHub/EdgeWebViews/summaryView.html: 45
	Client_Potential_XSS	/CommonExtensions/Platform/DiagnosticsHub/EdgeWebViews/summaryView.html: 41
	Client_Potential_XSS	/CommonExtensions/Platform/Shell/ExtensionManagerWindowResources/Webviews/node_modules/dompurify/purify.js: 1187
	Client_Potential_XSS	/PrivateAssemblies/plugin.vs.v2.js: 2210
	Client_Potential_XSS	/PrivateAssemblies/plugin.vs.v2.js: 2210
	Client_Potential_XSS	/CommonExtensions/Microsoft/ClientDiagnostics/AppResponsiveness/View/DiagnosticsCommon/Bpt.Diagnostics.CommonMerged.js: 1295
	Client_Potential_XSS	/CommonExtensions/Platform/DiagnosticsHub/WebViews/Scripts/knockout-3.4.0.js: 22
	Client_Potential_XSS	/CommonExtensions/Platform/DiagnosticsHub/EdgeWebViews/scripts/knockout-3.4.0.js: 22
	Client_Potential_XSS	/CommonExtensions/Platform/Debugger/WebViews/Knockout/knockout-3.4.0.js: 22
	Client_Potential_XSS	/CommonExtensions/Microsoft/IceCap/WebViews/Scripts/knockout-3.4.0.js: 22
	Client_Potential_XSS	/CommonExtensions/Platform/Debugger/WebViews/BptDiagnosticCommon/JSTreeDynamicGridControl.js: 2672
	Cxb90148b9-bcbe	Npm-knockout-3.4.0
	Dangerous_Functions	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/windows/py_win_helpers.hpp: 9
	Dangerous_Functions	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/common/py_version.hpp: 66
	Dangerous_Functions	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/common/py_version.hpp: 54
	Hardcoded_Password_in_Connection_String	/Extensions/Microsoft/Python/Core/visualstudio_py_testlauncher.py: 237
	Hardcoded_Password_in_Connection_String	/Extensions/Microsoft/Python/Core/visualstudio_py_testlauncher.py: 237
	MemoryFree_on_StackVariable	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/windows/attach.cpp: 137
	Memory_Leak	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/windows/attach.cpp: 185
	Memory_Leak	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/common/py_settrace.hpp: 166
	Memory_Leak	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd_attach_to_process/windows/attach.cpp: 170
	Object_Access_Violation	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_run_in_console.py: 106
	Object_Access_Violation	/Extensions/Microsoft/Python/Core/pylance/dist/scripts/scrape_module.py: 1288
	Object_Access_Violation	/Extensions/Microsoft/Python/Core/pylance/dist/scripts/scrape_module.py: 1288
	Object_Access_Violation	/Extensions/Microsoft/Python/Core/ptvsd_repl_launcher.py: 72
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd.py: 3288
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydevd.py: 3288
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 30
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 30
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/adapter/__main__.py: 227
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_run_in_console.py: 106
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_coverage.py: 38
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_coverage.py: 38
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/pydev_run_in_console.py: 106
	Path_Traversal	/Extensions/Microsoft/Python/Core/debugpy/_vendored/pydevd/setup_pydevd_cython.py: 30
	Path_Traversal	/Extensions/Microsoft/Python/Core/testlauncher.py: 44
	Path_Traversal	/Extensions/Microsoft/Python/Core/testlauncher.py: 44
	Path_Traversal

More results are available on AST platform