modified: Dockerfile #6
Conversation
PavelLinearB
commented
May 21, 2023
PavelLinearB
commented
modified: README.md modified: introduction/apis.py modified: introduction/mitre.py modified: introduction/static/css/dark-theme.css modified: introduction/views.py
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![jit-ci[bot]](https://avatars.githubusercontent.com/in/142441?s=60&v=4){kind=small}
| @@ -156,7 +156,9 @@ | |||
| print(sql_query) | |||
| try: | |||
| print("\nin try\n") | |||
| val="" | |||
| val=login.objects.raw(sql_query) | |||
| val=login.objects.raw(sql_query) | |||
There was a problem hiding this comment.
Security control: Static Code Analysis Python Semgrep
Type: Gitlab.Bandit.B611
Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
| val="" | ||
| val=login.objects.raw(sql_query) | ||
| val=login.objects.raw(sql_query) | ||
| val=login.objects.raw(sql_query) |
There was a problem hiding this comment.
Security control: Static Code Analysis Python Semgrep
Type: Gitlab.Bandit.B611
Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
| @@ -156,7 +156,9 @@ | |||
| print(sql_query) | |||
| try: | |||
| print("\nin try\n") | |||
| val="" | |||
| val=login.objects.raw(sql_query) | |||
There was a problem hiding this comment.
Security control: Static Code Analysis Python Semgrep
Type: Gitlab.Bandit.B611
Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
|
SonarCloud Quality Gate failed.
|
gitstream-cm
bot
added
🌶️ x 1 Security hotspots
and removed
🌶️ x 1 Security hotspots
labels
![orca-security-us[bot]](https://avatars.githubusercontent.com/in/276250?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
|
| @@ -210,6 +210,11 @@ | |||
| # @authentication_decorator | |||
| @csrf_exempt | |||
| def mitre_lab_25_api(request): | |||
| if request.method == "POST": | |||
| expression = request.POST.get('expression') | |||
| result = eval(expression) | |||
Check failure
Code scanning / SonarCloud
Dynamic code execution should not be vulnerable to injection attacks High
