Code Security Report: 63 high severity findings, 189 total findings

[dev-mend-for-github-com]

Code Security Report

Scan Metadata

Latest Scan: 2024-07-22 05:04pm
Total Findings: 189 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 17809
Detected Programming Languages: 3 (PHP, JavaScript / Node.js, TypeScript)

• Check this box to manually trigger a scan

Most Relevant Findings

The list below presents the 10 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend Application.

Severity	Vulnerability Type	CWE	File	Data Flows	Date
High	Session Fixation	CWE-384	with_cookie_and_session.php:8	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/with_cookie_and_session.php Lines 3 to 8 in 8e9466d require __DIR__.'/common.inc'; setcookie('abc', 'def'); session_set_save_handler(new TestSessionHandler('abc|i:123;'), false); session_start(); 1 Data Flow/s detected symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/with_cookie_and_session.php Line 8 in 8e9466d session_start(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Session Fixation Training ● Videos    ▪ Secure Code Warrior Session Fixation Video ● Further Reading    ▪ OWASP Session Hijacking Attack    ▪ OWASP Session Management Cheat Sheet
High	File Manipulation	CWE-73	DotenvDumpCommand.php:85	3	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Lines 80 to 85 in 8e9466d // This file was generated by running "php bin/console dotenv:dump $env" return $vars; EOF; file_put_contents($dotenvPath.'.local.php', $vars, \LOCK_EX); 3 Data Flow/s detected View Data Flow 1 symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 64 in 8e9466d $config += (is_file($composerFile) ? json_decode(file_get_contents($composerFile), true) : [])['extra']['runtime'] ?? []; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 65 in 8e9466d $dotenvPath = $projectDir.'/'.($config['dotenv_path'] ?? '.env'); symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 85 in 8e9466d file_put_contents($dotenvPath.'.local.php', $vars, \LOCK_EX); View Data Flow 2 symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 64 in 8e9466d $config += (is_file($composerFile) ? json_decode(file_get_contents($composerFile), true) : [])['extra']['runtime'] ?? []; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 67 in 8e9466d $envKey = $config['env_var_name'] ?? 'APP_ENV'; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 70 in 8e9466d $vars = [$envKey => $env]; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 85 in 8e9466d file_put_contents($dotenvPath.'.local.php', $vars, \LOCK_EX); View Data Flow 3 symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 64 in 8e9466d $config += (is_file($composerFile) ? json_decode(file_get_contents($composerFile), true) : [])['extra']['runtime'] ?? []; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 67 in 8e9466d $envKey = $config['env_var_name'] ?? 'APP_ENV'; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 70 in 8e9466d $vars = [$envKey => $env]; symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 76 in 8e9466d $vars = var_export($vars, true); symfony/src/Symfony/Component/Dotenv/Command/DotenvDumpCommand.php Line 85 in 8e9466d file_put_contents($dotenvPath.'.local.php', $vars, \LOCK_EX); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior File Manipulation Training ● Videos    ▪ Secure Code Warrior File Manipulation Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Session Fixation	CWE-384	with_cookie_and_session.php:10	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/with_cookie_and_session.php Lines 5 to 10 in 8e9466d setcookie('abc', 'def'); session_set_save_handler(new TestSessionHandler('abc|i:123;'), false); session_start(); session_write_close(); session_start(); 1 Data Flow/s detected symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/with_cookie_and_session.php Line 10 in 8e9466d session_start(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Session Fixation Training ● Videos    ▪ Secure Code Warrior Session Fixation Video ● Further Reading    ▪ OWASP Session Hijacking Attack    ▪ OWASP Session Management Cheat Sheet
High	Session Fixation	CWE-384	AbstractProxyTest.php:108	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Proxy/AbstractProxyTest.php Lines 103 to 108 in 8e9466d * @preserveGlobalState disabled */ public function testIdException() { $this->expectException(\LogicException::class); session_start(); 1 Data Flow/s detected symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Proxy/AbstractProxyTest.php Line 108 in 8e9466d session_start(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Session Fixation Training ● Videos    ▪ Secure Code Warrior Session Fixation Video ● Further Reading    ▪ OWASP Session Hijacking Attack    ▪ OWASP Session Management Cheat Sheet
High	Session Fixation	CWE-384	AbstractProxyTest.php:83	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Proxy/AbstractProxyTest.php Lines 78 to 83 in 8e9466d * @preserveGlobalState disabled */ public function testNameException() { $this->expectException(\LogicException::class); session_start(); 1 Data Flow/s detected symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Proxy/AbstractProxyTest.php Line 83 in 8e9466d session_start(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Session Fixation Training ● Videos    ▪ Secure Code Warrior Session Fixation Video ● Further Reading    ▪ OWASP Session Hijacking Attack    ▪ OWASP Session Management Cheat Sheet
High	Path/Directory Traversal	CWE-22	SymfonyTestsListenerTrait.php:251	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Bridge/PhpUnit/Legacy/SymfonyTestsListenerTrait.php Lines 246 to 251 in 8e9466d public function endTest($test, $time): void { if ($file = getenv('SYMFONY_EXPECTED_DEPRECATIONS_SERIALIZE')) { putenv('SYMFONY_EXPECTED_DEPRECATIONS_SERIALIZE'); $expectedDeprecations = file_get_contents($file); 1 Data Flow/s detected symfony/src/Symfony/Bridge/PhpUnit/Legacy/SymfonyTestsListenerTrait.php Line 249 in 8e9466d if ($file = getenv('SYMFONY_EXPECTED_DEPRECATIONS_SERIALIZE')) { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Session Fixation	CWE-384	NativeSessionStorageTest.php:274	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php Lines 269 to 274 in 8e9466d $this->assertSame(7, $storage->getBag('attributes')->get('lucky'), 'Data still available'); } public function testCanCreateNativeSessionStorageWhenSessionAlreadyStarted() { session_start(); 1 Data Flow/s detected symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php Line 274 in 8e9466d session_start(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Session Fixation Training ● Videos    ▪ Secure Code Warrior Session Fixation Video ● Further Reading    ▪ OWASP Session Hijacking Attack    ▪ OWASP Session Management Cheat Sheet
High	Session Fixation	CWE-384	NativeSessionStorageTest.php:283	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php Lines 278 to 283 in 8e9466d $this->addToAssertionCount(1); } public function testSetSessionOptionsOnceSessionStartedIsIgnored() { session_start(); 1 Data Flow/s detected symfony/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php Line 283 in 8e9466d session_start(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Session Fixation Training ● Videos    ▪ Secure Code Warrior Session Fixation Video ● Further Reading    ▪ OWASP Session Hijacking Attack    ▪ OWASP Session Management Cheat Sheet
High	Path/Directory Traversal	CWE-22	ExpectDeprecationTraitForV8_4.php:32	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Bridge/PhpUnit/Legacy/ExpectDeprecationTraitForV8_4.php Lines 27 to 32 in 8e9466d // Expected deprecations set by isolated tests need to be written to a file // so that the test running process can take account of them. if ($file = getenv('SYMFONY_EXPECTED_DEPRECATIONS_SERIALIZE')) { $this->getTestResultObject()->beStrictAboutTestsThatDoNotTestAnything(false); $expectedDeprecations = file_get_contents($file); 1 Data Flow/s detected symfony/src/Symfony/Bridge/PhpUnit/Legacy/ExpectDeprecationTraitForV8_4.php Line 30 in 8e9466d if ($file = getenv('SYMFONY_EXPECTED_DEPRECATIONS_SERIALIZE')) { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Deserialization of Untrusted Data	CWE-502	LoggerDataCollector.php:186	1	2024-07-22 06:43pm
Vulnerable Code symfony/src/Symfony/Component/HttpKernel/DataCollector/LoggerDataCollector.php Lines 181 to 186 in 8e9466d return []; } $bootTime = filemtime($file); $logs = []; foreach (unserialize($logContent) as $log) { 1 Data Flow/s detected symfony/src/Symfony/Component/HttpKernel/DataCollector/LoggerDataCollector.php Line 180 in 8e9466d if ('' === $logContent = trim(file_get_contents($file))) { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Deserialization of Untrusted Data Training ● Videos    ▪ Secure Code Warrior Deserialization of Untrusted Data Video ● Further Reading    ▪ OWASP Deserialization Cheat Sheet    ▪ OWASP Top Ten 2017 A8: Insecure Deserialization    ▪ OWASP Deserialization of untrusted data

Findings Overview

Severity	Vulnerability Type	CWE	Language	Count
High	Command Injection	CWE-78	PHP	3
High	Cross-Site Scripting	CWE-79	PHP	4
High	Deserialization of Untrusted Data	CWE-502	PHP	12
High	Session Fixation	CWE-384	PHP	22
High	Code Injection	CWE-94	PHP	4
High	File Manipulation	CWE-73	PHP	12
High	Path/Directory Traversal	CWE-22	PHP	5
High	SQL Injection	CWE-89	PHP	1
Medium	XML External Entity (XXE) Injection	CWE-611	PHP	1
Medium	Hidden HTML Input	CWE-472	PHP	9
Medium	LDAP Injection	CWE-90	PHP	1
Medium	Regex Denial of Service (ReDoS)	CWE-400	PHP	2
Medium	Hardcoded Password/Credentials	CWE-798	PHP	28
Medium	Log Messages Information Leak	CWE-209	PHP	2
Low	File Upload	CWE-434	PHP	15
Low	Cookie Without 'HttpOnly' Flag	CWE-1004	PHP	22
Low	Dangerous File Extensions	CWE-530	PHP	2
Low	Weak Encryption Strength	CWE-326	PHP	33
Low	HTTP Response Splitting	CWE-113	PHP	11