TEST: Aikido integration#6281
Open
robdiciuccio wants to merge 7 commits intomainfrom
Open
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| mentioned_column = ALLOWED_SORT_COLUMNS.find { |c| cleaned.include?(c) } | ||
| return scope unless mentioned_column | ||
|
|
||
| scope.reorder(Arel.sql(cleaned)) |
There was a problem hiding this comment.
Potential SQL injection via string-based query concatenation - critical severity
SQL injection might be possible in these locations, especially if the strings being concatenated are controlled via user input.
Show fix
Remediation: If possible, rebuild the query to use prepared statements or an ORM. If that is not possible, make sure the user input is allowlisted or sanitized. As an added layer of protection, we also recommend installing a WAF that blocks SQL injection attacks.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| # (`//evil.com`) URL that could spoof our host. | ||
| destination = "https://#{destination}" if destination.start_with?("//") | ||
|
|
||
| redirect_to(destination, allow_other_host: true) |
There was a problem hiding this comment.
Open redirect can be used in social engineering attacks - critical severity
An open redirect allows an attacker to use your app to perform social engineering attacks by redirecting users to other top-level domains (e.g. evilsite.com). It can usually also be used to combine with other exploits that could result in stolen credentials and user account takeover.
Show fix
Remediation: Never set the allow_other_host parameter from the redirect function to true.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
There was a problem hiding this comment.
10 Open source vulnerabilities detected - critical severity
Aikido detected 10 vulnerabilities across 2 packages, it includes 1 critical, 5 high, 3 medium and 1 low vulnerabilities.
Details
Remediation Aikido suggests bumping the vulnerable packages to a safe version.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
❌ SAST Scan (Semgrep) FailedResolve all findings before proceeding. 🛡️ SARIF Security ReportSemgrep OSS 📊 Summary
🐛 Detailed Results🟠 - Warning [yaml.github-actions.security.run-shell-injection.run-shell-injection] - yaml.github-actions.security.run-shell-injection.run-shell-injectionDetailsMessage:
Description:
Tags:
Locations:
|
❌ Security Scan (Trivy) FailedResolve all CRITICAL and HIGH severity findings before proceeding. 🛡️ SARIF Security ReportTrivy v0.69.3 📊 Summary
🐛 Detailed Results🔴 - Error [DS-0002] - MisconfigurationDetailsMessage:
Description:
Tags:
Locations:
|
❌ Security Scan (Trivy) FailedResolve all CRITICAL and HIGH severity findings before proceeding. 🛡️ SARIF Security ReportTrivy v0.69.3 📊 Summary
🐛 Detailed Results🔴 - Error [DS-0002] - MisconfigurationDetailsMessage:
Description:
Tags:
Locations:
|
❌ SAST Scan (Semgrep) FailedResolve all findings before proceeding. 🛡️ SARIF Security ReportSemgrep OSS 📊 Summary
🐛 Detailed Results🟠 - Warning [yaml.github-actions.security.run-shell-injection.run-shell-injection] - yaml.github-actions.security.run-shell-injection.run-shell-injectionDetailsMessage:
Description:
Tags:
Locations:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| mentioned_column = ALLOWED_SORT_COLUMNS.find { |c| cleaned.include?(c) } | ||
| return scope unless mentioned_column | ||
|
|
||
| scope.reorder(Arel.sql(cleaned)) |
| mentioned_column = ALLOWED_SORT_COLUMNS.find { |c| cleaned.include?(c) } | ||
| return scope unless mentioned_column | ||
|
|
||
| scope.reorder(Arel.sql(cleaned)) |
| # (`//evil.com`) URL that could spoof our host. | ||
| destination = "https://#{destination}" if destination.start_with?("//") | ||
|
|
||
| redirect_to(destination, allow_other_host: true) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE
Link to pivotal/JIRA issue
Is PM acceptance required? (delete one)
Reminder: merge main into this branch and get green tests before merging to main
What was done?
How to test?
Screenshots (for visual changes)