← Back to scan
File as GitHub Issue repo: ilbers/isar

Push this scan report to ilbers/isar

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Missing import: `os` used but not imported

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED030 [MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__. testsuite/cleanup.py:16
CRIT MINED018 [MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLo… testsuite/cleanup.py:16
CRIT SEC081 [SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marsh… testsuite/cleanup.py:16
CRIT MINED107 Missing import: `os` used but not imported bitbake/lib/bb/ui/taskexp_ncurses.py:146
CRIT MINED107 Missing import: `os` used but not imported bitbake/lib/bb/ui/taskexp.py:200
CRIT MINED107 Missing import: `string` used but not imported bitbake/lib/bb/fetch2/__init__.py:293
CRIT MINED107 Missing import: `queue` used but not imported bitbake/lib/bb/asyncrpc/serv.py:385
CRIT MINED107 Missing import: `collections` used but not imported bitbake/lib/layerindexlib/cooker.py:107
CRIT MINED107 Missing import: `string` used but not imported bitbake/lib/bs4/element.py:868
CRIT MINED107 Missing import: `queue` used but not imported bitbake/lib/bb/utils.py:1124
CRIT MINED107 Missing import: `collections` used but not imported bitbake/lib/bb/cooker.py:1129
CRIT MINED107 Missing import: `os` used but not imported meta/lib/oe/sstatesig.py:516
CRIT MINED107 Missing import: `stat` used but not imported meta/lib/oe/utils.py:577
CRIT MINED107 Missing import: `os` used but not imported meta/lib/oe/utils.py:585
CRIT MINED107 Missing import: `os` used but not imported meta/lib/oe/terminal.py:68
CRIT MINED107 Missing import: `os` used but not imported meta/scripts/lib/wic/plugins/source/boo…:104
CRIT MINED107 Missing import: `os` used but not imported meta/lib/buildstats.py:17
CRIT MINED107 Missing import: `os` used but not imported scripts/lib/wic/plugins/source/bootimg-…:104
CRIT MINED107 Missing import: `stat` used but not imported scripts/lib/wic/filemap.py:46
CRIT MINED107 Missing import: `os` used but not imported testsuite/citest.py:522
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … testsuite/keys/ssh/id_rsa:1
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… testsuite/unittests/bitbake.py:36
HIGH MINED034 [MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command inje… scripts/lockrun.py:42
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… bitbake/doc/sphinx-static/switchers.js:200
HIGH MINED108 `self.log` used but never assigned in __init__ testsuite/citest.py:42
HIGH MINED108 `self.exec_cmd` used but never assigned in __init__ testsuite/citest.py:40
HIGH MINED108 `self.init` used but never assigned in __init__ testsuite/citest.py:39
HIGH MINED108 `self.log` used but never assigned in __init__ testsuite/citest.py:36
HIGH MINED106 Phantom test coverage: test_run_arm_buster_example_module testsuite/citest.py:320
HIGH MINED106 Phantom test coverage: test_run_arm_buster_getty_target testsuite/citest.py:307
HIGH MINED106 Phantom test coverage: test_run_arm_buster_base testsuite/citest.py:300
HIGH MINED106 Phantom test coverage: test_run_arm_bullseye_getty_target testsuite/citest.py:288
HIGH MINED106 Phantom test coverage: test_run_arm_bullseye_example_module testsuite/citest.py:275
HIGH MINED106 Phantom test coverage: test_run_arm_bullseye_base testsuite/citest.py:268
HIGH MINED106 Phantom test coverage: test_cross testsuite/citest.py:256
HIGH MINED106 Phantom test coverage: test_installer_root_partition testsuite/citest.py:241
HIGH MINED106 Phantom test coverage: test_installer_run testsuite/citest.py:236
HIGH MINED106 Phantom test coverage: test_installer_build testsuite/citest.py:228
HIGH MINED106 Phantom test coverage: test_ccache_rebuild testsuite/citest.py:214
HIGH MINED106 Phantom test coverage: test_repro_unsigned testsuite/citest.py:193
HIGH MINED106 Phantom test coverage: test_repro_signed testsuite/citest.py:180
HIGH MINED106 Phantom test coverage: test_sbuild_flavor testsuite/citest.py:157
HIGH MINED106 Phantom test coverage: test_repository_nopriority testsuite/citest.py:140
HIGH MINED106 Phantom test coverage: test_compat_recipe testsuite/citest.py:122
HIGH MINED106 Phantom test coverage: test_dev_run_arm_bookworm testsuite/citest.py:110
HIGH MINED106 Phantom test coverage: test_dev_run_arm64_bookworm testsuite/citest.py:106
HIGH MINED106 Phantom test coverage: test_dev_run_amd64_bookworm testsuite/citest.py:102
HIGH MINED106 Phantom test coverage: test_dev_rebuild testsuite/citest.py:87
HIGH MINED106 Phantom test coverage: test_dev_apps testsuite/citest.py:78
HIGH MINED106 Phantom test coverage: test_dev testsuite/citest.py:67
HIGH MINED106 Phantom test coverage: test_build testsuite/citest.py:50
HIGH MINED106 Phantom test coverage: test_nop testsuite/citest.py:35
HIGH MINED108 `self.build_dir` used but never assigned in __init__ testsuite/repro-build-test.py:72
HIGH MINED108 `self.build_dir` used but never assigned in __init__ testsuite/repro-build-test.py:71
HIGH MINED108 `self.fail` used but never assigned in __init__ testsuite/repro-build-test.py:76
HIGH MINED108 `self.log` used but never assigned in __init__ testsuite/repro-build-test.py:67
HIGH MINED108 `self.delete_from_build_dir` used but never assigned in __init__ testsuite/repro-build-test.py:64
HIGH MINED108 `self.delete_from_build_dir` used but never assigned in __init__ testsuite/repro-build-test.py:63
HIGH MINED108 `self.log` used but never assigned in __init__ testsuite/repro-build-test.py:59
HIGH MINED108 `self.log` used but never assigned in __init__ testsuite/repro-build-test.py:51
HIGH MINED108 `self.error` used but never assigned in __init__ testsuite/repro-build-test.py:42
HIGH MINED108 `self.move_in_build_dir` used but never assigned in __init__ testsuite/repro-build-test.py:60
HIGH MINED108 `self.get_image_path` used but never assigned in __init__ testsuite/repro-build-test.py:58
HIGH MINED108 `self.bitbake` used but never assigned in __init__ testsuite/repro-build-test.py:55
HIGH MINED108 `self.configure` used but never assigned in __init__ testsuite/repro-build-test.py:52
HIGH MINED108 `self.clean` used but never assigned in __init__ testsuite/repro-build-test.py:48
HIGH MINED108 `self.git_last_commit_timestamp` used but never assigned in __init__ testsuite/repro-build-test.py:21
HIGH MINED108 `self.params` used but never assigned in __init__ testsuite/repro-build-test.py:20
HIGH MINED108 `self.params` used but never assigned in __init__ testsuite/repro-build-test.py:17
HIGH MINED108 `self.compare_repro_image` used but never assigned in __init__ testsuite/repro-build-test.py:26
HIGH MINED108 `self.build_repro_image` used but never assigned in __init__ testsuite/repro-build-test.py:25
HIGH MINED108 `self.build_repro_image` used but never assigned in __init__ testsuite/repro-build-test.py:24
HIGH MINED108 `self.init` used but never assigned in __init__ testsuite/repro-build-test.py:23
HIGH MINED106 Phantom test coverage: test_repro_build testsuite/repro-build-test.py:16
HIGH COMP001 [COMP001] High cognitive complexity: Function `main` has cognitive complexity 28 (SonarSo… scripts/pybootchartgui/pybootchartgui/m…:106
HIGH MINED118 Dockerfile FROM `alpine:3.14.4` not pinned by digest bitbake/contrib/prserv/Dockerfile:30
HIGH MINED118 Dockerfile FROM `alpine:3.13.1` not pinned by digest bitbake/contrib/hashserv/Dockerfile:11
HIGH MINED118 Dockerfile FROM `ghcr.io/siemens/kas/kas-isar (no tag)` not pinned by digest testsuite/dockerdata/Dockerfile:2
HIGH MINED112 Django view `XhrBuild` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:1189
HIGH MINED112 Django view `XhrProject` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:991
HIGH MINED112 Django view `XhrCustomRecipePackages` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:743
HIGH MINED112 Django view `XhrCustomRecipeId` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:685
HIGH MINED112 Django view `XhrCustomRecipe` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:511
HIGH MINED112 Django view `XhrLayer` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:265
HIGH MINED112 Django view `XhrSetDefaultImageUrl` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:183
HIGH MINED112 Django view `XhrProjectUpdate` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:140
HIGH MINED112 Django view `XhrBuildRequest` has destructive methods without auth bitbake/lib/toaster/toastergui/api.py:49
HIGH MINED112 Django view `CommandLineBuilds` has destructive methods without auth bitbake/lib/toaster/toastergui/views.py:1961
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… testsuite/utils.py:58
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … testsuite/unittests/bitbake.py:36
MED SEC007 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code. testsuite/cleanup.py:16
MED MINED109 Mutable default argument in `__init__` (dict) bitbake/lib/bb/asyncrpc/client.py:43
MED MINED109 Mutable default argument in `start` (dict) bitbake/lib/bs4/builder/_lxml.py:136
MED MINED109 Mutable default argument in `report_unihash_equiv` (dict) bitbake/lib/hashserv/client.py:105
MED MINED109 Mutable default argument in `report_unihash` (dict) bitbake/lib/hashserv/client.py:97
MED MINED109 Mutable default argument in `load_cache` (list) bitbake/lib/layerindexlib/restapi.py:84
MED MINED109 Mutable default argument in `load_layerindex` (list) bitbake/lib/layerindexlib/__init__.py:177
MED MINED109 Mutable default argument in `__init__` (list) bitbake/lib/bs4/dammit.py:335
MED MINED109 Mutable default argument in `search_tag` (dict) bitbake/lib/bs4/element.py:1597
MED MINED109 Mutable default argument in `__init__` (dict) bitbake/lib/bs4/element.py:1534
MED MINED109 Mutable default argument in `find_all` (dict) bitbake/lib/bs4/element.py:1243
MED MINED109 Mutable default argument in `find` (dict) bitbake/lib/bs4/element.py:1232
MED MINED109 Mutable default argument in `find_parents` (dict) bitbake/lib/bs4/element.py:479
MED MINED109 Mutable default argument in `find_parent` (dict) bitbake/lib/bs4/element.py:467
MED MINED109 Mutable default argument in `find_previous_siblings` (dict) bitbake/lib/bs4/element.py:458
MED MINED109 Mutable default argument in `find_previous_sibling` (dict) bitbake/lib/bs4/element.py:451
MED MINED109 Mutable default argument in `find_all_previous` (dict) bitbake/lib/bs4/element.py:442
MED MINED109 Mutable default argument in `find_previous` (dict) bitbake/lib/bs4/element.py:435
MED MINED109 Mutable default argument in `find_next_siblings` (dict) bitbake/lib/bs4/element.py:426
MED MINED109 Mutable default argument in `find_next_sibling` (dict) bitbake/lib/bs4/element.py:419
MED MINED109 Mutable default argument in `find_all_next` (dict) bitbake/lib/bs4/element.py:411
MED MINED109 Mutable default argument in `find_next` (dict) bitbake/lib/bs4/element.py:405
MED MINED109 Mutable default argument in `get_file_layer` (dict) bitbake/lib/bb/utils.py:1552
MED MINED111 Bare except continues silently bitbake/lib/bb/build.py:627
MED MINED111 Bare except continues silently bitbake/lib/bb/build.py:264
MED MINED111 Bare except continues silently bitbake/lib/bb/build.py:191
MED MINED111 Bare except continues silently bitbake/lib/bb/cache.py:494
MED MINED111 Bare except continues silently bitbake/lib/bb/cache.py:968
MED MINED111 Bare except continues silently bitbake/lib/bb/cache.py:854
MED MINED111 Bare except continues silently bitbake/lib/bb/runqueue.py:1449
MED MINED111 Bare except continues silently bitbake/lib/bb/runqueue.py:182
MED MINED111 Bare except continues silently bitbake/lib/bb/event.py:211
MED MINED109 Mutable default argument in `__init__` (list) bitbake/lib/bb/event.py:479
MED MINED111 Bare except continues silently bitbake/lib/bb/command.py:137
MED MINED111 Bare except continues silently bitbake/lib/bb/data_smart.py:66
MED MINED111 Bare except continues silently bitbake/lib/bb/persist_data.py:148
MED MINED111 Bare except continues silently bitbake/lib/bb/cooker.py:1570
MED MINED111 Bare except continues silently bitbake/lib/bb/cooker.py:119
MED MINED111 Bare except continues silently bitbake/lib/bb/cooker.py:2105
MED MINED111 Bare except continues silently bitbake/lib/bb/cooker.py:2098
MED MINED111 Bare except continues silently bitbake/lib/bb/cooker.py:2030
MED MINED111 Bare except continues silently bitbake/contrib/dump_cache.py:54
MED MINED111 Bare except continues silently bitbake/contrib/dump_cache.py:79
MED MINED111 Bare except continues silently meta/lib/oe/path.py:116
MED MINED111 Bare except continues silently meta/lib/oe/path.py:233
MED MINED111 Bare except continues silently meta/lib/oe/utils.py:283
MED MINED111 Bare except continues silently meta/lib/oe/terminal.py:222
MED MINED111 Bare except continues silently meta/lib/oe/terminal.py:332
MED MINED111 Bare except continues silently testsuite/utils.py:61
MED MINED109 Mutable default argument in `bitbake` (list) testsuite/cibuilder.py:306
MED COMP001 [COMP001] High cognitive complexity: Function `prune` has cognitive complexity 21 (SonarS… scripts/pybootchartgui/pybootchartgui/p…:155
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DKR001 Docker final stage has no non-root USER testsuite/dockerdata/Dockerfile:3
MED DKR001 Docker final stage has no non-root USER bitbake/contrib/prserv/Dockerfile:31
MED DKR001 Docker final stage has no non-root USER bitbake/contrib/hashserv/Dockerfile:12
MED WEB003 Public web service has no security.txt .well-known/security.txt
MED AGT006 React interval is created without an explicit cleanup bitbake/lib/toaster/toastergui/static/j…:137
MED SEC005 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input. scripts/lockrun.py:42
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… testsuite/start_vm.py:92
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… testsuite/repro-build-test.py:68
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… bitbake/doc/sphinx-static/switchers.js:221
LOW COMP001 [COMP001] High cognitive complexity: Function `merge_logger` has cognitive complexity 14 … scripts/pybootchartgui/pybootchartgui/p…:197
LOW AIC003 Duplicated implementation block across source files scripts/lib/wic/plugins/source/rootfs.py:53
LOW AIC003 Duplicated implementation block across source files scripts/lib/wic/plugins/source/isoimage…:10
LOW AIC003 Duplicated implementation block across source files scripts/lib/wic/plugins/source/bootimg-…:15
LOW AIC003 Duplicated implementation block across source files scripts/lib/wic/plugins/source/bootimg-…:42
LOW AIC003 Duplicated implementation block across source files scripts/lib/wic/plugins/source/bootimg-…:19
LOW AIC003 Duplicated implementation block across source files scripts/lib/wic/plugins/source/bootimg-…:1
LOW AIC003 Duplicated implementation block across source files bitbake/lib/toaster/toastermain/managem…:25
LOW AIC003 Duplicated implementation block across source files bitbake/lib/bb/ui/uievent.py:50
INFO MINED077 [MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles. scripts/pybootchartgui/pybootchartgui/m…:145
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… scripts/ci_build.sh:25
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … bitbake/doc/sphinx-static/switchers.js:162
Reset to top 5 164 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `ilbers/isar`

**Score: 54/100 (B-)**  ·  175 findings  ·  scanned 2026-06-05 14:30 UTC  ·  122,158 LOC

| Severity | Count |
|---|---|
| CRITICAL | 21 |
| HIGH | 67 |
| MEDIUM | 61 |
| LOW | 12 |

📊 [Full filterable report](https://repobility.com/scan/be4da8ca-e338-4195-92e9-a8bd1035b103/)  ·  ![scorecard](https://repobility.com/scan/be4da8ca-e338-4195-92e9-a8bd1035b103/report.png?v=1780669820-s2)

### Top findings

1. **CRITICAL** `MINED030` — Python Pickle Loads
   `testsuite/cleanup.py:16` · CWE-502 · ✓ Repobility
2. **CRITICAL** `MINED018` — Unsafe Deserialization Pickle
   `testsuite/cleanup.py:16` · CWE-502 · ✓ Repobility
3. **CRITICAL** `SEC081` — Python: pickle.loads / marshal.loads on untrusted data
   `testsuite/cleanup.py:16` · A05:2021 Security Misconfiguration
4. **CRITICAL** `MINED107` — Missing import: `os` used but not imported
   `bitbake/lib/bb/ui/taskexp_ncurses.py:146` · ✓ Repobility
5. **CRITICAL** `MINED107` — Missing import: `os` used but not imported
   `bitbake/lib/bb/ui/taskexp.py:200` · ✓ Repobility

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/be4da8ca-e338-4195-92e9-a8bd1035b103/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 3 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'ilbers/isar' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Filing guard overridden Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.