Generated using http://gitorious.org/code-scanner/ror-sec-scanner/
Configuration
| date: |
Tue Feb 21 15:07:32 2012 |
| rules dir: |
rules/ |
| ignore info rules: |
yes |
| ignore low rules: |
yes |
| ignore medium rules: |
no |
| ignore high rules: |
no |
| nr. of rules files: |
28 |
| nr. of rules loaded: |
74 |
| xcld rules loaded: |
11 |
| icld rules loaded: |
1 |
| search dir: |
../hawk |
| reduce path: |
yes |
| nr. of code files: |
124 |
| nr. of views files: |
51 |
| nr. of modell files: |
14 |
| nr. of controller files: |
19 |
| nr. of config files: |
1 |
/hawk/app/controllers/explorer_controller.rb:44 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@hb_report = HbReport.new("#{RAILS_ROOT}/tmp/pids/history_report")
/hawk/app/controllers/explorer_controller.rb:117 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
tpath = "/tmp/#{@report_name}/#{tname}"
/hawk/app/controllers/explorer_controller.rb:153 [03_insecure_function.rule:Insecure function:rule 1:high:CWE-88,CWE-78]
stdin, stdout, stderr, thread = Util.popen3("/usr/bin/dot", "-Tpng", tmpfile.path)
/hawk/app/controllers/explorer_controller.rb:201 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@report_path = "/tmp/#{@report_name}.tar.bz2"
/hawk/app/controllers/explorer_controller.rb:203 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@hb_report.path = "/tmp/#{@report_name}"
/hawk/app/controllers/hb_reports_controller.rb:39 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@hb_report = HbReport.new("#{RAILS_ROOT}/tmp/pids/hb_report", "/tmp/hb_report-hawk")
/hawk/app/controllers/hb_reports_controller.rb:75 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
if File.exists?("/tmp/hb_report-hawk.tar.bz2")
/hawk/app/controllers/hb_reports_controller.rb:76 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
send_file "/tmp/hb_report-hawk.tar.bz2"
/hawk/app/controllers/main_controller.rb:144 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
f = File.new("#{RAILS_ROOT}/tmp/sim.in", "w")
/hawk/app/controllers/main_controller.rb:185 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
f = File.new("#{RAILS_ROOT}/tmp/sim.info", "w")
/hawk/app/controllers/main_controller.rb:189 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
"-x", "#{RAILS_ROOT}/tmp/sim.in",
/hawk/app/controllers/main_controller.rb:190 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
"-O", "#{RAILS_ROOT}/tmp/sim.out",
/hawk/app/controllers/main_controller.rb:191 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
"-G", "#{RAILS_ROOT}/tmp/sim.graph",
/hawk/app/controllers/main_controller.rb:192 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
"-D", "#{RAILS_ROOT}/tmp/sim.dot",
/hawk/app/controllers/main_controller.rb:198 [09_file_open.rule:Identify all file handling:rule 1:medium:CWE-377]
f = File.open("#{RAILS_ROOT}/tmp/sim.graph")
/hawk/app/controllers/main_controller.rb:198 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
f = File.open("#{RAILS_ROOT}/tmp/sim.graph")
/hawk/app/controllers/main_controller.rb:219 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
File.new("#{RAILS_ROOT}/tmp/sim.info").read.split(/\n/).each do |line|
/hawk/app/controllers/main_controller.rb:236 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
send_data File.new("#{RAILS_ROOT}/tmp/sim.in").read, :type => (params[:munge] == "txt" ? "text/plain" : "text/xml"), :disposition => "inline"
/hawk/app/controllers/main_controller.rb:238 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
send_data File.new("#{RAILS_ROOT}/tmp/sim.out").read, :type => (params[:munge] == "txt" ? "text/plain" : "text/xml"), :disposition => "inline"
/hawk/app/controllers/main_controller.rb:241 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
send_data File.new("#{RAILS_ROOT}/tmp/sim.graph").read, :type => (params[:munge] == "txt" ? "text/plain" : "text/xml"), :disposition => "inline"
/hawk/app/controllers/main_controller.rb:243 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
stdin, stdout, stderr, thread = Util.popen3("/usr/bin/dot", "-Tpng", "#{RAILS_ROOT}/tmp/sim.dot")
/hawk/app/controllers/main_controller.rb:243 [03_insecure_function.rule:Insecure function:rule 1:high:CWE-88,CWE-78]
stdin, stdout, stderr, thread = Util.popen3("/usr/bin/dot", "-Tpng", "#{RAILS_ROOT}/tmp/sim.dot")
/hawk/app/controllers/sessions_controller.rb:60 [06_HTTP_header_injection.rule:HTTP header field usage:rule 3:medium:CWE-113]
redirect_to :action => 'new', :username => params[:username]
/hawk/app/controllers/sessions_controller.rb:60 [16_HTTP_redirect.rule:HTTP redirects emitted by the Application:rule 1:medium:CWE-601,CWE-698,CWE-79]
redirect_to :action => 'new', :username => params[:username]
/hawk/app/controllers/sessions_controller.rb:63 [03_insecure_function.rule:Insecure function:rule 1:high:CWE-88,CWE-78]
IO.popen("#{HAWK_CHKPWD} passwd '#{params[:username]}'", 'w+') do |pipe|
/hawk/app/controllers/sessions_controller.rb:75 [06_HTTP_header_injection.rule:HTTP header field usage:rule 3:medium:CWE-113]
redirect_to :action => 'new', :username => params[:username]
/hawk/app/controllers/sessions_controller.rb:75 [16_HTTP_redirect.rule:HTTP redirects emitted by the Application:rule 1:medium:CWE-601,CWE-698,CWE-79]
redirect_to :action => 'new', :username => params[:username]
/hawk/app/controllers/sessions_controller.rb:79 [06_HTTP_header_injection.rule:HTTP header field usage:rule 3:medium:CWE-113]
redirect_to :action => 'new', :username => params[:username]
/hawk/app/controllers/sessions_controller.rb:79 [16_HTTP_redirect.rule:HTTP redirects emitted by the Application:rule 1:medium:CWE-601,CWE-698,CWE-79]
redirect_to :action => 'new', :username => params[:username]
/hawk/app/models/cib.rb:221 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
cib_path = "#{RAILS_ROOT}/tmp/#{cib_path}"
/hawk/app/views/hb_reports/create.js.erb:19 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
$("#hbreport-gentime").text("<%= escape_javascript(File.mtime("/tmp/hb_report-hawk.tar.bz2").strftime("%Y-%m-%d %H:%M:%S")) %>");
/hawk/app/views/hb_reports/new.html.erb:39 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
<% if @hb_report.lastexit == 0 && File.exists?("/tmp/hb_report-hawk.tar.bz2") %>
/hawk/app/views/hb_reports/new.html.erb:50 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
$("#hbreport-gentime").text("<%= escape_javascript(File.mtime("/tmp/hb_report-hawk.tar.bz2").strftime("%Y-%m-%d %H:%M:%S")) %>");
/hawk/lib/crm_history.rb:39 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@pidfile = "#{RAILS_ROOT}/tmp/pids/crm_history.pid"
/hawk/lib/crm_history.rb:40 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@cmdfile = "#{RAILS_ROOT}/tmp/pids/crm_history.cmd"
/hawk/lib/crm_history.rb:41 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@outfile = "#{RAILS_ROOT}/tmp/pids/crm_history.stdout"
/hawk/lib/crm_history.rb:42 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@errfile = "#{RAILS_ROOT}/tmp/pids/crm_history.stderr"
/hawk/lib/crm_history.rb:43 [09_file_open.rule:Identify all file handling:rule 3:medium:CWE-377]
@exitfile = "#{RAILS_ROOT}/tmp/pids/crm_history.exit"
Statistics
| Lines ignored by keyword: |
8 |
| Files ignored by keyword: |
0 |
| Lines analyzed: |
10224 |
| Physical Source Lines of Code (SLOC): |
7253 |
| Hits@level: |
[info] 0 [low] 0 [medium] 35 [high] 3 |
| Hits/KSLOC@level+ (KLSOC = 7): |
[info+] 5 [low+] 5 [medium+] 5 [high+] 0 |