New vulns #9
New vulns #9
Conversation
![jit-ci[bot]](https://avatars.githubusercontent.com/in/142441?s=60&v=4){kind=small}
package.json
Outdated
| @@ -119,17 +119,20 @@ | |||
| "cookie-parser": "^1.4.5", | |||
| "cors": "^2.8.5", | |||
| "dottie": "^2.0.2", | |||
| "download": "^8.0.0", | |||
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Got Allows A Redirect To A Unix Socket
Description: download>got
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "express-rate-limit": "^5.3.0", | ||
| "express-robots-txt": "^0.4.1", | ||
| "express-security.txt": "^2.0.0", | ||
| "feature-policy": "^0.5.0", | ||
| "file-stream-rotator": "^0.5.7", | ||
| "file-type": "^16.1.0", | ||
| "filesniffer": "^1.0.3", | ||
| "finale-rest": "^1.1.1", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Regular Expression Denial Of Service In Moment
Description: finale-rest>moment
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "express-rate-limit": "^5.3.0", | ||
| "express-robots-txt": "^0.4.1", | ||
| "express-security.txt": "^2.0.0", | ||
| "feature-policy": "^0.5.0", | ||
| "file-stream-rotator": "^0.5.7", | ||
| "file-type": "^16.1.0", | ||
| "filesniffer": "^1.0.3", | ||
| "finale-rest": "^1.1.1", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Regular Expression Denial Of Service (Redos) In Lodash
Description: finale-rest>lodash
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "errorhandler": "^1.5.1", | ||
| "exif": "^0.6.0", | ||
| "express": "^4.17.1", | ||
| "express-ipfilter": "^1.2.0", | ||
| "express-jwt": "0.1.3", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Authorization Bypass In Express-Jwt
Description: express-jwt
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| "errorhandler": "^1.5.1", | ||
| "exif": "^0.6.0", | ||
| "express": "^4.17.1", | ||
| "express-ipfilter": "^1.2.0", | ||
| "express-jwt": "0.1.3", |
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage
Description: express-jwt>jsonwebtoken
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
package.json
Outdated
| @@ -119,17 +119,20 @@ | |||
| "cookie-parser": "^1.4.5", | |||
| "cors": "^2.8.5", | |||
| "dottie": "^2.0.2", | |||
| "download": "^8.0.0", | |||
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service
Description: download>got>cacheable-request>http-cache-semantics
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
routes/updateProductReviews.ts
Outdated
| { _id: req.body.id }, // vuln-code-snippet vuln-line noSqlReviewsChallenge forgedReviewChallenge | ||
| { $set: { message: req.body.message } }, | ||
| { multi: true } // vuln-code-snippet vuln-line noSqlReviewsChallenge | ||
| ).then( |
There was a problem hiding this comment.
Security control: Static Code Analysis Js
Type: Codsec.Javascriptnosql-Injection.Nosql-Injection
Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
lib/insecurity.ts
Outdated
| @@ -20,6 +20,7 @@ import * as utils from './utils' | |||
| import * as z85 from 'z85' | |||
|
|
|||
| export const publicKey = fs ? fs.readFileSync('encryptionkeys/jwt.pub', 'utf8') : 'placeholder-public-key' | |||
| const privateKey = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----' | |||
There was a problem hiding this comment.
Security control: Secret Detection
Type: Private-Key
Description: Private Key
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
data/static/users.yml
Outdated
| @@ -147,6 +147,8 @@ | |||
| email: wurstbrot | |||
| username: wurstbrot | |||
| password: 'EinBelegtesBrotMitSchinkenSCHINKEN!' | |||
| totpSecret: IFTXE3SPOEYVURT2MRYGI52TKJ4HC3KH | |||
| key: timo | |||
There was a problem hiding this comment.
Security control: Secret Detection
Type: Generic-Api-Key
Description: Generic API Key
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
test/smoke/Dockerfile
Outdated
| @@ -1,3 +1,4 @@ | |||
| FROM alpine | |||
There was a problem hiding this comment.
Security control: Docker Scan
Type: Image User Should Not Be 'Root'
Description: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
Severity: HIGH
Fix suggestion:
This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.
Suggestion guidelines
- First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this:
docker run <image> whoami. If it returnsroot, then you should consider using a non-root user, by following one of the next steps:- If a non-root user already exists in your container, consider using it.
- If not, you can create a new user by adding a
USERcommand to the Dockerfile, with a non-root user as argument, for example:USER <non-root-user-name>.
| FROM alpine | |
| FROM alpine | |
| RUN addgroup --system <group> | |
| RUN adduser --system <user> --ingroup <group> | |
| USER <user>:<group> | |
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
|
PR: {"isFullyInstalled":false,"title":"New vulns","approvals":[],"requested_changes":[],"author":"PavelLinearB","description":" \n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345353},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345361},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345367},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345376},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n
Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on","created_at":"2023-06-06T10:26:08Z","id":1578380078},{"commenter":"gitstream-cm","content":"This PR failed due to High severity vulnerability finding, if you don't fix it please select:\n- [ ] I need help with that fix.\n- [ ] I want to accept the risk, please approve. \n- [ ] This is false positive, please approve.\n- [ ] This is a test / simulator environment, please exclude.\n","created_at":"2023-06-06T10:26:21Z","id":1578380638},{"commenter":"sonarcloud","content":"SonarCloud Quality Gate failed.  \n\n  0 Bugs \n 0 Vulnerabilities \n  2 Security Hotspots \n 0 Code Smells\n\n No Coverage information \n 0.0% Duplication\n\n","created_at":"2023-06-06T10:28:10Z","id":1578384996}],"reviews":[{"commenter":"jit-ci","content":"❌ Jit has detected 11 important findings in this PR that you should review.\n_The findings are detailed below as separate comments.\n_It’s highly recommended that you fix these security issues before merge.","state":"commented","conversations":[{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345353},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345361},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345367},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345376},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345381},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345387},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345394},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345402},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345410},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345416},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345423}]}],"conversations":[{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":21,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":23,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":151,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","start_line":null,"end_line":1,"is_resolved":false}],"isPrivate":false,"target":"master"}Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n |
|
This PR failed due to High severity vulnerability finding, if you don't fix it please select:
|
|
PR: {"isFullyInstalled":false,"title":"New vulns","approvals":[],"requested_changes":[],"author":"PavelLinearB","description":" \n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345353},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345361},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345367},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345376},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n
Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on","created_at":"2023-06-06T10:26:08Z","id":1578380078},{"commenter":"gitstream-cm","content":"This PR failed due to High severity vulnerability finding, if you don't fix it please select:\n- [ ] I need help with that fix.\n- [ ] I want to accept the risk, please approve. \n- [ ] This is false positive, please approve.\n- [ ] This is a test / simulator environment, please exclude.\n","created_at":"2023-06-06T10:26:21Z","id":1578380638},{"commenter":"sonarcloud","content":"SonarCloud Quality Gate failed. \n\n 0 Bugs \n 0 Vulnerabilities \n 2 Security Hotspots \n 0 Code Smells\n\n No Coverage information \n 0.0% Duplication\n\n","created_at":"2023-06-06T10:28:10Z","id":1578384996}],"reviews":[{"commenter":"jit-ci","content":"❌ Jit has detected 11 important findings in this PR that you should review.\n_The findings are detailed below as separate comments.\n_It’s highly recommended that you fix these security issues before merge.","state":"commented","conversations":[{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345353},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345361},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345367},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345376},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345381},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345387},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345394},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345402},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345410},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345416},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345423}]},{"commenter":"PavelLinearB","content":"","state":"commented","conversations":[{"commenter":"PavelLinearB","content":"#jit_ignore_fp","created_at":"2023-06-06T10:28:41Z","state":"submitted","id":1219378096}]}],"conversations":[{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"PavelLinearB","content":"#jit_ignore_fp","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":21,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":23,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":151,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","start_line":null,"end_line":1,"is_resolved":false}],"isPrivate":false,"target":"master"}Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n |
|
PR: {"isFullyInstalled":false,"title":"New vulns","approvals":[],"requested_changes":[],"author":"PavelLinearB","description":" \n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345353},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345361},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345367},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345376},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n
Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on","created_at":"2023-06-06T10:26:08Z","id":1578380078},{"commenter":"gitstream-cm","content":"This PR failed due to High severity vulnerability finding, if you don't fix it please select:\n- [x] I need help with that fix.\n- [ ] I want to accept the risk, please approve. \n- [ ] This is false positive, please approve.\n- [ ] This is a test / simulator environment, please exclude.\n","created_at":"2023-06-06T10:26:21Z","id":1578380638},{"commenter":"sonarcloud","content":"SonarCloud Quality Gate failed. \n\n 0 Bugs \n 0 Vulnerabilities \n 2 Security Hotspots \n 0 Code Smells\n\n No Coverage information \n 0.0% Duplication\n\n","created_at":"2023-06-06T10:28:10Z","id":1578384996}],"reviews":[{"commenter":"jit-ci","content":"❌ Jit has detected 11 important findings in this PR that you should review.\n_The findings are detailed below as separate comments.\n_It’s highly recommended that you fix these security issues before merge.","state":"commented","conversations":[{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345353},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345361},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345367},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345376},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345381},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345387},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:56Z","state":"submitted","id":1219345394},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345402},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345410},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345416},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","created_at":"2023-06-06T10:08:57Z","state":"submitted","id":1219345423}]},{"commenter":"PavelLinearB","content":"","state":"commented","conversations":[{"commenter":"PavelLinearB","content":"#jit_ignore_fp","created_at":"2023-06-06T10:28:41Z","state":"submitted","id":1219378096}]},{"commenter":"jit-ci","content":"❌ Jit has detected 10 important findings in this PR that you should review.\n_The findings are detailed as separate comments.\n_It’s highly recommended that you fix these security issues before merge.\n\nUntil now, you ignored/fixed 1 finding.","state":"commented","conversations":[]}],"conversations":[{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Got Allows A Redirect To A Unix Socket\n\nDescription: download>got \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"PavelLinearB","content":"#jit_ignore_fp","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service In Moment\n\nDescription: finale-rest>moment \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Regular Expression Denial Of Service (Redos) In Lodash\n\nDescription: finale-rest>lodash \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":135,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Authorization Bypass In Express-Jwt\n\nDescription: express-jwt \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Jsonwebtoken Unrestricted Key Type Could Lead To Legacy Keys Usage \n\nDescription: express-jwt>jsonwebtoken \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Forgeable Public/Private Tokens In Jws\n\nDescription: express-jwt>jsonwebtoken>jws \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":127,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Software Component Analysis Js\n\nType: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service\n\nDescription: download>got>cacheable-request>http-cache-semantics \n\nSeverity: HIGH\n\nLearn more about this issue\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":122,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Static Code Analysis Js\n\nType: Codsec.Javascriptnosql-Injection.Nosql-Injection\n\nDescription: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query. \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":21,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Private-Key\n\nDescription: Private Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":23,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Secret Detection\n\nType: Generic-Api-Key\n\nDescription: Generic API Key \n\nSeverity: HIGH\n\n---\nJit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n\n \n\n","start_line":null,"end_line":151,"is_resolved":false},{"commenter":"jit-ci","content":"Security control: Docker Scan\n\nType: Image User Should Not Be 'Root'\n\nDescription: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. \n\nSeverity: HIGH\n\nLearn more about this issue\n\n\nFix suggestion: \n\nThis fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.\n\nSuggestion guidelines\n\n* First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\ndocker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:\n * If a non-root user already exists in your container, consider using it.\n * If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.\n\n\nsuggestion\nFROM alpine\n\nRUN addgroup --system <group>\nRUN adduser --system <user> --ingroup <group>\nUSER <user>:<group>\n\n\n\n---\n\n \n\n","start_line":null,"end_line":1,"is_resolved":false}],"isPrivate":false,"target":"master"}Jit Bot commands and options (e.g., ignore issue)\n\n\nYou can trigger Jit actions by commenting on this PR review:\n- #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”\n- #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”\n- #jit_undo_ignore Undo ignore command\n |
|
SonarCloud Quality Gate failed.
|
PavelLinearB
force-pushed
the
master
branch
from
95de275
to
39b4686
Compare
Description
A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.
Resolved or fixed issue:
Affirmation