amunchet / labyrinth Goto Github PK

Missing close for concurrent.futures.ThreadPoolExecutor [:34] , add close or use a with block.

serve.py
Line 34
Line 525
Line 533
Line 558
Line 576
Line 593

watcher.py
Line 38

Unsanitized input from the HTTP request body [:117] flows [:117, :120, ... :139] into the return value of upload [:139] , where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

https://owasp.org/www-community/attacks/xss/

serve.py

• Line 139
• Line 149
• Line 193
• Line 256
• Line 326
• Line 447
• Line 506
• Line 516
• Line 584
• Line 596
• Line 610
• Line 626
• Line 637
• Line 853

No catch method for promise [:125] . This may result in an unhandled promise rejection.

CreateEditSubnet.vue - Line 125
authService.js - Line 161

Use the is operator instead of == [:20] to compare to None [:20] , because == [:20] calls eq which is slower and error-prone.

common_auth.py

• Line 20
• Line 25

map [:97] does not modify this array [:97] , it returns a new object. Ignoring the return value of map [:97] is not the intended use of this api. Did you mean to modify this array [:97] ?

CreateEditHost.vue

Line 97

test_03_ansible.py

Line 70

Use os.makedirs instead of os.mkdir [:70] because the given path may require creating the parent directories.

The function defined here [:309] takes 0 parameter(s), but is called here [:274] with 1 argument(s). The extra arguments will be ignored.
Line 274

Deploy.vue

The global event listener for event resize [:213] on window [:213] , added in addEventListener [:213] in lifecycle method created [:212] is never removed. Remove it in the vue lifecycle method beforeDestroy.

Line 213

Dashboard.vue

Use os.makedirs instead of os.mkdir [:128] because the given path may require creating the parent directories.

serve.py

• Line 128

ansible_helper.py

• Line 125
• Line 129

Unsanitized input from an HTTP parameter [:110] flows [:110, :114, :133] into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

https://owasp.org/www-community/attacks/Path_Traversal

serve.py

• Line 133
• Line 134
• Line 376
• Line 496
• Line 516
• Line 636
• Line 655
• Line 685

requests.get [:560] performs an authentication WITH http://alertmanager:9093/api/v2/alerts [:557] over the HTTP. Use https instead

serve.py
Line 560
Line 582
Line 595

watcher.py
Line 40