-
Notifications
You must be signed in to change notification settings - Fork 0
AutoFix PR #4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
AutoFix PR #4
Conversation
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 20 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| Deserialization | 1 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
| A08-Software-And-Data-Integrity-Failures | 1 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
1 similar comment
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
3 similar comments
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.
1 similar comment
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1021 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 1022 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 922 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via phoneNumber in CustomerController.debug |
| 923 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via firstName in CustomerController.debug |
| 924 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via tin in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 2 |
| High | 19 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Sensitive Data Leak | 12 |
| Cross-Site Scripting | 7 |
| Directory Traversal | 2 |
| OWASP 2021 Category | Count |
|---|---|
| A01-Broken-Access-Control | 14 |
| A03-Injection | 7 |
1 rule failed.


Qwiet.AI AutoFix
This PR was created automatically by the Qwiet.AI autofix tool.
As long as it is open, subsequent scans and generated fixes to this same branch
will be added to it as new commits.
Each commit fixes one vulnerability.
Some manual intervention might be required before merging this PR.
Fixes
AutoPatch applied to src/main/java/io/shiftleft/controller/SearchController.java for finding 1025 (Remote Code Execution: Code Injection Through Attacker-controlled Data via
fooinSearchController.doGetSearch) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/controller/AdminController.java for finding 1032 (Deserialization: Attacker-controlled Data Used in Unsafe Deserialization Function via
authinAdminController.doPostLogin) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1044 (Sensitive Data Leak: Sensitive Data is Leaked via
accountNumberto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1046 (Sensitive Data Leak: Sensitive Data is Leaked via
initialInterestto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1041 (Sensitive Data Leak: Sensitive Data is Leaked via
initialBalanceto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1043 (Sensitive Data Leak: Sensitive Data is Leaked to Log in
Account.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1085 (Sensitive Data Leak: Sensitive Data is Leaked via
initialBalanceto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1087 (Sensitive Data Leak: Sensitive Data is Leaked to Log in
Account.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1085 (Sensitive Data Leak: Sensitive Data is Leaked via
initialBalanceto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1087 (Sensitive Data Leak: Sensitive Data is Leaked to Log in
Account.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1083 (Sensitive Data Leak: Sensitive Data is Leaked via
accountNumberto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1083 (Sensitive Data Leak: Sensitive Data is Leaked via
accountNumberto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1084 (Sensitive Data Leak: Sensitive Data is Leaked via
initialInterestto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1086 (Sensitive Data Leak: Sensitive Data is Leaked via
routingNumberto Log inAccount.<init>) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/controller/CustomerController.java for finding 1082 (Sensitive Data Leak: Sensitive Data is Leaked to Log in
CustomerController.getCustomer) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/controller/CustomerController.java for finding 1082 (Sensitive Data Leak: Sensitive Data is Leaked to Log in
CustomerController.getCustomer) of project shiftleft-java-demoAutoPatch applied to src/main/java/io/shiftleft/model/Account.java for finding 1086 (Sensitive Data Leak: Sensitive Data is Leaked via
routingNumberto Log inAccount.<init>) of project shiftleft-java-demo