MalDet · Static Security Report
The repository has a high vulnerability score of 95.0, which means there are many obvious coding errors that an attacker could easily exploit to break your system. However, the malicious-pattern score is 0.0, indicating that the code does not appear to be intentionally harmful or designed to attack others. Most of the issues found are standard mistakes like missing CSRF protection or SQL injection risks rather than signs of a hidden malware campaign. While some findings suggest potential for dangerous behavior, such as running containers as root or using user-controlled data in HTML, they are classified as insecure patterns that should be fixed to prevent real-world damage. The developer should prioritize addressing the high-severity issues first to ensure the application is safe and reliable before deploying it to production.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 14 | 50 | 0 | 64 |
7 of 64 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Generic Secret detected | 2 | /.env:21 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 2 | /Dockerfile:92 |
| high | semgrep | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities | 10 | /front/pages/assessor_manager_requests.js:24 |
| medium | semgrep | CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`. | 3 | /src/Controller/Renaissance/Adhesion/AdhesionController.php:57 |
| medium | semgrep | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 1 | /front/utils/url.js:2 |
| medium | semgrep | Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. | 2 | /src/Command/SyncEventInscriptionDuplicatesCommand.php:56 |
| medium | semgrep | Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. | 1 | /front/listeners/em-datetime-picker.js:12 |
| medium | semgrep | The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. | 40 | /src/Controller/Admin/AdminCandidaciesGroupCandidateImportController.php:94 |
| medium | semgrep | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT | 2 | /front/components/DataGrid.js:318 |
| medium | semgrep | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted | 1 | /public/maintenance.html:27 |