Skip to content

Conversation

@bliof-fc
Copy link
Member

@bliof-fc bliof-fc commented Apr 8, 2024

./bin/hellgrid -r -t
         x        | diff-lcs | rspec | rspec-core | rspec-expectations | rspec-mocks |  rake  | rspec-support | hellgrid
------------------+----------+-------+------------+--------------------+-------------+--------+---------------+----------
         hellgrid |  1.5.1   | 3.8.0 |   3.8.2    |       3.8.6        |    3.8.2    |   x    |     3.8.3     |  0.4.0
     spec/tmp/bar |  1.2.5   | 2.0.0 |   2.0.0    |       2.0.0        |    2.0.0    | 10.0.0 |       x       |    x
  spec/tmp/in/foo |  1.2.5   | 3.0.0 |   3.0.4    |       3.0.4        |    3.0.4    | 11.1.0 |     3.0.4     |    x

@bliof-fc bliof-fc added the wip label Apr 8, 2024
@fc-infosec-sast
Copy link

fc-infosec-sast commented Apr 8, 2024

❌ SAST Report

Errors (1)

Fingerprint: cfe59e475c1a35e0a708b0ec8b9be93fa53eeeefb78c5020adb1ed70326a02bd
Category: CWE-94 Improper Control of Generation of Code ('Code Injection')
Rule ID: ruby.lang.security.dangerous-subshell.dangerous-subshell
Location: spec/hellgrid_spec.rb [146:16]

 146 |         expect(`cd #{PROJECT_ROOT}/spec/tmp && #{PROJECT_ROOT}/bin/hellgrid -t`).to eq(expected_result)

Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.


For more details, please check code annotations on the changed files.

To create an exception, follow this guide. For help, join #coberos-help.

```
./bin/hellgrid -r -t
         x        | diff-lcs | rspec | rspec-core | rspec-expectations | rspec-mocks |  rake  | rspec-support | hellgrid
------------------+----------+-------+------------+--------------------+-------------+--------+---------------+----------
         hellgrid |  1.5.1   | 3.8.0 |   3.8.2    |       3.8.6        |    3.8.2    |   x    |     3.8.3     |  0.4.0
     spec/tmp/bar |  1.2.5   | 2.0.0 |   2.0.0    |       2.0.0        |    2.0.0    | 10.0.0 |       x       |    x
  spec/tmp/in/foo |  1.2.5   | 3.0.0 |   3.0.4    |       3.0.4        |    3.0.4    | 11.1.0 |     3.0.4     |    x
```
@bliof-fc bliof-fc removed the wip label Apr 26, 2024
@bliof-fc bliof-fc merged commit 8b8fba3 into master May 7, 2024
@bliof-fc bliof-fc deleted the matrix-transpose branch May 7, 2024 11:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants