d4vinci/scrapling

[MINED013] Password In Url: https://user:password@host — leaks creds via logs, referrer, error messages.

[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data — RCE.

[MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__.

[MINED107] Missing import: `string` used but not imported: The file uses `string.something(...)` but never imports `string`. This raises NameError at runtime the first time the line executes.

[MINED116] Workflow uses `secrets.DOCKER_USERNAME` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKER_USERNAME }` …

[MINED116] Workflow uses `secrets.DOCKER_PASSWORD` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.DOCKER_PASSWORD }` …

[MINED116] Workflow uses `secrets.CONTAINER_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.CONTAINER_TOKEN }` …

[MINED125] GHA script injection via github.event.pull_request.title in run-step: `run:` step interpolates ${{ github.event.pull_request.title }} directly into shell. PR title/body/branch/comment fiel…

[SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marshal.load(s) execute arbitrary code on untrusted input. Ported from dlint DUO103 / DUO120 (BSD-3).

[COMP001] High cognitive complexity: Function `_general_selection` has cognitive complexity 55 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — …

[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

[MINED106] Phantom test coverage: test_lxml: Test function `test_lxml` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifyin…

[MINED106] Phantom test coverage: test_bs4_lxml: Test function `test_bs4_lxml` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without …

[MINED106] Phantom test coverage: test_bs4_html5lib: Test function `test_bs4_html5lib` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage …

[MINED106] Phantom test coverage: test_pyquery: Test function `test_pyquery` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without ve…

[MINED106] Phantom test coverage: test_scrapling: Test function `test_scrapling` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage withou…

[MINED106] Phantom test coverage: test_parsel: Test function `test_parsel` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without veri…

[MINED106] Phantom test coverage: test_mechanicalsoup: Test function `test_mechanicalsoup` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line cover…

[MINED106] Phantom test coverage: test_selectolax: Test function `test_selectolax` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage with…

[MINED106] Phantom test coverage: test_scrapling_text: Test function `test_scrapling_text` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line cover…

[MINED106] Phantom test coverage: test_autoscraper: Test function `test_autoscraper` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage wi…

[MINED106] Phantom test coverage: test_invalid_header_format: Test function `test_invalid_header_format` runs code but contains no assert / expect / should call — it passes regardless of behaviour. A…

[MINED106] Phantom test coverage: test_json_error_handling: Test function `test_json_error_handling` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds …

[MINED106] Phantom test coverage: test_invalid_selector_initialization: Test function `test_invalid_selector_initialization` runs code but contains no assert / expect / should call — it passes regard…

[MINED106] Phantom test coverage: test_invalid_storage: Test function `test_invalid_storage` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line cov…

[MINED106] Phantom test coverage: test_bad_selectors: Test function `test_bad_selectors` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverag…

[MINED106] Phantom test coverage: test_unpickleable_objects: Test function `test_unpickleable_objects` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Add…

[MINED106] Phantom test coverage: test_text_handler_json_invalid: Test function `test_text_handler_json_invalid` runs code but contains no assert / expect / should call — it passes regardless of beha…

[MINED106] Phantom test coverage: test_init_with_negative_interval_raises: Test function `test_init_with_negative_interval_raises` runs code but contains no assert / expect / should call — it passes …

[MINED106] Phantom test coverage: test_init_with_invalid_interval_type_raises: Test function `test_init_with_invalid_interval_type_raises` runs code but contains no assert / expect / should call — it…

[MINED106] Phantom test coverage: test_cleanup_no_error_when_no_file: Test function `test_cleanup_no_error_when_no_file` runs code but contains no assert / expect / should call — it passes regardless…

[MINED106] Phantom test coverage: test_manager_no_default_session_when_empty: Test function `test_manager_no_default_session_when_empty` runs code but contains no assert / expect / should call — it p…

[MINED106] Phantom test coverage: test_add_duplicate_id_raises: Test function `test_add_duplicate_id_raises` runs code but contains no assert / expect / should call — it passes regardless of behaviou…

[MINED106] Phantom test coverage: test_remove_nonexistent_raises: Test function `test_remove_nonexistent_raises` runs code but contains no assert / expect / should call — it passes regardless of beha…

[MINED106] Phantom test coverage: test_get_nonexistent_raises_with_available: Test function `test_get_nonexistent_raises_with_available` runs code but contains no assert / expect / should call — it p…

[MINED106] Phantom test coverage: test_start_requests_raises_when_nothing_configured: Test function `test_start_requests_raises_when_nothing_configured` runs code but contains no assert / expect / sh…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `__getitem__` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-leve…

[MINED108] `self.attrib` used but never assigned in __init__: Method `__getitem__` of class `Selector` reads `self.attrib`, but no assignment to it exists in __init__ (and no class-level fallback). T…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `__contains__` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-lev…

[MINED108] `self.attrib` used but never assigned in __init__: Method `__contains__` of class `Selector` reads `self.attrib`, but no assignment to it exists in __init__ (and no class-level fallback). …

[MINED108] `self.__elements_convertor` used but never assigned in __init__: Method `__handle_elements` of class `Selector` reads `self.__elements_convertor`, but no assignment to it exists in __init_…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `tag` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level fallba…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `text` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `get_all_text` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-lev…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `attrib` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level fal…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `html_content` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-lev…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `body` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `prettify` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level f…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `has_class` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level …

[MINED108] `self.__element_convertor` used but never assigned in __init__: Method `parent` of class `Selector` reads `self.__element_convertor`, but no assignment to it exists in __init__ (and no cla…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `below_elements` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-l…

[MINED108] `self.__elements_convertor` used but never assigned in __init__: Method `below_elements` of class `Selector` reads `self.__elements_convertor`, but no assignment to it exists in __init__ (…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `children` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level f…

[MINED108] `self.__element_convertor` used but never assigned in __init__: Method `children` of class `Selector` reads `self.__element_convertor`, but no assignment to it exists in __init__ (and no c…

[MINED108] `self.parent` used but never assigned in __init__: Method `siblings` of class `Selector` reads `self.parent`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self.parent` used but never assigned in __init__: Method `siblings` of class `Selector` reads `self.parent`, but no assignment to it exists in __init__ (and no class-level fallback). This…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `iterancestors` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-le…

[MINED108] `self.__element_convertor` used but never assigned in __init__: Method `iterancestors` of class `Selector` reads `self.__element_convertor`, but no assignment to it exists in __init__ (and…

[MINED108] `self.iterancestors` used but never assigned in __init__: Method `find_ancestor` of class `Selector` reads `self.iterancestors`, but no assignment to it exists in __init__ (and no class-le…

[MINED108] `self.iterancestors` used but never assigned in __init__: Method `path` of class `Selector` reads `self.iterancestors`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED108] `self._is_text_node` used but never assigned in __init__: Method `next` of class `Selector` reads `self._is_text_node`, but no assignment to it exists in __init__ (and no class-level fallb…

[MINED110] Blocking call `requests.append` inside async function `test_snapshot_returns_copies`: `requests.append` is a synchronous (blocking) call. When invoked inside an `async def` it stalls the e…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `actions/setup-python` pinned to mutable ref `@v6`: `uses: actions/setup-python@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …

[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v6`: `uses: actions/upload-artifact@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `actions/github-script` pinned to mutable ref `@v8`: `uses: actions/github-script@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that mad…

[MINED115] Action `softprops/action-gh-release` pinned to mutable ref `@v2`: `uses: softprops/action-gh-release@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action own…

[MINED115] Action `actions/setup-python` pinned to mutable ref `@v6`: `uses: actions/setup-python@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …

[MINED115] Action `pypa/gh-action-pypi-publish` pinned to mutable ref `@release/v1`: `uses: pypa/gh-action-pypi-publish@release/v1` resolves at workflow-run time. Tags and branches can be re-pushed b…

[MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

[MINED115] Action `actions/setup-python` pinned to mutable ref `@v6`: `uses: actions/setup-python@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …

[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…

[MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions…

[MINED118] Dockerfile FROM `python:3.12-slim-trixie` not pinned by digest: `FROM python:3.12-slim-trixie` resolves the tag at build time. The registry CAN re-push a different image for the same tag, …

[MINED131] pre-commit hook `https://github.com/PyCQA/bandit` pinned to mutable rev `1.9.0`: `.pre-commit-config.yaml` references `https://github.com/PyCQA/bandit` at `rev: 1.9.0`. If `{rev}` is a bra…

[MINED131] pre-commit hook `https://github.com/netromdk/vermin` pinned to mutable rev `v1.7.0`: `.pre-commit-config.yaml` references `https://github.com/netromdk/vermin` at `rev: v1.7.0`. If `{rev}` …

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…

[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-…

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…

Agent control bridge may listen on a network interface without visible auth

Docker final stage has no non-root USER

Dockerfile separates apt update from install

Dockerfile copies broad context with incomplete .dockerignore

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

[MINED124] requirements.txt: `pngquant` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats…

[MINED124] requirements.txt: `pytest-cov` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosqua…

[MINED124] requirements.txt: `werkzeug<3.0.0` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typo…

[MINED124] requirements.txt: `pytest-asyncio` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typo…

[MINED124] requirements.txt: `pytest-xdist` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosq…

[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.

Duplicated implementation block across source files

Duplicated implementation block across source files

Duplicated implementation block across source files

[COMP001] High cognitive complexity: Function `clean` has cognitive complexity 13 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branch…

[COMP001] High cognitive complexity: Function `__str__` has cognitive complexity 10 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested bran…

.dockerignore misses sensitive defaults

[COMP001] High cognitive complexity (and 15 more): Same pattern found in 15 additional files. Review if needed.

[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

[MINED050] Stub Only Function (and 1 more): Same pattern found in 1 additional files. Review if needed.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

[MINED062] Python Dataclass No Fields (and 3 more): Same pattern found in 3 additional files. Review if needed.

[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.

[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.

[MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.

[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.

[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…

[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 1 more): Same pattern found in 1 additional files. Review if needed.