tikv/pd · MalDet

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-simulator/simulator/client.go line 112
Likely real: Yes, 99% confidence

Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.

cc, err := grpc.Dial(strings.TrimPrefix(url, "http://"), grpc.WithTransportCredentials(insecure.NewCredentials()))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/utils/testutil/testutil.go line 104
Likely real: Yes, 99% confidence

Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.

conn, err := grpc.Dial(strings.TrimPrefix(addr, "http://"), grpc.WithTransportCredentials(insecure.NewCredentials()))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/utils/grpcutil/grpcutil.go line 152
Likely real: Yes, 99% confidence

Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.

opt := grpc.WithTransportCredentials(insecure.NewCredentials())

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /client/pkg/utils/grpcutil/grpcutil.go line 122
Likely real: Yes, 99% confidence

Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.

opt := grpc.WithTransportCredentials(insecure.NewCredentials())

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/mcs/tso/server/testutil.go line 32
Likely real: Yes, 99% confidence

Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.

conn, err := grpc.Dial(strings.TrimPrefix(addr, "http://"), grpc.WithTransportCredentials(insecure.NewCredentials()))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-ut/ut.go line 889
Likely real: Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

cmd := exec.Command(exe, "-test.list", "Test")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-ut/ut.go line 748
Likely real: Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

return exec.Command(exe, args...)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Dockerfile line 44
Likely real: Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

ENTRYPOINT ["/pd-server"]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/syncer/client.go line 150
Likely real: Yes, 100% confidence

Variable `origin` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference

origin, _, err := bc.PreCheckPutRegion(region)
		if err != nil {
			log.Debug("region is stale", zap.Stringer("origin", origin.GetMeta()), errs.ZapError(err))
			continue
		}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-ctl/helper/tidb/types/core_time.go line 103
Likely real: Yes, 100% confidence

Variable `t1` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference

t1, err := t.GoTime(gotime.UTC)
	// allow invalid dates
	if err != nil {
		return t1.Weekday()
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /client/resource_group/controller/group_controller.go line 859
Likely real: Yes, 100% confidence

Variable `d` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference

d, err := gc.acquireTokens(ctx, delta, &waitDuration, allowDebt)
			if err != nil {
				if errs.ErrClientResourceGroupThrottled.Equal(err) {
					gc.metrics.failedRequestCounterWithThrottled.Inc()
					gc.metrics.failedLimitReserveDuration.Observe(d.Seconds())
				} else {
					gc.metrics.failedRequestCounterWithOthers.Inc()
				}
				return nil, waitDuration, err
			}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/memory/meminfo.go line 75
Likely real: Yes, 100% confidence

Variable `v` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference

v, err := mem.VirtualMemory()
	if err != nil {
		return v.Used, err
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /server/api/region.go line 257
Likely real: Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method

id, err := strconv.Atoi(vars["id"])
	if err != nil {
		h.rd.JSON(w, http.StatusBadRequest, err.Error())
		return
	}
	// get type from query
	typ := r.URL.Query().Get("type")
	if len(typ) == 0 {
		typ = string(core.AllInSubTree)
	}

	regions, err := rc.GetStoreRegionsByTypeInSubTree(uint64(id), core.SubTreeRegionType(typ))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /server/api/region.go line 592
Likely real: Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method

id, err := strconv.Atoi(vars["id"])
	if err != nil {
		h.rd.JSON(w, http.StatusBadRequest, err.Error())
		return
	}
	region := rc.GetRegion(uint64(id))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-analysis/analysis/parse_log.go line 74
Likely real: Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method

num, err := strconv.ParseInt(subStrings[i], 10, 64)
			if err != nil {
				return results, err
			}
			results = append(results, uint64(num))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /server/api/region.go line 592
Likely real: Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method

id, err := strconv.Atoi(vars["id"])
	if err != nil {
		h.rd.JSON(w, http.StatusBadRequest, err.Error())
		return
	}
	region := rc.GetRegion(uint64(id))
	if region == nil {
		h.rd.JSON(w, http.StatusNotFound, errs.ErrRegionNotFound.FastGenByArgs(uint64(id)).Error())
		return
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /client/resource_group/controller/group_controller.go line 756
Likely real: Yes, 99% confidence

Variable `d` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference

d, err := gc.acquireTokens(ctx, delta, &waitDuration, false)
		if err != nil {
			if errs.ErrClientResourceGroupThrottled.Equal(err) {
				gc.metrics.failedRequestCounterWithThrottled.Inc()
				gc.metrics.failedLimitReserveDuration.Observe(d.Seconds())
			} else {
				gc.metrics.failedRequestCounterWithOthers.Inc()
			}
			gc.mu.Lock()
			sub(gc.mu.consumption, reportedDelta)
			gc.mu.Unlock()
			failpoint.Inject("triggerUpdate", func() {
				gc.lowRUNotifyChan <- notifyMsg{}
			})
			return nil, nil, waitDuration, 0, err
		}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/schedule/scatter/region_scatterer.go line 1309
Likely real: Yes, 99% confidence

Iteration over a possibly empty map `specialOldStores`. This is likely a bug or redundant code

specialOldStores := make(map[string][]uint64)
	specialNewStores := make(map[string][]uint64)

	classifyStore := func(storeID uint64, ordinary *[]uint64, special map[string][]uint64) string {
		store := r.cluster.GetStore(storeID)
		if store == nil {
			return ""
		}
		if engineFilter.Target(r.cluster.GetSharedConfig(), store).IsOK() {
			*ordinary = append(*ordinary, storeID)
			return core.EngineTiKV
		}
		engine := store.GetLabelValue(core.EngineKey)
		special[engine] = append(special[engine], storeID)
		return engine
	}

	for _, peer := range region.GetPeers() {
		classifyStore(peer.GetStoreId(), &ordinaryOldStores, specialOldStores)
	}
	for _, peer := range targetPeers {
		storeID := peer.GetStoreId()
		engine := classifyStore(storeID, &ordinaryNewStores, specialNewStores)
		// Same as Put: don't let a force-buried store still present in the
		// target placement recreate a series DeleteStoreMetrics already
		// deleted at bury time.
		if recordMetrics && engine != "" {
			if store := r.cluster.GetStore(storeID); store != nil && !store.IsRemoved() {
				scatterDistributionCounter.WithLabelValues(
					strconv.FormatUint(storeID, 10),
					strconv.FormatBool(false),
					engine).Inc()
			}
		}
	}

	state.ordinaryEngine.selectedPeer.Update(group, ordinaryOldStores, ordinaryNewStores)
	specialEngines := make(map[string]struct{}, len(specialOldStores)+len(specialNewStores))
	for engine := range specialOldStores {
		specialEngines[engine] = struct{}{}
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/schedule/scatter/region_scatterer.go line 1310
Likely real: Yes, 99% confidence

Iteration over a possibly empty map `specialNewStores`. This is likely a bug or redundant code

specialNewStores := make(map[string][]uint64)

	classifyStore := func(storeID uint64, ordinary *[]uint64, special map[string][]uint64) string {
		store := r.cluster.GetStore(storeID)
		if store == nil {
			return ""
		}
		if engineFilter.Target(r.cluster.GetSharedConfig(), store).IsOK() {
			*ordinary = append(*ordinary, storeID)
			return core.EngineTiKV
		}
		engine := store.GetLabelValue(core.EngineKey)
		special[engine] = append(special[engine], storeID)
		return engine
	}

	for _, peer := range region.GetPeers() {
		classifyStore(peer.GetStoreId(), &ordinaryOldStores, specialOldStores)
	}
	for _, peer := range targetPeers {
		storeID := peer.GetStoreId()
		engine := classifyStore(storeID, &ordinaryNewStores, specialNewStores)
		// Same as Put: don't let a force-buried store still present in the
		// target placement recreate a series DeleteStoreMetrics already
		// deleted at bury time.
		if recordMetrics && engine != "" {
			if store := r.cluster.GetStore(storeID); store != nil && !store.IsRemoved() {
				scatterDistributionCounter.WithLabelValues(
					strconv.FormatUint(storeID, 10),
					strconv.FormatBool(false),
					engine).Inc()
			}
		}
	}

	state.ordinaryEngine.selectedPeer.Update(group, ordinaryOldStores, ordinaryNewStores)
	specialEngines := make(map[string]struct{}, len(specialOldStores)+len(specialNewStores))
	for engine := range specialOldStores {
		specialEngines[engine] = struct{}{}
	}
	for engine := range specialNewStores {
		specialEngines[engine] = struct{}{}
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /server/apiv2/handlers/affinity.go line 309
Likely real: Yes, 99% confidence

Iteration over a possibly empty map `affectedGroups`. This is likely a bug or redundant code

affectedGroups := make(map[string]bool)
	addOps, err := convertAndValidateRangeOps(req.Add, manager, affectedGroups)
	if handleAffinityError(c, err) {
		return
	}
	removeOps, err := convertAndValidateRangeOps(req.Remove, manager, affectedGroups)
	if handleAffinityError(c, err) {
		return
	}

	// Call manager to perform batch modify
	err = manager.UpdateAffinityGroupKeyRanges(addOps, removeOps)
	if handleAffinityError(c, err) {
		return
	}

	// Build response with all affected groups
	resp := AffinityGroupsResponse{
		AffinityGroups: make(map[string]*affinity.GroupState, len(affectedGroups)),
	}

	for groupID := range affectedGroups {
		state := manager.GetAffinityGroupState(groupID)
		if state != nil {
			resp.AffinityGroups[groupID] = state
		}
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/assign-to-one-project.yaml line 7
Likely real: Yes, 98% confidence

A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed.

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/dashboard/adapter/redirector.go line 112
Likely real: Yes, 57% confidence

An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.

http.Redirect(w, r, addr+r.RequestURI, http.StatusTemporaryRedirect)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/dashboard/adapter/redirector.go line 78
Likely real: Yes, 54% confidence

ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.

h.proxy.Director = func(r *http.Request) { //nolint:staticcheck // SA1019: preserve existing proxy header semantics.
		defaultDirector(r)
		r.Header.Add(proxyHeader, h.name)
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /server/apiv2/handlers/tso_keyspace_group.go line 604
Likely real: Yes, 54% confidence

Downcasting or changing sign of an integer with `uint32` method

id, err := strconv.ParseUint(c.Param("id"), 10, 64)
	if err != nil {
		return 0, err
	}
	if !isValid(uint32(id)) {
		return 0, errors.Errorf("invalid keyspace group id: %d", id)
	}
	return uint32(id), nil

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /server/apiv2/handlers/keyspace.go line 187
Likely real: Yes, 54% confidence

Downcasting or changing sign of an integer with `uint32` method

id, err := strconv.ParseUint(c.Param("id"), 10, 64)
	if err != nil {
		c.AbortWithStatusJSON(http.StatusInternalServerError, "invalid keyspace id")
		return
	}
	svr := c.MustGet(middlewares.ServerContextKey).(*server.Server)
	manager := svr.GetKeyspaceManager()
	if manager == nil {
		c.AbortWithStatusJSON(http.StatusInternalServerError, managerUninitializedErr)
		return
	}
	meta, err := manager.LoadKeyspaceByID(uint32(id))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/gctuner/tuner.go line 56
Likely real: Yes, 54% confidence

Downcasting or changing sign of an integer with `uint32` method

if val, err := strconv.Atoi(os.Getenv("GOGC")); err == nil {
		defaultGCPercent = uint32(val)
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/keyspace/tso_keyspace_group.go line 1507
Likely real: Yes, 53% confidence

Downcasting or changing sign of an integer with `uint32` method

newID, err := strconv.ParseUint(newGroupID, 10, 64)
	if err != nil {
		return err
	}

	m.Lock()
	defer m.Unlock()
	var (
		oldKG *endpoint.KeyspaceGroup
		newKG *endpoint.KeyspaceGroup
	)
	if err := m.store.RunInTxn(m.ctx, func(txn kv.Txn) error {
		var err error
		oldKG, err = m.store.LoadKeyspaceGroup(txn, uint32(oldID))
		if err != nil {
			return err
		}
		if oldKG == nil || endpoint.StringUserKind(oldKG.UserKind) != oldUserKind {
			return errors.Errorf("keyspace group %s not found in %s group", oldGroupID, oldUserKind)
		}
		if oldID == newID {
			newKG = oldKG
		} else {
			newKG, err = m.store.LoadKeyspaceGroup(txn, uint32(newID))
			if err != nil {
				return err
			}
		}
		if newKG == nil || endpoint.StringUserKind(newKG.UserKind) != newUserKind {
			return errors.Errorf("keyspace group %s not found in %s group", newGroupID, newUserKind)
		}
		if oldKG.IsSplitting() {
			return errs.ErrKeyspaceGroupInSplit.FastGenByArgs(uint32(oldID))
		} else if newKG.IsSplitting() {
			return errs.ErrKeyspaceGroupInSplit.FastGenByArgs(uint32(newID))
		} else if oldKG.IsMerging() {
			return errs.ErrKeyspaceGroupInMerging.FastGenByArgs(uint32(oldID))
		} else if newKG.IsMerging() {
			return errs.ErrKeyspaceGroupInMerging.FastGenByArgs(uint32(newID))
		}

		if !slice.Contains(newKG.Keyspaces, keyspaceID) {
			newKG.Keyspaces = append(newKG.Keyspaces, keyspaceID)
			slices.Sort(newKG.Keyspaces)
		}
		oldKG.Keyspaces = slice.Remove(oldKG.Keyspaces, keyspaceID)
		if oldID == newID {
			return m.store.SaveKeyspaceGroup(txn, oldKG)
		}
		if err = m.store.SaveKeyspaceGroup(txn, oldKG); err != nil {
			return err
		}
		return m.store.SaveKeyspaceGroup(txn, newKG)
	}); err != nil {
		return err
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/keyspace/tso_keyspace_group.go line 1503
Likely real: Yes, 53% confidence

Downcasting or changing sign of an integer with `uint32` method

oldID, err := strconv.ParseUint(oldGroupID, 10, 64)
	if err != nil {
		return err
	}
	newID, err := strconv.ParseUint(newGroupID, 10, 64)
	if err != nil {
		return err
	}

	m.Lock()
	defer m.Unlock()
	var (
		oldKG *endpoint.KeyspaceGroup
		newKG *endpoint.KeyspaceGroup
	)
	if err := m.store.RunInTxn(m.ctx, func(txn kv.Txn) error {
		var err error
		oldKG, err = m.store.LoadKeyspaceGroup(txn, uint32(oldID))
		if err != nil {
			return err
		}
		if oldKG == nil || endpoint.StringUserKind(oldKG.UserKind) != oldUserKind {
			return errors.Errorf("keyspace group %s not found in %s group", oldGroupID, oldUserKind)
		}
		if oldID == newID {
			newKG = oldKG
		} else {
			newKG, err = m.store.LoadKeyspaceGroup(txn, uint32(newID))
			if err != nil {
				return err
			}
		}
		if newKG == nil || endpoint.StringUserKind(newKG.UserKind) != newUserKind {
			return errors.Errorf("keyspace group %s not found in %s group", newGroupID, newUserKind)
		}
		if oldKG.IsSplitting() {
			return errs.ErrKeyspaceGroupInSplit.FastGenByArgs(uint32(oldID))
		} else if newKG.IsSplitting() {
			return errs.ErrKeyspaceGroupInSplit.FastGenByArgs(uint32(newID))
		} else if oldKG.IsMerging() {
			return errs.ErrKeyspaceGroupInMerging.FastGenByArgs(uint32(oldID))
		} else if newKG.IsMerging() {
			return errs.ErrKeyspaceGroupInMerging.FastGenByArgs(uint32(newID))
		}

		if !slice.Contains(newKG.Keyspaces, keyspaceID) {
			newKG.Keyspaces = append(newKG.Keyspaces, keyspaceID)
			slices.Sort(newKG.Keyspaces)
		}
		oldKG.Keyspaces = slice.Remove(oldKG.Keyspaces, keyspaceID)
		if oldID == newID {
			return m.store.SaveKeyspaceGroup(txn, oldKG)
		}
		if err = m.store.SaveKeyspaceGroup(txn, oldKG); err != nil {
			return err
		}
		return m.store.SaveKeyspaceGroup(txn, newKG)
	}); err != nil {
		return err
	}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/utils/grpcutil/grpcutil.go line 93
Likely real: Yes, 53% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.

return &tls.Config{
			Certificates: certificates,
			RootCAs:      certPool,
			NextProtos:   []string{"h2", "http/1.1"}, // specify `h2` to let Go use HTTP/2.
		}, nil

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /client/pkg/utils/tlsutil/tlsconfig.go line 191
Likely real: Yes, 53% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.

return &tls.Config{
			Certificates: certificates,
			RootCAs:      certPool,
			NextProtos:   []string{"h2", "http/1.1"}, // specify `h2` to let Go use HTTP/2.
		}, nil

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /client/pkg/utils/tlsutil/tlsconfig.go line 83
Likely real: Yes, 52% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.

cfg = &tls.Config{ServerName: info.serverName}

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-tests.yaml line 70
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-tests.yaml line 56
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/setup-go@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-tests.yaml line 55
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-tests.yaml line 81
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-docker-image.yaml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/setup-go@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/tso-function-test.yaml line 28
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/setup-go@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/assign-to-one-project.yaml line 15
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: srggrs/assign-one-project-github-action@1.2.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/tso-function-test.yaml line 27
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-tests.yaml line 96
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: codecov/codecov-action@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-tests.yaml line 83
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/download-artifact@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/check.yaml line 13
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/setup-go@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/check.yaml line 12
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/pd-docker-image.yaml line 19
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-simulator/simulator/drive.go line 419
Likely real: Uncertain, 48% confidence

Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.

http.ListenAndServe(d.statusAddress, nil)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/mcs/resourcemanager/redirector/redirector.go line 102
Likely real: Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

_, _ = w.Write([]byte(initErr.Error()))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /tools/pd-simulator/simulator/event.go line 20
Likely real: Uncertain, 38% confidence