Skip to content

Conversation

@conikeec
Copy link
Owner

@conikeec conikeec commented Aug 8, 2024

Qwiet.AI AutoFix

This PR was created automatically by the Qwiet.AI autofix tool.
As long as it is open, subsequent scans and generated fixes to this same branch
will be added to it as new commits.

Each commit fixes one vulnerability.

Some manual intervention might be required before merging this PR.

Fixes

  • AutoPatch applied to src/main/java/io/shiftleft/controller/SearchController.java for finding 1025 (Remote Code Execution: Code Injection Through Attacker-controlled Data via foo in SearchController.doGetSearch) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/controller/AdminController.java for finding 1032 (Deserialization: Attacker-controlled Data Used in Unsafe Deserialization Function via auth in AdminController.doPostLogin) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1044 (Sensitive Data Leak: Sensitive Data is Leaked via accountNumber to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1046 (Sensitive Data Leak: Sensitive Data is Leaked via initialInterest to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1041 (Sensitive Data Leak: Sensitive Data is Leaked via initialBalance to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1043 (Sensitive Data Leak: Sensitive Data is Leaked to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1085 (Sensitive Data Leak: Sensitive Data is Leaked via initialBalance to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1087 (Sensitive Data Leak: Sensitive Data is Leaked to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1085 (Sensitive Data Leak: Sensitive Data is Leaked via initialBalance to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1087 (Sensitive Data Leak: Sensitive Data is Leaked to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1083 (Sensitive Data Leak: Sensitive Data is Leaked via accountNumber to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1083 (Sensitive Data Leak: Sensitive Data is Leaked via accountNumber to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1084 (Sensitive Data Leak: Sensitive Data is Leaked via initialInterest to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1086 (Sensitive Data Leak: Sensitive Data is Leaked via routingNumber to Log in Account.<init>) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/controller/CustomerController.java for finding 1082 (Sensitive Data Leak: Sensitive Data is Leaked to Log in CustomerController.getCustomer) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/controller/CustomerController.java for finding 1082 (Sensitive Data Leak: Sensitive Data is Leaked to Log in CustomerController.getCustomer) of project shiftleft-java-demo

  • AutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1086 (Sensitive Data Leak: Sensitive Data is Leaked via routingNumber to Log in Account.<init>) of project shiftleft-java-demo

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 81.

Results per rule:

  • No critical or high SAST findings: FAIL
    (22 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 20 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     Deserialization            1 
     OWASP 2021 Category                        Count 
     A01-Broken-Access-Control                     14 
     A03-Injection                                  7 
     A08-Software-And-Data-Integrity-Failures       1 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 84.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 84.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 84.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 88.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

1 similar comment
@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 88.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 92.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

3 similar comments
@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 92.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 92.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 92.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 92.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

1 similar comment
@github-actions
Copy link

github-actions bot commented Aug 8, 2024

Qwiet LogoQwiet Logo

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.2675 (dce72c1185d6f527bdd2f3bcabb2b44de5db41e5).

Checking findings on scan 92.

Results per rule:

  • No critical or high SAST findings: FAIL
    (21 matched vulnerabilities; configured threshold is 0).

    First 5 findings:

         ID   CVSS    Rating    Title                                                                                                               
     1021    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie   
     1022    9.0   critical   Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings  
      922    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug 
      923    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug   
      924    8.0     high     Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug         
     Severity rating   Count 
     Critical              2 
     High                 19 
     Medium                0 
     Low                   0 
     Category               Count 
     Sensitive Data Leak       12 
     Cross-Site Scripting       7 
     Directory Traversal        2 
     OWASP 2021 Category         Count 
     A01-Broken-Access-Control      14 
     A03-Injection                   7 

1 rule failed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants