pinballmap/pbm · MalDet

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/operators_controller.rb line 7
Likely real: Yes, 100% confidence

Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking.

render json: operators.select { |o| o.name =~ /#{Regexp.escape params[:term] || ''}/i }.sort_by(&:name).map { |o| { label: o.name, value: o.name, id: o.id } }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/application_controller.rb line 1
Likely real: Yes, 99% confidence

Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.

class ApplicationController < ActionController::Base
  FILTERING_REQUIRED_MSG = "Filtering is required for this action. Please provide a filter when using this endpoint.".freeze
  AUTH_REQUIRED_MSG = "Authentication is required for this action. If you are using the app, you may need to confirm your account (see the email from us) or log out and back in.".freeze
  ACCOUNT_DISABLED_MSG = "account_disabled".freeze
  COUNTRIES_WITHOUT_STATE = %w[AT BE DE EE GB FI FR HK HR HU NL NO PL PT NZ RO SI SE].freeze
  rate_limit to: 60, within: 1.minute, if: lambda { |req| req.bot? }, name: "bot"

  include Pagy::Method

  def append_info_to_payload(payload)
    if Rails.env.production?
      super
      payload[:user_id] = current_user&.id || @api_token_user_id
      payload[:bot_or_not] = browser.bot? ? "IsBot" : "NotBot"
    end
  end

  def no_route
    render file: Rails.public_path.join("404.html"), status: :not_found, layout: false
  end

  def bot?
    browser.bot?
  end

  before_action :authenticate_from_token

  protect_from_forgery prepend: true
  before_action :configure_permitted_parameters, if: :devise_controller?
  before_action :detect_region
  before_action { @title_params = {} } # default to an un-set title
  after_action :flash_to_headers, :store_location

  rescue_from ActionView::MissingTemplate do
  end

  rescue_from CanCan::AccessDenied do |exception|
    redirect_to "/users/login", alert: exception.message
  end

  def normalize_array_params
    array_param_keys = %i[by_type_id by_location_id by_operator_id by_zone_id
                          by_machine_id by_machine_single_id by_machine_group_id
                          by_machine_id_ic by_machine_single_id_ic by_machine_year
                          by_ipdb_id by_opdb_id manufacturer by_machine_type by_machine_display
                          by_country by_state_name by_state_id by_all_ages]
    array_param_keys.each do |key|
      params[key] = [ params[key] ] if params[key].is_a?(String) && params[key].present?
    end
  end

  def flash_to_headers
    return unless request.xhr?

    response.headers["X-Message"] = flash_message
    response.headers["X-Message-Type"] = flash_type.to_s

    flash.discard
  end

  def add_host_info_to_subject(subject)
    server_name = request.host.match?(/pbmstaging/) ? "(STAGING) " : ""

    server_name + subject
  end

  def send_new_location_notification(params, region, user = nil)
    user_info = " by #{user.username} (#{user.email})"

    location_type = params["location_type"]&.is_a?(Integer) || params["location_type"]&.match?(/^[0-9]+$/) ? LocationType.find(params["location_type"]) : LocationType.find_by_name(params["location_type"])
    operator = params["location_operator"]&.is_a?(Integer) || params["location_operator"]&.match?(/^[0-9]+$/) ? Operator.find(params["location_operator"]) : Operator.find_by_name(params["location_operator"])
    zone = params["location_zone"]&.is_a?(Integer) || params["location_zone"]&.match?(/^[0-9]+$/) ? Zone.find(params["location_zone"]) : Zone.find_by_name(params["location_zone"])

    user_inputted_address = [ params["location_street"], params["location_city"], params["location_state"], params["location_zip"] ].join(", ")

    (geocoded_results, lat, lon, street, city, state, zip) = ""

    geocoded_results = Geocoder.search(user_inputted_address).first unless Rails.env.test?

    if geocoded_results.present?
      street_address = geocoded_results.formatted_address.split(",")[0] unless Rails.env.test?
      lat, lon = geocoded_results.coordinates
      street = street_address
      zip = geocoded_results.postal_code
      city = geocoded_results.city if params["place_id"].blank?
      state = geocoded_results.state_code
    end

    region = region unless params[:region_id].blank? || region.blank?

    if region.blank?
      if geocoded_results.present?
        region = Region.near([ lat, lon ], :effective_radius).first
      else
        region = Region.near([ params[:lat], params[:lon] ], :effective_radius).first
      end
    end

    machine_name_list = ""
    machine_id_list = ""
    if !params["location_machines_ids"].nil?
      params["location_machines_ids"]&.each do |machine_id|
        machine = Machine.find_by(id: machine_id)
        machine_name_list = machine_name_list + machine.name_and_year + ", "
      end
      machine_id_list = params["location_machines_ids"]
    else
      machine_name_list = params["location_machines"]
      machine_id_list = params["location_machines"]
    end

    body = "Location Name: #{params['location_name']} Street: #{params['location_street']} City: #{params['location_city']} State: #{params['location_state']} Zip: #{params['location_zip']} Country: #{params['location_country']} Phone: #{params['location_phone']} Website: #{params['location_website']} Type: #{location_type ? location_type.name : ''} Operator: #{operator ? operator.name : ''} Zone: #{zone ? zone.name : ''} All Ages? #{params['location_all_ages']} Free Play? #{params['location_payment_type']} Comments: #{params['location_comments']} Machines: #{machine_name_list} Google Places ID: #{params['place_id']} (entered from #{request.remote_ip} via #{request.headers['AppVersion']} #{request.user_agent}#{user_info})"

    submitted_state = COUNTRIES_WITHOUT_STATE.include?(params["location_country"]) ? nil : (state || params["location_state"])

    sl = SuggestedLocation.create(region_id: region&.id, name: params["location_name"], street: street || params["location_street"], city: city || params["location_city"], state: submitted_state, zip: zip || params["location_zip"], country: params["location_country"], phone: params["location_phone"], website: params["location_website"], location_type: location_type, operator: operator, zone: zone, comments: params["location_comments"], machines: machine_name_list, place_id: params["place_id"], lat: lat, lon: lon, user_inputted_address: user_inputted_address, user_id: user.id, all_ages: params["location_all_ages"], payment_type: params["location_payment_type"])

    AdminMailer.with(to_users: ENV.fetch("EMAIL_ADMIN", "admin@pinballmap.com"), cc_users: Array(User.all.select(&:is_super_admin).map(&:email)) + Array(region&.users&.map(&:email)), subject: add_host_info_to_subject("Pinball Map - New location#{region ? ' (' + region.full_name + ')' : ''} - #{params['location_name']}"), location_name: params["location_name"], location_street: params["location_street"], location_city: params["location_city"], location_state: params["location_state"], location_zip: params["location_zip"], location_country: params["location_country"], location_phone: params["location_phone"], location_website: params["location_website"], location_type: location_type ? location_type.name : "", operator: operator ? operator.name : "", zone: zone ? zone.name : "", location_comments: params["location_comments"], location_machines: machine_name_list, location_all_ages: params["location_all_ages"], location_payment_type: params["location_payment_type"], admin_notes: sl.admin_notes, place_id: params["place_id"], remote_ip: request.remote_ip, headers: request.headers["AppVersion"], user_agent: request.user_agent, user_info: user_info, user_email: user.email).send_new_location_notification.deliver_later

    UserSubmission.create(region_id: region&.id, submission_type: UserSubmission::SUGGEST_LOCATION_TYPE, submission: body, user_id: user.id)
    User.increment_counter(:num_locations_suggested, user.id)
  end

  def send_admin_notification(params, region, user = nil)
    sender_name = user&.username || params[:name]
    sender_string = user&.id ? "Username: #{user.username} User Email: #{user.email}" : "Their Name: #{params[:name]} Their Email: #{params[:email]}"
    body = "#{sender_string} Message: #{params[:message]} (entered from #{request.remote_ip} via #{request.headers['AppVersion']} #{request.user_agent})"

    AdminMailer.with(name: params[:name], email: params[:email], message: params[:message], user_name: user&.username, user_email: user&.email, to_users: ENV.fetch("EMAIL_ADMIN", "admin@pinballmap.com"), cc_users: Array(User.all.select(&:is_super_admin).map(&:email)) + Array(region&.users&.map(&:email)), subject: add_host_info_to_subject(region.nil? ? "Pinball Map - Message from #{sender_name}" : "Pinball Map - Message (#{region.full_name}) from #{sender_name}"), remote_ip: request.remote_ip, headers: request.headers["AppVersion"], user_agent: request.user_agent).send_admin_notification.deliver_later

    UserSubmission.create(region_id: region&.id, submission_type: UserSubmission::CONTACT_US_TYPE, submission: body, user_id: user&.id)
  end

  def notify_super_admins_of_api_token_request(api_token)
    history = ApiToken.disabled_history_summary(api_token.user, excluding: api_token)

    AdminMailer.with(
      to_users: ENV.fetch("EMAIL_ADMIN", "admin@pinballmap.com"),
      cc_users: Array(User.all.select(&:is_super_admin).map(&:email)),
      user_email: api_token.user.email,
      requested_use: api_token.requested_use,
      prior_revoked_count: history[:revoked],
      prior_denied_count: history[:denied],
      subject: add_host_info_to_subject("Pinball Map - New API token request - #{api_token.user.email}")
    ).send_api_token_request_notification.deliver_later
  end

  def notify_api_token_approved(api_token)
    AdminMailer.with(to_users: api_token.user.email, token: api_token.token).send_api_token_approved.deliver_later
  end

  def notify_api_token_denied(api_token)
    AdminMailer.with(to_users: api_token.user.email).send_api_token_denied.deliver_later
  end

  def return_response(data, root, includes = [], methods = [], http_status = 200, except = [], pagy = nil)
    json_data = data.as_json(include: includes, methods: methods, root: false, except: except)

    if pagy
      render json: { root => json_data, pagy: @pagy_hash }, status: http_status
    else
      render json: root.nil? ? json_data : { root => json_data }, status: http_status
    end
  end

  def allow_cors
    headers["Access-Control-Allow-Origin"] = "*"
    headers["Access-Control-Request-Method"] = "*"
    headers["Access-Control-Allow-Methods"] = %w[GET POST PUT DELETE OPTIONS].join(",")
    headers["Access-Control-Allow-Headers"] = %w[Origin Accept Content-Type X-Requested-With X-CSRF-Token].join(",")

    head(:ok) if request.request_method == "OPTIONS"
  end

  private

  def authenticate_from_token
    email = params[:user_email].presence || request.headers["X-User-Email"].presence
    token = params[:user_token].presence || request.headers["X-User-Token"].presence
    return unless email && token
    user = User.find_by(email: email)
    return unless user && token_matches?(user, token)
    sign_in(user, store: false)
  end

  def token_matches?(user, token)
    ActiveSupport::SecurityUtils.secure_compare(user.authentication_token.to_s, token.to_s)
  end

  def require_api_user
    if current_user.nil?
      email = params[:user_email].presence
      if email && User.exists?(email: email, is_disabled: true)
        render json: { error: ACCOUNT_DISABLED_MSG }, status: :forbidden
        return nil
      end
      return_response(AUTH_REQUIRED_MSG, "errors")
      return nil
    end

    current_user
  end

  def after_sign_out_path_for(*)
    request.referrer.match?(/admin/) ? root_path : request.referrer
  end

  def store_location
    return unless request.get?

    if request.path != "/users/login" &&
       request.path != "/users/join" &&
       request.path != "/users/password/new" &&
       request.path != "/users/password/edit" &&
       request.path != "/users/confirmation" &&
       request.path != "/users/logout" &&
       !request.xhr?
      session[:previous_url] = request.fullpath
    end
  end

  def after_sign_in_path_for(*)
    session[:previous_url] || root_path
  end

  def flash_message
    %i[error warning notice].each do |type|
      return flash[type] unless flash[type].blank?
    end
  end

  def flash_type
    %i[error warning notice].each do |type|
      return type unless flash[type].blank?
    end
  end

  def mobile_device?
    if session[:mobile_param]
      session[:mobile_param] == "1"
    else
      (request.user_agent =~ /Mobile|webOS/) && (request.user_agent !~ /iPad/)
    end
  end

  helper_method :mobile_device?

  def is_bot?
    browser.bot?
  end

  helper_method :is_bot?

  def user_life_list_machine_ids
    @user_life_list_machine_ids ||= current_user ? UserMachineXref.where(user_id: current_user.id).pluck(:machine_id).to_set : Set.new
  end

  helper_method :user_life_list_machine_ids

  protected

  def default_url_options
    if Rails.env.production?
      { host: "www.pinballmap.com", protocol: "https" }
    else
      { protocol: "http" }
    end
  end

  def configure_permitted_parameters
    devise_parameter_sanitizer.permit(:sign_up) { |u| u.permit(:username, :email, :password, :password_confirmation, :remember_me) }
    devise_parameter_sanitizer.permit(:sign_in) { |u| u.permit(:login, :username, :email, :password, :remember_me) }
    devise_parameter_sanitizer.permit(:account_update) { |u| u.permit(:username, :email, :password, :password_confirmation, :current_password) }
  end

  def detect_region
    @region = Region.find_by_name(params[:region].downcase) if params[:region]&.is_a? String

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/maps_controller.rb line 123
Likely real: Yes, 99% confidence

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.

@pagy, @locations = pagy(apply_scopes(Location).where([ "region_id = ?", @region_id ]).includes(:location_type, :machines))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 77
Likely real: Yes, 99% confidence

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.

lmx = LocationMachineXref.unscoped.where([ "location_id = ? and machine_id = ?", location_id, machine_id ]).where.not(deleted_at: nil).where(deleted_at: 7.days.ago..Time.current).order(updated_at: :desc).first

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/maps_controller.rb line 125
Likely real: Yes, 99% confidence

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.

@pagy, @locations = pagy(apply_scopes(Location).where([ "region_id = ?", @region_id ]).where(city_condition).where(zone_condition).select([ "id", "lat", "lon", "name", "location_type_id", "street", "city", "state", "zip", "machine_count", "all_ages", "payment_type" ]).order(sort_order).includes(:location_type, :machines), limit: 50, request_path: "/region_location_load")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 39
Likely real: Yes, 99% confidence

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.

existing = LocationMachineXref.where([ "location_id = ? and machine_id = ?", location.id, machine.id ]).where(deleted_at: nil).first

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/regions_controller.rb line 17
Likely real: Yes, 99% confidence

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.

region = Region.where([ "lower(name) = ?", params[:region_name].downcase ]).first

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 20
Likely real: Yes, 99% confidence

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.

lmx = LocationMachineXref.unscoped.where([ "location_id = ? and machine_id = ?", location.id, machine.id ]).where.not(deleted_at: nil).where(deleted_at: 7.days.ago..Time.current).order(updated_at: :desc).first

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 312
Likely real: Yes, 98% confidence

Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.

@pagy, locations_within = pagy(apply_scopes(Location).includes(:machines).within_bounding_box(bounds).order(order_by).distinct, **pagy_limit_override)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 297
Likely real: Yes, 98% confidence

Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.

@pagy, locations_within = pagy(apply_scopes(Location.where(id: fave_locations)).includes(:machines).within_bounding_box(bounds).order(order_by).distinct, **pagy_limit_override)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 299
Likely real: Yes, 98% confidence

Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.

locations_within = apply_scopes(Location.where(id: fave_locations)).includes(:machines).within_bounding_box(bounds).order(order_by).uniq

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 302
Likely real: Yes, 98% confidence

Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.

locations_within = apply_scopes(Location).within_bounding_box(bounds).order(order_by).uniq

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 305
Likely real: Yes, 98% confidence

Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.

locations_within = apply_scopes(Location).includes(:machines).within_bounding_box(bounds).order(order_by).uniq

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 308
Likely real: Yes, 98% confidence

Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.

.select("locations.*, #{Geocoder::Sql.full_distance(params[:user_lat], params[:user_lon], :lat, :lon)} AS distance")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Dockerfile line 12
Likely real: Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

CMD bundle exec rails s

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /docker-compose.postgres.yml line 5
Likely real: Yes, 100% confidence

Service 'db' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

db:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /docker-compose.yml line 5
Likely real: Yes, 100% confidence

Service 'db' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

db:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 191
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "locations/lmx_count_row", locals: { location: Location.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_picture_xrefs_controller.rb line 22
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lpx = LocationPictureXref.find_by_id(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 195
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "locations/render_update_metadata", locals: { l: Location.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_picture_xrefs_controller.rb line 7
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "location_picture_xrefs/form", locals: { l: Location.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 179
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 122
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find_by_id(params[:id]) or not_found

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 111
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find_by_id(params[:id]) or not_found

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 379
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 100
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find_by_id(params[:id]) or not_found

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 89
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find_by_id(params[:id]) or not_found

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 64
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(id)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 50
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find_by_id(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 16
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machine = Machine.find(params["add_machine_by_id_#{location.id}"])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/location_machine_xrefs_controller.rb line 8
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:location_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/application_controller.rb line 72
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

zone = params["location_zone"]&.is_a?(Integer) || params["location_zone"]&.match?(/^[0-9]+$/) ? Zone.find(params["location_zone"]) : Zone.find_by_name(params["location_zone"])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/application_controller.rb line 71
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

operator = params["location_operator"]&.is_a?(Integer) || params["location_operator"]&.match?(/^[0-9]+$/) ? Operator.find(params["location_operator"]) : Operator.find_by_name(params["location_operator"])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/application_controller.rb line 70
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location_type = params["location_type"]&.is_a?(Integer) || params["location_type"]&.match?(/^[0-9]+$/) ? LocationType.find(params["location_type"]) : LocationType.find_by_name(params["location_type"])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api_token_approvals_controller.rb line 40
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

@api_token = ApiToken.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 404
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/machine_conditions_controller.rb line 7
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

mcx = MachineCondition.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 343
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/machine_score_xrefs_controller.rb line 60
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

msx = MachineScoreXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/users_controller.rb line 40
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "users/render_user_flag", locals: { user: User.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/users_controller.rb line 10
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:location_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/users_controller.rb line 9
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/users_controller.rb line 5
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

@user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/user_machine_xrefs_controller.rb line 12
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

umx = UserMachineXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/suggested_locations_controller.rb line 5
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

sl = SuggestedLocation.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/maps_controller.rb line 118
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

@region = Region.find_by_id(params[:region_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/machines_controller.rb line 3
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machine = Machine.select(:opdb_img, :ic_eligible).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/machine_score_xrefs_controller.rb line 74
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

msx = MachineScoreXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 199
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "locations/metadata_edit_form", locals: { l: Location.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/machine_conditions_controller.rb line 21
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

mcx = MachineCondition.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 48
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 282
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

l = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 261
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

l = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 251
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

l = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 223
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

l = Location.find_by_id(params[:id]) or not_found

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 212
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

l = Location.find_by_id(params[:id]) or not_found

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 207
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "locations/render_add_machine", locals: { l: Location.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/locations_controller.rb line 203
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

render partial: "locations/render_last_updated", locals: { l: Location.find(params[:id]) }

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 158
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machine_conditions_controller.rb line 13
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machine_condition = MachineCondition.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 527
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 499
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 470
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 447
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.includes(location_machine_xrefs: [ :user, :machine, { machine_conditions: :user }, { machine_score_xrefs: :user } ]).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 442
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.includes(:machines).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 437
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.includes(:last_updated_by_user).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 425
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.includes(:location_machine_xrefs, :last_updated_by_user).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 293
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:user_faved])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 293
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/locations_controller.rb line 51
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

region = Region.find(params["region_id"]) unless params[:region_id].blank?

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_picture_xrefs_controller.rb line 59
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lpx = LocationPictureXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_picture_xrefs_controller.rb line 13
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lpx = LocationPictureXref.includes(photo_attachment: :blob).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 214
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(params[:location_machine_xref_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 131
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 114
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 46
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.includes({ machine_score_xrefs: :user }, :machine).order("machine_score_xrefs.score DESC").find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 41
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.includes({ machine_score_xrefs: :user }, :machine).order("machine_score_xrefs.score DESC").find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/location_machine_xrefs_controller.rb line 33
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.includes(:machine).find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machine_score_xrefs_controller.rb line 26
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 323
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 275
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machine = Machine.find(params[:machine_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 274
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 253
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machine = Machine.find(params[:by_machine_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 215
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 75
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:location_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 74
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 49
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:location_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/users_controller.rb line 22
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

user = User.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/user_submissions_controller.rb line 63
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

location = Location.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/regions_controller.rb line 95
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

region = Region.find(params["region_id"])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/regions_controller.rb line 73
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

region = Region.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/operators_controller.rb line 44
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

operator = Operator.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machines_controller.rb line 30
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machines = params[:region_id] ? Region.find(params[:region_id]).machines : Machine.all

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machine_score_xrefs_controller.rb line 136
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

high_score = MachineScoreXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machine_score_xrefs_controller.rb line 112
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

high_score = MachineScoreXref.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machine_score_xrefs_controller.rb line 82
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

lmx = LocationMachineXref.find(params[:location_machine_xref_id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/controllers/api/v1/machine_conditions_controller.rb line 37
Likely real: Yes, 100% confidence

Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.

machine_condition = MachineCondition.find(params[:id])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /app/helpers/locations_helper.rb line 17
Likely real: Yes, 100% confidence