« Volver al Resumen Volver al Dashboard Principal
| Check ID | Path | Start Line | End Line | Message | Severity | |
|---|---|---|---|---|---|---|
| 0 | yaml.github-actions.security.run-shell-injection.run-shell-injection | .github/workflows/base-setup.yml | 34 | 37 | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | ERROR |
| 1 | html.security.audit.missing-integrity.missing-integrity | docs/index.html | 7 | 10 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 2 | java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled | docs/reports/bdd/index.html | 47 | 47 | Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element. | WARNING |
| 3 | html.security.audit.missing-integrity.missing-integrity | public/index.html | 7 | 7 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 4 | html.security.audit.missing-integrity.missing-integrity | public/index.html | 8 | 8 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 5 | html.security.audit.missing-integrity.missing-integrity | public/index.html | 125 | 125 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 6 | javascript.browser.security.insecure-document-method.insecure-document-method | public/js/auth.js | 112 | 112 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities | ERROR |
| 7 | javascript.browser.security.insecure-document-method.insecure-document-method | public/js/main.js | 49 | 54 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities | ERROR |
| 8 | javascript.browser.security.insecure-document-method.insecure-document-method | public/js/main.js | 112 | 153 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities | ERROR |
| 9 | html.security.audit.missing-integrity.missing-integrity | public/login.html | 7 | 7 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 10 | html.security.audit.missing-integrity.missing-integrity | public/login.html | 8 | 8 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 11 | html.security.audit.missing-integrity.missing-integrity | public/login.html | 124 | 124 | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. | WARNING |
| 12 | javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage | server.cjs | 13 | 13 | A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies. | INFO |
| 13 | javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name | server.cjs | 34 | 43 | Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly. | WARNING |
| 14 | javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain | server.cjs | 34 | 43 | Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next. | WARNING |
| 15 | javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires | server.cjs | 34 | 43 | Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies. | WARNING |
| 16 | javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path | server.cjs | 34 | 43 | Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request. | WARNING |
| 17 | javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure | server.cjs | 34 | 43 | Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS. | WARNING |
| 18 | javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring | services/gemini.js | 78 | 78 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. | INFO |