https://github.com/ZhiXuanWang/cf-speed-dns ·
lang: python ·
LOC: ·
source: both
| Rule | Severity | Count |
|---|---|---|
MINED111 Bare except continues silently |
medium | 8 |
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) |
high | 6 |
MINED108 self.attribute used but never assigned in __init__ |
high | 4 |
COMP001 [COMP001] High cognitive complexity: Function `load_yfinanc… |
low | 3 |
SEC020 Secret Printed to Logs |
high | 2 |
MINED067 Python Requests No Timeout |
info | 2 |
MINED049 Print Pii |
info | 2 |
SEC078 Python: requests without timeout |
high | 2 |
MINED043 Http Not Https |
info | 2 |
WEB001 Public web app has no robots.txt |
low | 1 |
CORE_NO_TESTS
No test files found
No test files foundMINED108
self.attribute used but never assigned in __init__
CWE-476
dnspod.py:82
· conf 1.00
[MINED108] `self._get_signature_key` used but never assigned in __init__: Method `sign` of class `TencentCloudSigner` reads `self._get_signature_key`, but no assignment to it exists in __init__ (and …MINED108
self.attribute used but never assigned in __init__
CWE-476
dnspod.py:142
· conf 1.00
[MINED108] `self._call_api` used but never assigned in __init__: Method `get_record` of class `DnsPodClient` reads `self._call_api`, but no assignment to it exists in __init__ (and no class-level fal…MINED108
self.attribute used but never assigned in __init__
CWE-476
dnspod.py:157
· conf 1.00
[MINED108] `self._call_api` used but never assigned in __init__: Method `get_record` of class `DnsPodClient` reads `self._call_api`, but no assignment to it exists in __init__ (and no class-level fal…MINED108
self.attribute used but never assigned in __init__
CWE-476
dnspod.py:174
· conf 1.00
[MINED108] `self._call_api` used but never assigned in __init__: Method `change_record` of class `DnsPodClient` reads `self._call_api`, but no assignment to it exists in __init__ (and no class-level …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/dns_cf.yml:16
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/dns_cf.yml:18
· conf 0.90
[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/dns_pod.yml:16
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/dns_pod.yml:18
· conf 0.90
[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/sync.yml:23
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/sync.yml:28
· conf 0.90
[MINED115] Action `aormsby/Fork-Sync-With-Upstream-action` pinned to mutable ref `@v3.4`: `uses: aormsby/[email protected]` resolves at workflow-run time. Tags and branches can be r…SEC078
Python: requests without timeout
dnscf.py:44
· conf 1.00
[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…SEC078
Python: requests without timeout
dnspod.py:195
· conf 1.00
[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…CFG006
[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.
[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.MINED111
Bare except continues silently
dnscf.py:50
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnscf.py:83
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnscf.py:128
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnscf.py:159
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnspod.py:201
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnspod.py:230
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnspod.py:255
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.MINED111
Bare except continues silently
dnspod.py:285
· conf 1.00
[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.WEB003
Public web service has no security.txt
.well-known/security.txt
· conf 0.78
Public web service has no security.txtWEB015
Public web app has no Content Security Policy
index.html
· conf 0.70
Public web app has no Content Security PolicyAIC003
Duplicated implementation block across source files
dnspod.py:142
· conf 0.86
Duplicated implementation block across source filesCOMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
dnscf.py:31
· conf 0.95
[COMP001] High cognitive complexity: Function `get_cf_speed_test_ip` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand —…COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
dnscf.py:57
· conf 0.95
[COMP001] High cognitive complexity: Function `get_dns_records` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nest…COMP001
[COMP001] High cognitive complexity: Function `load_yfinance_data` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, for=1, if=2, nested_bonus=3, or=2.
dnspod.py:182
· conf 0.95
[COMP001] High cognitive complexity: Function `get_cf_speed_test_ip` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand —…CORE_NO_LICENSE
No LICENSE file
No LICENSE fileWEB001
Public web app has no robots.txt
robots.txt
· conf 0.74
Public web app has no robots.txtWEB002
Public web app has no sitemap
sitemap.xml
· conf 0.72
Public web app has no sitemapWEB008
Public docs site has no llms.txt
llms.txt
· conf 0.64
Public docs site has no llms.txtWEB011
Public web app has no humans.txt
humans.txt
· conf 0.50
Public web app has no humans.txtMINED043
Http Not Https
CWE-319
dnscf.py:146
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
dnspod.py:272
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED049
Print Pii
CWE-532
dnscf.py:143
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED049
Print Pii
CWE-532
dnspod.py:269
· conf 1.00
[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.MINED067
Python Requests No Timeout
CWE-400
dnscf.py:44
· conf 1.00
[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.MINED067
Python Requests No Timeout
CWE-400
dnspod.py:195
· conf 1.00
[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.SEC020
Secret Printed to Logs
dnscf.py:143
· conf 0.15
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
dnspod.py:269
· conf 0.15
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/2cb101d2-97f8-4a7c-ac78-0e7f30b02851/.