search

proactiveops / picofun

Code generator for Python based Lambda functions that consume APIs defined in Open API spec files
MIT License
9 stars 0 forks source link

Vulnerabilities Dashboard - Code #113

Open nullify-proactiveops[bot] opened 3 months ago

nullify-proactiveops[bot] commented 3 months ago

Severity Threshold: 🔵 MEDIUM

1 Potential vulnerability sources found within this repo

🔴 CRITICAL 🟡 HIGH 🔵 MEDIUM ⚪ LOW
0 0 1 0

ID: 01J6TC6QPHD0CQD54XMYN0PC1R Language: Python Severity: 🔵 MEDIUM CWE-116

Improper Encoding or Escaping of Output

The vulnerability stems from the Jinja2 Environment being initialized without enabling autoescaping. Normally, this could lead to XSS vulnerabilities if user input is rendered in an HTML context. However, the code comments suggest that HTML is not being generated, which significantly reduces the risk of XSS attacks. The intentional ignoring of security linter warnings also indicates that the developers are aware of the potential issues and have made a conscious decision based on their specific use case. Read more: https://cwe.mitre.org/data/definitions/116.html https://github.com/proactiveops/picofun/blob/7058cb06235f9d65e5fd03222bd6930a35f01474/picofun/template.py#L19-L23

Reply with /nullify to interact with me like another developer

nullify-proactiveops[bot] commented 3 months ago

New code security updates for commits 93fc9c9351386b56c57a4c5a482508e73e925363...6ee98fa2aa193b5c92cc262c619388e42ebddf6d

New Fixed Allowlisted Unallowlisted
1 0 0 0
See Details ### New Findings | ID | Title | File | Line | CWE | |-|-|-|-|-| | 01J0KEY76HQDRZRAH2XYGJGYG9 | Yaml load | picofun/spec.py | 128 | 20 |
skwashd commented 2 weeks ago

/nullify allowlist 01J6TC6QPHD0CQD54XMYN0PC1R no escaping is required as it isn't being used to generate HTML