Home / apereo / cas
Repository Analysis

apereo/cas

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

1.1 Likely human-written View on GitHub
1.1
Adjusted Score
1.1
Raw Score
100%
Time Factor
2026-05-30
Last Push
11,335
Stars
Java
Language
751,459
Lines of Code
10681
Files
380
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 41HIGH 0MEDIUM 10LOW 329

Pattern Findings

380 matches across 10 categories. Click a row to expand file-level details.

Hallucination Indicators41 hits · 488 pts
SeverityFileLineSnippet
CRITICAL…s/web/support/gen/CookieRetrievingCookieGenerator.java109 var cookie = org.springframework.web.util.WebUtils.getCookie(request, Objects.requireNonNull(getCookieName()
CRITICAL…cenarios/sso-access-per-service/services/Sample-2.json15 "randomNumber" : "groovy { return org.apereo.cas.util.RandomUtils.generateSecureRandomId() }"
CRITICAL…cenarios/sso-access-per-service/services/Sample-1.json15 "randomNumber" : "groovy { return org.apereo.cas.util.RandomUtils.generateSecureRandomId() }"
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md166 at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md167 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md168 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md169 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md170 at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md201 org.apereo.cas.client.validation.Saml11TicketValidator.retrieveResponseFromServer(Saml11TicketValidator.java:203)
CRITICAL…er-documentation/installation/Troubleshooting-Guide.md202 org.apereo.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:185)
CRITICAL…-documentation/authentication/SPNEGO-Authentication.md234 at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)
CRITICAL…org/apereo/cas/config/CasJpaUtilAutoConfiguration.java52 com.mysql.cj.jdbc.Driver.class.getName(),
CRITICAL…org/apereo/cas/config/CasJpaUtilAutoConfiguration.java55 org.mariadb.jdbc.Driver.class.getName()
CRITICAL…ereo/cas/heimdall/HeimdallAuthorizationController.java59 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…ereo/cas/heimdall/HeimdallAuthorizationController.java98 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…/org/apereo/cas/config/CasJaversAutoConfiguration.java100 @Pointcut("execution(* org.apereo.cas.services.ServicesManager.save(..))")
CRITICAL…meleaf/src/main/resources/static/js/palantir-system.js153 const originalLabels = Chart.defaults.plugins.legend.labels.generateLabels(chart);
CRITICAL…hymeleaf/src/main/resources/static/js/inwebo/client.js3 o=(h[2]||"").split(".").sort(),n){for(l=oa.event.special[n]||{},m=i[n=(d?l.delegateType:l.bindType)||n]||[],h=h[
CRITICAL…hymeleaf/src/main/resources/static/js/inwebo/client.js4 if(v="abort",r.add(n.complete),w.done(n.success),w.fail(n.error),d=Y(Kb,n,b,w)){if(w.readyState=1,k&&p.trigger("
CRITICAL…hymeleaf/src/main/resources/static/js/inwebo/client.js5 this.options.axis&&"x"===this.options.axis||(this.helper[0].style.top=this.position.top+"px"),a.ui.ddmanager&&a.ui.d
CRITICAL…c/main/resources/templates/consent/casConsentView.html171 #{screen.consent.options.desc.attributevalue.first(${service.id})} +
CRITICAL…c/main/resources/templates/consent/casConsentView.html173 #{screen.consent.options.desc.attributevalue.second(${service.id})} +
CRITICAL…c/main/resources/templates/consent/casConsentView.html175 #{screen.consent.options.desc.attributevalue.third(${service.id})} +
CRITICAL…apereo/cas/support/rest/RegisteredServiceResource.java72 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…/cas/config/CasJpaTicketRegistryAutoConfiguration.java231 val repo = new org.springframework.integration.jdbc.lock.DefaultLockRepository(dataSourceTicket);
CRITICAL…g/OidcDynamicClientRegistrationEndpointController.java61 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…dynareg/OidcClientConfigurationEndpointController.java94 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…llers/jwks/OidcJwksRegistrationEndpointController.java68 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…IdPDelegatedClientAuthenticationRequestCustomizer.java136 if (org.apache.commons.lang3.StringUtils.isBlank(identityProviderEntityId)) {
CRITICAL…dp/metadata/SamlRegisteredServiceMetadataEndpoint.java216 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(required = true,
CRITICAL…va/org/apereo/cas/webauthn/web/WebAuthnController.java106 requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…shell/commands/util/ValidateLdapConnectionCommand.java131 if (org.apache.commons.lang3.StringUtils.isNotBlank(userPassword)) {
CRITICAL…thn/web/flow/WebAuthnMultifactorWebflowConfigurer.java97 val appId = org.apache.commons.lang3.StringUtils.defaultIfBlank(webAuthn.getCore().getApplicationId(), casPr
CRITICAL…dpoints/OAuth20AccessTokenEndpointControllerTests.java681 assertEquals(org.springframework.http.HttpStatus.FOUND.value(), devResponse.getStatus());
CRITICAL…/cas/adaptors/duo/web/DuoSecurityAdminApiEndpoint.java129 @io.swagger.v3.oas.annotations.parameters.RequestBody(
CRITICAL…eo/cas/config/CasSpringBootAdminAutoConfiguration.java95 val nettyHttpClient = reactor.netty.http.client.HttpClient.create()
CRITICAL…in/java/org/apereo/cas/logging/CloudWatchAppender.java104 org.apereo.cas.util.LoggingUtils.error(LOGGER, e);
CRITICAL…in/java/org/apereo/cas/logging/CloudWatchAppender.java226 org.apereo.cas.util.LoggingUtils.error(LOGGER, e);
CRITICAL…in/java/org/apereo/cas/logging/CloudWatchAppender.java234 org.apereo.cas.util.LoggingUtils.error(LOGGER, e);
CRITICAL…in/java/org/apereo/cas/logging/CloudWatchAppender.java261 org.apereo.cas.util.LoggingUtils.error(LOGGER, e);
CRITICAL…in/java/org/apereo/cas/logging/CloudWatchAppender.java303 org.apereo.cas.util.LoggingUtils.error(LOGGER, e);
Hyper-Verbose Identifiers190 hits · 183 pts
SeverityFileLineSnippet
LOW…s/throttle/DefaultThrottledRequestResponseHandler.java22public class DefaultThrottledRequestResponseHandler implements ThrottledRequestResponseHandler {
LOWci/tests/puppeteer/run.sh55function downloadAndRunExternalTomcat() {
LOW…scenarios/redis-ticket-registry-idle-timeout/script.js9async function verifyTicketGrantingTicketCount(count = 0) {
LOW…/scenarios/passwordless-login-user-selection/script.js29async function authenticateWithDelegation(browser) {
LOW…/scenarios/passwordless-login-user-selection/script.js53async function authenticateWithPasswordlessToken(browser) {
LOW…tests/puppeteer/scenarios/pm-account-profile/script.js15async function importMultifactorTrustedRecord() {
LOW…tests/puppeteer/scenarios/pm-account-profile/script.js50async function removeMultifactorTrustedRecord(record) {
LOW…tests/puppeteer/scenarios/pm-account-profile/script.js54async function verifyAccountManagementFlow(browser) {
LOW…tests/puppeteer/scenarios/pm-account-profile/script.js131async function verifyPasswordManagementFlow(browser) {
LOW…ppeteer/scenarios/pm-mfa-device-registration/script.js6async function registerGoogleAuthenticatorAccount() {
LOW…ppeteer/scenarios/pm-mfa-device-registration/script.js17async function deleteGoogleAuthenticatorAccounts() {
LOW…ppeteer/scenarios/pm-mfa-device-registration/script.js21async function passwordResetFlowMfaWithoutRegisteredDevice(browser) {
LOW…sts/puppeteer/scenarios/oidc-authzcode-login/script.js4async function verifyAccessTokenIsLimited(context) {
LOW…sts/puppeteer/scenarios/oidc-authzcode-login/script.js43async function verifyAccessTokenIsNeverReceived(context) {
LOW…sts/puppeteer/scenarios/oidc-authzcode-login/script.js75async function verifyAccessTokenAndProfile(context) {
LOW…sts/puppeteer/scenarios/oidc-authzcode-login/script.js183async function verifyMissingTicketGrantingCookie(context) {
LOW…ts/puppeteer/scenarios/delegated-login-saml2/script.js8async function verifyNormalAuthenticationFlow(browser) {
LOW…/tests/puppeteer/scenarios/oidc-login-jwt-at/script.js62async function verifyAccessTokenWithProfile(accessToken) {
LOW…r/scenarios/shibboleth-idp-service-selection/script.js4function getShibbolethUrlForEntityId(entityId) {
LOW…uppeteer/scenarios/surrogate-login-selection/script.js20async function verifyImpersonationByPrincipalAttributes(browser) {
LOW…uppeteer/scenarios/surrogate-login-selection/script.js39async function verifyImpersonationByPrincipalAttributesDisabled(browser) {
LOW…narios/mfa-duo-universal-login-storage-fails/script.js3async function makeBrowserStorageUnavailable(page) {
LOW…ests/puppeteer/scenarios/oidc-token-exchange/script.js97async function verifyTokenExchangeNativeSso() {
LOW…eer/scenarios/mfa-webauthn-register-qr-login/script.js7async function verifyFlowUsingQRCodeButtonSameWindow() {
LOW…uppeteer/scenarios/account-mgmt-registration/script.js4async function verifyAccountRegistrationWithOidcService() {
LOW…uppeteer/scenarios/account-mgmt-registration/script.js30async function submitAccountRegistrationRequest(page, browser) {
LOW…uppeteer/scenarios/account-mgmt-registration/script.js70async function verifyAccountRegistrationWithCasService() {
LOW…enarios/pm-account-profile-mfa-trusteddevice/script.js7async function passwordResetFlowWithoutTrustedDevice(browser) {
LOW…enarios/pm-account-profile-mfa-trusteddevice/script.js58async function passwordResetFlowWithTrustedDevice(browser) {
LOW…enarios/pm-account-profile-mfa-trusteddevice/script.js97async function passwordResetFlowWithAccountProfileWithoutTrustedDevice(browser) {
LOW…enarios/pm-account-profile-mfa-trusteddevice/script.js129async function passwordResetFlowWithAccountProfileWithTrustedDeviceIgnored(browser) {
LOW…scenarios/redis-ticket-registry-loadbalanced/script.js5async function ensureNoSsoSessionsExistAfterLogout(page, port) {
LOW…scenarios/redis-ticket-registry-loadbalanced/script.js38async function checkTicketValidationAcrossNodes(browser) {
LOW…/scenarios/passwordless-delegation-with-ldap/script.js5async function verifyDelegatedAuthenticationFlow(page) {
LOW…/scenarios/passwordless-delegation-with-ldap/script.js21async function verifyPasswordRequestFlow(page) {
LOW…puppeteer/scenarios/surrogate-oidc-authzcode/script.js4async function verifyImpersonationAutoSelected(browser) {
LOW…puppeteer/scenarios/surrogate-oidc-authzcode/script.js69async function verifyImpersonationUserChoice(browser) {
LOW…er/scenarios/mfa-gauth-login-trusted-devices/script.js4async function loginAndRegisterTrustedDevice(browser) {
LOW…er/scenarios/mfa-gauth-login-trusted-devices/script.js30async function loginFromPublicWorkstation(browser) {
LOW…puppeteer/scenarios/oidc-par-authzcode-login/script.js4async function sendPushAuthorizationRequest(redirectUrl) {
LOW…puppeteer/scenarios/oidc-par-authzcode-login/script.js24async function verifyPushAuthorizationRequestSuccess() {
LOW…puppeteer/scenarios/oidc-par-authzcode-login/script.js92async function verifyPushAuthorizationFailure() {
LOW…s/puppeteer/scenarios/oidc-clientcredentials/script.js63async function verifyClientCredentialsGrantType() {
LOW…puppeteer/scenarios/interrupt-aftersso-login/script.js42async function verifyInterruptionBlocked(context) {
LOW…gate-login-selection-duomfa-universal-prompt/script.js7async function verifyImpersonationWithMfa(page) {
LOW…gate-login-selection-duomfa-universal-prompt/script.js45async function verifyNoImpersonationWithMfa(page) {
LOWci/tests/puppeteer/scenarios/oidc-logout/script.js4async function verifyLogoutWithIdTokenHint(clientId, casService, page) {
LOWci/docs/publish.sh18function validateProjectDocumentation() {
LOWdocs/cas-server-documentation/javascripts/main.js3function isDocumentationSiteViewedLocally() {
LOWdocs/cas-server-documentation/javascripts/main.js7function generateNavigationBarAndCrumbs() {
LOWdocs/cas-server-documentation/javascripts/main.js31function getActiveDocumentationVersionInView(returnBlankIfNoVersion) {
LOWdocs/cas-server-documentation/javascripts/main.js53function loadSidebarForActiveVersion() {
LOWdocs/cas-server-documentation/javascripts/main.js166function generateSidebarLinksForActiveVersion() {
LOW…thymeleaf/src/main/resources/static/js/palantir-mfa.js1async function populateMultifactorProviderTables() {
LOW…thymeleaf/src/main/resources/static/js/palantir-mfa.js99async function initializeMultifactorOperations() {
LOW…thymeleaf/src/main/resources/static/js/palantir-mfa.js204async function initializeTrustedMultifactorOperations() {
LOW…ymeleaf/src/main/resources/static/js/palantir-authz.js1async function initializeHeimdallOperations() {
LOW…ymeleaf/src/main/resources/static/js/palantir-authz.js101async function initializeAccessStrategyOperations() {
LOW…eleaf/src/main/resources/static/js/palantir-consent.js1async function initializeConsentOperations() {
LOW…thymeleaf/src/main/resources/static/js/palantir-sso.js29async function initializeSsoSessionOperations() {
130 more matches not shown…
Over-Commented Block123 hits · 82 pts
SeverityFileLineSnippet
LOW…eteer/scenarios/oidc-login-strapi/strapi/entrypoint.sh1#!/bin/bash
LOWci/tests/elastic/apm-server.yml1######################### APM Server Configuration #########################
LOWci/tests/elastic/apm-server.yml21
LOWci/tests/elastic/apm-server.yml41 #rate_limit:
LOWci/tests/elastic/apm-server.yml61
LOWci/tests/elastic/apm-server.yml81 # request from the agent.
LOWci/tests/elastic/apm-server.yml101 # Path to file containing the certificate for server authentication.
LOWci/tests/elastic/apm-server.yml121
LOWci/tests/elastic/apm-server.yml141
LOWci/tests/elastic/apm-server.yml161 #source_mapping:
LOWci/tests/elastic/apm-server.yml181 #elasticsearch:
LOWci/tests/elastic/apm-server.yml201 # When using APM agent configuration, information fetched from Elasticsearch or Kibana will be cached in memory for
LOWci/tests/elastic/apm-server.yml221 # Scheme and port can be left out and will be set to the default (`http` and `5601`).
LOWci/tests/elastic/apm-server.yml241 #
LOWci/tests/elastic/apm-server.yml261 #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
LOWci/tests/elastic/apm-server.yml281
LOWci/tests/elastic/apm-server.yml301
LOWci/tests/elastic/apm-server.yml321 #username: "elastic"
LOWci/tests/elastic/apm-server.yml341 # tries to reconnect. If the attempt fails, the backoff timer is increased
LOWci/tests/elastic/apm-server.yml361 # Enable custom SSL settings. Set to false to ignore custom SSL settings for secure communication.
LOWci/tests/elastic/apm-server.yml381 #ssl.verification_mode: full
LOWci/tests/elastic/apm-server.yml401 #ssl.cipher_suites: []
LOWci/tests/elastic/apm-server.yml421 # Configure escaping HTML symbols in strings.
LOWci/tests/elastic/apm-server.yml441 # Optional maximum time to live for a connection to Logstash, after which the
LOWci/tests/elastic/apm-server.yml461 # after a network error. After waiting backoff.init seconds, apm-server
LOWci/tests/elastic/apm-server.yml481 # Enable SSL support. SSL is automatically enabled if any SSL setting is set.
LOWci/tests/elastic/apm-server.yml501 #ssl.verification_mode: full
LOWci/tests/elastic/apm-server.yml521 #ssl.cipher_suites: []
LOWci/tests/elastic/apm-server.yml541 # using any event field. To set the topic from document type use `%{[type]}`.
LOWci/tests/elastic/apm-server.yml561 # Authentication details. Password is required if username is set.
LOWci/tests/elastic/apm-server.yml581 #retry.max: 3
LOWci/tests/elastic/apm-server.yml601
LOWci/tests/elastic/apm-server.yml621 # Set the compression level. Currently only gzip provides a compression level
LOWci/tests/elastic/apm-server.yml641 #ssl.enabled: false
LOWci/tests/elastic/apm-server.yml661
LOWci/tests/elastic/apm-server.yml681
LOWci/tests/elastic/apm-server.yml701 # Name of the Kerberos user. It is used when auth_type is set to password.
LOWci/tests/elastic/apm-server.yml721 # Hosts to report instrumentation results to.
LOWci/tests/elastic/apm-server.yml741
LOWci/tests/elastic/apm-server.yml761 # Windows systems default to file output. All other systems default to syslog.
LOWci/tests/elastic/apm-server.yml781 # The period after which to log the internal metrics. The default is 30s.
LOWci/tests/elastic/apm-server.yml801
LOWci/tests/elastic/apm-server.yml821 #http.enabled: false
LOWci/tests/elastic/apm-server.yml841 # output configuration. This means that if you have the Elasticsearch output configured,
LOWci/tests/elastic/apm-server.yml861
LOWci/tests/elastic/apm-server.yml881 # The maximum number of seconds to wait before attempting to connect to
LOWci/tests/elastic/apm-server.yml901 # * certificate, which verifies that the provided certificate is signed by a
LOWci/tests/elastic/apm-server.yml921 #ssl.key: "/etc/pki/client/cert.key"
LOWci/tests/ldap/run-ad-server.sh1#!/bin/bash
LOWci/tests/cassandra/cassandra.yaml1
LOWci/tests/cassandra/cassandra.yaml21# Specifying initial_token will override this setting on the node's initial start,
LOWci/tests/cassandra/cassandra.yaml41
LOWci/tests/cassandra/cassandra.yaml61# this defines the maximum amount of time a dead host will have hints
LOWci/tests/cassandra/cassandra.yaml81
LOWci/tests/cassandra/cassandra.yaml101# Authentication backend, implementing IAuthenticator; used to identify users
LOWci/tests/cassandra/cassandra.yaml121# Part of the Authentication & Authorization backend, implementing IRoleManager; used
LOWci/tests/cassandra/cassandra.yaml141
LOWci/tests/cassandra/cassandra.yaml161# Will be disabled automatically for AllowAllAuthorizer.
LOWci/tests/cassandra/cassandra.yaml181credentials_validity_in_ms: 2000
LOWci/tests/cassandra/cassandra.yaml201partitioner: org.apache.cassandra.dht.Murmur3Partitioner
63 more matches not shown…
Self-Referential Comments7 hits · 26 pts
SeverityFileLineSnippet
MEDIUMci/tests/elastic/apm-server.yml19 # Define a shared secret token for authorizing agents using the "Bearer" authorization method.
MEDIUMci/tests/ldap/run-ldap-server.sh34# Create an empty OpenLdap server for the company Example Inc. and the domain example.org.
MEDIUMci/tests/cassandra/generate-keys.sh52# Create the cluster key for cluster communication.
MEDIUMci/tests/cassandra/generate-keys.sh57# Create the public key for the cluster which is used to identify nodes.
MEDIUMci/tests/cassandra/generate-keys.sh70# Create the client key for CQL.
MEDIUMci/tests/cassandra/generate-keys.sh75# Create the public key for the client to identify itself.
MEDIUMci/tests/cassandra/generate-keys.sh84# Create a pks12 keystore file
Verbosity Indicators6 hits · 9 pts
SeverityFileLineSnippet
LOWci/tests/cassandra/cassandra.yaml1109# Step 1: Set internode_encryption=<dc|rack|all> and explicitly set optional=true. Restart all nodes
LOWci/tests/cassandra/cassandra.yaml1111# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual
LOWci/tests/cassandra/cassandra.yaml1156# Step 1: Set enabled=true and explicitly set optional=true. Restart all nodes
LOWci/tests/cassandra/cassandra.yaml1158# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual
LOWgradle/libs.versions.toml272# This section handles Gradle build classpath dependency versions
LOWgradle/libs.versions.toml808# This section handles Gradle build classpath dependencies
Slop Phrases2 hits · 6 pts
SeverityFileLineSnippet
MEDIUMci/tests/cassandra/cassandra.yaml46# initial_token allows you to specify tokens manually. While you can use it with
MEDIUMci/tests/cassandra/cassandra.yaml715# you may want to adjust max_value_size_in_mb accordingly. This should be positive and less than 2048.
Unused Imports4 hits · 4 pts
SeverityFileLineSnippet
LOWetc/loadtests/locust/cas/samlLocust.py3
LOWetc/loadtests/locust/cas/allLocust.py1
LOWetc/loadtests/locust/cas/casLocust.py3
LOWetc/loadtests/locust/cas/casLocust.py10
Fake / Example Data4 hits · 4 pts
SeverityFileLineSnippet
LOW…web/flow/CasSimpleMultifactorSendTokenActionTests.java53 "mail", List.of("cas@example.org", "user@example.com"),
LOW…ain/resources/templates/login/casLoginMessageView.html16 <span class="mdc-list-item__text" th:utext="${message.text}">Lorem ipsum dolor sit amet, consectetur
LOW…ain/resources/templates/login/casLoginMessageView.html16 <span class="mdc-list-item__text" th:utext="${message.text}">Lorem ipsum dolor sit amet, consectetur
LOW…apereo/cas/support/saml/SamlAttributeEncoderTests.java23 original.put("address", EncodingUtils.hexEncode("123 Main Street"));
Redundant / Tautological Comments2 hits · 3 pts
SeverityFileLineSnippet
LOWci/tests/elastic/apm-server.yml594 # Set max_retries to a value less than 0 to retry
LOWci/tests/cassandra/generate-keys.sh23# Check if cluster-name and password are provided as params....
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippet
MEDIUMci/tests/cassandra/cassandra.yaml1318# each write which may be lower in order to facilitate availability.