Remove outdated scan result files
ci/woodpecker/push/woodpecker Pipeline was successful
Details
ci/woodpecker/push/woodpecker Pipeline was successful
Details
This commit is contained in:
parent
5d87d8e9f3
commit
ae66bf0193
|
@ -1,73 +0,0 @@
|
||||||
# Ploughshares Security and Code Quality Scan Results (Updated)
|
|
||||||
|
|
||||||
## Deployment Status
|
|
||||||
|
|
||||||
✅ **Application successfully deployed**
|
|
||||||
- Web application running at http://localhost:5001
|
|
||||||
- API documentation available at http://localhost:5001/api-docs
|
|
||||||
|
|
||||||
## Test Results
|
|
||||||
|
|
||||||
### Functionality Tests
|
|
||||||
✅ **All tests passed**
|
|
||||||
- Core imports verified
|
|
||||||
- API routes verified
|
|
||||||
|
|
||||||
### Code Quality Tests
|
|
||||||
✅ **All tests passed**
|
|
||||||
- Python syntax valid
|
|
||||||
- No inappropriate print statements
|
|
||||||
|
|
||||||
### Dependency Tests
|
|
||||||
✅ **All tests passed**
|
|
||||||
- requirements.txt exists
|
|
||||||
- No known vulnerable package versions
|
|
||||||
|
|
||||||
## Security Scan Results
|
|
||||||
|
|
||||||
### Dependency Vulnerabilities (Safety)
|
|
||||||
|
|
||||||
✅ **No vulnerabilities detected in dependencies**
|
|
||||||
|
|
||||||
All dependencies have been updated to secure versions:
|
|
||||||
- Flask: 2.2.2 → 3.1.1
|
|
||||||
- psycopg2-binary: 2.9.3 → 2.9.9
|
|
||||||
- requests: 2.28.1 → 2.32.2
|
|
||||||
- gunicorn: 20.1.0 → 23.0.0
|
|
||||||
- Werkzeug: 2.3.7 → 3.0.6
|
|
||||||
- Jinja2: 3.1.2 → 3.1.6
|
|
||||||
|
|
||||||
### Code Security Issues (Bandit)
|
|
||||||
|
|
||||||
⚠️ **3 potential security issues remain to be addressed**
|
|
||||||
|
|
||||||
1. **Hardcoded Password String** (Severity: Low, Confidence: Medium)
|
|
||||||
- Location: app.py:20
|
|
||||||
- Issue: `app.secret_key = 'supersecretkey'`
|
|
||||||
- CWE-259: Use of Hard-coded Password
|
|
||||||
|
|
||||||
2. **Binding to All Interfaces** (Severity: Medium, Confidence: Medium)
|
|
||||||
- Location: app.py:220
|
|
||||||
- Issue: `app.run(host='0.0.0.0', port=port)`
|
|
||||||
- CWE-605: Multiple Binds to the Same Port
|
|
||||||
|
|
||||||
3. **Hardcoded Password in Function Argument** (Severity: Low, Confidence: Medium)
|
|
||||||
- Location: init_db.py:6-11
|
|
||||||
- Issue: `password="testpass"` in database connection
|
|
||||||
- CWE-259: Use of Hard-coded Password
|
|
||||||
|
|
||||||
## Recommendations
|
|
||||||
|
|
||||||
### Immediate Actions
|
|
||||||
1. ✅ **Update vulnerable dependencies** - COMPLETED
|
|
||||||
2. **Replace hardcoded secrets** with environment variables
|
|
||||||
3. **Restrict network binding** in development environments
|
|
||||||
|
|
||||||
### Long-term Improvements
|
|
||||||
1. Implement **secret management** solution
|
|
||||||
2. Add **continuous security scanning** in CI/CD pipeline
|
|
||||||
3. Establish **dependency update policy**
|
|
||||||
|
|
||||||
## Next Steps
|
|
||||||
1. Run `./install-codechecks.sh` to install all required code quality tools
|
|
||||||
2. Address remaining security findings
|
|
|
@ -1,86 +0,0 @@
|
||||||
# Ploughshares Security and Code Quality Scan Results
|
|
||||||
|
|
||||||
## Deployment Status
|
|
||||||
|
|
||||||
✅ **Application successfully deployed**
|
|
||||||
- Web application running at http://localhost:5001
|
|
||||||
- API documentation available at http://localhost:5001/api-docs
|
|
||||||
|
|
||||||
## Test Results
|
|
||||||
|
|
||||||
### Functionality Tests
|
|
||||||
✅ **All tests passed**
|
|
||||||
- Core imports verified
|
|
||||||
- API routes verified
|
|
||||||
|
|
||||||
### Code Quality Tests
|
|
||||||
✅ **All tests passed**
|
|
||||||
- Python syntax valid
|
|
||||||
- No inappropriate print statements
|
|
||||||
|
|
||||||
### Dependency Tests
|
|
||||||
✅ **Basic tests passed**
|
|
||||||
- requirements.txt exists
|
|
||||||
- No known vulnerable package versions in hardcoded list
|
|
||||||
|
|
||||||
## Security Scan Results
|
|
||||||
|
|
||||||
### Dependency Vulnerabilities (Safety)
|
|
||||||
|
|
||||||
⚠️ **Multiple vulnerabilities detected in dependencies**
|
|
||||||
|
|
||||||
| Package | Installed | Affected | Issue ID |
|
|
||||||
|------------|-----------|-------------------------|----------|
|
|
||||||
| flask | 2.2.2 | <2.2.5 | 55261 |
|
|
||||||
| flask | 2.2.2 | <3.1.1 | 77323 |
|
|
||||||
| requests | 2.28.1 | <2.32.2 | 71064 |
|
|
||||||
| requests | 2.28.1 | >=2.3.0,<2.31.0 | 58755 |
|
|
||||||
| gunicorn | 20.1.0 | <21.2.0 | 72780 |
|
|
||||||
| gunicorn | 20.1.0 | <22.0.0 | 71600 |
|
|
||||||
| gunicorn | 20.1.0 | <23.0.0 | 76244 |
|
|
||||||
| werkzeug | 2.3.7 | <2.3.8 | 62019 |
|
|
||||||
| werkzeug | 2.3.7 | <3.0.3 | 71594 |
|
|
||||||
| werkzeug | 2.3.7 | <3.0.6 | 73969 |
|
|
||||||
| werkzeug | 2.3.7 | <3.0.6 | 73889 |
|
|
||||||
| werkzeug | 2.3.7 | <=2.3.7 | 71595 |
|
|
||||||
| jinja2 | 3.1.2 | <3.1.3 | 64227 |
|
|
||||||
| jinja2 | 3.1.2 | <3.1.4 | 71591 |
|
|
||||||
| jinja2 | 3.1.2 | <3.1.5 | 76378 |
|
|
||||||
| jinja2 | 3.1.2 | <3.1.5 | 74735 |
|
|
||||||
| jinja2 | 3.1.2 | <3.1.6 | 75976 |
|
|
||||||
|
|
||||||
### Code Security Issues (Bandit)
|
|
||||||
|
|
||||||
⚠️ **3 potential security issues detected**
|
|
||||||
|
|
||||||
1. **Hardcoded Password String** (Severity: Low, Confidence: Medium)
|
|
||||||
- Location: app.py:20
|
|
||||||
- Issue: `app.secret_key = 'supersecretkey'`
|
|
||||||
- CWE-259: Use of Hard-coded Password
|
|
||||||
|
|
||||||
2. **Binding to All Interfaces** (Severity: Medium, Confidence: Medium)
|
|
||||||
- Location: app.py:220
|
|
||||||
- Issue: `app.run(host='0.0.0.0', port=port)`
|
|
||||||
- CWE-605: Multiple Binds to the Same Port
|
|
||||||
|
|
||||||
3. **Hardcoded Password in Function Argument** (Severity: Low, Confidence: Medium)
|
|
||||||
- Location: init_db.py:6-11
|
|
||||||
- Issue: `password="testpass"` in database connection
|
|
||||||
- CWE-259: Use of Hard-coded Password
|
|
||||||
|
|
||||||
## Recommendations
|
|
||||||
|
|
||||||
### Immediate Actions
|
|
||||||
1. **Update vulnerable dependencies** to their latest secure versions
|
|
||||||
2. **Replace hardcoded secrets** with environment variables
|
|
||||||
3. **Restrict network binding** in development environments
|
|
||||||
|
|
||||||
### Long-term Improvements
|
|
||||||
1. Implement **secret management** solution
|
|
||||||
2. Add **continuous security scanning** in CI/CD pipeline
|
|
||||||
3. Establish **dependency update policy**
|
|
||||||
|
|
||||||
## Next Steps
|
|
||||||
1. Run `./install-codechecks.sh` to install all required code quality tools
|
|
||||||
2. Update dependencies to secure versions
|
|
||||||
3. Address security findings
|
|
Loading…
Reference in New Issue