ruby3.2-activesupport/7.1.3.4 package update #21273
Conversation
![octo-sts[bot]](https://avatars.githubusercontent.com/in/801323?s=60&v=4){kind=small}
octo-sts
bot
commented
Jun 4, 2024
octo-sts
bot
commented
Signed-off-by: wolfi-bot <121097084+wolfi-bot@users.noreply.github.com>
octo-sts
bot
added
request-version-update
Package ruby3.2-activesupport: Click to expand/collapsePackage ruby3.2-activesupport:
Added: /usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/CHANGELOG.md bincapz found differences: Click to expand/collapsetime=2024-06-04T19:03:33.078Z level=ERROR msg=error namespace=evasion/hidden-functions.yara id=php_hidden_eval "disabled due to unexpected warning"="string "$func" may slow down scanning" Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/testing/parallelization.rb [✅ LOW]
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/test_case.rb [
|
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | exec/shell_command | execute a shell command | system |
| -LOW | process/create | create child process | fork |
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://docs.seattlerb.org/minitest/Minitest/Assertions.html |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/descendants_tracker.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://bugs.ruby-lang.org/issues/18928 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/multibyte/chars.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | net/socket/send | send a message to a socket | _send |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/duration/iso8601_parser.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://en.wikipedia.org/wiki/ISO_8601 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/string/output_safety.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval("proc |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/railtie.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | time/tzinfo | Uses timezone information | tzinfo |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/message_verifier.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/words/exclamation | gets very excited | !! |
| -LOW | encoding/base64 | Supports base64 encoded strings | base64 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/time_with_zone.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | net/socket/send | send a message to a socket | _send |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/time/calculations.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://bugs.ruby-lang.org/issues/17025 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/xml_mini.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | encoding/base64 | Supports base64 encoded strings | base64 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/testing/parallelization/worker.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | process/create | create child process | fork |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/code_generator.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(" |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/message_encryptor.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | encoding/base64 | Supports base64 encoded strings | base64 |
| -LOW | ref/site/url | contains embedded HTTPS URLs | ruby/openssl#63 https://www.limited-entropy.com/padding-oracle-attacks/. |
| -LOW | ref/words/password | references a 'password' | password |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/testing/assertions.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(e, eval(expression |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/cache/strategy/local_cache.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/words/exclamation | gets very excited | !! |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/concurrency/share_lock.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://en.wikipedia.org/wiki/Readers |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/digest/uuid.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://www.ietf.org/rfc/rfc4122.txt |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/fork_tracker.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | process/create | create child process | _fork |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/duration.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://en.wikipedia.org/wiki/ISO_8601 https://ruby-doc.org/stdlib/libdoc/date/rdoc/Date.html https://ruby-doc.org/stdlib/libdoc/time/rdoc/Time.html |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/message_pack/serializer.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | fd/write | writes to a file handle | packer.write(SIGNATURE_INT) packer.write(object) |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/deprecation/proxy_wrappers.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | net/socket/send | send a message to a socket | _send |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/object/json.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | combo/recon/system_network | invasive recon val | ipaddr |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/messages/codec.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | evasion/base64/decode | decode base64 strings | urlsafe_decode64 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/secure_compare_rotator.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/words/password | references a 'password' | new_password old_password |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/rescuable.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using exec() | exec(e, |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/cache/file_store.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | fd/write | writes to a file handle | f.write(payload) |
| -LOW | fs/lock/update | apply or remove an advisory lock on a file | flock |
| -LOW | fs/symlink/resolve | resolves symbolic links | realpath |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/gzip.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | compression/gzip | works with gzip files | gzip |
| -LOW | fd/write | writes to a file handle | gz.write(source) |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/option_merger.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | net/socket/send | send a message to a socket | _send |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/callbacks.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using exec() | exec(target, |
| -LOW | ref/site/url | contains embedded HTTPS URLs | rails/rails#18011 |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/erb/util.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | encoding/json/decode | Decodes JSON messages | JSON.parse |
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://www.w3.org/TR/REC-xml/ |
| -LOW | ref/words/plugin | references a 'plugin' | plugins |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/cache/memory_store.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/words/exclamation | gets very excited | !! |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/ordered_hash.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://yaml.org/type/omap.html |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/cache.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/path/tmp | path reference within /tmp | /tmp/cache |
| -LOW | ref/site/url | contains embedded HTTPS URLs | rails/rails#41522 https://guides.rubyonrails.org/upgrading_ruby_on_rails.html |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/json/encoding.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTP URLs | http://www.json.org |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/file/atomic.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | fs/permission/modify | modifies file permissions | chmod |
| -LOW | fs/tempfile/create | Uses mktemp to create temporary files | temp file |
| -LOW | random/insecure | generate random numbers insecurely | rand |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/backtrace_cleaner.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/path/root | path reference within /root | /root/app/models/person.rb |
| -LOW | ref/path/hidden | possible hidden file path | /puma/.match |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/message_pack/extensions.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | combo/recon/system_network | invasive recon val | ipaddr |
| -LOW | fd/write | writes to a file handle | packer.write(LOAD_WITH_JSON_CREATE) packer.write(LOAD_WITH_MSGPACK_EXT) |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/cache/redis_cache_store.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | net/socket/connect | initiate a connection on a socket | connect |
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://redis.io/commands/KEYS https://redis.io/topics/lru-cache |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/encrypted_file.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | fs/symlink/resolve | resolves symbolic links | realpath |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/cache/mem_cache_store.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://guides.rubyonrails.org/upgrading_ruby_on_rails.html https://memcached.org |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/evented_file_update_checker.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/path/tmp | references an unusual path within /tmp | /tmp/foo |
| -LOW | fs/symlink/resolve | resolves symbolic links | realpath |
| -LOW | fs/watch | monitors filesystem events | inotify |
| -LOW | process/create | create child process | fork |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/module/attribute_accessors.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(definition |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/json/decoding.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | encoding/json/decode | Decodes JSON messages | JSON.parse |
| -LOW | ref/site/url | contains embedded HTTP URLs | http://www.json.org |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/parameter_filter.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/words/password | references a 'password' | password |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/testing/stream.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(" |
| -LOW | fs/file/delete | deletes files | unlink |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/key_generator.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/words/password | references a 'password' | uses this for password storage |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/values/time_zone.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | ruby/date#39 |
| -LOW | time/tzinfo | Uses timezone information | tzinfo |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/module/delegation.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(method |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/module/concerning.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | net/socket/send | send a message to a socket | _send |
| -LOW | ref/words/obfuscate | Mentions the word obfuscate | obfuscate |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/xml_mini/jdom.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | https://archive.is/9xcQQ |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/current_attributes.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | ref/words/agent | references an 'agent' | user_agent |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/core_ext/hash/conversions.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -MEDIUM | net/upload | uploads files | uploaded |
Deleted: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.3/lib/active_support/testing/strict_warnings.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| -LOW | ref/site/url | contains embedded HTTPS URLs | mikel/mail#1557 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/cache/file_store.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | fd/write | writes to a file handle | f.write(payload) |
| +LOW | fs/lock/update | apply or remove an advisory lock on a file | flock |
| +LOW | fs/symlink/resolve | resolves symbolic links | realpath |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/message_verifier.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/words/exclamation | gets very excited | !! |
| +LOW | encoding/base64 | Supports base64 encoded strings | base64 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/json/encoding.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTP URLs | http://www.json.org |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/gzip.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | compression/gzip | works with gzip files | gzip |
| +LOW | fd/write | writes to a file handle | gz.write(source) |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/message_pack/extensions.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | combo/recon/system_network | invasive recon val | ipaddr |
| +LOW | fd/write | writes to a file handle | packer.write(LOAD_WITH_JSON_CREATE) packer.write(LOAD_WITH_MSGPACK_EXT) |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/string/output_safety.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval("proc |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/module/attribute_accessors.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(definition |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/concurrency/share_lock.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://en.wikipedia.org/wiki/Readers |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/railtie.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | time/tzinfo | Uses timezone information | tzinfo |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/module/delegation.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(method |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/cache/memory_store.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/words/exclamation | gets very excited | !! |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/code_generator.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(" |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/rescuable.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using exec() | exec(e, |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/time/calculations.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://bugs.ruby-lang.org/issues/17025 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/secure_compare_rotator.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/words/password | references a 'password' | new_password old_password |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/option_merger.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | net/socket/send | send a message to a socket | _send |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/cache/mem_cache_store.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://guides.rubyonrails.org/upgrading_ruby_on_rails.html https://memcached.org |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/fork_tracker.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | process/create | create child process | _fork |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/cache.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/path/tmp | path reference within /tmp | /tmp/cache |
| +LOW | ref/site/url | contains embedded HTTPS URLs | rails/rails#41522 https://guides.rubyonrails.org/upgrading_ruby_on_rails.html |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/hash/conversions.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | net/upload | uploads files | uploaded |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/multibyte/chars.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | net/socket/send | send a message to a socket | _send |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/key_generator.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/words/password | references a 'password' | uses this for password storage |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/callbacks.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using exec() | exec(target, |
| +LOW | ref/site/url | contains embedded HTTPS URLs | rails/rails#18011 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/encrypted_file.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | fs/symlink/resolve | resolves symbolic links | realpath |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/parameter_filter.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/words/password | references a 'password' | password |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/message_encryptor.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | encoding/base64 | Supports base64 encoded strings | base64 |
| +LOW | ref/site/url | contains embedded HTTPS URLs | ruby/openssl#63 https://www.limited-entropy.com/padding-oracle-attacks/. |
| +LOW | ref/words/password | references a 'password' | password |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/cache/strategy/local_cache.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/words/exclamation | gets very excited | !! |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/digest/uuid.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://www.ietf.org/rfc/rfc4122.txt |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/testing/stream.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(" |
| +LOW | fs/file/delete | deletes files | unlink |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/values/time_zone.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | ruby/date#39 |
| +LOW | time/tzinfo | Uses timezone information | tzinfo |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/duration/iso8601_parser.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://en.wikipedia.org/wiki/ISO_8601 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/duration.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://en.wikipedia.org/wiki/ISO_8601 https://ruby-doc.org/stdlib/libdoc/date/rdoc/Date.html https://ruby-doc.org/stdlib/libdoc/time/rdoc/Time.html |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/file/atomic.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | fs/permission/modify | modifies file permissions | chmod |
| +LOW | fs/tempfile/create | Uses mktemp to create temporary files | temp file |
| +LOW | random/insecure | generate random numbers insecurely | rand |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/cache/redis_cache_store.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | net/socket/connect | initiate a connection on a socket | connect |
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://redis.io/commands/KEYS https://redis.io/topics/lru-cache |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/erb/util.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | encoding/json/decode | Decodes JSON messages | JSON.parse |
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://www.w3.org/TR/REC-xml/ |
| +LOW | ref/words/plugin | references a 'plugin' | plugins |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/backtrace_cleaner.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/path/root | path reference within /root | /root/app/models/person.rb |
| +LOW | ref/path/hidden | possible hidden file path | /puma/.match |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/test_case.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | exec/shell_command | execute a shell command | system |
| +LOW | process/create | create child process | fork |
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://docs.seattlerb.org/minitest/Minitest/Assertions.html |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/ordered_hash.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://yaml.org/type/omap.html |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/xml_mini.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | encoding/base64 | Supports base64 encoded strings | base64 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/testing/parallelization.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | exec/program/background | wait for process to exit | waitpid |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/message_pack/serializer.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | fd/write | writes to a file handle | packer.write(SIGNATURE_INT) packer.write(object) |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/current_attributes.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/words/agent | references an 'agent' | user_agent |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/messages/codec.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | evasion/base64/decode | decode base64 strings | urlsafe_decode64 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/testing/assertions.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | techniques/code_eval | evaluate code dynamically using eval() | eval(e, eval(expression |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/testing/strict_warnings.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | mikel/mail#1557 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/xml_mini/jdom.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://archive.is/9xcQQ |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/object/json.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | combo/recon/system_network | invasive recon val | ipaddr |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/testing/parallelization/worker.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | process/create | create child process | fork |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/core_ext/module/concerning.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | net/socket/send | send a message to a socket | _send |
| +LOW | ref/words/obfuscate | Mentions the word obfuscate | obfuscate |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/evented_file_update_checker.rb [⚠️ MEDIUM]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +MEDIUM | ref/path/tmp | references an unusual path within /tmp | /tmp/foo |
| +LOW | fs/symlink/resolve | resolves symbolic links | realpath |
| +LOW | fs/watch | monitors filesystem events | inotify |
| +LOW | process/create | create child process | fork |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/time_with_zone.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | net/socket/send | send a message to a socket | _send |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/descendants_tracker.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | ref/site/url | contains embedded HTTPS URLs | https://bugs.ruby-lang.org/issues/18928 |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/json/decoding.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | encoding/json/decode | Decodes JSON messages | JSON.parse |
| +LOW | ref/site/url | contains embedded HTTP URLs | http://www.json.org |
Added: ruby3.2-activesupport/usr/lib/ruby/gems/3.2.0/gems/activesupport-7.1.3.4/lib/active_support/deprecation/proxy_wrappers.rb [✅ LOW]
| RISK | KEY | DESCRIPTION | EVIDENCE |
|---|---|---|---|
| +LOW | net/socket/send | send a message to a socket | _send |
