NGINX and NGINX Plus Ingress Controllers for Kubernetes
This report summarizes scanner evidence for nginx/kubernetes-ingress, a Go project with 5,082 GitHub stars. SynthScan examined 362,866 lines of code across 2203 source files, recording 1480 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 6.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1311 finding(s).
Are imports declared and package/API names verified? 6 finding(s).
Are wrappers, guards, and repeated structures necessary? 711 finding(s).
Which changes need focused human review? 1480 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1480 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/requirements.txt | 1029 | # WARNING: The following packages were not pinned, but pip requires them to be | COMMENT |
| LOW | tests/README.md | 24 | #### Step 1 - Create a Minikube Cluster | COMMENT |
| LOW | tests/README.md | 30 | #### Step 2 - Run the Tests | COMMENT |
| LOW | tests/README.md | 88 | #### Step 1 - Create a Kind Cluster | COMMENT |
| LOW | tests/README.md | 94 | #### Step 2 - Run the Tests | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 179 | # Step 2: conf file was removed — no traffic served for this TS | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 184 | # Step 3: traffic is rejected/no response for this TS | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 267 | # Step 1: TS has valid config and serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 276 | # Step 2: patch TS with invalid server snippet | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 287 | # Step 3: TS traffic still works — invalid config was rolled back | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 295 | # Step 4: TS config rolled back, invalid directive absent from conf | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 305 | # Step 5: TS is Invalid, status contains actual nginx error and rollback confirmation | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 388 | # Step 2: VS serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 391 | # Step 3: apply ConfigMap with invalid setting | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 421 | # Step 5: VS still serves traffic — Valid status | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 425 | # Step 6: TS traffic still works | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 433 | # Step 7: TS config unchanged | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 166 | # Step 1: TS is Invalid — no previous config to fall back to | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 319 | # Step 6: VS still serves traffic — unaffected by TS rollback | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 373 | # Step 1: capture TS config before change, verify traffic | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 402 | # Step 4: IC logs confirm main config rollback | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 68 | # Step 1: create VS with invalid server-snippet baked in (sub_filter_once invalid) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 75 | # Step 2: VS is Invalid — no previous config to fall back to, status contains actual nginx error | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 176 | # Step 1: valid VS serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 178 | # Step 2: load VS YAML, apply invalid patch, send to cluster | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 268 | # Step 1: VS serves traffic, capture TS config | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 277 | # Step 2: apply ConfigMap with invalid setting | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 287 | # Step 3: IC logs confirm rollback with actual nginx error | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 305 | # Step 4: VS still responds — nginx.conf was rolled back, VS not affected | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 308 | # Step 5: TS config unchanged | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 357 | # Step 2: capture TS config before ConfigMap change | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 366 | # Step 3: apply ConfigMap with invalid location-snippets | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 421 | # Step 6: ConfigMap event reflects partial failure | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 431 | # Step 7: restoring the ConfigMap returns the controller to the normal state | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 87 | # Step 3: conf file was removed — no traffic served for this host | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 189 | # Step 3: traffic still works — invalid config was rolled back | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 200 | # Step 4: VS is Invalid, status contains actual nginx error and rollback confirmation | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 213 | # Step 5: add new VS to prove nginx -t still passes after rollback | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 333 | # Step 1: create three valid VirtualServers | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 377 | # Step 4: the later VS resources fail; the controller then takes the shared-input early-exit path | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 410 | # Step 5: TS config unchanged (stream blocks not affected by location-snippets) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 88 | # Step 1: create Ingress with invalid server-snippet baked in | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 96 | # Step 2: conf file removed — no traffic served | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 218 | # Step 1: Ingress serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 221 | # Step 2: patch Ingress with invalid annotation(s) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 230 | # Step 3: traffic still works — invalid config rolled back | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 293 | # Step 1: Ingress serves traffic, capture TS config | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 303 | # Step 2: apply ConfigMap with invalid setting | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 333 | # Step 4: Ingress still responds | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 336 | # Step 5: TS config unchanged | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 379 | # Step 2: capture TS config before ConfigMap change | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 388 | # Step 3: apply ConfigMap with invalid location-snippets | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 399 | # Step 4: logs show threshold-triggered early exit; previous-good traffic keeps working | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 409 | # Step 5: TS config unchanged (stream blocks not affected by location-snippets) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 420 | # Step 6: ConfigMap event reflects partial failure | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 430 | # Step 7: restoring the ConfigMap returns the controller to the normal state | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 110 | # Step 3: event contains actual nginx error, but no "rolled back" (nothing to roll back to) | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 241 | # Step 4: event contains actual nginx error and rollback confirmation | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 314 | # Step 3: IC logs confirm rollback with actual nginx error | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 363 | # Step 1: create three valid Ingresses | COMMENT |
| 365 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/conftest.py | 163 | def pytest_collection_modifyitems(config, items) -> None: | CODE |
| LOW | tests/conftest.py | 221 | def pytest_runtest_makereport(item) -> None: | CODE |
| LOW | tests/suite/test_filter_secrets.py | 15 | def setup_single_secret_and_ns(request, kube_apis): | CODE |
| LOW | tests/suite/test_filter_secrets.py | 39 | def test_filter_secret_single_namespace(self, request, kube_apis, ingress_controller, setup_single_secret_and_ns): | CODE |
| LOW | tests/suite/test_filter_secrets.py | 52 | def test_filter_secret_created_after_ic(self, request, kube_apis, ingress_controller): | CODE |
| LOW | tests/suite/test_filter_secrets.py | 69 | def setup_multiple_ns_and_multiple_secrets(request, kube_apis): | CODE |
| LOW | tests/suite/test_filter_secrets.py | 106 | def test_filter_secret_multi_namespace( | CODE |
| LOW | tests/suite/test_filter_secrets.py | 121 | def test_filter_secret_multiplue_created_after_ic(self, request, kube_apis, ingress_controller): | CODE |
| LOW | tests/suite/test_watch_namespace_label.py | 98 | def create_and_setup_namespace(kube_apis, ingress_controller_endpoint, ns_name, is_vs=False): | CODE |
| LOW | tests/suite/test_ingress_mtls_ingress.py | 73 | def setup_invalid_ingress_mtls(self, kube_apis, test_namespace): | CODE |
| LOW | tests/suite/test_ingress_mtls_ingress.py | 91 | def test_ingress_mtls_policy_ingress( | CODE |
| LOW | tests/suite/test_ingress_mtls_ingress.py | 189 | def test_ingress_mtls_policy_ingress_with_opaque_secret( | CODE |
| LOW | tests/suite/test_ingress_mtls_ingress.py | 267 | def test_invalid_ingress_mtls_policy_ingress( | CODE |
| LOW | tests/suite/test_ingress_mtls_ingress.py | 346 | def test_ingress_mtls_chain_validation( | CODE |
| LOW | tests/suite/test_ingress_mtls_ingress.py | 449 | def test_ingress_mtls_missing_secret_ingress( | CODE |
| LOW | tests/suite/test_config_rollback_ts.py | 348 | def test_configmap_main_snippet_rollback( | CODE |
| LOW | tests/suite/test_app_protect_integration.py | 165 | def test_ap_nginx_config_entries(self, kube_apis, crd_ingress_controller_with_ap, appprotect_setup, test_namespace): | CODE |
| LOW | tests/suite/test_app_protect_integration.py | 194 | def test_ap_enable_true_policy_correct( | CODE |
| LOW | tests/suite/test_app_protect_integration.py | 217 | def test_ap_enable_false_policy_correct( | CODE |
| LOW | tests/suite/test_app_protect_integration.py | 241 | def test_ap_enable_true_policy_incorrect( | CODE |
| LOW | tests/suite/test_app_protect_integration.py | 268 | def test_ap_enable_false_policy_incorrect( | CODE |
| LOW | tests/suite/test_app_protect_integration.py | 408 | def test_ap_enable_true_policy_correct_uds( | CODE |
| LOW | tests/suite/test_virtual_server_validation.py | 12 | def assert_reject_events_emitted(virtual_server_setup, new_list, previous_list, expected_amount): | CODE |
| LOW | tests/suite/test_virtual_server_validation.py | 20 | def assert_event_count_increased_in_list(virtual_server_setup, new_list, previous_list): | CODE |
| LOW | tests/suite/test_virtual_server_validation.py | 50 | def test_virtual_server_behavior( | CODE |
| LOW | tests/suite/test_hsts.py | 126 | def test_headers_without_secret(self, kube_apis, hsts_setup, ingress_controller_prerequisites): | CODE |
| LOW | tests/suite/test_jwt_policies_jwksuri.py | 265 | def test_jwt_invalid_policy_jwksuri( | CODE |
| LOW | tests/suite/test_jwt_policies_jwksuri.py | 327 | def test_jwt_policy_subroute_jwksuri( | CODE |
| LOW | tests/suite/test_jwt_policies_jwksuri.py | 395 | def test_jwt_policy_subroute_jwksuri_multiple_vs( | CODE |
| LOW | tests/suite/test_config_rollback_vs.py | 249 | def test_configmap_main_snippet_rollback( | CODE |
| LOW | tests/suite/test_config_rollback_vs.py | 319 | def test_configmap_partial_rollback( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 74 | def test_response_for_regex_location( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 135 | def test_flow_for_invalid_vsr( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 236 | def test_exact_match_overrides_all( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 249 | def test_regexp_overrides_prefix( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 270 | def test_longest_prefix_overrides_regexp( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 346 | def test_response_for_regex_location( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 417 | def test_flow_for_invalid_vsr( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 480 | def vsr_selector_regexp_setup( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 530 | def test_exact_match_overrides_all( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 543 | def test_regexp_overrides_prefix( | CODE |
| LOW | tests/suite/test_v_s_route_regexp_location.py | 567 | def test_longest_prefix_overrides_regexp( | CODE |
| LOW | tests/suite/test_rewrite_target.py | 83 | def test_static_rewrite_target(self, rewrite_target_setup): | CODE |
| LOW | tests/suite/test_rewrite_target.py | 102 | def test_regex_rewrite_target(self, rewrite_target_setup): | CODE |
| LOW | tests/suite/test_v_s_route_split_traffic.py | 26 | def get_upstreams_of_splitting(file) -> []: | CODE |
| LOW | tests/suite/test_oidc_native_ingress.py | 43 | def get_oidc_native_policy_file(oidc_type): | CODE |
| LOW | tests/suite/test_app_protect_waf_bundle_source_ing.py | 85 | def test_bundle_source_block_ingress( | CODE |
| LOW | tests/suite/test_app_protect_waf_bundle_source_ing.py | 130 | def test_bundle_source_mtls_block_ingress( | CODE |
| LOW⚡ | tests/suite/test_external_auth_policies_vsr.py | 484 | def test_tls_ssl_enabled_only( | CODE |
| LOW⚡ | tests/suite/test_external_auth_policies_vsr.py | 629 | def test_tls_nonexistent_ca_secret( | CODE |
| LOW⚡ | tests/suite/test_external_auth_policies_vsr.py | 932 | def test_tls_policy_override_vs_vsr( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 94 | def test_external_auth_policy_credentials( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 142 | def test_external_auth_policy_valid( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 193 | def test_external_auth_policy_invalid_rejected_by_crd( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 213 | def test_external_auth_policy_nonexistent_svc( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 252 | def test_external_auth_policy_delete_policy( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 317 | def test_external_auth_policy_override( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 373 | def test_external_auth_policy_override_vs_vsr( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 668 | def test_tls_ca_secret_missing_ca_crt( | CODE |
| LOW | tests/suite/test_external_auth_policies_vsr.py | 758 | def test_tls_verify_no_trusted_cert( | CODE |
| 486 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/suite/test_app_protect_integration.py | 0 | encapsulate the example details. attributes: req_url (str): | STRING |
| HIGH | tests/suite/test_app_protect_watch_namespace.py | 0 | encapsulate the example details. attributes: req_url (str): | STRING |
| HIGH | tests/suite/test_app_protect_watch_namespace_label.py | 0 | encapsulate the example details. attributes: req_url (str): | STRING |
| HIGH | perf-tests/suite/test_ap_reload_perf.py | 0 | encapsulate the example details. attributes: req_url (str): | STRING |
| HIGH | tests/suite/test_app_protect_integration.py | 0 | deploy simple application and all the appprotect(dataguard-alarm) resources under test in one namespace. :param request: | STRING |
| HIGH | perf-tests/suite/test_ap_reload_perf.py | 0 | deploy simple application and all the appprotect(dataguard-alarm) resources under test in one namespace. :param request: | STRING |
| HIGH | tests/suite/test_batch_reloads.py | 0 | deploy simple application and all the appprotect(dataguard-alarm) resources under test in one namespace. :param request: | STRING |
| HIGH | tests/suite/test_ingress_class.py | 0 | deploy simple application and all the appprotect(dataguard-alarm) resources under test in one namespace. :param request: | STRING |
| HIGH | tests/suite/test_batch_startup_times.py | 0 | deploy simple application and all the appprotect(dataguard-alarm) resources under test in one namespace. :param request: | STRING |
| HIGH | tests/suite/test_app_protect_waf_policies.py | 0 | deploy simple application and all the appprotect(dataguard-alarm) resources under test in one namespace. :param request: | STRING |
| HIGH | tests/suite/test_app_protect_integration.py | 0 | assert responses when policy config is blocking requests :param response: response | STRING |
| HIGH | tests/suite/test_app_protect_waf_policies.py | 0 | assert responses when policy config is blocking requests :param response: response | STRING |
| HIGH | perf-tests/suite/test_ap_reload_perf.py | 0 | assert responses when policy config is blocking requests :param response: response | STRING |
| HIGH | tests/suite/test_v_s_route_regexp_location.py | 0 | prepare an example app for advanced routing vsr. single namespace with vs+vsr and simple app. :param request: internal p | STRING |
| HIGH | tests/suite/test_v_s_route_advanced_routing.py | 0 | prepare an example app for advanced routing vsr. single namespace with vs+vsr and simple app. :param request: internal p | STRING |
| HIGH | tests/suite/test_v_s_route_focused_canary.py | 0 | prepare an example app for advanced routing vsr. single namespace with vs+vsr and simple app. :param request: internal p | STRING |
| HIGH | tests/suite/test_v_s_route_split_traffic.py | 0 | parse yaml file into an array of upstreams. :param file: an absolute path to file :return: [] | STRING |
| HIGH | tests/suite/test_v_s_route_focused_canary.py | 0 | parse yaml file into an array of upstreams. :param file: an absolute path to file :return: [] | STRING |
| HIGH | tests/suite/test_virtual_server_split_traffic.py | 0 | parse yaml file into an array of upstreams. :param file: an absolute path to file :return: [] | STRING |
| HIGH | tests/suite/test_virtual_server_focused_canary.py | 0 | parse yaml file into an array of upstreams. :param file: an absolute path to file :return: [] | STRING |
| HIGH | tests/suite/test_external_auth_policies_vsr.py | 0 | test that a policy with an invalid authuri (no leading slash) is rejected at the crd validation level by the kubernetes | STRING |
| HIGH | tests/suite/test_external_auth_policies_ingress.py | 0 | test that a policy with an invalid authuri (no leading slash) is rejected at the crd validation level by the kubernetes | STRING |
| HIGH | tests/suite/test_external_auth_policies_vs.py | 0 | test that a policy with an invalid authuri (no leading slash) is rejected at the crd validation level by the kubernetes | STRING |
| HIGH | tests/suite/test_jwt_policies_vsr.py | 0 | test if requests result in 500 when secret is deleted | STRING |
| HIGH | tests/suite/test_auth_basic_policies_vsr.py | 0 | test if requests result in 500 when secret is deleted | STRING |
| HIGH | tests/suite/test_jwt_policies.py | 0 | test if requests result in 500 when secret is deleted | STRING |
| HIGH | tests/suite/test_auth_basic_policies.py | 0 | test if requests result in 500 when secret is deleted | STRING |
| HIGH | tests/suite/test_jwt_policies_vsr.py | 0 | test if requests result in 500 when policy is deleted | STRING |
| HIGH | tests/suite/test_auth_basic_policies_vsr.py | 0 | test if requests result in 500 when policy is deleted | STRING |
| HIGH | tests/suite/test_jwt_policies.py | 0 | test if requests result in 500 when policy is deleted | STRING |
| HIGH | tests/suite/test_auth_basic_policies.py | 0 | test if requests result in 500 when policy is deleted | STRING |
| HIGH | tests/suite/test_transport_server_status.py | 0 | function to revert a transportserver resource to a valid state. | STRING |
| HIGH | tests/suite/test_transport_server_tcp_load_balance.py | 0 | function to revert a transportserver resource to a valid state. | STRING |
| HIGH | tests/suite/test_transport_server_udp_load_balance.py | 0 | function to revert a transportserver resource to a valid state. | STRING |
| HIGH | tests/suite/test_app_protect_wafv5_integration.py | 0 | function to revert vsr selector deployments to standard state | STRING |
| HIGH | tests/suite/test_app_protect_wafv5_integration_rorfs.py | 0 | function to revert vsr selector deployments to standard state | STRING |
| HIGH | tests/suite/test_app_protect_waf_policies.py | 0 | function to revert vsr selector deployments to standard state | STRING |
| HIGH | tests/suite/test_virtual_server_external_name.py | 0 | encapsulate externalname example details. attributes: ic_pod_name: external_host: external service host | STRING |
| HIGH | tests/suite/test_virtual_server_backup_service.py | 0 | encapsulate externalname example details. attributes: ic_pod_name: external_host: external service host | STRING |
| HIGH | tests/suite/test_transport_server_external_name.py | 0 | encapsulate externalname example details. attributes: ic_pod_name: external_host: external service host | STRING |
| HIGH | tests/suite/test_transport_server_backup_service.py | 0 | encapsulate externalname example details. attributes: ic_pod_name: external_host: external service host | STRING |
| HIGH | tests/suite/test_batch_reloads.py | 0 | encapsulate the smoke example details. attributes: public_endpoint (publicendpoint): ingress_host (str): | STRING |
| HIGH | tests/suite/test_smoke.py | 0 | encapsulate the smoke example details. attributes: public_endpoint (publicendpoint): ingress_host (str): | STRING |
| HIGH | tests/suite/test_prometheus_metrics.py | 0 | encapsulate the smoke example details. attributes: public_endpoint (publicendpoint): ingress_host (str): | STRING |
| HIGH | tests/suite/test_batch_startup_times.py | 0 | encapsulate the smoke example details. attributes: public_endpoint (publicendpoint): ingress_host (str): | STRING |
| HIGH | tests/suite/test_batch_reloads.py | 0 | deploy a simple application and appprotect manifests. :param request: pytest fixture :param kube_apis: client apis :para | STRING |
| HIGH | tests/suite/test_app_protect_watch_namespace.py | 0 | deploy a simple application and appprotect manifests. :param request: pytest fixture :param kube_apis: client apis :para | STRING |
| HIGH | tests/suite/test_app_protect_watch_namespace_label.py | 0 | deploy a simple application and appprotect manifests. :param request: pytest fixture :param kube_apis: client apis :para | STRING |
| HIGH | tests/suite/test_batch_startup_times.py | 0 | deploy a simple application and appprotect manifests. :param request: pytest fixture :param kube_apis: client apis :para | STRING |
| HIGH | tests/suite/test_virtual_server_configmap_keys.py | 0 | assert that an event with specific type, reason, and message substring exists. :param event_list: list of events :param | STRING |
| HIGH | tests/suite/test_zone_sync.py | 0 | assert that an event with specific type, reason, and message substring exists. :param event_list: list of events :param | STRING |
| HIGH | tests/suite/test_mgmt_configmap_keys.py | 0 | assert that an event with specific type, reason, and message substring exists. :param event_list: list of events :param | STRING |
| HIGH | tests/suite/test_ac_policies_vsr.py | 0 | replace configmap to add "set-real-ip-from" :param request: pytest fixture :param kube_apis: client apis :param ingress_ | STRING |
| HIGH | tests/suite/test_ac_policies_ingress.py | 0 | replace configmap to add "set-real-ip-from" :param request: pytest fixture :param kube_apis: client apis :param ingress_ | STRING |
| HIGH | tests/suite/test_ac_polices_vs.py | 0 | replace configmap to add "set-real-ip-from" :param request: pytest fixture :param kube_apis: client apis :param ingress_ | STRING |
| HIGH | tests/suite/test_ac_policies_ingress.py | 0 | encapsulate annotations example details. attributes: public_endpoint: publicendpoint ingress_src_file: ingress_name: ing | STRING |
| HIGH | tests/suite/test_annotations.py | 0 | encapsulate annotations example details. attributes: public_endpoint: publicendpoint ingress_src_file: ingress_name: ing | STRING |
| HIGH | tests/suite/test_rl_ingress.py | 0 | encapsulate annotations example details. attributes: public_endpoint: publicendpoint ingress_src_file: ingress_name: ing | STRING |
| HIGH | tests/suite/test_transport_server_backup_service.py | 0 | encapsulate transport server details. attributes: public_endpoint (object): ts_resource (dict): name (str): namespace (s | STRING |
| HIGH | tests/suite/test_ts_tls_passthrough.py | 0 | encapsulate transport server details. attributes: public_endpoint (object): ts_resource (dict): name (str): namespace (s | STRING |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .goreleaser.yml | 21 | main: ./cmd/nginx-ingress/ | COMMENT |
| LOW | .goreleaser.yml | 41 | # - aws | COMMENT |
| LOW | .goreleaser.yml | 61 | # - linux | COMMENT |
| LOW | .goreleaser.yml | 81 | # flags: | COMMENT |
| LOW | tests/requirements.txt | 1 | # | COMMENT |
| LOW | tests/requirements.txt | 841 | # -r requirements.in | COMMENT |
| LOW | tests/requirements.txt | 981 | --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ | COMMENT |
| LOW | tests/requirements.txt | 1001 | six==1.17.0 \ | COMMENT |
| LOW | tests/requirements.txt | 1021 | # requests | COMMENT |
| LOW | tests/suite/test_oidc_native.py | 281 | ingress_controller_endpoint, | COMMENT |
| LOW | …a/oidc-native/scenarios/vs/test-8a-njs-and-native.yaml | 1 | # Test 8a: NJS OIDC on spec, Native on route (same VS). | COMMENT |
| LOW | …/oidc-native/scenarios/vs/test-16-cross-namespace.yaml | 1 | # Test 16: Cross-namespace policy reference. | COMMENT |
| LOW | …c-native/scenarios/vs/test-7-same-policy-multi-vs.yaml | 1 | # Test 7: Two VirtualServers sharing the same OIDCNative policy. | COMMENT |
| LOW | internal/nginxconf/tokenizer_test.go | 41 | t.Errorf("%-28s value=%-14q tokenizer fail=%v, nginx fail=%v err=%v", c.note, c.value, got, c.wantFail, err) | COMMENT |
| LOW | internal/nginxconf/tokenizer.go | 1 | // Package nginxconf tokenizes NGINX configuration the way NGINX itself does. | COMMENT |
| LOW | internal/nginxconf/tokenizer.go | 21 | // syntax — instead of grepping the rendered output for suspicious substrings. | COMMENT |
| LOW | internal/nginxconf/tokenizer.go | 261 | // The first word of an entry in one of these is a key chosen by the user, not a | COMMENT |
| LOW | internal/k8s/transportserver_injection_test.go | 21 | name string | COMMENT |
| LOW | internal/k8s/controller.go | 1381 | // Step 2: Generate all NGINX config files from the accumulated | COMMENT |
| LOW | internal/k8s/controller.go | 1401 | // minutes at scale for leader pod | COMMENT |
| LOW | internal/k8s/controller.go | 1621 | changes, problems = lbc.configuration.AddOrUpdateVirtualServer(vs) | COMMENT |
| LOW | internal/k8s/controller.go | 1681 | return true | COMMENT |
| LOW | internal/k8s/controller.go | 2441 | // and there is nothing to apply in place. | COMMENT |
| LOW | internal/k8s/controller.go | 2581 | COMMENT | |
| LOW | internal/k8s/controller.go | 2601 | const leaderPollInterval = 500 * time.Millisecond | COMMENT |
| LOW | internal/k8s/controller.go | 4761 | COMMENT | |
| LOW | internal/k8s/batch_sync_test.go | 141 | // updateAllConfigsOnBatch flag is cleared at the end of every batch drain. | COMMENT |
| LOW | internal/k8s/weight_update_test.go | 221 | wantIndexes: [][3]int{{2, 70, 30}}, | COMMENT |
| LOW | internal/k8s/annotation_injection_test.go | 41 | name string | COMMENT |
| LOW | internal/k8s/virtualserver_injection_test.go | 261 | // TestVirtualServerCannotInjectConfiguration asserts, for the VirtualServer | COMMENT |
| LOW | internal/k8s/configuration_test.go | 6821 | // production symptom of the unsorted VSR slice. | COMMENT |
| LOW | internal/k8s/split_clients_index_test.go | 61 | // subroutes start at within its referencing VirtualServer's split_clients | COMMENT |
| LOW | internal/k8s/weight_fast_lane_test.go | 301 | } | COMMENT |
| LOW | internal/k8s/weight_fast_lane_test.go | 461 | } | COMMENT |
| LOW | internal/k8s/weight_fast_lane_test.go | 541 | // reported to the user twice for a single sync. | COMMENT |
| LOW | internal/k8s/weight_fast_lane_test.go | 781 | stored := lbc.configuration.GetVirtualServerRoute("default/coffee") | COMMENT |
| LOW | internal/k8s/weight_fast_lane_test.go | 901 | COMMENT | |
| LOW | internal/k8s/weight_fast_lane_test.go | 1221 | // haltIfVS(R)ConfigInvalid deadlock guard. | COMMENT |
| LOW | internal/nginx/rollback_manager.go | 201 | COMMENT | |
| LOW | internal/nginx/rollback_manager.go | 241 | COMMENT | |
| LOW | internal/nginx/rollback_manager.go | 381 | if _, tracked := cm.batchFiles[path]; tracked { | COMMENT |
| LOW | internal/configs/policy.go | 101 | replicas int | COMMENT |
| LOW | internal/configs/policy.go | 141 | oidcNativeRoleLogout = "logout" | COMMENT |
| LOW | internal/configs/virtualserver_routing_test.go | 4881 | t.Errorf("split_clients index %d is beyond the %d generated blocks", idx, test.wantSplitClientBlocks) | COMMENT |
| LOW | internal/configs/version1/header_parsing_helper.go | 21 | // Returns error messages (empty when valid). | COMMENT |
| LOW | internal/configs/wafbundle/s3.go | 61 | // A fresh S3 client is built per fetch call from the passed-in S3Config. | COMMENT |
| LOW | internal/certmanager/helper.go | 41 | issuerKindCmField = "tls.cert-manager.issuer-kind" | COMMENT |
| LOW | internal/certmanager/helper.go | 61 | // usages: "digital signature,key encipherment" | COMMENT |
| LOW | internal/certmanager/cm_controller.go | 181 | // - controller: true since owner refs | COMMENT |
| LOW | internal/telemetry/collector_test.go | 2781 | return secrets.NewLocalSecretStore(configurator) | COMMENT |
| LOW | internal/validation/data_types.go | 261 | // | COMMENT |
| LOW | internal/validation/nginx.go | 21 | // The contract is not free to choose for an existing field. It is decided by | COMMENT |
| LOW | internal/validation/nginx.go | 41 | // protocol, and the templates render .SSLProtocols/.Protocols unquoted (for | COMMENT |
| LOW | internal/validation/nginx.go | 61 | // It does not reject quotes, because NGINX does not: a quote is ordinary | COMMENT |
| LOW | internal/validation/nginx.go | 81 | // for NGINX variable expansion, while still rejecting an unescaped double quote | COMMENT |
| LOW | internal/validation/nginx.go | 181 | // | COMMENT |
| LOW | internal/validation/nginx.go | 201 | // branch, so a backslash escapes the next character in any context. It can | COMMENT |
| LOW | internal/validation/nginx.go | 221 | // hash $scheme";ip_hash;#" consistent; | COMMENT |
| LOW | internal/validation/nginx.go | 341 | } | COMMENT |
| LOW | internal/validation/nginx.go | 441 | if _, ok := validTLSProtocols[strings.ToLower(protocol)]; !ok { | COMMENT |
| 128 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 179 | # Step 2: conf file was removed — no traffic served for this TS | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 184 | # Step 3: traffic is rejected/no response for this TS | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 267 | # Step 1: TS has valid config and serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 276 | # Step 2: patch TS with invalid server snippet | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 287 | # Step 3: TS traffic still works — invalid config was rolled back | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 295 | # Step 4: TS config rolled back, invalid directive absent from conf | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 305 | # Step 5: TS is Invalid, status contains actual nginx error and rollback confirmation | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 388 | # Step 2: VS serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 391 | # Step 3: apply ConfigMap with invalid setting | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 421 | # Step 5: VS still serves traffic — Valid status | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 425 | # Step 6: TS traffic still works | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ts.py | 433 | # Step 7: TS config unchanged | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 166 | # Step 1: TS is Invalid — no previous config to fall back to | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 319 | # Step 6: VS still serves traffic — unaffected by TS rollback | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 373 | # Step 1: capture TS config before change, verify traffic | COMMENT |
| LOW | tests/suite/test_config_rollback_ts.py | 402 | # Step 4: IC logs confirm main config rollback | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 68 | # Step 1: create VS with invalid server-snippet baked in (sub_filter_once invalid) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 75 | # Step 2: VS is Invalid — no previous config to fall back to, status contains actual nginx error | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 176 | # Step 1: valid VS serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 178 | # Step 2: load VS YAML, apply invalid patch, send to cluster | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 268 | # Step 1: VS serves traffic, capture TS config | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 277 | # Step 2: apply ConfigMap with invalid setting | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 287 | # Step 3: IC logs confirm rollback with actual nginx error | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 305 | # Step 4: VS still responds — nginx.conf was rolled back, VS not affected | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 308 | # Step 5: TS config unchanged | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 357 | # Step 2: capture TS config before ConfigMap change | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 366 | # Step 3: apply ConfigMap with invalid location-snippets | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 421 | # Step 6: ConfigMap event reflects partial failure | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vs.py | 431 | # Step 7: restoring the ConfigMap returns the controller to the normal state | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 87 | # Step 3: conf file was removed — no traffic served for this host | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 189 | # Step 3: traffic still works — invalid config was rolled back | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 200 | # Step 4: VS is Invalid, status contains actual nginx error and rollback confirmation | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 213 | # Step 5: add new VS to prove nginx -t still passes after rollback | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 333 | # Step 1: create three valid VirtualServers | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 377 | # Step 4: the later VS resources fail; the controller then takes the shared-input early-exit path | COMMENT |
| LOW | tests/suite/test_config_rollback_vs.py | 410 | # Step 5: TS config unchanged (stream blocks not affected by location-snippets) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 88 | # Step 1: create Ingress with invalid server-snippet baked in | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 96 | # Step 2: conf file removed — no traffic served | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 218 | # Step 1: Ingress serves traffic | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 221 | # Step 2: patch Ingress with invalid annotation(s) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 230 | # Step 3: traffic still works — invalid config rolled back | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 293 | # Step 1: Ingress serves traffic, capture TS config | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 303 | # Step 2: apply ConfigMap with invalid setting | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 333 | # Step 4: Ingress still responds | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 336 | # Step 5: TS config unchanged | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 379 | # Step 2: capture TS config before ConfigMap change | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 388 | # Step 3: apply ConfigMap with invalid location-snippets | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 399 | # Step 4: logs show threshold-triggered early exit; previous-good traffic keeps working | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 409 | # Step 5: TS config unchanged (stream blocks not affected by location-snippets) | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 420 | # Step 6: ConfigMap event reflects partial failure | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_ingress.py | 430 | # Step 7: restoring the ConfigMap returns the controller to the normal state | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 110 | # Step 3: event contains actual nginx error, but no "rolled back" (nothing to roll back to) | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 241 | # Step 4: event contains actual nginx error and rollback confirmation | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 314 | # Step 3: IC logs confirm rollback with actual nginx error | COMMENT |
| LOW | tests/suite/test_config_rollback_ingress.py | 363 | # Step 1: create three valid Ingresses | COMMENT |
| LOW | tests/suite/test_virtual_server_configmap_keys.py | 461 | # Step 1: Update ConfigMap with valid parameters | COMMENT |
| LOW | tests/suite/test_virtual_server_configmap_keys.py | 488 | # Step 2: Update ConfigMap with invalid parameters | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vsr.py | 81 | # Step 1: verify traffic on both VSR routes | COMMENT |
| LOW⚡ | tests/suite/test_config_rollback_vsr.py | 87 | # Step 2: patch either VS or VSR with invalid snippet | COMMENT |
| LOW | tests/suite/test_config_rollback_vsr.py | 118 | # Step 3: traffic still works on both routes — invalid config was rolled back | COMMENT |
| 33 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/suite/test_external_auth_policies_vsr.py | 480 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/suite/test_external_auth_policies_vsr.py | 482 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/suite/test_external_auth_policies_vsr.py | 625 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/suite/test_external_auth_policies_vsr.py | 627 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/suite/test_external_auth_policies_vsr.py | 927 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/suite/test_external_auth_policies_vsr.py | 929 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/suite/test_external_auth_policies_vsr.py | 715 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/suite/test_external_auth_policies_vsr.py | 717 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/suite/test_external_auth_policies_vsr.py | 797 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/suite/test_external_auth_policies_vsr.py | 799 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/suite/utils/external_auth_utils.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/suite/utils/external_auth_utils.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 71 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 116 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 118 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 169 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 171 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 241 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 243 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6029 | // ── Valid inputs ────────────────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6086 | // ── Invalid: $ character ───────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6117 | // ── Invalid: malformed header names ────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6156 | // ── Edge: empty entries are skipped ─────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6189 | // ── Multiple errors in one annotation ──────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6207 | // ── Edge: special chars in value (non-$) ───────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6219 | // ── Edge: whitespace handling ──────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6231 | // ── Edge: empty name combined with dollar in value ─────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6242 | // ── Valid: properly escaped quotes and backslashes ────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6259 | // ── Invalid: unescaped quotes and backslashes ───────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6300 | // ── Valid inputs ────────────────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6348 | // ── Invalid: $ in value ─────────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6364 | // ── Invalid: bad header name ────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6380 | // ── Invalid: bad always flag ────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6396 | // ── Invalid: empty entries ──────────────────────────────────── | COMMENT |
| MEDIUM | internal/k8s/validation_test.go | 6412 | // ── Invalid: unescaped characters in value ──────────────────── | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 71 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 92 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 94 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 264 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 266 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 296 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 298 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 374 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/tech-specs-update.py | 376 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/conftest.py | 280 | except Exception as e: | CODE |
| LOW | tests/scripts/check_container_packages.py | 150 | except Exception as e: # noqa: BLE001 - one broken image must not hide the rest | CODE |
| LOW | tests/scripts/check_container_packages.py | 185 | except Exception as e: # noqa: BLE001 - record and carry on with the next package | CODE |
| LOW | tests/suite/test_agent.py | 40 | except Exception as e: | CODE |
| MEDIUM | tests/suite/test_agent.py | 41 | print(f"Error: {e}") | CODE |
| LOW | tests/suite/test_build_info.py | 53 | except Exception as ex: | CODE |
| LOW | tests/suite/test_build_info.py | 67 | except Exception: | CODE |
| LOW | tests/suite/test_app_protect_agent.py | 43 | except Exception as e: | CODE |
| MEDIUM | tests/suite/test_app_protect_agent.py | 44 | print(f"Error: {e}") | CODE |
| LOW | tests/suite/test_app_protect_waf_policies_grpc.py | 81 | except Exception: | CODE |
| LOW | tests/suite/test_virtual_server_foreign_upstream.py | 94 | except Exception as ex: | CODE |
| LOW | tests/suite/test_virtual_server_grpc.py | 76 | except Exception: | CODE |
| LOW | tests/suite/test_v_s_route_grpc.py | 46 | except Exception: | CODE |
| LOW | tests/suite/test_virtual_server_mixed_grpc.py | 50 | except Exception: | CODE |
| LOW | tests/suite/utils/custom_resources_utils.py | 25 | except Exception as ex: | CODE |
| LOW | tests/suite/utils/custom_resources_utils.py | 104 | except Exception: | CODE |
| LOW | tests/suite/utils/bundle_source_utils.py | 120 | except Exception as ex: | CODE |
| LOW | tests/suite/utils/vs_vsr_resources_utils.py | 62 | except Exception: | CODE |
| LOW | tests/suite/utils/vs_vsr_resources_utils.py | 130 | except Exception as ex: | CODE |
| LOW | tests/suite/utils/vs_vsr_resources_utils.py | 193 | except Exception as ex: | CODE |
| LOW⚡ | tests/suite/utils/policy_resources_utils.py | 159 | except Exception: | CODE |
| LOW⚡ | tests/suite/utils/policy_resources_utils.py | 165 | except Exception: | CODE |
| LOW⚡ | tests/suite/utils/policy_resources_utils.py | 172 | except Exception: | CODE |
| LOW | tests/suite/utils/external_auth_utils.py | 290 | except Exception: | CODE |
| LOW | tests/suite/utils/external_auth_utils.py | 327 | except Exception: | CODE |
| LOW | tests/suite/utils/external_auth_utils.py | 350 | except Exception: | CODE |
| MEDIUM | tests/suite/utils/external_auth_utils.py | 287 | def fin(): | CODE |
| MEDIUM⚡ | tests/suite/utils/resources_utils.py | 2265 | print(f"Error: {e}") | CODE |
| MEDIUM⚡ | tests/suite/utils/resources_utils.py | 2273 | print(f"Error: {e}") | CODE |
| MEDIUM | tests/suite/utils/resources_utils.py | 966 | print(f"Error: {e}") | CODE |
| MEDIUM | tests/suite/utils/resources_utils.py | 2349 | print(f"Error in pod restart: {e}") | CODE |
| LOW | tests/suite/utils/resources_utils.py | 965 | except Exception as e: | CODE |
| LOW | tests/suite/utils/resources_utils.py | 1747 | except Exception as ex: | CODE |
| LOW | tests/suite/utils/resources_utils.py | 2348 | except Exception as e: | CODE |
| LOW | .github/scripts/pull-release-notes.py | 132 | except Exception as e: | CODE |
| MEDIUM | .github/scripts/pull-release-notes.py | 128 | def get_pr_labels(repo, pr_number): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/suite/test_jwt_policies_jwksuri.py | 91 | # Create a user and set credentials | COMMENT |
| MEDIUM | tests/suite/test_jwt_policies_jwksuri.py | 106 | # Create a client | COMMENT |
| MEDIUM | tests/suite/test_external_auth_policies_vsr.py | 692 | # Create the Secret so the reference resolves but lacks the required key | COMMENT |
| MEDIUM | tests/suite/test_oidc.py | 89 | # Create a user and set credentials | COMMENT |
| MEDIUM | tests/suite/test_oidc_native.py | 92 | # Create a user and set credentials | COMMENT |
| MEDIUM | tests/suite/test_oidc_fclo.py | 87 | # Create a user and set credentials | COMMENT |
| MEDIUM | tests/suite/grpc/helloworld_pb2_grpc.py | 49 | # This class is part of an EXPERIMENTAL API. | COMMENT |
| MEDIUM | charts/nginx-ingress/values.yaml | 320 | ## Create the HorizontalPodAutoscaler resource. This can be set to false to manage the HPA externally. | COMMENT |
| MEDIUM | charts/nginx-ingress/values.yaml | 780 | ## Create a NetworkPolicy that targets the controller pods. | COMMENT |
| MEDIUM | .github/workflows/cherry-pick.yml | 171 | # Create a PR only if one doesn't already exist for this branch | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/scripts/check_container_packages.py | 141 | CODE | |
| LOW | tests/scripts/check_container_packages.py | 293 | CODE | |
| LOW | tests/suite/test_oidc_native_scenarios.py | 78 | CODE | |
| LOW | tests/suite/test_oidc_native_scenarios.py | 125 | CODE | |
| LOW | tests/suite/test_oidc_native_scenarios.py | 401 | CODE | |
| LOW | tests/suite/test_transport_server_backup_service.py | 239 | CODE | |
| LOW | tests/suite/test_dos.py | 310 | CODE | |
| LOW | tests/suite/test_virtual_server_dos.py | 290 | CODE | |
| LOW | tests/suite/test_virtual_server_dos.py | 358 | CODE | |
| LOW | tests/suite/test_oidc_native_scenarios_ingress.py | 121 | CODE | |
| LOW | tests/suite/test_oidc_native_scenarios_ingress.py | 347 | CODE | |
| LOW | tests/suite/utils/dos_utils.py | 9 | CODE | |
| LOW | tests/suite/utils/custom_assertions.py | 353 | CODE | |
| LOW | tests/suite/utils/yaml_utils.py | 110 | CODE | |
| LOW | tests/suite/utils/vs_vsr_resources_utils.py | 43 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 46 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 71 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 95 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 119 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 1566 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 1587 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 1704 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 1894 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 2252 | CODE | |
| LOW | .github/scripts/tech-specs-update.py | 379 | CODE | |
| LOW | .github/scripts/pull-release-notes.py | 68 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/suite/test_config_rollback_ts.py | 191 | except (requests.exceptions.ConnectionError, requests.exceptions.ReadTimeout): | CODE |
| HIGH | tests/suite/test_config_rollback_ts.py | 202 | except (ConnectionRefusedError, ConnectionResetError, socket.timeout, OSError): | CODE |
| HIGH | tests/suite/test_transport_server_udp_load_balance.py | 39 | except ValueError: | CODE |
| HIGH | tests/suite/utils/vs_vsr_resources_utils.py | 62 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/suite/test_custom_annotations.py | 83 | "# Print the value assigned to the annotation: 512", | CODE |
| LOW | tests/suite/test_custom_annotations.py | 96 | "# Print the value assigned to the annotation: 512", | CODE |
| LOW | …sts/data/custom-annotations/standard/nginx-config.yaml | 16 | # Print the value assigned to the annotation: {{$value}} | COMMENT |
| LOW | …ts/data/custom-annotations/mergeable/nginx-config.yaml | 16 | # Print the value assigned to the annotation: {{$value}} | COMMENT |
| LOW | .github/scripts/pull-release-notes.py | 72 | # Check if the line starts with a section header | COMMENT |
| LOW | .github/scripts/pull-release-notes.py | 86 | # Check if the line starts with "* " or "- " | COMMENT |
| LOW⚡ | .github/scripts/pull-release-notes.py | 192 | # Check if the PR has a "dependencies" label" | COMMENT |
| LOW⚡ | .github/scripts/pull-release-notes.py | 194 | # Check if the PR has a "docker" label, if so add to docker dependencies group | COMMENT |
| LOW⚡ | .github/scripts/pull-release-notes.py | 197 | # Check if the PR has "go", "python" or "github_actions" label, if so add to go dependencies group | COMMENT |
| LOW | .github/scripts/pull-release-notes.py | 231 | # Check if version is a patch release or a minor/major release | COMMENT |
| LOW | .github/scripts/docker-updater.sh | 25 | # Check if the file exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/suite/test_v_s_route.py | 236 | # reset count to 0 because we want to check that the event is added, not just updated, and the event is about de | COMMENT |
| LOW | tests/suite/test_v_s_route.py | 264 | # restore of the VSRoute gets an event about update but not about add, so count is not increased but just set to | COMMENT |
| MEDIUM | tests/suite/utils/ap_resources_utils.py | 1 | """Describe methods to utilize the AppProtect resources.""" | STRING |
| MEDIUM | tests/suite/utils/custom_resources_utils.py | 1 | """Describe methods to utilize the kubernetes-client.""" | STRING |
| MEDIUM | tests/suite/utils/vs_vsr_resources_utils.py | 1 | """Describe methods to utilize the VS/VSR resources.""" | STRING |
| MEDIUM | tests/suite/utils/policy_resources_utils.py | 1 | """Describe methods to utilize the Policy resource.""" | STRING |
| MEDIUM | tests/suite/utils/resources_utils.py | 1 | """Describe methods to utilize the kubernetes-client.""" | STRING |
| MEDIUM | internal/validation/validation.go | 101 | // ValidateURI is a more robust extensible function to validate URIs. It | COMMENT |
| LOW | .github/scripts/release-docs.sh | 219 | # If same year: just add to existing index | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | .github/workflows/external-pr.yml | 40 | core.setOutput('is_fork', pr.data.head.repo.fork.toString()); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hack/secrets.json | 1877 | "name": "Jane Doe", | CODE |
| LOW | hack/secrets.json | 1895 | "name": "John Doe", | CODE |
| LOW⚡ | …custom-resources/rate-limit-tiered-jwt-claim/README.md | 74 | "name": "John Doe" | CODE |
| LOW | …custom-resources/rate-limit-tiered-jwt-claim/README.md | 118 | "name": "Jane Doe" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/skills/nic-code-review/SKILL.md | 17 | ## Review guardrails | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/suite/test_external_auth_policies_tls_vs.py | 281 | verify path is gated by SSLEnabled && SSLVerify (policy.go:309), | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/suite/grpc/helloworld_pb2_grpc.py | 57 | CODE | |
| LOW | tests/suite/utils/resources_utils.py | 1878 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/suite/utils/external_auth_utils.py | 24 | logger = logging.getLogger(__name__) | CODE |