Scan report
terraform-lxd / terraform-provider-lxd
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 0
- Medium
- 5
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 4
- Uncertain
- 1
- Likely noise
- 0
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
4 findings likely need attention. Most notable: Variable `instance` is likely modified and later used on error. In some cases this coul... in /internal/instance/resource_instance_file.go (100% confidence).
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /internal/instance/resource_instance_file.go line 255
- Likely real
- Yes, 100% confidence
Variable `instance` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference
instance, _, err := server.GetInstance(instanceName) if err != nil { if errors.IsNotFoundError(err) { // If instance is not found, file cannot exist. Remove it // from the state to ensure it is created on next apply. resp.State.RemoveResource(ctx) return } resp.Diagnostics.AddError(fmt.Sprintf("Failed retrieve instance %q", instance.Name), err.Error()) return } -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/actions/cluster/action.yml line 36
- Likely real
- Yes, 53% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: canonical/lxd/.github/actions/reclaim-disk-space@main # zizmor: ignore[unpinned-uses] -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/actions/cluster/action.yml line 40
- Likely real
- Yes, 53% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: canonical/lxd/.github/actions/disable-docker@main # zizmor: ignore[unpinned-uses] -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/test.yml line 163
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: $/.github/actions/cluster -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /internal/acctest/testutils.go line 5
- Likely real
- Uncertain, 38% confidence
Do not use `math/rand`. Use `crypto/rand` instead.
"math/rand/v2"
No findings match these filters.