Malicious traffic detection system
This report summarizes scanner evidence for stamparm/maltrail, a Python project with 8,622 GitHub stars. SynthScan examined 119,453 lines of code across 277 source files, recording 1229 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 16.7 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 816 finding(s).
Are imports declared and package/API names verified? 67 finding(s).
Are wrappers, guards, and repeated structures necessary? 885 finding(s).
Which changes need focused human review? 1229 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1229 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/quic_sni.py | 219 | def derive_client_initial_keys(dcid, version=1): | CODE |
| LOW | core/quic_sni.py | 250 | def extract_sni_from_quic_initial(udp_payload): | CODE |
| LOW | core/common.py | 823 | def _format_action_invocation(self, action): | STRING |
| LOW | core/doctor.py | 131 | def check_update_reachability(): | CODE |
| LOW | tests/test_version_sync.py | 29 | def test_the_tree_agrees_with_itself(self): | CODE |
| LOW | tests/test_version_sync.py | 39 | def test_every_pattern_matches_exactly_once(self): | CODE |
| LOW | tests/test_version_sync.py | 50 | def test_the_bumper_and_the_checker_cover_the_same_files(self): | CODE |
| LOW | tests/test_version_sync.py | 61 | def test_a_bump_is_all_or_nothing(self): | CODE |
| LOW | tests/test_version_sync.py | 82 | def test_the_release_workflow_still_verifies_the_tag(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 47 | def test_it_refuses_to_change_anything_but_the_generated_file(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 54 | def test_it_does_not_write_to_master(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 62 | def test_it_verifies_what_it_proposes(self): | CODE |
| LOW | tests/test_workflows.py | 75 | def test_ci_still_fails_on_a_stale_mirror(self): | CODE |
| LOW | tests/test_workflows.py | 98 | def test_the_documented_feed_count_is_the_real_one(self): | CODE |
| LOW | tests/test_workflows.py | 131 | def test_no_job_references_a_matrix_it_does_not_have(self): | CODE |
| LOW | tests/test_reference.py | 60 | def test_no_substring_false_positive(self): | CODE |
| LOW⚡ | tests/test_reference.py | 110 | def test_a_trail_with_no_citation_is_not_reported_as_missing_provenance(self): | CODE |
| LOW⚡ | tests/test_reference.py | 115 | def test_no_sidecar_names_what_restores_it(self): | CODE |
| LOW⚡ | tests/test_reference.py | 123 | def test_a_corrupt_sidecar_does_not_take_the_endpoint_down(self): | CODE |
| LOW⚡ | tests/test_reference.py | 132 | def test_it_reopens_when_the_sidecar_changes(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 25 | def test_no_config_keeps_event(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 28 | def test_regex_match_and_miss(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 35 | def test_invalid_regex_does_not_crash(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 41 | def test_ignorelist_src_wildcards(self): | CODE |
| LOW | tests/test_ignore.py | 83 | def test_cidr_covers_its_network_and_stops_at_the_edges(self): | CODE |
| LOW | tests/test_ignore.py | 89 | def test_dash_ranges_in_both_spellings(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 103 | def test_malformed_rules_degrade_to_literals(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 110 | def test_a_range_does_not_match_a_non_numeric_port(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 113 | def test_reloading_the_ignore_list_in_place_takes_effect(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 55 | def test_no_js_debugger_statement(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 60 | def test_no_console_log_outside_the_vendored_bundle(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 65 | def test_no_pdb_breakpoints_in_the_server(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 71 | def test_shipped_config_keeps_the_safe_defaults(self): | CODE |
| LOW⚡ | tests/test_common.py | 59 | def test_common_affix_factoring(self): | CODE |
| LOW⚡ | tests/test_common.py | 63 | def test_metachars_escaped_literally(self): | CODE |
| LOW⚡ | tests/test_common.py | 73 | def test_builtin_ranges_match(self): | CODE |
| LOW⚡ | tests/test_common.py | 79 | def test_domain_not_range_matched(self): | CODE |
| LOW⚡ | tests/test_common.py | 83 | def test_exact_member_whitelisted(self): | CODE |
| LOW⚡ | tests/test_common.py | 211 | def test_a_pem_holding_a_known_bad_block_is_rejected(self): | CODE |
| LOW⚡ | tests/test_common.py | 216 | def test_the_key_is_recognised_without_its_original_certificate(self): | CODE |
| LOW⚡ | tests/test_common.py | 223 | def test_whitespace_and_block_order_do_not_matter(self): | CODE |
| LOW⚡ | tests/test_common.py | 228 | def test_an_unrelated_pem_is_accepted(self): | CODE |
| LOW⚡ | tests/test_common.py | 233 | def test_garbage_in_a_pem_block_is_not_a_crash(self): | CODE |
| LOW⚡ | tests/test_common.py | 241 | def test_an_unreadable_pem_is_neither_accepted_nor_rejected(self): | CODE |
| LOW⚡ | tests/test_common.py | 245 | def test_the_shipped_fingerprint_set_still_names_both_blocks(self): | CODE |
| LOW⚡ | tests/test_common.py | 316 | def test_missing_or_malformed_payload_is_a_non_answer_not_a_crash(self): | CODE |
| LOW⚡ | tests/test_common.py | 323 | def test_a_hit_costs_no_request(self): | CODE |
| LOW⚡ | tests/test_common.py | 329 | def test_a_failure_is_cached_too(self): | CODE |
| LOW⚡ | tests/test_common.py | 335 | def test_expiry_lets_a_lookup_retry(self): | CODE |
| LOW⚡ | tests/test_common.py | 345 | def test_the_cache_is_bounded(self): | CODE |
| LOW | tests/test_common.py | 38 | def test_public_and_boundaries(self): | CODE |
| LOW | tests/test_common.py | 122 | def test_non_aligned_cidr_whitelists_subnet(self): | CODE |
| LOW | tests/test_common.py | 299 | def test_geoloc_country_is_extracted_and_normalised(self): | CODE |
| LOW | tests/test_common.py | 305 | def test_a_country_that_is_not_a_country_code_is_dropped(self): | CODE |
| LOW | tests/test_common.py | 356 | def test_disabled_means_no_request_at_all(self): | CODE |
| LOW | tests/test_common.py | 362 | def test_an_unknown_kind_is_refused_before_any_request(self): | CODE |
| LOW | tests/test_quic_sni.py | 152 | def test_multibyte_packet_number(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 169 | def test_multi_crypto_frame_reassembly(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 176 | def test_multi_crypto_frame_out_of_order(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 183 | def test_padding_and_ping_frames_skipped(self): | CODE |
| 477 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | server.py | 150 | except Exception: | CODE |
| HIGH | server.py | 222 | except Exception: | CODE |
| HIGH | core/update.py | 77 | except (ImportError, AttributeError): | CODE |
| HIGH | core/update.py | 149 | except (IOError, OSError): | CODE |
| HIGH | core/update.py | 351 | except (OSError, IOError): | CODE |
| HIGH | core/update.py | 196 | except Exception: | CODE |
| HIGH | core/update.py | 833 | except OSError: | CODE |
| HIGH | core/update.py | 433 | except Exception: | CODE |
| HIGH | core/update.py | 541 | except Exception: | CODE |
| HIGH | core/update.py | 751 | except Exception: | CODE |
| HIGH | core/update.py | 873 | except OSError: | CODE |
| HIGH | core/update.py | 652 | except Exception: | CODE |
| HIGH | core/geo.py | 124 | except Exception: | CODE |
| HIGH | core/geo.py | 94 | except Exception: | CODE |
| HIGH | core/trailsbin.py | 127 | except OSError: | CODE |
| HIGH | core/index.py | 188 | except OSError: | CODE |
| HIGH | core/index.py | 82 | except OSError: | CODE |
| HIGH | core/index.py | 219 | except sqlite3.Error: | CODE |
| HIGH | core/log.py | 249 | except Exception: | CODE |
| HIGH | core/log.py | 254 | except socket.error: | CODE |
| HIGH | core/log.py | 660 | except Exception: | CODE |
| HIGH | core/log.py | 95 | except OSError: | CODE |
| HIGH | core/httpd.py | 89 | except ImportError: | CODE |
| HIGH | core/httpd.py | 95 | except Exception: | CODE |
| HIGH | core/httpd.py | 816 | except Exception: | CODE |
| HIGH | core/httpd.py | 905 | except ValueError: | CODE |
| HIGH | core/httpd.py | 979 | except (ValueError, RuntimeError): | CODE |
| HIGH | core/httpd.py | 299 | except Exception: | CODE |
| HIGH | core/httpd.py | 138 | except Exception: | CODE |
| HIGH | core/httpd.py | 644 | except Exception: | CODE |
| HIGH | core/httpd.py | 1050 | except Exception: | CODE |
| HIGH | core/httpd.py | 1210 | except Exception: | CODE |
| HIGH | core/httpd.py | 2644 | except Exception: | CODE |
| HIGH | core/httpd.py | 1005 | except Exception: | CODE |
| HIGH | core/httpd.py | 1292 | except Exception: | CODE |
| HIGH | core/httpd.py | 866 | except ValueError: | CODE |
| HIGH | core/httpd.py | 1706 | except Exception: | CODE |
| HIGH | core/httpd.py | 2638 | except Exception: | CODE |
| HIGH | core/httpd.py | 1996 | except Exception: | CODE |
| HIGH | core/httpd.py | 2483 | except Exception: | CODE |
| HIGH | core/httpd.py | 2539 | except Exception: | CODE |
| HIGH | core/httpd.py | 2416 | except Exception: pass | CODE |
| HIGH | core/common.py | 297 | except (IndexError, ValueError): | CODE |
| HIGH | core/common.py | 311 | except (IndexError, ValueError): | CODE |
| HIGH | core/common.py | 325 | except (IndexError, ValueError): | CODE |
| HIGH | core/common.py | 477 | except (IndexError, ValueError): | CODE |
| HIGH | core/common.py | 574 | except Exception: | CODE |
| HIGH | core/common.py | 733 | except Exception: | CODE |
| HIGH | core/common.py | 608 | except re.error: | CODE |
| HIGH | core/common.py | 715 | except Exception: | CODE |
| HIGH | core/settings.py | 385 | except Exception: | CODE |
| HIGH | core/settings.py | 392 | except Exception: | CODE |
| HIGH | core/settings.py | 399 | except Exception: | CODE |
| HIGH | core/settings.py | 406 | except Exception: | CODE |
| HIGH | core/settings.py | 414 | except Exception: | CODE |
| HIGH | core/settings.py | 420 | except Exception: | CODE |
| HIGH | core/settings.py | 426 | except Exception: | CODE |
| HIGH | core/settings.py | 433 | except Exception: | CODE |
| HIGH | core/provenance.py | 124 | except Exception: | CODE |
| HIGH | core/provenance.py | 128 | except Exception: | CODE |
| 19 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | server.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/update.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/geo.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/enums.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/trailsbin.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/compat.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/index.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/log.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/logfmt.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/httpd.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/__init__.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/addr.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/assemble.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/ignore.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/common.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/custom_trails.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/settings.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/attribdict.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/provenance.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/testing.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/trailsdict.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/alert.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | core/meta.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | tests/test_index.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/rutgers.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/ciarmy.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/policeman.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/atmos.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/fareit.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/blocklist.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/abuseipdb.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/viriback.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/greensnow.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/myip.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/emergingthreatsdns.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/sslproxies.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/blackbook.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/binarydefense.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/dshieldip.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/__init__.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/minerchk.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/sslblja3.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/bruteforceblocker.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/torprojectnodes.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/emergingthreatsbot.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/torproject.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/socksproxy.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/cybercrimetracker.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/emergingthreatscip.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/alienvault.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/ipnoise.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/bitcoinnodes.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/turris.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/feodotrackerip.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/sslblcert.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/gpfcomics.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/botscout.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/scriptzteam.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/blackholemonster.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| HIGH | feeds/trickbot.py | 0 | copyright (c) 2014-present maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copyin | STRING |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server.py | 150 | except Exception: | CODE |
| LOW | server.py | 203 | except Exception: | CODE |
| LOW | server.py | 222 | except Exception: | CODE |
| MEDIUM | core/update.py | 242 | def _cached_sha(): | CODE |
| MEDIUM | core/update.py | 838 | def update_ipcat(force=False): | CODE |
| LOW⚡ | core/update.py | 991 | except Exception: | CODE |
| LOW⚡ | core/update.py | 993 | except Exception as ex: | CODE |
| LOW⚡ | core/update.py | 1001 | except Exception as ex: | CODE |
| LOW | core/update.py | 108 | except Exception as ex: | CODE |
| LOW | core/update.py | 191 | except Exception as ex: | CODE |
| LOW | core/update.py | 196 | except Exception: | CODE |
| LOW | core/update.py | 276 | except Exception as ex: | CODE |
| LOW | core/update.py | 359 | except Exception as ex: | CODE |
| LOW | core/update.py | 397 | except Exception as ex: | CODE |
| LOW | core/update.py | 433 | except Exception: | CODE |
| LOW | core/update.py | 535 | except Exception as ex: | CODE |
| LOW | core/update.py | 541 | except Exception: | CODE |
| LOW | core/update.py | 652 | except Exception: | CODE |
| LOW | core/update.py | 743 | except Exception as ex: | CODE |
| LOW | core/update.py | 751 | except Exception: | CODE |
| LOW | core/update.py | 779 | except Exception as ex: | CODE |
| LOW | core/update.py | 798 | except Exception as ex: | CODE |
| LOW | core/update.py | 828 | except Exception as ex: | CODE |
| LOW | core/update.py | 842 | except Exception as ex: | CODE |
| LOW | core/update.py | 869 | except Exception as ex: | CODE |
| LOW | core/update.py | 896 | except Exception as ex: | CODE |
| LOW | core/update.py | 960 | except Exception as ex: | CODE |
| LOW | core/geo.py | 78 | except Exception: | CODE |
| LOW | core/geo.py | 94 | except Exception: | CODE |
| LOW | core/geo.py | 124 | except Exception: | CODE |
| LOW | core/geo.py | 153 | except Exception: | CODE |
| LOW | core/trailsbin.py | 124 | except Exception: | CODE |
| LOW | core/log.py | 249 | except Exception: | STRING |
| LOW | core/log.py | 660 | except Exception: | CODE |
| LOW | core/log.py | 700 | except Exception: | CODE |
| MEDIUM | core/log.py | 665 | def handle(self): | CODE |
| LOW | core/logfmt.py | 83 | except Exception: | CODE |
| LOW | core/logfmt.py | 92 | except Exception: | CODE |
| LOW | core/logfmt.py | 116 | except Exception: | CODE |
| LOW | core/logfmt.py | 138 | except Exception: | CODE |
| MEDIUM | core/httpd.py | 1018 | def process_request_thread(self, request, client_address): | CODE |
| MEDIUM | core/httpd.py | 1047 | def shutdown_request(self, request): | CODE |
| MEDIUM | core/httpd.py | 1213 | def do_POST(self): | CODE |
| LOW | core/httpd.py | 95 | except Exception: | CODE |
| LOW | core/httpd.py | 131 | except Exception: | CODE |
| LOW | core/httpd.py | 138 | except Exception: | CODE |
| LOW | core/httpd.py | 200 | except Exception: | CODE |
| LOW | core/httpd.py | 268 | except Exception: | CODE |
| LOW | core/httpd.py | 299 | except Exception: | CODE |
| LOW | core/httpd.py | 530 | except Exception: | CODE |
| LOW | core/httpd.py | 543 | except Exception: | CODE |
| LOW | core/httpd.py | 607 | except Exception: | CODE |
| LOW | core/httpd.py | 644 | except Exception: | CODE |
| LOW | core/httpd.py | 816 | except Exception: | CODE |
| LOW | core/httpd.py | 1005 | except Exception: | CODE |
| LOW | core/httpd.py | 1012 | except Exception: | CODE |
| LOW | core/httpd.py | 1032 | except Exception: | CODE |
| LOW | core/httpd.py | 1050 | except Exception: | CODE |
| LOW | core/httpd.py | 1210 | except Exception: | CODE |
| LOW | core/httpd.py | 1275 | except Exception: | CODE |
| 115 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/bin/sh | COMMENT |
| LOW | install.sh | 421 | fi | COMMENT |
| LOW | ruff.toml | 1 | # Python linting, so the server is held to a comparable bar to the sensor's clippy -D warnings. | COMMENT |
| LOW | ruff.toml | 41 | # documented CPython thread-safety workaround, and a linter cannot know that). | COMMENT |
| LOW | docker/entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/entrypoint.sh | 101 | chown "$want_uid:$want_gid" "$d" 2>/dev/null || : | COMMENT |
| LOW | docker/tests/entrypoint_test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | core/geo.py | 21 | from core.settings import GEO_IP2CC6_BUNDLED_FILE | COMMENT |
| LOW | core/trailsbin.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | core/log.py | 41 | from collections import OrderedDict | COMMENT |
| LOW | core/log.py | 441 | if config.SHOW_DEBUG: | COMMENT |
| LOW | core/log.py | 461 | # third - which is far more than compressing the payload could ever save: gzip on a single event of | COMMENT |
| LOW | core/log.py | 641 | # 500/s 0% loss 5,000/s 0% loss | COMMENT |
| LOW | core/log.py | 681 | else: # Note: naive format without timestamp in front | COMMENT |
| LOW | core/logfmt.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | core/httpd.py | 1141 | self.send_header(HTTP_HEADER.CONTENT_SECURITY_POLICY, "default-src 'self'; style-src 'self' 'uns | COMMENT |
| LOW | core/httpd.py | 1601 | return payload | COMMENT |
| LOW | core/httpd.py | 1661 | COMMENT | |
| LOW | core/httpd.py | 2061 | COMMENT | |
| LOW | core/assemble.py | 221 | # NO COMMAS anywhere in here. A third-party CSV reader that accepts any three-field row - which | COMMENT |
| LOW | core/assemble.py | 261 | sys.exit("[!] '%s' yielded no trails - wrong directory, or an empty checkout" % options.root) | COMMENT |
| LOW | core/ignore.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | core/custom_trails.py | 21 | # This used to be a directory inside the checkout (trails/custom/) that pretended to be a feed: an | COMMENT |
| LOW | core/settings.py | 181 | # --- DNS tunnelling ------------------------------------------------------------------------- | COMMENT |
| LOW | core/settings.py | 201 | # and URL-reputation services, DNS blocklists, CDNs and object stores. Their normal operation is | COMMENT |
| LOW | core/settings.py | 261 | # 'USE_CONDESND_STORAGE' looks configured while disabling its feature entirely. | COMMENT |
| LOW | core/provenance.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | core/alert.py | 21 | from core.settings import ALERT_SEVERITY_ORDER | COMMENT |
| LOW | core/meta.py | 21 | COMMENT | |
| LOW | tests/run.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/canaries.txt | 1 | # Domains and addresses that must never be flagged by a static trail. | COMMENT |
| LOW | tests/canaries-allow.txt | 1 | # Trails that match a popular domain and are RIGHT anyway. | COMMENT |
| LOW | tests/install/run.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/install/soname.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/install/assert.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tests/install/assert.sh | 201 | if maltrail-sensor -c "$CONF" -T >/tmp/selftest.log 2>&1; then | COMMENT |
| LOW | html/js/main.js | 101 | // severities for one event. So the page is served the regex itself (<meta name="mt-severity">, | COMMENT |
| LOW | html/js/main.js | 1821 | var tk = peek(); | COMMENT |
| LOW | sensor/Cargo.toml | 21 | # TPACKET_V3 mmap ring on Linux. | COMMENT |
| LOW | sensor/Cargo.toml | 41 | # digest that can match them. It is never used to authenticate anything. | COMMENT |
| LOW | sensor/deny.toml | 1 | # cargo-deny: the checks `cargo audit` does not do. | COMMENT |
| LOW | sensor/build.rs | 1 | //! Turn a missing libpcap into a sentence somebody can act on. | COMMENT |
| LOW | sensor/tools/check_redistribution.py | 61 | # door. EC2, EBS, WORKSPACES and the rest are single-tenant and stay eligible for listing. GCP's | COMMENT |
| LOW | sensor/tools/check_trails.py | 261 | # A dotless key is a bare-TLD trail (the `.xyz` entries in suspicious/domain.txt, with the | COMMENT |
| LOW | sensor/tools/check_trails.py | 281 | # leading dot - `.tk`, `.xyz`, `.cf` - which the loader strips and which this reads as "yes, | COMMENT |
| LOW | sensor/tools/check_trails.py | 401 | if verdict: | COMMENT |
| LOW | sensor/tools/gen_corpus.py | 601 | # 34. Two DIFFERENT DNS queries back-to-back on one socket in one second. sensor.py's burst | COMMENT |
| LOW | sensor/tools/gen_corpus.py | 801 | # A host/path trail whose BARE PATH is also a trail in its own right never produces the | COMMENT |
| LOW | sensor/tools/check.sh | 1 | #!/bin/sh | COMMENT |
| LOW | sensor/tools/check.sh | 41 | echo "== generated files are in sync with core/settings.py and data/ua.txt ==" | COMMENT |
| LOW | sensor/tools/check_windows.sh | 1 | #!/bin/sh | COMMENT |
| LOW | sensor/tools/check_windows.sh | 21 | # binary over the entire pcap corpus. | COMMENT |
| LOW | sensor/tests/fuzz_extended.rs | 1 | //! Extended, seed-randomised fuzzing of the same entry points `fuzz_parsers.rs` uses. | COMMENT |
| LOW | sensor/tests/loader_parity.rs | 1 | //! Differential loader test: the Rust loader vs `core.common.load_trails()`, on the REAL | COMMENT |
| LOW | sensor/tests/capture_live.rs | 1 | //! Live-capture and PACKET_FANOUT tests. | COMMENT |
| LOW | sensor/tests/capture_live.rs | 161 | COMMENT | |
| LOW | sensor/tests/capture_live.rs | 221 | p.extend_from_slice(&((8 + payload.len()) as u16).to_be_bytes()); | COMMENT |
| LOW | sensor/tests/trails.rs | 441 | let (db2, _) = trails::load(&second, &wl).unwrap(); | COMMENT |
| LOW | sensor/tests/bounded_state.rs | 1 | //! Bounded state (ROADMAP Gate 1.5). | COMMENT |
| LOW | sensor/tests/fail_closed.rs | 181 | /// A capture that OPENS but cannot be read must not replay to "success" with zero packets. | COMMENT |
| 100 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/test_frontend.py | 353 | else if (ch === " ") { row.push(cur); cur = ""; } | CODE |
| HIGH⚡ | tests/test_frontend.py | 356 | row.push(cur); | CODE |
| HIGH⚡ | tests/test_frontend.py | 357 | out.push(row); | CODE |
| HIGH⚡ | tests/test_frontend.py | 823 | var s = (t.sev || 1) * 1000; | CODE |
| HIGH⚡ | tests/test_frontend.py | 827 | s += Math.min(90, Math.log(1 + (t.count || 1)) * 15); | CODE |
| HIGH⚡ | tests/test_frontend.py | 842 | all.push({ sev: s, type: TYPES[ti], info: INFOS[ii], trail: TRAILS[tr], count: count }); | CODE |
| HIGH⚡ | tests/test_frontend.py | 846 | if (riskOf(t) !== want) bad.push("first call " + JSON.stringify(t) + " " + riskOf(t) + " != " + want); | CODE |
| HIGH⚡ | tests/test_frontend.py | 847 | if (riskOf(t) !== want) bad.push("memo hit differs " + JSON.stringify(t)); | CODE |
| HIGH⚡ | tests/test_frontend.py | 851 | if (riskOf(t) !== want2) bad.push("after count change " + JSON.stringify(t) + " " + riskOf(t) + " != " + want2); | CODE |
| HIGH⚡ | tests/test_frontend.py | 857 | for (var i = 0; i < a.length; i++) if (a[i] !== b[i]) { bad.push("order diverges at " + i); break; } | CODE |
| HIGH⚡ | tests/test_frontend.py | 964 | "0.0.0.0", "1.2.3.4", "", null, undefined, "not-an-ip", "2001:db8::1", | CODE |
| HIGH⚡ | tests/test_frontend.py | 969 | if (ipKey(c) !== want) bad.push("miss " + JSON.stringify(c) + " " + ipKey(c) + " != " + want); | CODE |
| HIGH⚡ | tests/test_frontend.py | 970 | if (ipKey(c) !== want) bad.push("hit " + JSON.stringify(c) + " differs on the cached call"); | CODE |
| HIGH⚡ | tests/test_frontend.py | 974 | for (var a = 0; a < 12; a++) for (var b = 0; b < 12; b++) ips.push(a + "." + b + "." + (b * 7 % 256) + "." + (a * 13 % 2 | CODE |
| HIGH⚡ | tests/test_frontend.py | 975 | ips.push("8.8.8.8", "10.0.0.1", "", "x"); | CODE |
| HIGH⚡ | tests/test_frontend.py | 978 | for (var i = 0; i < m.length; i++) if (m[i] !== r[i]) { bad.push("order diverges at " + i); break; } | CODE |
| HIGH | tests/test_frontend.py | 530 | function portDir() { return null; } function hay(t) { return (t.info + " " + t.trail).toLowerCase(); } | CODE |
| HIGH | tests/test_frontend.py | 582 | for (var i = 0; i < 10; i++) slices.push({ k: "threat" + i, v: 100 - i }); | CODE |
| HIGH | tests/test_frontend.py | 649 | if (i && v <= t[i - 1]) die("not ascending"); | CODE |
| HIGH | tests/test_frontend.py | 1106 | for (var i = 0; i < 4000; i++) rows.push({ | CODE |
| HIGH | tests/test_frontend.py | 1123 | if (a !== b) bad.push(k + ' dir=' + dir); | CODE |
| HIGH⚡ | tests/test_frontend.py | 198 | ranks = self._ranks('var document = { querySelector: function () { return null; } };') | STRING |
| HIGH⚡ | tests/test_frontend.py | 1049 | m = re.search(r"if \(agg && seen - lastRender >= RENDER_EVERY[^{]*\{", self.js, re.S) | STRING |
| HIGH | tests/test_severity_parity.py | 112 | %s.forEach(function (c) { out.push(NAMES[severityOf(c[0], c[1])]); }); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 154 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 156 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 263 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 265 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 313 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 315 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 506 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 508 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 665 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 667 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 749 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 751 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 781 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 39 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 139 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 182 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 184 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 233 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 235 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 104 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 106 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 275 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 277 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 380 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 382 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sensor/tools/check_windows.sh | 5 | # --------------- | COMMENT |
| MEDIUM | sensor/tools/check_windows.sh | 18 | # ------------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/update.py | 200 | CODE | |
| LOW | core/update.py | 385 | CODE | |
| LOW | core/update.py | 838 | CODE | |
| LOW | core/update.py | 949 | CODE | |
| LOW | core/update.py | 1007 | CODE | |
| LOW | core/index.py | 139 | CODE | |
| LOW | core/log.py | 78 | CODE | |
| LOW | core/log.py | 143 | CODE | |
| LOW | core/log.py | 281 | CODE | |
| LOW | core/log.py | 395 | CODE | |
| LOW | core/logfmt.py | 38 | CODE | |
| LOW | core/httpd.py | 151 | CODE | |
| LOW | core/httpd.py | 502 | CODE | |
| LOW | core/httpd.py | 549 | CODE | |
| LOW | core/httpd.py | 822 | CODE | |
| LOW | core/httpd.py | 966 | CODE | |
| LOW | core/httpd.py | 1056 | CODE | |
| LOW | core/httpd.py | 1228 | CODE | |
| LOW | core/httpd.py | 1279 | CODE | |
| LOW | core/httpd.py | 1386 | CODE | |
| LOW | core/httpd.py | 1662 | CODE | |
| LOW | core/httpd.py | 1942 | CODE | |
| LOW | core/httpd.py | 2001 | CODE | |
| LOW | core/httpd.py | 2058 | CODE | |
| LOW | core/httpd.py | 2177 | CODE | |
| LOW | core/httpd.py | 2201 | CODE | |
| LOW | core/httpd.py | 2329 | CODE | |
| LOW | core/httpd.py | 2550 | CODE | |
| LOW | core/httpd.py | 2650 | CODE | |
| LOW | core/httpd.py | 2742 | CODE | |
| LOW | core/httpd.py | 2857 | CODE | |
| LOW | core/addr.py | 109 | CODE | |
| LOW | core/quic_sni.py | 338 | CODE | |
| LOW | core/quic_sni.py | 377 | CODE | |
| LOW | core/assemble.py | 109 | CODE | |
| LOW | core/ignore.py | 58 | CODE | |
| LOW | core/common.py | 70 | CODE | |
| LOW | core/common.py | 173 | CODE | |
| LOW | core/common.py | 249 | CODE | |
| LOW | core/common.py | 400 | CODE | |
| LOW | core/common.py | 464 | CODE | |
| LOW | core/common.py | 513 | CODE | |
| LOW | core/common.py | 542 | CODE | |
| LOW | core/common.py | 583 | CODE | |
| LOW | core/common.py | 756 | CODE | |
| LOW | core/common.py | 425 | CODE | |
| LOW | core/custom_trails.py | 34 | CODE | |
| LOW | core/settings.py | 438 | CODE | |
| LOW | core/settings.py | 618 | CODE | |
| LOW | core/settings.py | 631 | CODE | |
| LOW | core/settings.py | 651 | CODE | |
| LOW | core/testing.py | 410 | CODE | |
| LOW | core/testing.py | 550 | CODE | |
| LOW | core/tls_intel.py | 118 | CODE | |
| LOW | core/tls_intel.py | 326 | CODE | |
| LOW | core/meta.py | 213 | CODE | |
| LOW | tests/test_quic_sni.py | 230 | CODE | |
| LOW | tests/test_frontend.py | 1161 | CODE | |
| LOW | tests/test_frontend.py | 1307 | CODE | |
| LOW | tests/test_tls_intel.py | 204 | CODE | |
| 41 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server.py | 16 | CODE | |
| LOW | server.py | 37 | CODE | |
| LOW | core/update.py | 67 | CODE | |
| LOW | core/update.py | 68 | CODE | |
| LOW | core/update.py | 69 | CODE | |
| LOW | core/update.py | 70 | CODE | |
| LOW | core/geo.py | 12 | CODE | |
| LOW | core/trailsbin.py | 25 | CODE | |
| LOW | core/httpd.py | 21 | CODE | |
| LOW | core/httpd.py | 79 | CODE | |
| LOW | core/httpd.py | 80 | CODE | |
| LOW | core/httpd.py | 81 | CODE | |
| LOW | core/httpd.py | 82 | CODE | |
| LOW | core/httpd.py | 88 | CODE | |
| LOW | core/quic_sni.py | 23 | CODE | |
| LOW | core/assemble.py | 8 | CODE | |
| LOW | core/ignore.py | 22 | CODE | |
| LOW | core/common.py | 48 | CODE | |
| LOW | core/common.py | 49 | CODE | |
| LOW | core/common.py | 50 | CODE | |
| LOW | core/common.py | 51 | CODE | |
| LOW | core/settings.py | 24 | CODE | |
| LOW | core/settings.py | 25 | CODE | |
| LOW | core/settings.py | 26 | CODE | |
| LOW | core/settings.py | 27 | CODE | |
| LOW | core/trailsdict.py | 8 | CODE | |
| LOW | core/alert.py | 8 | CODE | |
| LOW | core/tls_intel.py | 20 | CODE | |
| LOW | core/tls_intel.py | 21 | CODE | |
| LOW | tests/test_alert.py | 11 | CODE | |
| LOW | tests/test_adversarial.py | 13 | CODE | |
| LOW | tests/test_refs.py | 12 | CODE | |
| LOW | tests/test_refs.py | 16 | CODE | |
| LOW | tests/test_config.py | 123 | CODE | |
| LOW | tests/test_assemble.py | 139 | CODE | |
| LOW | tests/test_assemble.py | 139 | CODE | |
| LOW | tests/install/windows.py | 19 | CODE | |
| LOW | sensor/tools/check_redistribution.py | 32 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 19 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 30 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 31 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 32 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 33 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker/tests/entrypoint_test.sh | 13 | # It builds a small harness image rather than the real one: the entrypoint is the thing under | COMMENT |
| MEDIUM | docker/tests/entrypoint_test.sh | 15 | # harness copies the same entrypoint into the same directory layout, with a stub named | COMMENT |
| MEDIUM | sensor/tools/gen_corpus.py | 225 | # mode BOTH sensors stay silent here; the harness asserts these with --timestamps pcap. | COMMENT |
| MEDIUM | sensor/tools/gen_corpus.py | 242 | # breaks the harness instead of quietly restoring "parity" with a detection hole. | COMMENT |
| MEDIUM | .github/workflows/compat.yml | 3 | # The README claimed six platforms; the harness covered five, and none of the result was published. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 44 | # disagree in a way the parity harness structurally cannot see, because each is internally | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 360 | # actionlint only reaches the scripts embedded in workflows. install.sh, the compat harness | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 362 | # them - `ulimit -v` in a file declaring #!/bin/sh meant the test harness's memory cap | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 508 | # This runs against a real daemon and takes about a minute: it builds a small harness image | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 530 | fetch-depth: 0 # the harness serves the clone from this checkout over file:// | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sensor/src/addr.rs | 142 | // Step 1: re.findall("(?:0000:)+", address) -> maximal runs of the 5-byte unit | COMMENT |
| LOW | sensor/src/addr.rs | 179 | // Step 2: re.sub(r"(\A|:)0+(\w)", r"\g<1>\g<2>", address) | COMMENT |
| LOW | sensor/src/addr.rs | 223 | // Step 3: a collapsed leading run yields a single ':' -> make it '::'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sensor/src/addr.rs | 142 | // Step 1: re.findall("(?:0000:)+", address) -> maximal runs of the 5-byte unit | COMMENT |
| LOW | sensor/src/addr.rs | 179 | // Step 2: re.sub(r"(\A|:)0+(\w)", r"\g<1>\g<2>", address) | COMMENT |
| LOW | sensor/src/addr.rs | 223 | // Step 3: a collapsed leading run yields a single ':' -> make it '::'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_tls_intel.py | 23 | CODE | |
| LOW | sensor/tools/gen_ja_vectors.py | 36 | CODE |