diff --git a/reports/mitmproxy-2026-10-02/analysis.stderr b/reports/mitmproxy-2026-10-02/analysis.stderr new file mode 100644 index 0000000..e69de29 diff --git a/reports/mitmproxy-2026-10-02/findings.json b/reports/mitmproxy-2026-10-02/findings.json new file mode 100644 index 0000000..c8bb287 --- /dev/null +++ b/reports/mitmproxy-2026-10-02/findings.json @@ -0,0 +1,5470 @@ +{ + "schema_version": 1, + "tool": { + "name": "coretrace-python-analyzer", + "version": "0.21.0", + "components": [ + { + "kind": "plugin", + "name": "dependency-policy", + "version": "1.0.0", + "digest": "sha256:64108a692266b69ec97bccc9301116b718fbfff19596556a69473daff42182d5" + }, + { + "kind": "plugin", + "name": "reachable-vulnerability", + "version": "1.0.0", + "digest": "sha256:a934ad18a4c225a0b85e0f54e7d02d6e044b0f37e238aa1dcabd969df2055fd8" + }, + { + "kind": "plugin", + "name": "sample-advisories", + "version": "1.0.0", + "digest": "sha256:0d70ce268e90561f9a07eda73728c2aefc8984fc71b9406b9744f0d19a0c94b7" + }, + { + "kind": "plugin", + "name": "vulnerable-dependency", + "version": "1.0.0", + "digest": "sha256:b528af35294646c5dabdd8e9d1977007543ca665b1ceabb75fae2d1cddd5dcb4" + }, + { + "kind": "plugin", + "name": "aiohttp-models", + "version": "1.0.0", + "digest": "sha256:1fb9fc998a1828174de89efe2e63520e982d8b2952fc03da057fb2e35b6a8e2c" + }, + { + "kind": "plugin", + "name": "bottle-models", + "version": "1.0.0", + "digest": "sha256:a419b5911ab7736602d006a51d198199f4b9446264ad05b2c08a8ec16ba58b3c" + }, + { + "kind": "plugin", + "name": "cli-models", + "version": "1.0.0", + "digest": "sha256:2c7ea65765a0f27cdc62aa1aeb1d63a8a4fa1a1e6907c1650018daf741852ba5" + }, + { + "kind": "plugin", + "name": "credential-models", + "version": "1.0.0", + "digest": "sha256:35254a07aee5800506f32d3af2b716fd2fd57eadf64d2cb962ff69e8acaeead8" + }, + { + "kind": "plugin", + "name": "db-driver-models", + "version": "1.0.0", + "digest": "sha256:35ff485fc04801b3404bfe58b998c3901f14a55a5c1f1e80b8b37e388eb4dde0" + }, + { + "kind": "plugin", + "name": "django-models", + "version": "1.0.0", + "digest": "sha256:900ef18837883e3ec7f46ff23280505ddc61e3606838c5a1574e2bb3d6dbe754" + }, + { + "kind": "plugin", + "name": "fastapi-models", + "version": "1.0.0", + "digest": "sha256:ecf4ab97f3b91e75a38420f6577c1e214e007dcb214bb33b466a47a055de3772" + }, + { + "kind": "plugin", + "name": "flask-models", + "version": "1.0.0", + "digest": "sha256:86276bc1e6be85913a2161af269ad84b4cd19571abf8fa4dc22417afa1ea95ff" + }, + { + "kind": "plugin", + "name": "http-client-models", + "version": "1.0.0", + "digest": "sha256:5e4f46304dbc02f8c960215468bd87416e921064e7dfe9dc342e6a4f431001ce" + }, + { + "kind": "plugin", + "name": "python-stdlib-models", + "version": "1.0.0", + "digest": "sha256:2b237d794970e72d41fcc13bf0506c2fe43ef24333ab76804e9bb51e05f5595b" + }, + { + "kind": "plugin", + "name": "sqlalchemy-models", + "version": "1.0.0", + "digest": "sha256:f68f77a847d23dd85d049c9428cbd802633dc85a5351532cc963f186ab5b5acf" + }, + { + "kind": "plugin", + "name": "tornado-models", + "version": "1.0.0", + "digest": "sha256:69b2ef24e7cb3b93fe4859fd98e475c126448f0034136cbf97d24e1298c21b27" + }, + { + "kind": "plugin", + "name": "config-secrets", + "version": "1.0.0", + "digest": "sha256:7e7fb490705c5e5de981a2fbef129f1458ad1aaeb259e56eb49cc8ab1cdaffd5" + }, + { + "kind": "plugin", + "name": "hardcoded-secrets", + "version": "1.0.0", + "digest": "sha256:9629e9c37fd168250f7286d2e8a3b2f62267425f8100dcc5f56c2bd31eddf7dd" + }, + { + "kind": "plugin", + "name": "code-injection", + "version": "1.0.0", + "digest": "sha256:b97fb5ac23bcd251fa0408c16a95e2a23be2496252e3f78596bd339d5f7335dd" + }, + { + "kind": "plugin", + "name": "command-injection", + "version": "1.0.0", + "digest": "sha256:a79f25466752e1a0cf5105b6194d99ad4bcdc16834598d7bf86a167a0c5fd3e0" + }, + { + "kind": "plugin", + "name": "insecure-deserialization", + "version": "1.0.0", + "digest": "sha256:197001f660f3286f015baf9f2ee7fe0e9c376d98f5fd45886b9ebf51261c93e6" + }, + { + "kind": "plugin", + "name": "nosql-injection", + "version": "1.0.0", + "digest": "sha256:24a28107a44322339da20f519b49506f73b772b1961f1c4acb19180bcc36f3f9" + }, + { + "kind": "plugin", + "name": "open-redirect", + "version": "1.0.0", + "digest": "sha256:e0d5ee69073fb54e13158651f801c80250056276f9a4eb59e3356fd8c4cef043" + }, + { + "kind": "plugin", + "name": "path-traversal", + "version": "1.0.0", + "digest": "sha256:26446a23fea57e6a2ff582b6c905d84b7cd04df19e1020c31a888b038b0b82f9" + }, + { + "kind": "plugin", + "name": "plaintext-credentials", + "version": "1.0.0", + "digest": "sha256:281eb1d021a92333ea35541a4a8dddd1e61e60cb48741f3f8bbac7311318fef5" + }, + { + "kind": "plugin", + "name": "sql-injection", + "version": "1.0.0", + "digest": "sha256:7c6202503365c70289c3d35dae63a4a9510d7d47d1c0a4e85aaf6e72c7dab699" + }, + { + "kind": "plugin", + "name": "ssrf", + "version": "1.0.0", + "digest": "sha256:4354049a2ad1487fbf8688901fe40528024f4ec58caa35bbee2c13452884d369" + }, + { + "kind": "plugin", + "name": "xss", + "version": "1.0.0", + "digest": "sha256:9c6a3f3c7f68fe2441f3bcd3f4be2f3dbcaa837f541e3a8c0944fc940c0f30d1" + }, + { + "kind": "plugin", + "name": "dangerous-eval", + "version": "1.0.0", + "digest": "sha256:0be6472598d8ec6357f4dc2c8b20f97a26f011e6edcfb40d613a7560151ddd0a" + }, + { + "kind": "plugin", + "name": "flask-debug", + "version": "1.0.0", + "digest": "sha256:667f4e76bee3c1dd3b70d19cbc4587611240de469a35e3e6214b8cdbb14d600d" + }, + { + "kind": "plugin", + "name": "insecure-temp-file", + "version": "1.0.0", + "digest": "sha256:51395d5b1518f754d663a8d09695f0b5b2da55255b2f5e699daaaec2d47ea8b3" + }, + { + "kind": "plugin", + "name": "insecure-tls", + "version": "1.0.0", + "digest": "sha256:97fe6370d985b93eb2fddef6ec9b8f255904c19d98ccedd5fd1b5afc932c9740" + }, + { + "kind": "plugin", + "name": "missing-timeout", + "version": "1.0.0", + "digest": "sha256:8ef60c32d47d632685ef001691360f93c83e127eebbbe252ab4fcb0fe76ed4db" + }, + { + "kind": "plugin", + "name": "unsafe-archive-extraction", + "version": "1.0.0", + "digest": "sha256:4109a4eb18c45e6c50004fd8f770c055cbb4154a713dd14664870dd1e03dfda4" + }, + { + "kind": "plugin", + "name": "unsafe-xml", + "version": "1.0.0", + "digest": "sha256:416083cda0ba7ab89581c0471606a806efa2a2049262f2d75201247209eb49ed" + }, + { + "kind": "plugin", + "name": "weak-crypto", + "version": "1.0.0", + "digest": "sha256:1236fdfb5a1b6583cec47d8c1e8183a4284d283413581ebd232873b19e50ce2a" + }, + { + "kind": "plugin", + "name": "weak-random", + "version": "1.0.0", + "digest": "sha256:0f6287a58ec2daafb13b7b011b68e81d00bc4e1e29b6c5dac9bf114c7ab21fa9" + }, + { + "kind": "plugin", + "name": "architecture-rules", + "version": "1.0.0", + "digest": "sha256:912f10abeb0dc954cab6ce0fd9e09c7d75ce64f20f916b3f143538317ffe0578" + }, + { + "kind": "plugin", + "name": "curated-advisories", + "version": "2026.09.27", + "digest": "sha256:445a0bd33b7905052cfaa8a945a3c1eb30df95507cc3325da995b60bfd321cb7" + }, + { + "kind": "plugin", + "name": "enterprise-validators", + "version": "1.0.0", + "digest": "sha256:bddec63ed9fb4b9d37308ff27c9732bd7827394e0bfba917c3ad1974e77bba83" + }, + { + "kind": "plugin", + "name": "exposure-prioritization", + "version": "1.0.0", + "digest": "sha256:c7d14dafb655bfbabd0f007a50b0e061a186e4817067938bd0c2582345551447" + }, + { + "kind": "plugin", + "name": "frameworks-models", + "version": "1.0.0", + "digest": "sha256:1479b437640ec047234a5273a30283fd45432f2b1d0338898aa559cc8ebf1f1d" + }, + { + "kind": "plugin", + "name": "orm-n-plus-one", + "version": "1.0.0", + "digest": "sha256:32f043bb2a27a81d9c8d1a4be455ed4227ac494acdc292f3316d0c2034b5823d" + }, + { + "kind": "plugin", + "name": "serverless-declarations", + "version": "1.0.0", + "digest": "sha256:ad06322d7173cefffb6b2a171aaa829b5b028c7e0bff989f70c3973c468d37db" + } + ] + }, + "root": "/Users/hugopayet/Desktop/coretrace-python-dir/coretrace-python-analyzer/tests-project/mitmproxy", + "findings": [ + { + "rule_id": "ambiguous-module", + "message": "docs/build.py is the module 'build' like release/build.py: a symbol python.build.* may name a function of either, and an import of 'build' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "docs/build.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": {} + }, + { + "rule_id": "ambiguous-module", + "message": "examples/addons/shutdown.py is the module 'shutdown' like test/mitmproxy/data/addonscripts/shutdown.py: a symbol python.shutdown.* may name a function of either, and an import of 'shutdown' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "examples/addons/shutdown.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "exposure": "local", + "exposed_by": "examples.addons.shutdown." + } + }, + { + "rule_id": "missing-timeout", + "message": "python.requests.post is called without a timeout; a slow or silent peer blocks this code indefinitely", + "severity": "low", + "confidence": "high", + "location": { + "path": "examples/contrib/jsondump.py", + "line": 192, + "column": 13, + "end_line": 192, + "end_column": 74 + }, + "function": "dump", + "metadata": { + "symbol": "python.requests.post", + "exposure": "unreached" + } + }, + { + "rule_id": "hardcoded-credential", + "message": "Hardcoded credential in dump_password: p\u2026 (4 characters)", + "severity": "high", + "confidence": "low", + "location": { + "path": "examples/contrib/test_jsondump.py", + "line": 65, + "column": 35, + "end_line": 65, + "end_column": 41 + }, + "function": "test_http", + "metadata": { + "name": "dump_password", + "length": "4", + "context": "test", + "exposure": "unreached" + } + }, + { + "rule_id": "missing-timeout", + "message": "python.requests.get is called without a timeout; a slow or silent peer blocks this code indefinitely", + "severity": "low", + "confidence": "high", + "location": { + "path": "examples/contrib/xss_scanner.py", + "line": 141, + "column": 12, + "end_line": 141, + "end_column": 46 + }, + "function": "test_end_of_URL_injection", + "metadata": { + "symbol": "python.requests.get", + "exposure": "unreached" + } + }, + { + "rule_id": "missing-timeout", + "message": "python.requests.get is called without a timeout; a slow or silent peer blocks this code indefinitely", + "severity": "low", + "confidence": "high", + "location": { + "path": "examples/contrib/xss_scanner.py", + "line": 152, + "column": 12, + "end_line": 154, + "end_column": 6 + }, + "function": "test_referer_injection", + "metadata": { + "symbol": "python.requests.get", + "exposure": "unreached" + } + }, + { + "rule_id": "missing-timeout", + "message": "python.requests.get is called without a timeout; a slow or silent peer blocks this code indefinitely", + "severity": "low", + "confidence": "high", + "location": { + "path": "examples/contrib/xss_scanner.py", + "line": 165, + "column": 12, + "end_line": 167, + "end_column": 6 + }, + "function": "test_user_agent_injection", + "metadata": { + "symbol": "python.requests.get", + "exposure": "unreached" + } + }, + { + "rule_id": "missing-timeout", + "message": "python.requests.get is called without a timeout; a slow or silent peer blocks this code indefinitely", + "severity": "low", + "confidence": "high", + "location": { + "path": "examples/contrib/xss_scanner.py", + "line": 185, + "column": 12, + "end_line": 185, + "end_column": 50 + }, + "function": "test_query_injection", + "metadata": { + "symbol": "python.requests.get", + "exposure": "unreached" + } + }, + { + "rule_id": "reachable-vulnerability", + "message": "CVE-2026-27199: python.werkzeug.security.safe_join is affected in the required werkzeug <3.1.6: safe_join() accepts a Windows device name in a later segment of a multi-segment path (reports/NUL), so reading the path never ends", + "severity": "medium", + "confidence": "high", + "location": { + "path": "mitmproxy/addons/maplocal.py", + "line": 47, + "column": 14, + "end_line": 47, + "end_column": 58 + }, + "function": "_safe_path_join", + "metadata": { + "advisory": "CVE-2026-27199", + "package": "werkzeug", + "symbol": "python.werkzeug.security.safe_join", + "level": "reachable", + "entry_point": "python.werkzeug.security.safe_join", + "justification": "changed by commit f407712fdc60 (3.1.6): the device check applies to every '/'-separated segment of each part", + "conditions": "runs on Windows, where reports/NUL still names a device and reading it never ends", + "conditions_pending_review": "runs on Windows, where reports/NUL still names a device and reading it never ends", + "exposure": "unreached", + "advisory_source": "curated-advisories@2026.09.27" + } + }, + { + "rule_id": "syntax-error", + "message": "/Users/hugopayet/Desktop/coretrace-python-dir/coretrace-python-analyzer/tests-project/mitmproxy/mitmproxy/contentviews/_api.py:20:1: unsupported syntax: TypeAlias", + "severity": "info", + "confidence": "high", + "location": { + "path": "mitmproxy/contentviews/_api.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": {} + }, + { + "rule_id": "syntax-error", + "message": "/Users/hugopayet/Desktop/coretrace-python-dir/coretrace-python-analyzer/tests-project/mitmproxy/mitmproxy/contentviews/_utils.py:19:1: unsupported syntax: TypeAlias", + "severity": "info", + "confidence": "high", + "location": { + "path": "mitmproxy/contentviews/_utils.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": {} + }, + { + "rule_id": "syntax-error", + "message": "/Users/hugopayet/Desktop/coretrace-python-dir/coretrace-python-analyzer/tests-project/mitmproxy/mitmproxy/contentviews/_view_image/image_parser.py:10:1: unsupported syntax: TypeAlias", + "severity": "info", + "confidence": "high", + "location": { + "path": "mitmproxy/contentviews/_view_image/image_parser.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": {} + }, + { + "rule_id": "unsafe-xml", + "message": "call to python.xml.dom.minidom.parseString parses XML with entity expansion enabled; use defusedxml", + "severity": "medium", + "confidence": "high", + "location": { + "path": "mitmproxy/contrib/wbxml/ASWBXML.py", + "line": 819, + "column": 17, + "end_line": 819, + "end_column": 52 + }, + "function": "loadXml", + "metadata": { + "symbol": "python.xml.dom.minidom.parseString", + "exposure": "unreached" + } + }, + { + "rule_id": "syntax-error", + "message": "/Users/hugopayet/Desktop/coretrace-python-dir/coretrace-python-analyzer/tests-project/mitmproxy/mitmproxy/net/dns/https_records.py:35:1: unsupported syntax: TypeAlias", + "severity": "info", + "confidence": "high", + "location": { + "path": "mitmproxy/net/dns/https_records.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": {} + }, + { + "rule_id": "missing-timeout", + "message": "python.requests.get is called without a timeout; a slow or silent peer blocks this code indefinitely", + "severity": "low", + "confidence": "high", + "location": { + "path": "mitmproxy/utils/emoji.py", + "line": 1870, + "column": 9, + "end_line": 1870, + "end_column": 54 + }, + "function": "", + "metadata": { + "symbol": "python.requests.get", + "exposure": "local", + "exposed_by": "mitmproxy.utils.emoji." + } + }, + { + "rule_id": "weak-crypto", + "message": "call to python.hashlib.sha1 uses a broken hash algorithm", + "severity": "medium", + "confidence": "high", + "location": { + "path": "mitmproxy/utils/htpasswd.py", + "line": 77, + "column": 22, + "end_line": 77, + "end_column": 60 + }, + "function": "check_password", + "metadata": { + "symbol": "python.hashlib.sha1", + "exposure": "unreached" + } + }, + { + "rule_id": "weak-crypto", + "message": "call to python.hashlib.md5 uses a broken hash algorithm", + "severity": "medium", + "confidence": "high", + "location": { + "path": "mitmproxy/utils/magisk.py", + "line": 90, + "column": 17, + "end_line": 90, + "end_column": 55 + }, + "function": "subject_hash_old", + "metadata": { + "symbol": "python.hashlib.md5", + "exposure": "exposed", + "exposed_by": "mitmproxy.addons.onboardingapp.magisk" + } + }, + { + "rule_id": "ambiguous-module", + "message": "release/build.py is the module 'build' like docs/build.py: a symbol python.build.* may name a function of either, and an import of 'build' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "release/build.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": {} + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.check_call", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/build.py", + "line": 178, + "column": 9, + "end_line": 189, + "end_column": 10 + }, + "function": "macos_app", + "metadata": { + "source": "python.click.group.command", + "source_label": "argv", + "sink": "python.subprocess.check_call", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release.build.macos_app" + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.check_call", + "severity": "high", + "confidence": "medium", + "location": { + "path": "release/build.py", + "line": 200, + "column": 9, + "end_line": 210, + "end_column": 10 + }, + "function": "macos_app", + "metadata": { + "source": "python.click.group.command", + "source_label": "argv", + "sink": "python.subprocess.check_call", + "verdict": "hotspot", + "evidence": "guard at line 173 does not prove the value safe", + "exposure": "local", + "exposed_by": "release.build.macos_app" + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.run", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/release.py", + "line": 104, + "column": 5, + "end_line": 106, + "end_column": 6 + }, + "function": "", + "metadata": { + "source": "python.sys.argv", + "source_label": "argv", + "sink": "python.subprocess.run", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release." + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.run", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/release.py", + "line": 108, + "column": 5, + "end_line": 108, + "end_column": 67 + }, + "function": "", + "metadata": { + "source": "python.sys.argv", + "source_label": "argv", + "sink": "python.subprocess.run", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release." + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: process-output input reaches python.subprocess.run", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/release.py", + "line": 132, + "column": 5, + "end_line": 134, + "end_column": 6 + }, + "function": "", + "metadata": { + "source": "python.subprocess.run.stdout", + "source_label": "process-output", + "sink": "python.subprocess.run", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release." + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.run", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/release.py", + "line": 132, + "column": 5, + "end_line": 134, + "end_column": 6 + }, + "function": "", + "metadata": { + "source": "python.sys.argv", + "source_label": "argv", + "sink": "python.subprocess.run", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release." + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.run", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/release.py", + "line": 137, + "column": 5, + "end_line": 150, + "end_column": 6 + }, + "function": "", + "metadata": { + "source": "python.sys.argv", + "source_label": "argv", + "sink": "python.subprocess.run", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release." + } + }, + { + "rule_id": "command-injection", + "message": "Command injection: argv input reaches python.subprocess.run", + "severity": "high", + "confidence": "high", + "location": { + "path": "release/release.py", + "line": 153, + "column": 5, + "end_line": 155, + "end_column": 6 + }, + "function": "", + "metadata": { + "source": "python.sys.argv", + "source_label": "argv", + "sink": "python.subprocess.run", + "verdict": "vulnerability", + "evidence": "no guard on the path to the sink", + "exposure": "local", + "exposed_by": "release." + } + }, + { + "rule_id": "hardcoded-secret", + "message": "Hardcoded url secret in a string literal: Gene\u2026 (481 characters)", + "severity": "high", + "confidence": "high", + "location": { + "path": "test/helper_tools/gen_sample_flows.py", + "line": 2, + "column": 1, + "end_line": 12, + "end_column": 4 + }, + "function": null, + "metadata": { + "provider": "url", + "name": "", + "length": "481", + "exposure": "local", + "exposed_by": "gen_sample_flows." + } + }, + { + "rule_id": "hardcoded-secret", + "message": "Hardcoded url secret in a string literal: --up\u2026 (65 characters)", + "severity": "high", + "confidence": "high", + "location": { + "path": "test/helper_tools/gen_sample_flows.py", + "line": 271, + "column": 18, + "end_line": 271, + "end_column": 85 + }, + "function": "main", + "metadata": { + "provider": "url", + "name": "", + "length": "65", + "exposure": "local", + "exposed_by": "gen_sample_flows." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: 1603\u2026 (212 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/addons/test_next_layer.py", + "line": 40, + "column": 5, + "end_line": 44, + "end_column": 21 + }, + "function": null, + "metadata": { + "name": "", + "length": "212", + "entropy": "3.54", + "exposure": "local", + "exposed_by": "test.mitmproxy.addons.test_next_layer." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: ca00\u2026 (2560 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/addons/test_next_layer.py", + "line": 65, + "column": 5, + "end_line": 93, + "end_column": 47 + }, + "function": null, + "metadata": { + "name": "", + "length": "2560", + "entropy": "4.00", + "exposure": "local", + "exposed_by": "test.mitmproxy.addons.test_next_layer." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: c200\u2026 (2460 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/addons/test_next_layer.py", + "line": 97, + "column": 5, + "end_line": 124, + "end_column": 37 + }, + "function": null, + "metadata": { + "name": "", + "length": "2460", + "entropy": "4.00", + "exposure": "local", + "exposed_by": "test.mitmproxy.addons.test_next_layer." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: 52e2\u2026 (360 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/addons/test_next_layer.py", + "line": 128, + "column": 5, + "end_line": 131, + "end_column": 97 + }, + "function": null, + "metadata": { + "name": "", + "length": "360", + "entropy": "3.97", + "exposure": "local", + "exposed_by": "test.mitmproxy.addons.test_next_layer." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: ca0a\u2026 (90 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/addons/test_next_layer.py", + "line": 976, + "column": 9, + "end_line": 976, + "end_column": 101 + }, + "function": "test_starts_like_quic", + "metadata": { + "name": "", + "length": "90", + "entropy": "3.86", + "exposure": "unreached" + } + }, + { + "rule_id": "ambiguous-module", + "message": "test/mitmproxy/data/addonscripts/addon.py is the module 'addon' like test/mitmproxy/data/addonscripts/same_filename/addon.py: a symbol python.addon.* may name a function of either, and an import of 'addon' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "test/mitmproxy/data/addonscripts/addon.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "exposure": "local", + "exposed_by": "test.mitmproxy.data.addonscripts.addon." + } + }, + { + "rule_id": "ambiguous-module", + "message": "test/mitmproxy/data/addonscripts/same_filename/addon.py is the module 'addon' like test/mitmproxy/data/addonscripts/addon.py: a symbol python.addon.* may name a function of either, and an import of 'addon' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "test/mitmproxy/data/addonscripts/same_filename/addon.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "exposure": "local", + "exposed_by": "test.mitmproxy.data.addonscripts.same_filename.addon." + } + }, + { + "rule_id": "ambiguous-module", + "message": "test/mitmproxy/data/addonscripts/shutdown.py is the module 'shutdown' like examples/addons/shutdown.py: a symbol python.shutdown.* may name a function of either, and an import of 'shutdown' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "test/mitmproxy/data/addonscripts/shutdown.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "exposure": "local", + "exposed_by": "test.mitmproxy.data.addonscripts.shutdown." + } + }, + { + "rule_id": "ambiguous-module", + "message": "test/mitmproxy/data/servercert/generate.py is the module 'generate' like test/mitmproxy/net/data/verificationcerts/generate.py: a symbol python.generate.* may name a function of either, and an import of 'generate' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "test/mitmproxy/data/servercert/generate.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "exposure": "local", + "exposed_by": "test.mitmproxy.data.servercert.generate." + } + }, + { + "rule_id": "ambiguous-module", + "message": "test/mitmproxy/net/data/verificationcerts/generate.py is the module 'generate' like test/mitmproxy/data/servercert/generate.py: a symbol python.generate.* may name a function of either, and an import of 'generate' resolves only from its own root", + "severity": "info", + "confidence": "high", + "location": { + "path": "test/mitmproxy/net/data/verificationcerts/generate.py", + "line": 1, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "exposure": "local", + "exposed_by": "test.mitmproxy.net.data.verificationcerts.generate." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: zHai\u2026 (39 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/net/http/test_cookies.py", + "line": 21, + "column": 23, + "end_line": 21, + "end_column": 64 + }, + "function": null, + "metadata": { + "name": "", + "length": "39", + "entropy": "4.93", + "exposure": "local", + "exposed_by": "test.mitmproxy.net.http.test_cookies." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: 789c\u2026 (34 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/net/test_encoding.py", + "line": 79, + "column": 30, + "end_line": 79, + "end_column": 66 + }, + "function": "test_zlib", + "metadata": { + "name": "", + "length": "34", + "entropy": "3.55", + "exposure": "unreached" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: 1f8b\u2026 (134 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/net/test_encoding.py", + "line": 85, + "column": 13, + "end_line": 86, + "end_column": 83 + }, + "function": "test_truncated", + "metadata": { + "name": "", + "length": "134", + "entropy": "3.81", + "exposure": "unreached" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: ca00\u2026 (2560 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/proxy/layers/quic/test__stream_layers.py", + "line": 114, + "column": 5, + "end_line": 142, + "end_column": 47 + }, + "function": null, + "metadata": { + "name": "", + "length": "2560", + "entropy": "4.00", + "exposure": "local", + "exposed_by": "test.mitmproxy.proxy.layers.quic.test__stream_layers." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: c200\u2026 (2460 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/proxy/layers/quic/test__stream_layers.py", + "line": 147, + "column": 5, + "end_line": 174, + "end_column": 37 + }, + "function": null, + "metadata": { + "name": "", + "length": "2460", + "entropy": "4.00", + "exposure": "local", + "exposed_by": "test.mitmproxy.proxy.layers.quic.test__stream_layers." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: cd00\u2026 (2460 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/proxy/layers/quic/test__stream_layers.py", + "line": 179, + "column": 5, + "end_line": 206, + "end_column": 37 + }, + "function": null, + "metadata": { + "name": "", + "length": "2460", + "entropy": "4.00", + "exposure": "local", + "exposed_by": "test.mitmproxy.proxy.layers.quic.test__stream_layers." + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: 0100\u2026 (202 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/proxy/layers/test_tls.py", + "line": 46, + "column": 5, + "end_line": 48, + "end_column": 21 + }, + "function": null, + "metadata": { + "name": "", + "length": "202", + "entropy": "3.57", + "exposure": "local", + "exposed_by": "test.mitmproxy.proxy.layers.test_tls." + } + }, + { + "rule_id": "hardcoded-secret", + "message": "Hardcoded url secret in a string literal: reve\u2026 (40 characters)", + "severity": "high", + "confidence": "high", + "location": { + "path": "test/mitmproxy/proxy/test_mode_servers.py", + "line": 352, + "column": 36, + "end_line": 352, + "end_column": 78 + }, + "function": "test_udp_start_error", + "metadata": { + "provider": "url", + "name": "", + "length": "40", + "exposure": "unreached" + } + }, + { + "rule_id": "hardcoded-secret", + "message": "Hardcoded url secret in a string literal: reve\u2026 (39 characters)", + "severity": "high", + "confidence": "high", + "location": { + "path": "test/mitmproxy/proxy/test_mode_servers.py", + "line": 356, + "column": 15, + "end_line": 356, + "end_column": 54 + }, + "function": "test_udp_start_error", + "metadata": { + "provider": "url", + "name": "", + "length": "39", + "exposure": "unreached" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in a string literal: 0301\u2026 (194 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "test/mitmproxy/test_tls.py", + "line": 4, + "column": 5, + "end_line": 6, + "end_column": 21 + }, + "function": null, + "metadata": { + "name": "", + "length": "194", + "entropy": "3.61", + "exposure": "local", + "exposed_by": "test.mitmproxy.test_tls." + } + }, + { + "rule_id": "hardcoded-credential", + "message": "Hardcoded credential in web_password: t\u2026 (4 characters)", + "severity": "high", + "confidence": "low", + "location": { + "path": "test/mitmproxy/tools/web/test_webaddons.py", + "line": 26, + "column": 41, + "end_line": 26, + "end_column": 47 + }, + "function": "test_plaintext_auth", + "metadata": { + "name": "web_password", + "length": "4", + "context": "test", + "exposure": "unreached" + } + }, + { + "rule_id": "hardcoded-credential", + "message": "Hardcoded credential in web_password: $arg\u2026 (61 characters)", + "severity": "high", + "confidence": "low", + "location": { + "path": "test/mitmproxy/tools/web/test_webaddons.py", + "line": 37, + "column": 17, + "end_line": 37, + "end_column": 80 + }, + "function": "test_argon2_auth", + "metadata": { + "name": "web_password", + "length": "61", + "context": "test", + "exposure": "unreached" + } + }, + { + "rule_id": "hardcoded-credential", + "message": "Hardcoded credential in web_password: $arg\u2026 (10 characters)", + "severity": "high", + "confidence": "low", + "location": { + "path": "test/mitmproxy/tools/web/test_webaddons.py", + "line": 48, + "column": 45, + "end_line": 48, + "end_column": 57 + }, + "function": "test_invalid_hash", + "metadata": { + "name": "web_password", + "length": "10", + "context": "test", + "exposure": "unreached" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: Kk1l\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/charles.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.04" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: PaWn\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/chrome.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.12" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: CKG1\u2026 (116 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/chrome.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "116", + "entropy": "5.11" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: DPEk\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.14" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: Eufb\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.14" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: UuHH\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "4.99" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: TOLq\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "4.92" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: nnIr\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.10" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: PMTL\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.17" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: Wea5\u2026 (76 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "76", + "entropy": "5.37" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: 0okG\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.16" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: dkVe\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/firefox.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.06" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: aN65\u2026 (33 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/head-content-length.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "33", + "entropy": "4.60" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: uGf_\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/insomnia.json", + "line": 54, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "4.88" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: Qd8J\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.07" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: X2i3\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.20" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: IW86\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.12" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: hZNJ\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.06" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: OOEf\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.14" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: zPDS\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.13" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: EnEf\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.11" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: _rRb\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "4.93" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: Eznj\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.02" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: V4Oi\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.17" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: V4Oi\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.17" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: LbvT\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.19" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: LbvT\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.19" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: hvJP\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.16" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: 6aMk\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.27" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: TIE2\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.13" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: qpYq\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.21" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: I+4U\u2026 (76 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "76", + "entropy": "5.29" + } + }, + { + "rule_id": "high-entropy-string", + "message": "High-entropy string in headers: PQpx\u2026 (56 characters)", + "severity": "medium", + "confidence": "low", + "location": { + "path": "tests-project/mitmproxy/test/mitmproxy/data/har_files/safari.json", + "line": 57, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "headers", + "length": "56", + "entropy": "5.31" + } + }, + { + "rule_id": "vulnerable-dependency", + "message": "CVE-2026-27199: werkzeug <3.1.6 is required by werkzeug: safe_join() accepts a Windows device name in a later segment of a multi-segment path (reports/NUL), so reading the path never ends", + "severity": "medium", + "confidence": "high", + "location": { + "path": "tests-project/mitmproxy/uv.lock", + "line": 620, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "advisory": "CVE-2026-27199", + "package": "werkzeug", + "specifier": "", + "level": "imported", + "advisory_source": "curated-advisories@2026.09.27" + } + }, + { + "rule_id": "hardcoded-credential", + "message": "Hardcoded credential in js-tokens: ^\u2026 (6 characters)", + "severity": "high", + "confidence": "medium", + "location": { + "path": "tests-project/mitmproxy/web/package-lock.json", + "line": 71, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "js-tokens", + "length": "6" + } + }, + { + "rule_id": "hardcoded-credential", + "message": "Hardcoded credential in js-tokens: ^3.0\u2026 (16 characters)", + "severity": "high", + "confidence": "medium", + "location": { + "path": "tests-project/mitmproxy/web/package-lock.json", + "line": 71, + "column": 1, + "end_line": null, + "end_column": null + }, + "function": null, + "metadata": { + "name": "js-tokens", + "length": "16" + } + } + ], + "coverage": { + "files": 583, + "files_analysed": 571, + "functions": 6182, + "functions_analysed": 6182, + "details": [ + { + "path": "docs/build.py", + "status": "ambiguous", + "functions": 1, + "analysed": 1 + }, + { + "path": "docs/scripts/api-events.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "docs/scripts/api-render.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "docs/scripts/clirecording/clidirector.py", + "status": "analysed", + "functions": 23, + "analysed": 23 + }, + { + "path": "docs/scripts/clirecording/record.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "docs/scripts/clirecording/screenplays.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "docs/scripts/examples.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "docs/scripts/filters.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "docs/scripts/options.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/anatomy.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/anatomy2.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/commands-flows.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/commands-paths.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/commands-simple.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/contentview-interactive.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/contentview.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/dns-simple.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/duplicate-modify-replay.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/filter-flows.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "examples/addons/http-add-header.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/http-modify-form.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/http-modify-query-string.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/http-redirect-requests.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/http-reply-from-proxy.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/http-stream-modify.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/http-stream-simple.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/http-trailers.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/internet-in-mirror.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/io-read-saved-flows.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "examples/addons/io-write-flow-file.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "examples/addons/log-events.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/nonblocking.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/addons/options-configure.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "examples/addons/options-simple.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "examples/addons/shutdown.py", + "status": "ambiguous", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/tcp-simple.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/websocket-inject-message.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "examples/addons/websocket-simple.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/addons/wsgi-flask-app.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/contrib/all_markers.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/contrib/block_dns_over_https.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "examples/contrib/change_upstream_proxy.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/contrib/check_ssl_pinning.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "examples/contrib/custom_next_layer.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/contrib/dns_spoofing.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/contrib/domain_fronting.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "examples/contrib/har_dump.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "examples/contrib/http_manipulate_cookies.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "examples/contrib/httpdump.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "examples/contrib/jsondump.py", + "status": "analysed", + "functions": 17, + "analysed": 17 + }, + { + "path": "examples/contrib/link_expander.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/contrib/mitmproxywrapper.py", + "status": "analysed", + "functions": 19, + "analysed": 19 + }, + { + "path": "examples/contrib/modify_body_inject_iframe.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/contrib/ntlm_upstream_proxy.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "examples/contrib/portfile.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/contrib/remote-debug.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/contrib/save_streamed_data.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "examples/contrib/search.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "examples/contrib/sslstrip.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "examples/contrib/suppress_error_responses.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "examples/contrib/test_jsondump.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "examples/contrib/test_xss_scanner.py", + "status": "analysed", + "functions": 23, + "analysed": 23 + }, + { + "path": "examples/contrib/tls_passthrough.py", + "status": "analysed", + "functions": 20, + "analysed": 20 + }, + { + "path": "examples/contrib/upstream_pac.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "examples/contrib/webscanner_helper/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "examples/contrib/webscanner_helper/mapping.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "examples/contrib/webscanner_helper/proxyauth_selenium.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "examples/contrib/webscanner_helper/test_mapping.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "examples/contrib/webscanner_helper/test_proxyauth_selenium.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "examples/contrib/webscanner_helper/test_urldict.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "examples/contrib/webscanner_helper/test_urlindex.py", + "status": "analysed", + "functions": 24, + "analysed": 24 + }, + { + "path": "examples/contrib/webscanner_helper/test_urlinjection.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "examples/contrib/webscanner_helper/test_watchdog.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "examples/contrib/webscanner_helper/urldict.py", + "status": "analysed", + "functions": 17, + "analysed": 17 + }, + { + "path": "examples/contrib/webscanner_helper/urlindex.py", + "status": "analysed", + "functions": 21, + "analysed": 21 + }, + { + "path": "examples/contrib/webscanner_helper/urlinjection.py", + "status": "analysed", + "functions": 20, + "analysed": 20 + }, + { + "path": "examples/contrib/webscanner_helper/watchdog.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "examples/contrib/xss_scanner.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "mitmproxy/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/addonmanager.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "mitmproxy/addons/__init__.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/addons/anticache.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/addons/anticomp.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/addons/asgiapp.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/addons/block.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/addons/blocklist.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/addons/browser.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/addons/clientplayback.py", + "status": "analysed", + "functions": 21, + "analysed": 21 + }, + { + "path": "mitmproxy/addons/command_history.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "mitmproxy/addons/comment.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/addons/core.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "mitmproxy/addons/cut.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/addons/disable_h2c.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/addons/dns_resolver.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "mitmproxy/addons/dumper.py", + "status": "analysed", + "functions": 30, + "analysed": 30 + }, + { + "path": "mitmproxy/addons/errorcheck.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/addons/eventstore.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/addons/export.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "mitmproxy/addons/intercept.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "mitmproxy/addons/keepserving.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/addons/maplocal.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/addons/mapremote.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/addons/modifybody.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/addons/modifyheaders.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/addons/next_layer.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "mitmproxy/addons/onboarding.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/addons/onboardingapp/__init__.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/addons/proxyauth.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "mitmproxy/addons/proxyserver.py", + "status": "analysed", + "functions": 23, + "analysed": 23 + }, + { + "path": "mitmproxy/addons/readfile.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/addons/save.py", + "status": "analysed", + "functions": 23, + "analysed": 23 + }, + { + "path": "mitmproxy/addons/savehar.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "mitmproxy/addons/script.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "mitmproxy/addons/server_side_events.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/addons/serverplayback.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "mitmproxy/addons/stickyauth.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/addons/stickycookie.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/addons/strip_dns_https_records.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/addons/termlog.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/addons/tlsconfig.py", + "status": "analysed", + "functions": 19, + "analysed": 19 + }, + { + "path": "mitmproxy/addons/update_alt_svc.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/addons/upstream_auth.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/addons/view.py", + "status": "analysed", + "functions": 89, + "analysed": 89 + }, + { + "path": "mitmproxy/certs.py", + "status": "analysed", + "functions": 48, + "analysed": 48 + }, + { + "path": "mitmproxy/command.py", + "status": "analysed", + "functions": 30, + "analysed": 30 + }, + { + "path": "mitmproxy/command_lexer.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/connection.py", + "status": "analysed", + "functions": 23, + "analysed": 23 + }, + { + "path": "mitmproxy/contentviews/__init__.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/contentviews/_api.py", + "status": "syntax-error", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/contentviews/_compat.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/contentviews/_registry.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/contentviews/_utils.py", + "status": "syntax-error", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/contentviews/_view_css.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/contentviews/_view_dns.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/contentviews/_view_graphql.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/contentviews/_view_http3.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/contentviews/_view_image/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/contentviews/_view_image/image_parser.py", + "status": "syntax-error", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/contentviews/_view_image/view.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/contentviews/_view_javascript.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/contentviews/_view_json.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/contentviews/_view_mqtt.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "mitmproxy/contentviews/_view_multipart.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/contentviews/_view_query.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/contentviews/_view_raw.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/contentviews/_view_socketio.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/contentviews/_view_urlencoded.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/contentviews/_view_wbxml.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/contentviews/_view_xml_html.py", + "status": "analysed", + "functions": 24, + "analysed": 24 + }, + { + "path": "mitmproxy/contentviews/_view_zip.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/contentviews/base.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/contrib/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/contrib/click/__init__.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/contrib/imghdr.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/dtls_client_hello.py", + "status": "analysed", + "functions": 28, + "analysed": 28 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/exif.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/gif.py", + "status": "analysed", + "functions": 38, + "analysed": 38 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/google_protobuf.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/ico.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/jpeg.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/png.py", + "status": "analysed", + "functions": 48, + "analysed": 48 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/tls_client_hello.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "mitmproxy/contrib/kaitaistruct/vlq_base128_le.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/contrib/wbxml/ASCommandResponse.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/contrib/wbxml/ASWBXML.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/contrib/wbxml/ASWBXMLByteQueue.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/contrib/wbxml/ASWBXMLCodePage.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/contrib/wbxml/GlobalTokens.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/contrib/wbxml/InvalidDataException.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/contrib/wbxml/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/coretypes/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/coretypes/bidi.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/coretypes/multidict.py", + "status": "analysed", + "functions": 32, + "analysed": 32 + }, + { + "path": "mitmproxy/coretypes/serializable.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "mitmproxy/ctx.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/dns.py", + "status": "analysed", + "functions": 47, + "analysed": 47 + }, + { + "path": "mitmproxy/eventsequence.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/exceptions.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/flow.py", + "status": "analysed", + "functions": 20, + "analysed": 20 + }, + { + "path": "mitmproxy/flowfilter.py", + "status": "analysed", + "functions": 136, + "analysed": 136 + }, + { + "path": "mitmproxy/hooks.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/http.py", + "status": "analysed", + "functions": 119, + "analysed": 119 + }, + { + "path": "mitmproxy/io/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/io/compat.py", + "status": "analysed", + "functions": 38, + "analysed": 38 + }, + { + "path": "mitmproxy/io/har.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/io/io.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/io/tnetstring.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/log.py", + "status": "analysed", + "functions": 24, + "analysed": 24 + }, + { + "path": "mitmproxy/master.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/net/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/net/check.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/net/dns/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/net/dns/classes.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/net/dns/domain_names.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/net/dns/https_records.py", + "status": "syntax-error", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/net/dns/op_codes.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/net/dns/response_codes.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/net/dns/types.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/net/encoding.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "mitmproxy/net/free_port.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/net/http/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/net/http/cookies.py", + "status": "analysed", + "functions": 22, + "analysed": 22 + }, + { + "path": "mitmproxy/net/http/headers.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/net/http/http1/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/net/http/http1/assemble.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/net/http/http1/read.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/net/http/multipart.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/net/http/status_codes.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/net/http/url.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "mitmproxy/net/http/user_agents.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/net/http/validate.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/net/local_ip.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/net/server_spec.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/net/tls.py", + "status": "analysed", + "functions": 19, + "analysed": 19 + }, + { + "path": "mitmproxy/options.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/optmanager.py", + "status": "analysed", + "functions": 52, + "analysed": 52 + }, + { + "path": "mitmproxy/platform/__init__.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/platform/linux.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/platform/openbsd.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/platform/osx.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/platform/pf.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/platform/windows.py", + "status": "analysed", + "functions": 48, + "analysed": 48 + }, + { + "path": "mitmproxy/proxy/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/proxy/commands.py", + "status": "analysed", + "functions": 19, + "analysed": 19 + }, + { + "path": "mitmproxy/proxy/context.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/proxy/events.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "mitmproxy/proxy/layer.py", + "status": "analysed", + "functions": 21, + "analysed": 21 + }, + { + "path": "mitmproxy/proxy/layers/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/proxy/layers/dns.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "mitmproxy/proxy/layers/http/__init__.py", + "status": "analysed", + "functions": 50, + "analysed": 50 + }, + { + "path": "mitmproxy/proxy/layers/http/_base.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/proxy/layers/http/_events.py", + "status": "analysed", + "functions": 19, + "analysed": 19 + }, + { + "path": "mitmproxy/proxy/layers/http/_hooks.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/proxy/layers/http/_http1.py", + "status": "analysed", + "functions": 25, + "analysed": 25 + }, + { + "path": "mitmproxy/proxy/layers/http/_http2.py", + "status": "analysed", + "functions": 27, + "analysed": 27 + }, + { + "path": "mitmproxy/proxy/layers/http/_http3.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "mitmproxy/proxy/layers/http/_http_h2.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "mitmproxy/proxy/layers/http/_http_h3.py", + "status": "analysed", + "functions": 29, + "analysed": 29 + }, + { + "path": "mitmproxy/proxy/layers/http/_upstream_proxy.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/proxy/layers/modes.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "mitmproxy/proxy/layers/quic/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/proxy/layers/quic/_client_hello_parser.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/proxy/layers/quic/_commands.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/proxy/layers/quic/_events.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/proxy/layers/quic/_hooks.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/proxy/layers/quic/_raw_layers.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "mitmproxy/proxy/layers/quic/_stream_layers.py", + "status": "analysed", + "functions": 33, + "analysed": 33 + }, + { + "path": "mitmproxy/proxy/layers/tcp.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/proxy/layers/tls.py", + "status": "analysed", + "functions": 41, + "analysed": 41 + }, + { + "path": "mitmproxy/proxy/layers/udp.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/proxy/layers/websocket.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "mitmproxy/proxy/mode_servers.py", + "status": "analysed", + "functions": 52, + "analysed": 52 + }, + { + "path": "mitmproxy/proxy/mode_specs.py", + "status": "analysed", + "functions": 36, + "analysed": 36 + }, + { + "path": "mitmproxy/proxy/server.py", + "status": "analysed", + "functions": 32, + "analysed": 32 + }, + { + "path": "mitmproxy/proxy/server_hooks.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/proxy/tunnel.py", + "status": "analysed", + "functions": 19, + "analysed": 19 + }, + { + "path": "mitmproxy/proxy/utils.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/script/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/script/concurrent.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/tcp.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/test/taddons.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/test/tflow.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "mitmproxy/test/tutils.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/tls.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/tools/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/tools/cmdline.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "mitmproxy/tools/console/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/tools/console/commander/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/tools/console/commander/commander.py", + "status": "analysed", + "functions": 23, + "analysed": 23 + }, + { + "path": "mitmproxy/tools/console/commandexecutor.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/tools/console/commands.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "mitmproxy/tools/console/common.py", + "status": "analysed", + "functions": 27, + "analysed": 27 + }, + { + "path": "mitmproxy/tools/console/consoleaddons.py", + "status": "analysed", + "functions": 60, + "analysed": 60 + }, + { + "path": "mitmproxy/tools/console/defaultkeys.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/tools/console/eventlog.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/tools/console/flowdetailview.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/tools/console/flowlist.py", + "status": "analysed", + "functions": 20, + "analysed": 20 + }, + { + "path": "mitmproxy/tools/console/flowview.py", + "status": "analysed", + "functions": 33, + "analysed": 33 + }, + { + "path": "mitmproxy/tools/console/grideditor/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/tools/console/grideditor/base.py", + "status": "analysed", + "functions": 63, + "analysed": 63 + }, + { + "path": "mitmproxy/tools/console/grideditor/col_bytes.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/tools/console/grideditor/col_subgrid.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/tools/console/grideditor/col_text.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/tools/console/grideditor/col_viewany.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/tools/console/grideditor/editors.py", + "status": "analysed", + "functions": 45, + "analysed": 45 + }, + { + "path": "mitmproxy/tools/console/help.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/tools/console/keybindings.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "mitmproxy/tools/console/keymap.py", + "status": "analysed", + "functions": 30, + "analysed": 30 + }, + { + "path": "mitmproxy/tools/console/layoutwidget.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/tools/console/master.py", + "status": "analysed", + "functions": 21, + "analysed": 21 + }, + { + "path": "mitmproxy/tools/console/options.py", + "status": "analysed", + "functions": 29, + "analysed": 29 + }, + { + "path": "mitmproxy/tools/console/overlay.py", + "status": "analysed", + "functions": 31, + "analysed": 31 + }, + { + "path": "mitmproxy/tools/console/palettes.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/tools/console/quickhelp.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/tools/console/searchable.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "mitmproxy/tools/console/signals.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/tools/console/statusbar.py", + "status": "analysed", + "functions": 25, + "analysed": 25 + }, + { + "path": "mitmproxy/tools/console/tabs.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/tools/console/window.py", + "status": "analysed", + "functions": 31, + "analysed": 31 + }, + { + "path": "mitmproxy/tools/dump.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/tools/main.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "mitmproxy/tools/web/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/tools/web/app.py", + "status": "analysed", + "functions": 72, + "analysed": 72 + }, + { + "path": "mitmproxy/tools/web/master.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/tools/web/static_viewer.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "mitmproxy/tools/web/web_columns.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/tools/web/webaddons.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "mitmproxy/types.py", + "status": "analysed", + "functions": 78, + "analysed": 78 + }, + { + "path": "mitmproxy/udp.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "mitmproxy/utils/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "mitmproxy/utils/arg_check.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/utils/asyncio_utils.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/utils/data.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/utils/debug.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "mitmproxy/utils/emoji.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/utils/htpasswd.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/utils/human.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "mitmproxy/utils/magisk.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "mitmproxy/utils/pyinstaller/__init__.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/utils/pyinstaller/hook-mitmproxy.addons.onboardingapp.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/utils/pyinstaller/hook-mitmproxy.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/utils/pyinstaller/hook-mitmproxy.tools.web.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "mitmproxy/utils/signals.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "mitmproxy/utils/sliding_window.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/utils/spec.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/utils/strutils.py", + "status": "analysed", + "functions": 22, + "analysed": 22 + }, + { + "path": "mitmproxy/utils/typecheck.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/utils/vt_codes.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "mitmproxy/version.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "mitmproxy/websocket.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "release/build.py", + "status": "ambiguous", + "functions": 17, + "analysed": 17 + }, + { + "path": "release/deploy-microsoft-store.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "release/deploy.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "release/release.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "release/selftest.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/bench/benchmark.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/conftest.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/examples/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/examples/test_examples.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/filename_matching.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/helper_tools/dumperview.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/helper_tools/gen_sample_flows.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "test/helper_tools/hunt_memory_leaks.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/helper_tools/inspect_dumpfile.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/helper_tools/linkify-changelog.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/helper_tools/loggrep.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/helper_tools/memoryleak.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/helper_tools/memoryleak2.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/helper_tools/passive_close.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/individual_coverage.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/__init__.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/addons/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/addons/test_anticache.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/addons/test_anticomp.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/addons/test_asgiapp.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/addons/test_block.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/addons/test_blocklist.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/addons/test_browser.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "test/mitmproxy/addons/test_clientplayback.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "test/mitmproxy/addons/test_command_history.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "test/mitmproxy/addons/test_comment.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/addons/test_core.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "test/mitmproxy/addons/test_cut.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "test/mitmproxy/addons/test_disable_h2c.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/addons/test_dns_resolver.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "test/mitmproxy/addons/test_dumper.py", + "status": "analysed", + "functions": 16, + "analysed": 16 + }, + { + "path": "test/mitmproxy/addons/test_errorcheck.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/addons/test_eventstore.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/addons/test_export.py", + "status": "analysed", + "functions": 50, + "analysed": 50 + }, + { + "path": "test/mitmproxy/addons/test_intercept.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/addons/test_keepserving.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "test/mitmproxy/addons/test_maplocal.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/addons/test_mapremote.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/addons/test_modifybody.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/addons/test_modifyheaders.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/addons/test_next_layer.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/addons/test_onboarding.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/addons/test_proxyauth.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/addons/test_proxyserver.py", + "status": "analysed", + "functions": 64, + "analysed": 64 + }, + { + "path": "test/mitmproxy/addons/test_readfile.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "test/mitmproxy/addons/test_save.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "test/mitmproxy/addons/test_savehar.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "test/mitmproxy/addons/test_script.py", + "status": "analysed", + "functions": 20, + "analysed": 20 + }, + { + "path": "test/mitmproxy/addons/test_server_side_events.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/addons/test_serverplayback.py", + "status": "analysed", + "functions": 25, + "analysed": 25 + }, + { + "path": "test/mitmproxy/addons/test_stickyauth.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/addons/test_stickycookie.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "test/mitmproxy/addons/test_strip_dns_https_records.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/addons/test_termlog.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/addons/test_tlsconfig.py", + "status": "analysed", + "functions": 27, + "analysed": 27 + }, + { + "path": "test/mitmproxy/addons/test_update_alt_svc.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/addons/test_upstream_auth.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/addons/test_view.py", + "status": "analysed", + "functions": 39, + "analysed": 39 + }, + { + "path": "test/mitmproxy/contentviews/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/contentviews/_view_image/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/contentviews/_view_image/test_image_parser.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/contentviews/_view_image/test_view.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/contentviews/test___init__.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/contentviews/test__api.py", + "status": "analysed", + "functions": 12, + "analysed": 12 + }, + { + "path": "test/mitmproxy/contentviews/test__compat.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/contentviews/test__registry.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/contentviews/test__utils.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/contentviews/test__view_css.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/contentviews/test__view_dns.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/contentviews/test__view_graphql.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/contentviews/test__view_http3.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/contentviews/test__view_javascript.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/contentviews/test__view_json.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/contentviews/test__view_mqtt.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/contentviews/test__view_multipart.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/contentviews/test__view_query.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/contentviews/test__view_raw.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/contentviews/test__view_socketio.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/contentviews/test__view_urlencoded.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/contentviews/test__view_wbxml.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/contentviews/test__view_xml_html.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/contentviews/test__view_zip.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/contentviews/test_base.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/coretypes/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/coretypes/test_bidi.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/coretypes/test_multidict.py", + "status": "analysed", + "functions": 26, + "analysed": 26 + }, + { + "path": "test/mitmproxy/coretypes/test_serializable.py", + "status": "analysed", + "functions": 29, + "analysed": 29 + }, + { + "path": "test/mitmproxy/data/addonscripts/addon.py", + "status": "ambiguous", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/data/addonscripts/concurrent_decorator.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/data/addonscripts/concurrent_decorator_class.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/data/addonscripts/concurrent_decorator_err.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/data/addonscripts/configure.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/data/addonscripts/custom_option.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/data/addonscripts/error.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/data/addonscripts/import_error.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/load_error.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/recorder/a.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/recorder/b.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/recorder/c.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/recorder/e.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/recorder/recorder.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/data/addonscripts/same_filename/addon.py", + "status": "ambiguous", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/addonscripts/shutdown.py", + "status": "ambiguous", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/data/addonscripts/stream_modify.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/data/addonscripts/tcp_stream_modify.py", + "status": "analysed", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/data/servercert/generate.py", + "status": "ambiguous", + "functions": 1, + "analysed": 1 + }, + { + "path": "test/mitmproxy/io/test_compat.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/io/test_har.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/io/test_io.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/io/test_tnetstring.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "test/mitmproxy/net/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/net/data/verificationcerts/generate.py", + "status": "ambiguous", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/net/dns/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/net/dns/test_classes.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/net/dns/test_domain_names.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/net/dns/test_https_records.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/net/dns/test_op_codes.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/net/dns/test_response_codes.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/net/dns/test_types.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/net/http/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/net/http/http1/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/net/http/http1/test_assemble.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/net/http/http1/test_read.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "test/mitmproxy/net/http/test_cookies.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/net/http/test_headers.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/net/http/test_multipart.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/net/http/test_status_codes.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/net/http/test_url.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/net/http/test_user_agents.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/net/http/test_validate.py", + "status": "analysed", + "functions": 10, + "analysed": 10 + }, + { + "path": "test/mitmproxy/net/test_check.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/net/test_encoding.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/net/test_free_port.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/net/test_local_ip.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/net/test_server_spec.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/net/test_tls.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/platform/test_pf.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/proxy/bench.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "test/mitmproxy/proxy/conftest.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/layers/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/proxy/layers/http/hyper_h2_test_helpers.py", + "status": "analysed", + "functions": 17, + "analysed": 17 + }, + { + "path": "test/mitmproxy/proxy/layers/http/test_http.py", + "status": "analysed", + "functions": 76, + "analysed": 76 + }, + { + "path": "test/mitmproxy/proxy/layers/http/test_http1.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/proxy/layers/http/test_http2.py", + "status": "analysed", + "functions": 45, + "analysed": 45 + }, + { + "path": "test/mitmproxy/proxy/layers/http/test_http3.py", + "status": "analysed", + "functions": 61, + "analysed": 61 + }, + { + "path": "test/mitmproxy/proxy/layers/http/test_http_fuzz.py", + "status": "analysed", + "functions": 25, + "analysed": 25 + }, + { + "path": "test/mitmproxy/proxy/layers/http/test_http_version_interop.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/test__client_hello_parser.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/test__commands.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/test__events.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/test__hooks.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/test__raw_layers.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "test/mitmproxy/proxy/layers/quic/test__stream_layers.py", + "status": "analysed", + "functions": 64, + "analysed": 64 + }, + { + "path": "test/mitmproxy/proxy/layers/test_dns.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "test/mitmproxy/proxy/layers/test_modes.py", + "status": "analysed", + "functions": 22, + "analysed": 22 + }, + { + "path": "test/mitmproxy/proxy/layers/test_socks5_fuzz.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/layers/test_tcp.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/proxy/layers/test_tls.py", + "status": "analysed", + "functions": 40, + "analysed": 40 + }, + { + "path": "test/mitmproxy/proxy/layers/test_tls_fuzz.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/layers/test_udp.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/proxy/layers/test_websocket.py", + "status": "analysed", + "functions": 27, + "analysed": 27 + }, + { + "path": "test/mitmproxy/proxy/test_commands.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/proxy/test_context.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/test_events.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/proxy/test_layer.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/proxy/test_mode_servers.py", + "status": "analysed", + "functions": 28, + "analysed": 28 + }, + { + "path": "test/mitmproxy/proxy/test_mode_specs.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/proxy/test_server.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/proxy/test_server_hooks.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/proxy/test_tunnel.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "test/mitmproxy/proxy/test_tutils.py", + "status": "analysed", + "functions": 20, + "analysed": 20 + }, + { + "path": "test/mitmproxy/proxy/test_utils.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/proxy/tutils.py", + "status": "analysed", + "functions": 34, + "analysed": 34 + }, + { + "path": "test/mitmproxy/script/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/script/test_concurrent.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/test_addonmanager.py", + "status": "analysed", + "functions": 24, + "analysed": 24 + }, + { + "path": "test/mitmproxy/test_certs.py", + "status": "analysed", + "functions": 32, + "analysed": 32 + }, + { + "path": "test/mitmproxy/test_command.py", + "status": "analysed", + "functions": 37, + "analysed": 37 + }, + { + "path": "test/mitmproxy/test_command_lexer.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/test_connection.py", + "status": "analysed", + "functions": 8, + "analysed": 8 + }, + { + "path": "test/mitmproxy/test_ctx.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/test_dns.py", + "status": "analysed", + "functions": 18, + "analysed": 18 + }, + { + "path": "test/mitmproxy/test_eventsequence.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/test_exceptions.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/test_flow.py", + "status": "analysed", + "functions": 14, + "analysed": 14 + }, + { + "path": "test/mitmproxy/test_flowfilter.py", + "status": "analysed", + "functions": 103, + "analysed": 103 + }, + { + "path": "test/mitmproxy/test_hooks.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/test_http.py", + "status": "analysed", + "functions": 112, + "analysed": 112 + }, + { + "path": "test/mitmproxy/test_log.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/test_master.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/test_options.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/test_optmanager.py", + "status": "analysed", + "functions": 37, + "analysed": 37 + }, + { + "path": "test/mitmproxy/test_proxy.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/test_taddons.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/test_tcp.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/test_tls.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/test_typemanager.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/test_types.py", + "status": "analysed", + "functions": 22, + "analysed": 22 + }, + { + "path": "test/mitmproxy/test_udp.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/test_version.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/test_websocket.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/tools/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/tools/console/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/tools/console/conftest.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/tools/console/test_commander.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "test/mitmproxy/tools/console/test_common.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/tools/console/test_contentview.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/tools/console/test_defaultkeys.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/tools/console/test_flowview.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/tools/console/test_integration.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/tools/console/test_keymap.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/tools/console/test_master.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/tools/console/test_palettes.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/tools/console/test_quickhelp.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/tools/console/test_statusbar.py", + "status": "analysed", + "functions": 15, + "analysed": 15 + }, + { + "path": "test/mitmproxy/tools/test_cmdline.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/tools/test_dump.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/tools/test_main.py", + "status": "analysed", + "functions": 5, + "analysed": 5 + }, + { + "path": "test/mitmproxy/tools/web/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/tools/web/test_app.py", + "status": "analysed", + "functions": 51, + "analysed": 51 + }, + { + "path": "test/mitmproxy/tools/web/test_master.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "test/mitmproxy/tools/web/test_static_viewer.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/tools/web/test_web_columns.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/tools/web/test_webaddons.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/utils/__init__.py", + "status": "analysed", + "functions": 0, + "analysed": 0 + }, + { + "path": "test/mitmproxy/utils/test_arg_check.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/utils/test_asyncio_utils.py", + "status": "analysed", + "functions": 9, + "analysed": 9 + }, + { + "path": "test/mitmproxy/utils/test_data.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/utils/test_debug.py", + "status": "analysed", + "functions": 6, + "analysed": 6 + }, + { + "path": "test/mitmproxy/utils/test_emoji.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/utils/test_htpasswd.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/utils/test_human.py", + "status": "analysed", + "functions": 7, + "analysed": 7 + }, + { + "path": "test/mitmproxy/utils/test_magisk.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/utils/test_signals.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/utils/test_sliding_window.py", + "status": "analysed", + "functions": 4, + "analysed": 4 + }, + { + "path": "test/mitmproxy/utils/test_spec.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "test/mitmproxy/utils/test_strutils.py", + "status": "analysed", + "functions": 13, + "analysed": 13 + }, + { + "path": "test/mitmproxy/utils/test_typecheck.py", + "status": "analysed", + "functions": 11, + "analysed": 11 + }, + { + "path": "test/mitmproxy/utils/test_vt_codes.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "web/gen/backend_consts.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "web/gen/options_js.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "web/gen/state_js.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + }, + { + "path": "web/gen/tflow_js.py", + "status": "analysed", + "functions": 2, + "analysed": 2 + }, + { + "path": "web/gen/web_columns.py", + "status": "analysed", + "functions": 3, + "analysed": 3 + } + ] + } +} diff --git a/reports/mitmproxy-2026-10-02/rapport.md b/reports/mitmproxy-2026-10-02/rapport.md new file mode 100644 index 0000000..553c177 --- /dev/null +++ b/reports/mitmproxy-2026-10-02/rapport.md @@ -0,0 +1,260 @@ +# Analyse de mitmproxy — 2 octobre 2026 + +L’analyse CoreTrace avec les plugins entreprise produit **87 résultats : 75 alertes et 12 diagnostics de couverture**. La revue conclut à **8 VP, 66 FP et 1 cas à double lecture : VP de présence d’un appel, FP d’exploitabilité pour le scénario CVE examiné**. Aucune exploitation distante n’a été démontrée dans cette revue. + +Les huit VP sont six absences de timeout, une utilisation conditionnelle de SHA-1 pour des mots de passe et une dépendance vulnérable verrouillée. Ils ne représentent donc pas huit vulnérabilités distantes. Les deux alertes Werkzeug portent sur la même CVE. + +## Périmètre et reproduction + +| Élément | Valeur | +| --- | --- | +| Projet | `tests-project/mitmproxy` | +| Commit mitmproxy | `be758251c42116a17a1d7236d020af603fd82ef7` | +| Moteur | CoreTrace Python Analyzer **0.21.0** | +| Commit moteur | `4365d6e808769a7649e5726fe33cd2864c8e5816` | +| Plugins supplémentaires | `../coretrace-python-analyzer-plugins/plugins` | +| Commit plugins | `ac35460dc206eda1d81828b85a1e2bf6d1edc048` | +| Intelligence CVE | `curated-advisories@2026.09.27` | +| Chargement confirmé | 37 plugins intégrés + 7 plugins entreprise, versions et empreintes dans `findings.json` | +| Interpréteur | Python 3.14.5 | +| Mode | Analyse statique du dépôt complet, tests, exemples et scripts inclus ; sans cache ni baseline | +| Fin d’exécution | Code **1**, résultat normal lorsque des alertes existent ; stderr vide | + +Commande exécutée depuis la racine du moteur : + +```sh +PYTHONPATH=src .venv/bin/python -m coretrace_python \ + --check tests-project/mitmproxy \ + --plugins ../coretrace-python-analyzer-plugins/plugins \ + --format json \ + --sbom reports/mitmproxy-2026-10-02/sbom.json \ + --vex reports/mitmproxy-2026-10-02/vex.json \ + > reports/mitmproxy-2026-10-02/findings.json \ + 2> reports/mitmproxy-2026-10-02/analysis.stderr +``` + +Les sept plugins supplémentaires sont `architecture-rules`, `curated-advisories`, `enterprise-validators`, `exposure-prioritization`, `frameworks-models`, `orm-n-plus-one` et `serverless-declarations`. Leur chargement ne signifie pas que chacun rencontre une configuration applicable. Aucun fichier de règles architecture/validateurs ni déclaration serverless reconnue n’a été relevé. PyYAML n’est pas installé dans l’environnement du moteur ; aucune alerte de template serverless non lu n’a été produite. L’intelligence CVE provient du catalogue local, sans actualisation générale des avis en ligne. + +L’approche conserve le pipeline et les modèles natifs du moteur, puis ajoute une qualification humaine séparée : on peut reproduire les détections sans introduire d’exceptions spécifiques à mitmproxy dans les règles. Aucune modification du code ou des tests des trois dépôts. Aucun commit effectué. + +## Synthèse de la qualification + +VP signifie que le problème signalé est pertinent dans le périmètre indiqué ; FP signifie qu’il ne constitue pas la vulnérabilité suggérée dans l’application examinée. Un appel à une API sensible peut être réel tout en constituant un FP de vulnérabilité. Les diagnostics de couverture ne sont pas classés comme des failles. + +| Règle | Nombre | Verdict | Motif | +| --- | ---: | --- | --- | +| `missing-timeout` | 6 | VP de robustesse | Appels `requests` sans timeout explicite, dans des extensions optionnelles ou un utilitaire de maintenance. | +| `weak-crypto` — htpasswd | 1 | VP conditionnel | Vérification de mots de passe avec SHA-1 non salé si l’opérateur choisit le format `{SHA}`. | +| `vulnerable-dependency` | 1 | VP d’inventaire | `uv.lock` verrouille Werkzeug 3.1.5, affecté selon le catalogue par CVE-2026-27199. | +| `reachable-vulnerability` | 1 | VP technique / FP d’exploitabilité | L’appel à `safe_join` existe, mais le découpage préalable bloque les chemins de périphériques Windows testés. | +| `command-injection` | 8 | FP | Exécutables fixes, listes d’arguments, pas de shell ; données de l’opérateur ou sortie locale de Git. | +| `high-entropy-string` | 46 | FP | Trames TLS/QUIC, données compressées, fixture de cookie et identifiants publics d’en-têtes HTTP. | +| `hardcoded-credential` | 6 | FP | Quatre valeurs de test et deux contraintes de version du paquet `js-tokens`. | +| `hardcoded-secret` | 4 | FP | Deux textes d’aide avec un token fictif et deux spécifications de proxy interprétées à tort comme des identifiants. | +| `weak-crypto` — Magisk | 1 | FP | MD5 sert à produire le nom de certificat imposé par Android/OpenSSL, pas à établir sa confiance. | +| `unsafe-xml` | 1 | FP dans le flux applicatif examiné | La méthode signalée n’a pas d’appel direct trouvé ; le visualiseur WBXML utilise une autre méthode. | +| `ambiguous-module` | 8 | Diagnostic | Collisions de noms de modules. | +| `syntax-error` | 4 | Diagnostic | Syntaxe Python valide `type ...` non prise en charge par le moteur. | + +Sévérités brutes : **18 high, 51 medium, 6 low, 12 info**, aucune critical. Les 18 alertes high sont classées FP dans cette revue. Ces chiffres décrivent les résultats de ce scan, pas un taux de précision général du moteur. + +## VP à traiter + +### Six appels HTTP sans timeout + +| Emplacement, relatif à mitmproxy | Usage et conséquence | +| --- | --- | +| `examples/contrib/jsondump.py:192` | `requests.post` dans le worker d’export ; un destinataire silencieux peut immobiliser le worker. | +| `examples/contrib/xss_scanner.py:141` | Requête du scanner sur le chemin de l’URL. | +| `examples/contrib/xss_scanner.py:152` | Requête du scanner avec un Referer de test. | +| `examples/contrib/xss_scanner.py:165` | Requête du scanner avec un User-Agent de test. | +| `examples/contrib/xss_scanner.py:185` | Requête du scanner sur les paramètres d’URL. | +| `mitmproxy/utils/emoji.py:1870` | Générateur de table d’emoji, uniquement sous `if __name__ == "__main__"`. | + +Les fonctions du scanner préfixées `test_` sont bien appelées par son hook `response` (`xss_scanner.py:524` et suivantes) : ce sont des fonctions actives de l’extension, pas des tests unitaires. Les appels synchrones peuvent bloquer l’extension face à un serveur silencieux. L’utilitaire emoji peut bloquer sa propre exécution, mais cet appel ne s’exécute pas lors d’un simple import. + +Priorité faible, portée conditionnelle à l’utilisation de ces extensions/utilitaires. Ajouter un timeout adapté aux appels et traiter les exceptions au niveau du worker ou du hook qui décide comment poursuivre. La politique `SECURITY.md:13` de mitmproxy considère les DoS comme des bugs ordinaires ; il ne faut pas transformer ces constats en six CVE. + +### SHA-1 dans htpasswd + +`mitmproxy/utils/htpasswd.py:77` calcule SHA-1 directement sur le mot de passe pour vérifier une entrée `{SHA}`. Le chemin applicatif existe : option `proxyauth` → `Htpasswd` (`addons/proxyauth.py:203`) → `check_password` (`:214`). + +**VP de faiblesse cryptographique conditionnelle** : un fichier htpasswd en SHA-1 expose ses mots de passe à une recherche hors ligne rapide si ses empreintes sont obtenues. Cela ne démontre ni une fuite de ce fichier ni un contournement d’authentification. Le module reconnaît explicitement cette faiblesse et propose déjà bcrypt. L’action minimale est de migrer les entrées concernées vers bcrypt ; remplacer SHA-1 dans cette branche sans migration casserait la compatibilité du format. + +### Werkzeug : dépendance vulnérable, scénario applicatif neutralisé + +`uv.lock:1998–1999` fixe **Werkzeug 3.1.5**. Le plugin entreprise signale **CVE-2026-27199**, corrigée selon son catalogue en **3.1.6**, et relève l’appel `mitmproxy/addons/maplocal.py:47`. + +La distinction est essentielle : + +1. **VP d’inventaire** : la version vulnérable est réellement verrouillée. Une mise à jour du lock reste pertinente. La version effectivement déployée n’a pas été mesurée. +2. **VP de présence de l’appel** : `safe_join` est réellement utilisé sur des chemins dérivés des URL lorsque `map_local` est configuré. +3. **FP d’exploitabilité pour le scénario étudié** : `_safe_path_join` transforme d’abord le chemin en `Path(untrusted).parts`, puis appelle `safe_join(root, *parts)`. Chaque segment est donc contrôlé séparément, ce qui neutralise précisément l’absence de vérification des segments internes de Werkzeug 3.1.5. + +Vérification sur le module `werkzeug/security.py` de la wheel officielle 3.1.5, téléchargée isolément sans installation : + +```text +safe_join("C:/mapped", "reports/NUL") -> "C:/mapped/reports/NUL" +_safe_path_join(root, "reports/NUL") -> ValueError +_safe_path_join(root, "reports/CON") -> ValueError +_safe_path_join(root, "reports/CON.txt.html") -> ValueError +_safe_path_join(root, "reports/NUL ") -> ValueError +_safe_path_join(root, "reports/COM1") -> ValueError +_safe_path_join(root, "reports/normal.txt") -> chemin accepté +``` + +Le corps exact de la fonction mitmproxy a été extrait par AST ; `PureWindowsPath`, `ntpath` et un contexte Windows isolé du module Werkzeug ont servi au contrôle. **Ce n’est pas une exécution native sous Windows ni une reproduction de DoS**. La sortie et le SHA-256 de la wheel sont dans `verification.txt`. + +La CVE ne concerne que Windows : le contrôle des noms de périphériques de Werkzeug ne s’applique que si `os.name == "nt"`. Sur Linux et macOS, le scénario n’existe pas. + +Le fichier VEX généré annonce `affected` parce que le moteur voit l’appel, et ce rapport conserve ce statut. Le statut `not_affected` avec la justification `inline_mitigations_already_exist` est une piste, pas un résultat établi : il ne pourrait être retenu qu’après une reproduction sous Windows natif, alors que la vérification ci-dessus est simulée. Le statut `affected` ne constitue pas non plus une preuve d’exploitation. La mention `exposure=unreached` du plugin ne prouve pas non plus l’inaccessibilité : ici le hook `MapLocal.request` fournit un chemin réel que le graphe ne représente pas entièrement. + +## Principales familles de FP + +### Huit injections de commande dans les scripts de release + +`release/build.py:178,200` appelle `xcrun` avec des listes d’arguments. `release/release.py:104,108,132,137,153` appelle `git` ou `gh` de la même manière. La ligne 132 produit deux alertes, pour deux sources, d’où huit résultats pour sept appels. + +Les exécutables sont fixes ; aucun de ces appels n’active `shell=True`. Les caractères de shell dans une valeur ne deviennent pas des commandes. La version de release est en outre contrôlée au début du script par `assert re.match(r"^\d+\.\d+\.\d+$", version)`, et la branche vient de Git. Ce contrôle n’est pas une validation robuste : `assert` disparaît sous `python -O`, et `$` accepte un saut de ligne final. Le verdict FP n’en dépend pas, puisqu’aucun shell n’interprète les arguments. Aucun passage d’une entrée distante à un interpréteur de commandes n’a été établi. Une validation d’arguments reste utile en général, mais ces traces ne démontrent pas l’injection annoncée. Les scripts de release n’ont pas été exécutés. + +### Cinquante-six alertes de secrets + +Les **46 chaînes à forte entropie** se répartissent en 13 valeurs dans du Python (F029–F033, F039–F045, F048) et 33 valeurs JSON (F052–F084). Les premières sont des trames TLS/QUIC, des buffers compressés et une fixture de parsing de cookie. Les 33 valeurs JSON ont été rapprochées de leurs noms d’en-têtes : `x-amz-cf-id`, `x-amz-id-2` et `x-client-data`. Ce sont des identifiants de requêtes ou des métadonnées de navigateur, pas des clés d’authentification AWS. + +Les **six credentials** sont `dump_password` dans `examples/contrib/test_jsondump.py`, trois cas d’authentification de `test_webaddons.py`, et deux dépendances `js-tokens` dans `web/package-lock.json`. Les deux dernières sont des plages de versions npm, pas des tokens. + +Les **quatre secrets URL** sont `?token=...` dans la documentation et le message d’aide de `gen_sample_flows.py`, puis deux syntaxes `reverse:udp://...@...` dans `test_mode_servers.py`. Dans ce dernier format, `@` sépare la destination et l’adresse d’écoute ; il ne sépare pas un mot de passe d’un serveur. + +Le verdict ne repose donc pas uniquement sur le placement dans un répertoire de tests. Il repose sur l’usage et le contenu de chaque famille. Aucun credential de production exploitable n’a été établi ; aucune tentative d’authentification avec les valeurs relevées n’a été effectuée. + +### MD5 pour le nom des certificats Android + +`mitmproxy/utils/magisk.py:90` reproduit `openssl -subject_hash_old` pour nommer le fichier du certificat Android (`:102`). MD5 n’est ni la signature du certificat ni une empreinte utilisée pour décider de sa confiance. Le remplacer localement par un autre hash casserait le format attendu. **FP de faiblesse de sécurité dans cet usage.** + +### XML dans le code WBXML embarqué + +`mitmproxy/contrib/wbxml/ASWBXML.py:819` utilise bien `minidom.parseString`. Toutefois, aucune invocation directe de `loadXml` n’a été trouvée par recherche AST. Le chemin réel du visualiseur est `_view_wbxml.py:15` → `ASCommandResponse.decodeWBXML` → `loadBytes` → `getXml`, sans passer par `loadXml`. + +**FP de vulnérabilité exposée dans le flux examiné**, avec confiance moyenne sur l’absence de tout appel dynamique externe. Ce verdict ne certifie pas que `loadXml` serait sûr pour une autre intégration acceptant du XML non fiable. Il ne faut pas non plus présenter un simple appel `minidom` comme une preuve d’XXE ou de lecture de fichiers. + +## Couverture et limites + +- **583 fichiers découverts**, dont **571 marqués analysés**, **8 ambigus** et **4 non traités à cause de `TypeAlias`**. +- **6 182 / 6 182 fonctions comptabilisées analysées**. Ce « 100 % » ne couvre pas les fonctions des quatre fichiers que le moteur n’a pas pu construire : leur compteur vaut zéro. Les huit fichiers ambigus ont tout de même des fonctions analysées, avec une résolution de noms limitée. +- Les quatre fichiers non pris en charge sont `mitmproxy/contentviews/_api.py`, `mitmproxy/contentviews/_utils.py`, `mitmproxy/contentviews/_view_image/image_parser.py` et `mitmproxy/net/dns/https_records.py`. +- Aucun résultat n’a été supprimé par baseline ou suppression dans le rapport. +- La revue vérifie les résultats obtenus, pas l’exhaustivité des vulnérabilités du projet. Les hooks mitmproxy, appels dynamiques et dépendances natives peuvent dépasser les modèles disponibles. L’analyse Python n’est pas un audit du frontend JavaScript/TypeScript. +- Les métadonnées `exposure` restent indicatives. Par exemple les appels du scanner XSS sont marqués `unreached`, alors que son hook `response` les appelle réellement. +- Certaines positions de configuration sont approximatives : les valeurs HAR sont toutes rattachées au premier champ `headers`, le second `js-tokens` est rattaché à la première occurrence, et l’alerte Werkzeug pointe une référence transitive dans le lock. L’inventaire ci-dessous et `triage.csv` donnent des positions vérifiées lorsque possible, sans modifier le JSON brut. +- Aucun test existant n’a été modifié ou exécuté ; la vérification ciblée porte sur le contournement allégué de `safe_join` et sur les appels directs de `loadXml`. + +Pour améliorer l’architecture du moteur, les pistes pertinentes seraient la modélisation de `subprocess` selon le shell, l’exécutable et la position des arguments ; la qualification sémantique des valeurs détectées comme secrets ; et la représentation des préconditions et gardes des advisories. Des exclusions codées en dur pour les chemins de mitmproxy masqueraient ces causes générales. Aucune de ces évolutions n’est implémentée dans cette analyse. + +Les défauts du moteur relevés par cette revue sont suivis dans des issues : + +- [#206](https://github.com/CoreTrace/coretrace-python-analyzer/issues/206) : chemins des fichiers de dépendances et de configuration relatifs au répertoire courant, et non à la racine analysée (F052–F087 ici). +- [#207](https://github.com/CoreTrace/coretrace-python-analyzer/issues/207) : position et message de `vulnerable-dependency` pour un paquet verrouillé (F085). +- [#208](https://github.com/CoreTrace/coretrace-python-analyzer/issues/208) : `command-injection` sans distinction entre shell et liste d’arguments (F019–F026). +- [#209](https://github.com/CoreTrace/coretrace-python-analyzer/issues/209) : motif `url` de `hardcoded-secret` appliqué aux placeholders et aux paires `hôte:port@` (F027, F028, F046, F047). +- [#210](https://github.com/CoreTrace/coretrace-python-analyzer/issues/210) : positions et analyse des fichiers structurés (F052–F084, F086, F087). +- [#211](https://github.com/CoreTrace/coretrace-python-analyzer/issues/211) : hash de mots de passe signalés comme mots de passe (F050, F051). + +Les gains attendus de ces corrections restent à mesurer par un nouveau scan avec les mêmes paramètres. + +## Fichiers livrés + +- [Résultats bruts](findings.json), [SBOM](sbom.json), [VEX automatique](vex.json). +- [Qualification ligne par ligne](triage.csv), [preuves ciblées](verification.txt). +- Les identifiants `F001` à `F087` ci-dessous correspondent à l’ordre des résultats dans `findings.json`. + +## Inventaire exhaustif + +| ID | Règle | Position vérifiée | Verdict | Justification | +| --- | --- | --- | --- | --- | +| F001 | `ambiguous-module` | [docs/build.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/docs/build.py#L1) | Diagnostic | docs/build.py is the module 'build' like release/build.py: a symbol python.build.* may name a function of either, and an import of 'build' resolves only from its own root | +| F002 | `ambiguous-module` | [examples/addons/shutdown.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/addons/shutdown.py#L1) | Diagnostic | examples/addons/shutdown.py is the module 'shutdown' like test/mitmproxy/data/addonscripts/shutdown.py: a symbol python.shutdown.* may name a function of either, and an import of 'shutdown' resolves only from its own root | +| F003 | `missing-timeout` | [examples/contrib/jsondump.py:192](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/contrib/jsondump.py#L192) | VP | Appel requests sans timeout ; robustesse de l’extension optionnelle. | +| F004 | `hardcoded-credential` | [examples/contrib/test_jsondump.py:65](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/contrib/test_jsondump.py#L65) | FP | Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. | +| F005 | `missing-timeout` | [examples/contrib/xss_scanner.py:141](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/contrib/xss_scanner.py#L141) | VP | Appel requests sans timeout ; robustesse de l’extension optionnelle. | +| F006 | `missing-timeout` | [examples/contrib/xss_scanner.py:152](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/contrib/xss_scanner.py#L152) | VP | Appel requests sans timeout ; robustesse de l’extension optionnelle. | +| F007 | `missing-timeout` | [examples/contrib/xss_scanner.py:165](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/contrib/xss_scanner.py#L165) | VP | Appel requests sans timeout ; robustesse de l’extension optionnelle. | +| F008 | `missing-timeout` | [examples/contrib/xss_scanner.py:185](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/examples/contrib/xss_scanner.py#L185) | VP | Appel requests sans timeout ; robustesse de l’extension optionnelle. | +| F009 | `reachable-vulnerability` | [mitmproxy/addons/maplocal.py:47](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/addons/maplocal.py#L47) | VP technique / FP exploitabilité | Appel réel à safe_join 3.1.5 ; Path(untrusted).parts neutralise le scénario de périphérique Windows testé. Pas de DoS natif reproduit. | +| F010 | `syntax-error` | [mitmproxy/contentviews/_api.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/contentviews/_api.py#L1) | Diagnostic | mitmproxy/contentviews/_api.py:20:1: unsupported syntax: TypeAlias | +| F011 | `syntax-error` | [mitmproxy/contentviews/_utils.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/contentviews/_utils.py#L1) | Diagnostic | mitmproxy/contentviews/_utils.py:19:1: unsupported syntax: TypeAlias | +| F012 | `syntax-error` | [mitmproxy/contentviews/_view_image/image_parser.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/contentviews/_view_image/image_parser.py#L1) | Diagnostic | mitmproxy/contentviews/_view_image/image_parser.py:10:1: unsupported syntax: TypeAlias | +| F013 | `unsafe-xml` | [mitmproxy/contrib/wbxml/ASWBXML.py:819](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/contrib/wbxml/ASWBXML.py#L819) | FP | loadXml sans appel direct trouvé ; le visualiseur utilise loadBytes/getXml. Appels dynamiques externes non exclus. | +| F014 | `syntax-error` | [mitmproxy/net/dns/https_records.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/net/dns/https_records.py#L1) | Diagnostic | mitmproxy/net/dns/https_records.py:35:1: unsupported syntax: TypeAlias | +| F015 | `missing-timeout` | [mitmproxy/utils/emoji.py:1870](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/utils/emoji.py#L1870) | VP | VP de robustesse du générateur lancé explicitement ; appel sous __main__, absent au simple import. | +| F016 | `weak-crypto` | [mitmproxy/utils/htpasswd.py:77](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/utils/htpasswd.py#L77) | VP | SHA-1 non salé pour mots de passe uniquement si un htpasswd {SHA} est choisi ; bcrypt est déjà supporté. | +| F017 | `weak-crypto` | [mitmproxy/utils/magisk.py:90](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/mitmproxy/utils/magisk.py#L90) | FP | MD5 utilisé pour le nom Android/OpenSSL subject_hash_old, pas pour une décision de confiance. | +| F018 | `ambiguous-module` | [release/build.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/build.py#L1) | Diagnostic | release/build.py is the module 'build' like docs/build.py: a symbol python.build.* may name a function of either, and an import of 'build' resolves only from its own root | +| F019 | `command-injection` | [release/build.py:178](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/build.py#L178) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F020 | `command-injection` | [release/build.py:200](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/build.py#L200) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F021 | `command-injection` | [release/release.py:104](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/release.py#L104) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F022 | `command-injection` | [release/release.py:108](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/release.py#L108) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F023 | `command-injection` | [release/release.py:132](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/release.py#L132) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F024 | `command-injection` | [release/release.py:132](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/release.py#L132) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F025 | `command-injection` | [release/release.py:137](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/release.py#L137) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F026 | `command-injection` | [release/release.py:153](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/release/release.py#L153) | FP | Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré. | +| F027 | `hardcoded-secret` | [test/helper_tools/gen_sample_flows.py:2](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/helper_tools/gen_sample_flows.py#L2) | FP | Texte d’aide/docstring contenant ?token=... comme placeholder, pas un vrai token. | +| F028 | `hardcoded-secret` | [test/helper_tools/gen_sample_flows.py:271](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/helper_tools/gen_sample_flows.py#L271) | FP | Texte d’aide/docstring contenant ?token=... comme placeholder, pas un vrai token. | +| F029 | `high-entropy-string` | [test/mitmproxy/addons/test_next_layer.py:40](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/addons/test_next_layer.py#L40) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F030 | `high-entropy-string` | [test/mitmproxy/addons/test_next_layer.py:65](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/addons/test_next_layer.py#L65) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F031 | `high-entropy-string` | [test/mitmproxy/addons/test_next_layer.py:97](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/addons/test_next_layer.py#L97) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F032 | `high-entropy-string` | [test/mitmproxy/addons/test_next_layer.py:128](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/addons/test_next_layer.py#L128) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F033 | `high-entropy-string` | [test/mitmproxy/addons/test_next_layer.py:976](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/addons/test_next_layer.py#L976) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F034 | `ambiguous-module` | [test/mitmproxy/data/addonscripts/addon.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/addonscripts/addon.py#L1) | Diagnostic | test/mitmproxy/data/addonscripts/addon.py is the module 'addon' like test/mitmproxy/data/addonscripts/same_filename/addon.py: a symbol python.addon.* may name a function of either, and an import of 'addon' resolves only from its own root | +| F035 | `ambiguous-module` | [test/mitmproxy/data/addonscripts/same_filename/addon.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/addonscripts/same_filename/addon.py#L1) | Diagnostic | test/mitmproxy/data/addonscripts/same_filename/addon.py is the module 'addon' like test/mitmproxy/data/addonscripts/addon.py: a symbol python.addon.* may name a function of either, and an import of 'addon' resolves only from its own root | +| F036 | `ambiguous-module` | [test/mitmproxy/data/addonscripts/shutdown.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/addonscripts/shutdown.py#L1) | Diagnostic | test/mitmproxy/data/addonscripts/shutdown.py is the module 'shutdown' like examples/addons/shutdown.py: a symbol python.shutdown.* may name a function of either, and an import of 'shutdown' resolves only from its own root | +| F037 | `ambiguous-module` | [test/mitmproxy/data/servercert/generate.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/servercert/generate.py#L1) | Diagnostic | test/mitmproxy/data/servercert/generate.py is the module 'generate' like test/mitmproxy/net/data/verificationcerts/generate.py: a symbol python.generate.* may name a function of either, and an import of 'generate' resolves only from its own root | +| F038 | `ambiguous-module` | [test/mitmproxy/net/data/verificationcerts/generate.py:1](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/net/data/verificationcerts/generate.py#L1) | Diagnostic | test/mitmproxy/net/data/verificationcerts/generate.py is the module 'generate' like test/mitmproxy/data/servercert/generate.py: a symbol python.generate.* may name a function of either, and an import of 'generate' resolves only from its own root | +| F039 | `high-entropy-string` | [test/mitmproxy/net/http/test_cookies.py:21](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/net/http/test_cookies.py#L21) | FP | Fixture de parsing de cookies, utilisée comme donnée attendue ; pas de credential de production établi. | +| F040 | `high-entropy-string` | [test/mitmproxy/net/test_encoding.py:79](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/net/test_encoding.py#L79) | FP | Buffer compressé hexadécimal dans un test de décodage, pas un secret. | +| F041 | `high-entropy-string` | [test/mitmproxy/net/test_encoding.py:85](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/net/test_encoding.py#L85) | FP | Buffer compressé hexadécimal dans un test de décodage, pas un secret. | +| F042 | `high-entropy-string` | [test/mitmproxy/proxy/layers/quic/test__stream_layers.py:114](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/proxy/layers/quic/test__stream_layers.py#L114) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F043 | `high-entropy-string` | [test/mitmproxy/proxy/layers/quic/test__stream_layers.py:147](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/proxy/layers/quic/test__stream_layers.py#L147) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F044 | `high-entropy-string` | [test/mitmproxy/proxy/layers/quic/test__stream_layers.py:179](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/proxy/layers/quic/test__stream_layers.py#L179) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F045 | `high-entropy-string` | [test/mitmproxy/proxy/layers/test_tls.py:46](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/proxy/layers/test_tls.py#L46) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F046 | `hardcoded-secret` | [test/mitmproxy/proxy/test_mode_servers.py:352](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/proxy/test_mode_servers.py#L352) | FP | La syntaxe reverse:udp://destination@écoute contient des adresses locales de test, pas des identifiants URL. | +| F047 | `hardcoded-secret` | [test/mitmproxy/proxy/test_mode_servers.py:356](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/proxy/test_mode_servers.py#L356) | FP | La syntaxe reverse:udp://destination@écoute contient des adresses locales de test, pas des identifiants URL. | +| F048 | `high-entropy-string` | [test/mitmproxy/test_tls.py:4](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/test_tls.py#L4) | FP | Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret. | +| F049 | `hardcoded-credential` | [test/mitmproxy/tools/web/test_webaddons.py:26](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/tools/web/test_webaddons.py#L26) | FP | Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. | +| F050 | `hardcoded-credential` | [test/mitmproxy/tools/web/test_webaddons.py:37](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/tools/web/test_webaddons.py#L37) | FP | Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. | +| F051 | `hardcoded-credential` | [test/mitmproxy/tools/web/test_webaddons.py:48](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/tools/web/test_webaddons.py#L48) | FP | Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. | +| F052 | `high-entropy-string` | [test/mitmproxy/data/har_files/charles.json:128](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/charles.json#L128) | FP | En-tête X-Amz-Cf-Id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F053 | `high-entropy-string` | [test/mitmproxy/data/har_files/chrome.json:188](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/chrome.json#L188) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F054 | `high-entropy-string` | [test/mitmproxy/data/har_files/chrome.json:498](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/chrome.json#L498) | FP | En-tête x-client-data : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F055 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:176](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L176) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F056 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:847](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L847) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F057 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:1023](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L1023) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F058 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:1199](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L1199) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F059 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:1386](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L1386) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F060 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:1573](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L1573) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F061 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:1708](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L1708) | FP | En-tête x-amz-id-2 : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F062 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:1919](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L1919) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F063 | `high-entropy-string` | [test/mitmproxy/data/har_files/firefox.json:2099](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/firefox.json#L2099) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F064 | `high-entropy-string` | [test/mitmproxy/data/har_files/head-content-length.json:100](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/head-content-length.json#L100) | FP | En-tête x-amz-id-2 : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F065 | `high-entropy-string` | [test/mitmproxy/data/har_files/insomnia.json:129](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/insomnia.json#L129) | FP | En-tête X-Amz-Cf-Id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F066 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:132](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L132) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F067 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:260](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L260) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F068 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:392](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L392) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F069 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:520](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L520) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F070 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:648](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L648) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F071 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:776](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L776) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F072 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:900](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L900) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F073 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1028](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1028) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F074 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1156](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1156) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F075 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1296](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1296) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F076 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1436](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1436) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F077 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1576](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1576) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F078 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1716](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1716) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F079 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1848](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1848) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F080 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:1976](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L1976) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F081 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:2104](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L2104) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F082 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:2228](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L2228) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F083 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:2399](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L2399) | FP | En-tête x-amz-id-2 : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F084 | `high-entropy-string` | [test/mitmproxy/data/har_files/safari.json:2538](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/test/mitmproxy/data/har_files/safari.json#L2538) | FP | En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification. | +| F085 | `vulnerable-dependency` | [uv.lock:1998](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/uv.lock#L1998) | VP | Werkzeug 3.1.5 verrouillé ; CVE-2026-27199 au niveau inventaire, même CVE que F009. Version déployée non mesurée. | +| F086 | `hardcoded-credential` | [web/package-lock.json:71](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/web/package-lock.json#L71) | FP | js-tokens est un nom de dépendance npm ; valeur = contrainte de version, pas un secret. | +| F087 | `hardcoded-credential` | [web/package-lock.json:9468](https://github.com/mitmproxy/mitmproxy/blob/be758251c42116a17a1d7236d020af603fd82ef7/web/package-lock.json#L9468) | FP | js-tokens est un nom de dépendance npm ; valeur = contrainte de version, pas un secret. | diff --git a/reports/mitmproxy-2026-10-02/sbom.json b/reports/mitmproxy-2026-10-02/sbom.json new file mode 100644 index 0000000..28dc74d --- /dev/null +++ b/reports/mitmproxy-2026-10-02/sbom.json @@ -0,0 +1,1486 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.5", + "version": 1, + "metadata": { + "tools": { + "components": [ + { + "type": "application", + "name": "coretrace-python-analyzer", + "version": "0.21.0" + }, + { + "type": "application", + "name": "dependency-policy", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "64108a692266b69ec97bccc9301116b718fbfff19596556a69473daff42182d5" + } + ] + }, + { + "type": "application", + "name": "reachable-vulnerability", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "a934ad18a4c225a0b85e0f54e7d02d6e044b0f37e238aa1dcabd969df2055fd8" + } + ] + }, + { + "type": "application", + "name": "sample-advisories", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "0d70ce268e90561f9a07eda73728c2aefc8984fc71b9406b9744f0d19a0c94b7" + } + ] + }, + { + "type": "application", + "name": "vulnerable-dependency", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "b528af35294646c5dabdd8e9d1977007543ca665b1ceabb75fae2d1cddd5dcb4" + } + ] + }, + { + "type": "application", + "name": "aiohttp-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "1fb9fc998a1828174de89efe2e63520e982d8b2952fc03da057fb2e35b6a8e2c" + } + ] + }, + { + "type": "application", + "name": "bottle-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "a419b5911ab7736602d006a51d198199f4b9446264ad05b2c08a8ec16ba58b3c" + } + ] + }, + { + "type": "application", + "name": "cli-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "2c7ea65765a0f27cdc62aa1aeb1d63a8a4fa1a1e6907c1650018daf741852ba5" + } + ] + }, + { + "type": "application", + "name": "credential-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "35254a07aee5800506f32d3af2b716fd2fd57eadf64d2cb962ff69e8acaeead8" + } + ] + }, + { + "type": "application", + "name": "db-driver-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "35ff485fc04801b3404bfe58b998c3901f14a55a5c1f1e80b8b37e388eb4dde0" + } + ] + }, + { + "type": "application", + "name": "django-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "900ef18837883e3ec7f46ff23280505ddc61e3606838c5a1574e2bb3d6dbe754" + } + ] + }, + { + "type": "application", + "name": "fastapi-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "ecf4ab97f3b91e75a38420f6577c1e214e007dcb214bb33b466a47a055de3772" + } + ] + }, + { + "type": "application", + "name": "flask-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "86276bc1e6be85913a2161af269ad84b4cd19571abf8fa4dc22417afa1ea95ff" + } + ] + }, + { + "type": "application", + "name": "http-client-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "5e4f46304dbc02f8c960215468bd87416e921064e7dfe9dc342e6a4f431001ce" + } + ] + }, + { + "type": "application", + "name": "python-stdlib-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "2b237d794970e72d41fcc13bf0506c2fe43ef24333ab76804e9bb51e05f5595b" + } + ] + }, + { + "type": "application", + "name": "sqlalchemy-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "f68f77a847d23dd85d049c9428cbd802633dc85a5351532cc963f186ab5b5acf" + } + ] + }, + { + "type": "application", + "name": "tornado-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "69b2ef24e7cb3b93fe4859fd98e475c126448f0034136cbf97d24e1298c21b27" + } + ] + }, + { + "type": "application", + "name": "config-secrets", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "7e7fb490705c5e5de981a2fbef129f1458ad1aaeb259e56eb49cc8ab1cdaffd5" + } + ] + }, + { + "type": "application", + "name": "hardcoded-secrets", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "9629e9c37fd168250f7286d2e8a3b2f62267425f8100dcc5f56c2bd31eddf7dd" + } + ] + }, + { + "type": "application", + "name": "code-injection", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "b97fb5ac23bcd251fa0408c16a95e2a23be2496252e3f78596bd339d5f7335dd" + } + ] + }, + { + "type": "application", + "name": "command-injection", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "a79f25466752e1a0cf5105b6194d99ad4bcdc16834598d7bf86a167a0c5fd3e0" + } + ] + }, + { + "type": "application", + "name": "insecure-deserialization", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "197001f660f3286f015baf9f2ee7fe0e9c376d98f5fd45886b9ebf51261c93e6" + } + ] + }, + { + "type": "application", + "name": "nosql-injection", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "24a28107a44322339da20f519b49506f73b772b1961f1c4acb19180bcc36f3f9" + } + ] + }, + { + "type": "application", + "name": "open-redirect", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "e0d5ee69073fb54e13158651f801c80250056276f9a4eb59e3356fd8c4cef043" + } + ] + }, + { + "type": "application", + "name": "path-traversal", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "26446a23fea57e6a2ff582b6c905d84b7cd04df19e1020c31a888b038b0b82f9" + } + ] + }, + { + "type": "application", + "name": "plaintext-credentials", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "281eb1d021a92333ea35541a4a8dddd1e61e60cb48741f3f8bbac7311318fef5" + } + ] + }, + { + "type": "application", + "name": "sql-injection", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "7c6202503365c70289c3d35dae63a4a9510d7d47d1c0a4e85aaf6e72c7dab699" + } + ] + }, + { + "type": "application", + "name": "ssrf", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "4354049a2ad1487fbf8688901fe40528024f4ec58caa35bbee2c13452884d369" + } + ] + }, + { + "type": "application", + "name": "xss", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "9c6a3f3c7f68fe2441f3bcd3f4be2f3dbcaa837f541e3a8c0944fc940c0f30d1" + } + ] + }, + { + "type": "application", + "name": "dangerous-eval", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "0be6472598d8ec6357f4dc2c8b20f97a26f011e6edcfb40d613a7560151ddd0a" + } + ] + }, + { + "type": "application", + "name": "flask-debug", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "667f4e76bee3c1dd3b70d19cbc4587611240de469a35e3e6214b8cdbb14d600d" + } + ] + }, + { + "type": "application", + "name": "insecure-temp-file", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "51395d5b1518f754d663a8d09695f0b5b2da55255b2f5e699daaaec2d47ea8b3" + } + ] + }, + { + "type": "application", + "name": "insecure-tls", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "97fe6370d985b93eb2fddef6ec9b8f255904c19d98ccedd5fd1b5afc932c9740" + } + ] + }, + { + "type": "application", + "name": "missing-timeout", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "8ef60c32d47d632685ef001691360f93c83e127eebbbe252ab4fcb0fe76ed4db" + } + ] + }, + { + "type": "application", + "name": "unsafe-archive-extraction", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "4109a4eb18c45e6c50004fd8f770c055cbb4154a713dd14664870dd1e03dfda4" + } + ] + }, + { + "type": "application", + "name": "unsafe-xml", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "416083cda0ba7ab89581c0471606a806efa2a2049262f2d75201247209eb49ed" + } + ] + }, + { + "type": "application", + "name": "weak-crypto", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "1236fdfb5a1b6583cec47d8c1e8183a4284d283413581ebd232873b19e50ce2a" + } + ] + }, + { + "type": "application", + "name": "weak-random", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "0f6287a58ec2daafb13b7b011b68e81d00bc4e1e29b6c5dac9bf114c7ab21fa9" + } + ] + }, + { + "type": "application", + "name": "architecture-rules", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "912f10abeb0dc954cab6ce0fd9e09c7d75ce64f20f916b3f143538317ffe0578" + } + ] + }, + { + "type": "application", + "name": "curated-advisories", + "version": "2026.09.27", + "hashes": [ + { + "alg": "SHA-256", + "content": "445a0bd33b7905052cfaa8a945a3c1eb30df95507cc3325da995b60bfd321cb7" + } + ] + }, + { + "type": "application", + "name": "enterprise-validators", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "bddec63ed9fb4b9d37308ff27c9732bd7827394e0bfba917c3ad1974e77bba83" + } + ] + }, + { + "type": "application", + "name": "exposure-prioritization", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "c7d14dafb655bfbabd0f007a50b0e061a186e4817067938bd0c2582345551447" + } + ] + }, + { + "type": "application", + "name": "frameworks-models", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "1479b437640ec047234a5273a30283fd45432f2b1d0338898aa559cc8ebf1f1d" + } + ] + }, + { + "type": "application", + "name": "orm-n-plus-one", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "32f043bb2a27a81d9c8d1a4be455ed4227ac494acdc292f3316d0c2034b5823d" + } + ] + }, + { + "type": "application", + "name": "serverless-declarations", + "version": "1.0.0", + "hashes": [ + { + "alg": "SHA-256", + "content": "ad06322d7173cefffb6b2a171aaa829b5b028c7e0bff989f70c3973c468d37db" + } + ] + } + ] + } + }, + "components": [ + { + "type": "library", + "bom-ref": "pkg:pypi/aioquic@1.2.0", + "name": "aioquic", + "version": "1.2.0", + "purl": "pkg:pypi/aioquic@1.2.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=1.2.0,<=1.2.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/altgraph@0.17.5", + "name": "altgraph", + "version": "0.17.5", + "purl": "pkg:pypi/altgraph@0.17.5" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/argon2-cffi@25.1.0", + "name": "argon2-cffi", + "version": "25.1.0", + "purl": "pkg:pypi/argon2-cffi@25.1.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=23.1.0,<=25.1.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/argon2-cffi-bindings@25.1.0", + "name": "argon2-cffi-bindings", + "version": "25.1.0", + "purl": "pkg:pypi/argon2-cffi-bindings@25.1.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/asgiref@3.11.0", + "name": "asgiref", + "version": "3.11.0", + "purl": "pkg:pypi/asgiref@3.11.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=3.2.10,<=3.12.1" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/attrs@25.4.0", + "name": "attrs", + "version": "25.4.0", + "purl": "pkg:pypi/attrs@25.4.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/awscli@1.46.1", + "name": "awscli", + "version": "1.46.1", + "purl": "pkg:pypi/awscli@1.46.1" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/backports-zstd@1.7.0", + "name": "backports-zstd", + "version": "1.7.0", + "purl": "pkg:pypi/backports-zstd@1.7.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=1.7.0,<=1.7.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/bcrypt@5.0.0", + "name": "bcrypt", + "version": "5.0.0", + "purl": "pkg:pypi/bcrypt@5.0.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=5.0.0,<=5.0.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/blinker@1.9.0", + "name": "blinker", + "version": "1.9.0", + "purl": "pkg:pypi/blinker@1.9.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/brotli@1.2.0", + "name": "brotli", + "version": "1.2.0", + "purl": "pkg:pypi/brotli@1.2.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=1.0,<=1.2.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/build@1.5.0", + "name": "build", + "version": "1.5.0", + "purl": "pkg:pypi/build@1.5.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/cachetools@7.0.3", + "name": "cachetools", + "version": "7.0.3", + "purl": "pkg:pypi/cachetools@7.0.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/certifi@2026.1.4", + "name": "certifi", + "version": "2026.1.4", + "purl": "pkg:pypi/certifi@2026.1.4", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=2019.9.11" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/cffi@2.0.0", + "name": "cffi", + "version": "2.0.0", + "purl": "pkg:pypi/cffi@2.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/charset-normalizer@3.4.4", + "name": "charset-normalizer", + "version": "3.4.4", + "purl": "pkg:pypi/charset-normalizer@3.4.4" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/click@8.4.2", + "name": "click", + "version": "8.4.2", + "purl": "pkg:pypi/click@8.4.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/colorama@0.4.6", + "name": "colorama", + "version": "0.4.6", + "purl": "pkg:pypi/colorama@0.4.6" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/coverage@7.13.2", + "name": "coverage", + "version": "7.13.2", + "purl": "pkg:pypi/coverage@7.13.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/cryptography@46.0.4", + "name": "cryptography", + "version": "46.0.4", + "purl": "pkg:pypi/cryptography@46.0.4", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=42.0,<=50.0.2" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/distlib@0.4.0", + "name": "distlib", + "version": "0.4.0", + "purl": "pkg:pypi/distlib@0.4.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/docutils@0.19", + "name": "docutils", + "version": "0.19", + "purl": "pkg:pypi/docutils@0.19" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/execnet@2.1.2", + "name": "execnet", + "version": "2.1.2", + "purl": "pkg:pypi/execnet@2.1.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/filelock@3.25.0", + "name": "filelock", + "version": "3.25.0", + "purl": "pkg:pypi/filelock@3.25.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/flask@3.1.2", + "name": "flask", + "version": "3.1.2", + "purl": "pkg:pypi/flask@3.1.2", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=3.0,<=3.1.3" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/h11@0.16.0", + "name": "h11", + "version": "0.16.0", + "purl": "pkg:pypi/h11@0.16.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=0.16.0,<=0.16.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/h2@4.3.0", + "name": "h2", + "version": "4.3.0", + "purl": "pkg:pypi/h2@4.3.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=4.3.0,<=4.4.1" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/hpack@4.1.0", + "name": "hpack", + "version": "4.1.0", + "purl": "pkg:pypi/hpack@4.1.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/hyperframe@6.1.0", + "name": "hyperframe", + "version": "6.1.0", + "purl": "pkg:pypi/hyperframe@6.1.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=6.0,<=6.1.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/hypothesis@6.130.6", + "name": "hypothesis", + "version": "6.130.6", + "purl": "pkg:pypi/hypothesis@6.130.6" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/id@1.5.0", + "name": "id", + "version": "1.5.0", + "purl": "pkg:pypi/id@1.5.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/idna@3.11", + "name": "idna", + "version": "3.11", + "purl": "pkg:pypi/idna@3.11" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/iniconfig@2.3.0", + "name": "iniconfig", + "version": "2.3.0", + "purl": "pkg:pypi/iniconfig@2.3.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/itsdangerous@2.2.0", + "name": "itsdangerous", + "version": "2.2.0", + "purl": "pkg:pypi/itsdangerous@2.2.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/jaraco-classes@3.4.0", + "name": "jaraco-classes", + "version": "3.4.0", + "purl": "pkg:pypi/jaraco-classes@3.4.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/jaraco-context@6.1.0", + "name": "jaraco-context", + "version": "6.1.0", + "purl": "pkg:pypi/jaraco-context@6.1.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/jaraco-functools@4.4.0", + "name": "jaraco-functools", + "version": "4.4.0", + "purl": "pkg:pypi/jaraco-functools@4.4.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/jeepney@0.9.0", + "name": "jeepney", + "version": "0.9.0", + "purl": "pkg:pypi/jeepney@0.9.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/jinja2@3.1.6", + "name": "jinja2", + "version": "3.1.6", + "purl": "pkg:pypi/jinja2@3.1.6" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/jmespath@1.1.0", + "name": "jmespath", + "version": "1.1.0", + "purl": "pkg:pypi/jmespath@1.1.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/kaitaistruct@0.11", + "name": "kaitaistruct", + "version": "0.11", + "purl": "pkg:pypi/kaitaistruct@0.11", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=0.10,<=0.11" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/keyring@25.7.0", + "name": "keyring", + "version": "25.7.0", + "purl": "pkg:pypi/keyring@25.7.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/ldap3@2.9.1", + "name": "ldap3", + "version": "2.9.1", + "purl": "pkg:pypi/ldap3@2.9.1", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=2.8,<=2.9.1" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/librt@0.11.0", + "name": "librt", + "version": "0.11.0", + "purl": "pkg:pypi/librt@0.11.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/macholib@1.16.4", + "name": "macholib", + "version": "1.16.4", + "purl": "pkg:pypi/macholib@1.16.4" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/markdown-it-py@4.0.0", + "name": "markdown-it-py", + "version": "4.0.0", + "purl": "pkg:pypi/markdown-it-py@4.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/markdown2@2.5.4", + "name": "markdown2", + "version": "2.5.4", + "purl": "pkg:pypi/markdown2@2.5.4" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/markupsafe@3.0.3", + "name": "markupsafe", + "version": "3.0.3", + "purl": "pkg:pypi/markupsafe@3.0.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/maturin@1.15.0", + "name": "maturin", + "version": "1.15.0", + "purl": "pkg:pypi/maturin@1.15.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mdurl@0.1.2", + "name": "mdurl", + "version": "0.1.2", + "purl": "pkg:pypi/mdurl@0.1.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mitmproxy-linux@0.12.9", + "name": "mitmproxy-linux", + "version": "0.12.9", + "purl": "pkg:pypi/mitmproxy-linux@0.12.9" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mitmproxy-macos@0.12.9", + "name": "mitmproxy-macos", + "version": "0.12.9", + "purl": "pkg:pypi/mitmproxy-macos@0.12.9" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mitmproxy-rs@0.12.9", + "name": "mitmproxy-rs", + "version": "0.12.9", + "purl": "pkg:pypi/mitmproxy-rs@0.12.9", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=0.12.6,<0.13" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mitmproxy-windows@0.12.9", + "name": "mitmproxy-windows", + "version": "0.12.9", + "purl": "pkg:pypi/mitmproxy-windows@0.12.9" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/more-itertools@10.8.0", + "name": "more-itertools", + "version": "10.8.0", + "purl": "pkg:pypi/more-itertools@10.8.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mypy@1.20.2", + "name": "mypy", + "version": "1.20.2", + "purl": "pkg:pypi/mypy@1.20.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/mypy-extensions@1.1.0", + "name": "mypy-extensions", + "version": "1.1.0", + "purl": "pkg:pypi/mypy-extensions@1.1.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/nh3@0.3.2", + "name": "nh3", + "version": "0.3.2", + "purl": "pkg:pypi/nh3@0.3.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/packaging@26.3", + "name": "packaging", + "version": "26.3", + "purl": "pkg:pypi/packaging@26.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pathspec@1.0.4", + "name": "pathspec", + "version": "1.0.4", + "purl": "pkg:pypi/pathspec@1.0.4" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pdoc@16.0.0", + "name": "pdoc", + "version": "16.0.0", + "purl": "pkg:pypi/pdoc@16.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pefile@2024.8.26", + "name": "pefile", + "version": "2024.8.26", + "purl": "pkg:pypi/pefile@2024.8.26" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/platformdirs@4.9.4", + "name": "platformdirs", + "version": "4.9.4", + "purl": "pkg:pypi/platformdirs@4.9.4" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pluggy@1.6.0", + "name": "pluggy", + "version": "1.6.0", + "purl": "pkg:pypi/pluggy@1.6.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/publicsuffix2@2.20191221", + "name": "publicsuffix2", + "version": "2.20191221", + "purl": "pkg:pypi/publicsuffix2@2.20191221", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=2.20190812,<=2.20191221" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyasn1@0.6.2", + "name": "pyasn1", + "version": "0.6.2", + "purl": "pkg:pypi/pyasn1@0.6.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyasn1-modules@0.4.2", + "name": "pyasn1-modules", + "version": "0.4.2", + "purl": "pkg:pypi/pyasn1-modules@0.4.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pycparser@3.0", + "name": "pycparser", + "version": "3.0", + "purl": "pkg:pypi/pycparser@3.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pydivert@2.1.0", + "name": "pydivert", + "version": "2.1.0", + "purl": "pkg:pypi/pydivert@2.1.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=2.0.3,<=3.1.3" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pygments@2.19.2", + "name": "pygments", + "version": "2.19.2", + "purl": "pkg:pypi/pygments@2.19.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyinstaller@6.22.3", + "name": "pyinstaller", + "version": "6.22.3", + "purl": "pkg:pypi/pyinstaller@6.22.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyinstaller-hooks-contrib@2026.7", + "name": "pyinstaller-hooks-contrib", + "version": "2026.7", + "purl": "pkg:pypi/pyinstaller-hooks-contrib@2026.7" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pylsqpack@0.3.23", + "name": "pylsqpack", + "version": "0.3.23", + "purl": "pkg:pypi/pylsqpack@0.3.23" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyopenssl@26.2.0", + "name": "pyopenssl", + "version": "26.2.0", + "purl": "pkg:pypi/pyopenssl@26.2.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=24.3,<=27.0.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyparsing@3.3.2", + "name": "pyparsing", + "version": "3.3.2", + "purl": "pkg:pypi/pyparsing@3.3.2", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=3.3.2,<=3.3.3" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyperclip@1.11.0", + "name": "pyperclip", + "version": "1.11.0", + "purl": "pkg:pypi/pyperclip@1.11.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=1.9.0,<=1.11.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyproject-api@1.10.0", + "name": "pyproject-api", + "version": "1.10.0", + "purl": "pkg:pypi/pyproject-api@1.10.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyproject-hooks@1.2.0", + "name": "pyproject-hooks", + "version": "1.2.0", + "purl": "pkg:pypi/pyproject-hooks@1.2.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pytest@8.4.2", + "name": "pytest", + "version": "8.4.2", + "purl": "pkg:pypi/pytest@8.4.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pytest-asyncio@1.2.0", + "name": "pytest-asyncio", + "version": "1.2.0", + "purl": "pkg:pypi/pytest-asyncio@1.2.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pytest-cov@7.0.0", + "name": "pytest-cov", + "version": "7.0.0", + "purl": "pkg:pypi/pytest-cov@7.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pytest-timeout@2.4.0", + "name": "pytest-timeout", + "version": "2.4.0", + "purl": "pkg:pypi/pytest-timeout@2.4.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pytest-xdist@3.8.0", + "name": "pytest-xdist", + "version": "3.8.0", + "purl": "pkg:pypi/pytest-xdist@3.8.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/python-dateutil@2.9.0", + "name": "python-dateutil", + "version": "2.9.0", + "purl": "pkg:pypi/python-dateutil@2.9.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/python-discovery@1.3.0", + "name": "python-discovery", + "version": "1.3.0", + "purl": "pkg:pypi/python-discovery@1.3.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pywin32-ctypes@0.2.3", + "name": "pywin32-ctypes", + "version": "0.2.3", + "purl": "pkg:pypi/pywin32-ctypes@0.2.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/pyyaml@6.0.3", + "name": "pyyaml", + "version": "6.0.3", + "purl": "pkg:pypi/pyyaml@6.0.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/readme-renderer@43.0", + "name": "readme-renderer", + "version": "43.0", + "purl": "pkg:pypi/readme-renderer@43.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/requests@2.34.2", + "name": "requests", + "version": "2.34.2", + "purl": "pkg:pypi/requests@2.34.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/requests-toolbelt@1.0.0", + "name": "requests-toolbelt", + "version": "1.0.0", + "purl": "pkg:pypi/requests-toolbelt@1.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/rfc3986@2.0.0", + "name": "rfc3986", + "version": "2.0.0", + "purl": "pkg:pypi/rfc3986@2.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/rich@15.0.0", + "name": "rich", + "version": "15.0.0", + "purl": "pkg:pypi/rich@15.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/rsa@4.7.2", + "name": "rsa", + "version": "4.7.2", + "purl": "pkg:pypi/rsa@4.7.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/ruamel-yaml@0.19.1", + "name": "ruamel-yaml", + "version": "0.19.1", + "purl": "pkg:pypi/ruamel-yaml@0.19.1", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=0.18.10,<=0.19.1" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/ruff@0.16.9", + "name": "ruff", + "version": "0.16.9", + "purl": "pkg:pypi/ruff@0.16.9" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/secretstorage@3.5.0", + "name": "secretstorage", + "version": "3.5.0", + "purl": "pkg:pypi/secretstorage@3.5.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/service-identity@24.2.0", + "name": "service-identity", + "version": "24.2.0", + "purl": "pkg:pypi/service-identity@24.2.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/setuptools@80.10.2", + "name": "setuptools", + "version": "80.10.2", + "purl": "pkg:pypi/setuptools@80.10.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/six@1.17.0", + "name": "six", + "version": "1.17.0", + "purl": "pkg:pypi/six@1.17.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/sortedcontainers@2.4.0", + "name": "sortedcontainers", + "version": "2.4.0", + "purl": "pkg:pypi/sortedcontainers@2.4.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=2.3,<=2.4.0" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/tomli-w@1.2.0", + "name": "tomli-w", + "version": "1.2.0", + "purl": "pkg:pypi/tomli-w@1.2.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/tornado@6.5.4", + "name": "tornado", + "version": "6.5.4", + "purl": "pkg:pypi/tornado@6.5.4", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=6.5.0,<=6.5.10" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/tox@4.55.1", + "name": "tox", + "version": "4.55.1", + "purl": "pkg:pypi/tox@4.55.1" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/tox-uv@1.35.2", + "name": "tox-uv", + "version": "1.35.2", + "purl": "pkg:pypi/tox-uv@1.35.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/tox-uv-bare@1.35.2", + "name": "tox-uv-bare", + "version": "1.35.2", + "purl": "pkg:pypi/tox-uv-bare@1.35.2" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/twine@7.0.0", + "name": "twine", + "version": "7.0.0", + "purl": "pkg:pypi/twine@7.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/types-requests@2.33.0.20260408", + "name": "types-requests", + "version": "2.33.0.20260408", + "purl": "pkg:pypi/types-requests@2.33.0.20260408" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/typing-extensions@4.14.0", + "name": "typing-extensions", + "version": "4.14.0", + "purl": "pkg:pypi/typing-extensions@4.14.0", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=4.13.2,<=4.14" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/urllib3@2.6.3", + "name": "urllib3", + "version": "2.6.3", + "purl": "pkg:pypi/urllib3@2.6.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/urwid@3.0.3", + "name": "urwid", + "version": "3.0.3", + "purl": "pkg:pypi/urwid@3.0.3", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=2.6.14,<=4.0.13" + } + ] + }, + { + "type": "library", + "bom-ref": "pkg:pypi/uv@0.9.28", + "name": "uv", + "version": "0.9.28", + "purl": "pkg:pypi/uv@0.9.28" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/virtualenv@21.1.0", + "name": "virtualenv", + "version": "21.1.0", + "purl": "pkg:pypi/virtualenv@21.1.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/wcwidth@0.5.3", + "name": "wcwidth", + "version": "0.5.3", + "purl": "pkg:pypi/wcwidth@0.5.3" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/werkzeug@3.1.5", + "name": "werkzeug", + "version": "3.1.5", + "purl": "pkg:pypi/werkzeug@3.1.5" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/wheel@0.48.0", + "name": "wheel", + "version": "0.48.0", + "purl": "pkg:pypi/wheel@0.48.0" + }, + { + "type": "library", + "bom-ref": "pkg:pypi/wsproto@1.3.2", + "name": "wsproto", + "version": "1.3.2", + "purl": "pkg:pypi/wsproto@1.3.2", + "properties": [ + { + "name": "coretrace:specifier", + "value": ">=1.0,<=1.3.2" + } + ] + } + ], + "vulnerabilities": [ + { + "id": "CVE-2026-27199", + "description": "safe_join() accepts a Windows device name in a later segment of a multi-segment path (reports/NUL), so reading the path never ends", + "ratings": [ + { + "severity": "medium" + } + ], + "affects": [ + { + "ref": "pkg:pypi/werkzeug@3.1.5" + } + ] + } + ] +} diff --git a/reports/mitmproxy-2026-10-02/triage.csv b/reports/mitmproxy-2026-10-02/triage.csv new file mode 100644 index 0000000..a4c7d75 --- /dev/null +++ b/reports/mitmproxy-2026-10-02/triage.csv @@ -0,0 +1,88 @@ +id,rule,severity_raw,path,line_raw,line_verified,verdict,triage_confidence,reason +F001,ambiguous-module,info,docs/build.py,1,1,Diagnostic,élevée,"docs/build.py is the module 'build' like release/build.py: a symbol python.build.* may name a function of either, and an import of 'build' resolves only from its own root" +F002,ambiguous-module,info,examples/addons/shutdown.py,1,1,Diagnostic,élevée,"examples/addons/shutdown.py is the module 'shutdown' like test/mitmproxy/data/addonscripts/shutdown.py: a symbol python.shutdown.* may name a function of either, and an import of 'shutdown' resolves only from its own root" +F003,missing-timeout,low,examples/contrib/jsondump.py,192,192,VP,élevée,Appel requests sans timeout ; robustesse de l’extension optionnelle. +F004,hardcoded-credential,high,examples/contrib/test_jsondump.py,65,65,FP,élevée,Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. +F005,missing-timeout,low,examples/contrib/xss_scanner.py,141,141,VP,élevée,Appel requests sans timeout ; robustesse de l’extension optionnelle. +F006,missing-timeout,low,examples/contrib/xss_scanner.py,152,152,VP,élevée,Appel requests sans timeout ; robustesse de l’extension optionnelle. +F007,missing-timeout,low,examples/contrib/xss_scanner.py,165,165,VP,élevée,Appel requests sans timeout ; robustesse de l’extension optionnelle. +F008,missing-timeout,low,examples/contrib/xss_scanner.py,185,185,VP,élevée,Appel requests sans timeout ; robustesse de l’extension optionnelle. +F009,reachable-vulnerability,medium,mitmproxy/addons/maplocal.py,47,47,VP technique / FP exploitabilité,élevée,Appel réel à safe_join 3.1.5 ; Path(untrusted).parts neutralise le scénario de périphérique Windows testé. Pas de DoS natif reproduit. +F010,syntax-error,info,mitmproxy/contentviews/_api.py,1,1,Diagnostic,élevée,mitmproxy/contentviews/_api.py:20:1: unsupported syntax: TypeAlias +F011,syntax-error,info,mitmproxy/contentviews/_utils.py,1,1,Diagnostic,élevée,mitmproxy/contentviews/_utils.py:19:1: unsupported syntax: TypeAlias +F012,syntax-error,info,mitmproxy/contentviews/_view_image/image_parser.py,1,1,Diagnostic,élevée,mitmproxy/contentviews/_view_image/image_parser.py:10:1: unsupported syntax: TypeAlias +F013,unsafe-xml,medium,mitmproxy/contrib/wbxml/ASWBXML.py,819,819,FP,moyenne,loadXml sans appel direct trouvé ; le visualiseur utilise loadBytes/getXml. Appels dynamiques externes non exclus. +F014,syntax-error,info,mitmproxy/net/dns/https_records.py,1,1,Diagnostic,élevée,mitmproxy/net/dns/https_records.py:35:1: unsupported syntax: TypeAlias +F015,missing-timeout,low,mitmproxy/utils/emoji.py,1870,1870,VP,élevée,"VP de robustesse du générateur lancé explicitement ; appel sous __main__, absent au simple import." +F016,weak-crypto,medium,mitmproxy/utils/htpasswd.py,77,77,VP,élevée,SHA-1 non salé pour mots de passe uniquement si un htpasswd {SHA} est choisi ; bcrypt est déjà supporté. +F017,weak-crypto,medium,mitmproxy/utils/magisk.py,90,90,FP,élevée,"MD5 utilisé pour le nom Android/OpenSSL subject_hash_old, pas pour une décision de confiance." +F018,ambiguous-module,info,release/build.py,1,1,Diagnostic,élevée,"release/build.py is the module 'build' like docs/build.py: a symbol python.build.* may name a function of either, and an import of 'build' resolves only from its own root" +F019,command-injection,high,release/build.py,178,178,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F020,command-injection,high,release/build.py,200,200,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F021,command-injection,high,release/release.py,104,104,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F022,command-injection,high,release/release.py,108,108,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F023,command-injection,high,release/release.py,132,132,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F024,command-injection,high,release/release.py,132,132,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F025,command-injection,high,release/release.py,137,137,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F026,command-injection,high,release/release.py,153,153,FP,élevée,"Exécutable fixe, liste d’arguments sans shell ; entrée opérateur ou sortie locale Git, aucun interpréteur de commandes démontré." +F027,hardcoded-secret,high,test/helper_tools/gen_sample_flows.py,2,2,FP,élevée,"Texte d’aide/docstring contenant ?token=... comme placeholder, pas un vrai token." +F028,hardcoded-secret,high,test/helper_tools/gen_sample_flows.py,271,271,FP,élevée,"Texte d’aide/docstring contenant ?token=... comme placeholder, pas un vrai token." +F029,high-entropy-string,medium,test/mitmproxy/addons/test_next_layer.py,40,40,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F030,high-entropy-string,medium,test/mitmproxy/addons/test_next_layer.py,65,65,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F031,high-entropy-string,medium,test/mitmproxy/addons/test_next_layer.py,97,97,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F032,high-entropy-string,medium,test/mitmproxy/addons/test_next_layer.py,128,128,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F033,high-entropy-string,medium,test/mitmproxy/addons/test_next_layer.py,976,976,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F034,ambiguous-module,info,test/mitmproxy/data/addonscripts/addon.py,1,1,Diagnostic,élevée,"test/mitmproxy/data/addonscripts/addon.py is the module 'addon' like test/mitmproxy/data/addonscripts/same_filename/addon.py: a symbol python.addon.* may name a function of either, and an import of 'addon' resolves only from its own root" +F035,ambiguous-module,info,test/mitmproxy/data/addonscripts/same_filename/addon.py,1,1,Diagnostic,élevée,"test/mitmproxy/data/addonscripts/same_filename/addon.py is the module 'addon' like test/mitmproxy/data/addonscripts/addon.py: a symbol python.addon.* may name a function of either, and an import of 'addon' resolves only from its own root" +F036,ambiguous-module,info,test/mitmproxy/data/addonscripts/shutdown.py,1,1,Diagnostic,élevée,"test/mitmproxy/data/addonscripts/shutdown.py is the module 'shutdown' like examples/addons/shutdown.py: a symbol python.shutdown.* may name a function of either, and an import of 'shutdown' resolves only from its own root" +F037,ambiguous-module,info,test/mitmproxy/data/servercert/generate.py,1,1,Diagnostic,élevée,"test/mitmproxy/data/servercert/generate.py is the module 'generate' like test/mitmproxy/net/data/verificationcerts/generate.py: a symbol python.generate.* may name a function of either, and an import of 'generate' resolves only from its own root" +F038,ambiguous-module,info,test/mitmproxy/net/data/verificationcerts/generate.py,1,1,Diagnostic,élevée,"test/mitmproxy/net/data/verificationcerts/generate.py is the module 'generate' like test/mitmproxy/data/servercert/generate.py: a symbol python.generate.* may name a function of either, and an import of 'generate' resolves only from its own root" +F039,high-entropy-string,medium,test/mitmproxy/net/http/test_cookies.py,21,21,FP,élevée,"Fixture de parsing de cookies, utilisée comme donnée attendue ; pas de credential de production établi." +F040,high-entropy-string,medium,test/mitmproxy/net/test_encoding.py,79,79,FP,élevée,"Buffer compressé hexadécimal dans un test de décodage, pas un secret." +F041,high-entropy-string,medium,test/mitmproxy/net/test_encoding.py,85,85,FP,élevée,"Buffer compressé hexadécimal dans un test de décodage, pas un secret." +F042,high-entropy-string,medium,test/mitmproxy/proxy/layers/quic/test__stream_layers.py,114,114,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F043,high-entropy-string,medium,test/mitmproxy/proxy/layers/quic/test__stream_layers.py,147,147,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F044,high-entropy-string,medium,test/mitmproxy/proxy/layers/quic/test__stream_layers.py,179,179,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F045,high-entropy-string,medium,test/mitmproxy/proxy/layers/test_tls.py,46,46,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F046,hardcoded-secret,high,test/mitmproxy/proxy/test_mode_servers.py,352,352,FP,élevée,"La syntaxe reverse:udp://destination@écoute contient des adresses locales de test, pas des identifiants URL." +F047,hardcoded-secret,high,test/mitmproxy/proxy/test_mode_servers.py,356,356,FP,élevée,"La syntaxe reverse:udp://destination@écoute contient des adresses locales de test, pas des identifiants URL." +F048,high-entropy-string,medium,test/mitmproxy/test_tls.py,4,4,FP,élevée,"Trame TLS/QUIC hexadécimale utilisée dans les tests protocolaires, pas un secret." +F049,hardcoded-credential,high,test/mitmproxy/tools/web/test_webaddons.py,26,26,FP,élevée,Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. +F050,hardcoded-credential,high,test/mitmproxy/tools/web/test_webaddons.py,37,37,FP,élevée,Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. +F051,hardcoded-credential,high,test/mitmproxy/tools/web/test_webaddons.py,48,48,FP,élevée,Valeur explicitement utilisée par un test d’authentification/export ; aucune configuration de production. +F052,high-entropy-string,medium,test/mitmproxy/data/har_files/charles.json,57,128,FP,élevée,"En-tête X-Amz-Cf-Id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F053,high-entropy-string,medium,test/mitmproxy/data/har_files/chrome.json,57,188,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F054,high-entropy-string,medium,test/mitmproxy/data/har_files/chrome.json,57,498,FP,élevée,"En-tête x-client-data : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F055,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,176,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F056,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,847,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F057,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,1023,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F058,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,1199,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F059,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,1386,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F060,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,1573,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F061,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,1708,FP,élevée,"En-tête x-amz-id-2 : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F062,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,1919,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F063,high-entropy-string,medium,test/mitmproxy/data/har_files/firefox.json,57,2099,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F064,high-entropy-string,medium,test/mitmproxy/data/har_files/head-content-length.json,57,100,FP,élevée,"En-tête x-amz-id-2 : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F065,high-entropy-string,medium,test/mitmproxy/data/har_files/insomnia.json,54,129,FP,élevée,"En-tête X-Amz-Cf-Id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F066,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,132,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F067,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,260,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F068,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,392,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F069,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,520,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F070,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,648,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F071,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,776,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F072,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,900,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F073,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1028,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F074,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1156,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F075,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1296,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F076,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1436,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F077,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1576,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F078,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1716,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F079,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1848,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F080,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,1976,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F081,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,2104,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F082,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,2228,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F083,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,2399,FP,élevée,"En-tête x-amz-id-2 : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F084,high-entropy-string,medium,test/mitmproxy/data/har_files/safari.json,57,2538,FP,élevée,"En-tête x-amz-cf-id : identifiant de requête/métadonnée publique, pas une clé d’authentification." +F085,vulnerable-dependency,medium,uv.lock,620,1998,VP,élevée,"Werkzeug 3.1.5 verrouillé ; CVE-2026-27199 au niveau inventaire, même CVE que F009. Version déployée non mesurée." +F086,hardcoded-credential,high,web/package-lock.json,71,71,FP,élevée,"js-tokens est un nom de dépendance npm ; valeur = contrainte de version, pas un secret." +F087,hardcoded-credential,high,web/package-lock.json,71,9468,FP,élevée,"js-tokens est un nom de dépendance npm ; valeur = contrainte de version, pas un secret." diff --git a/reports/mitmproxy-2026-10-02/verification.txt b/reports/mitmproxy-2026-10-02/verification.txt new file mode 100644 index 0000000..b3d1043 --- /dev/null +++ b/reports/mitmproxy-2026-10-02/verification.txt @@ -0,0 +1,13 @@ +Werkzeug wheel: werkzeug-3.1.5-py3-none-any.whl +SHA256: 5111e36e91086ece91f93268bb39b4a35c1e6f1feac762c9c822ded0a4e322dc +'reports/NUL' : direct safe_join = 'C:/mapped/reports/NUL' ; mitmproxy wrapper = REJECTED +'reports/CON' : direct safe_join = 'C:/mapped/reports/CON' ; mitmproxy wrapper = REJECTED +'reports/CON.txt.html' : direct safe_join = 'C:/mapped/reports/CON.txt.html' ; mitmproxy wrapper = REJECTED +'reports/NUL ' : direct safe_join = 'C:/mapped/reports/NUL ' ; mitmproxy wrapper = REJECTED +'reports/COM1' : direct safe_join = 'C:/mapped/reports/COM1' ; mitmproxy wrapper = REJECTED +'reports\\NUL' : direct safe_join = None ; mitmproxy wrapper = REJECTED +Normal path accepted: PASS +Windows path semantics simulated; no Windows device opened and no native Windows DoS attempted. +AST search: no direct .loadXml() call in repository; dynamic calls cannot be excluded by this check. +No mitmproxy source or test file changed; no release scripts executed. +Downloaded Werkzeug wheel SHA256 matches the wheel recorded in mitmproxy uv.lock: PASS diff --git a/reports/mitmproxy-2026-10-02/vex.json b/reports/mitmproxy-2026-10-02/vex.json new file mode 100644 index 0000000..8f47bcd --- /dev/null +++ b/reports/mitmproxy-2026-10-02/vex.json @@ -0,0 +1,33 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-7511cf99650ed4d7aad825450a632ac63afaa1710f1f1d66746aa1d928dd1a49", + "author": "Unknown Author", + "timestamp": "2026-10-02T12:38:51Z", + "version": 1, + "tooling": "coretrace-python-analyzer 0.21.0; dependency-policy 1.0.0 (sha256:64108a692266b69ec97bccc9301116b718fbfff19596556a69473daff42182d5); reachable-vulnerability 1.0.0 (sha256:a934ad18a4c225a0b85e0f54e7d02d6e044b0f37e238aa1dcabd969df2055fd8); sample-advisories 1.0.0 (sha256:0d70ce268e90561f9a07eda73728c2aefc8984fc71b9406b9744f0d19a0c94b7); vulnerable-dependency 1.0.0 (sha256:b528af35294646c5dabdd8e9d1977007543ca665b1ceabb75fae2d1cddd5dcb4); aiohttp-models 1.0.0 (sha256:1fb9fc998a1828174de89efe2e63520e982d8b2952fc03da057fb2e35b6a8e2c); bottle-models 1.0.0 (sha256:a419b5911ab7736602d006a51d198199f4b9446264ad05b2c08a8ec16ba58b3c); cli-models 1.0.0 (sha256:2c7ea65765a0f27cdc62aa1aeb1d63a8a4fa1a1e6907c1650018daf741852ba5); credential-models 1.0.0 (sha256:35254a07aee5800506f32d3af2b716fd2fd57eadf64d2cb962ff69e8acaeead8); db-driver-models 1.0.0 (sha256:35ff485fc04801b3404bfe58b998c3901f14a55a5c1f1e80b8b37e388eb4dde0); django-models 1.0.0 (sha256:900ef18837883e3ec7f46ff23280505ddc61e3606838c5a1574e2bb3d6dbe754); fastapi-models 1.0.0 (sha256:ecf4ab97f3b91e75a38420f6577c1e214e007dcb214bb33b466a47a055de3772); flask-models 1.0.0 (sha256:86276bc1e6be85913a2161af269ad84b4cd19571abf8fa4dc22417afa1ea95ff); http-client-models 1.0.0 (sha256:5e4f46304dbc02f8c960215468bd87416e921064e7dfe9dc342e6a4f431001ce); python-stdlib-models 1.0.0 (sha256:2b237d794970e72d41fcc13bf0506c2fe43ef24333ab76804e9bb51e05f5595b); sqlalchemy-models 1.0.0 (sha256:f68f77a847d23dd85d049c9428cbd802633dc85a5351532cc963f186ab5b5acf); tornado-models 1.0.0 (sha256:69b2ef24e7cb3b93fe4859fd98e475c126448f0034136cbf97d24e1298c21b27); config-secrets 1.0.0 (sha256:7e7fb490705c5e5de981a2fbef129f1458ad1aaeb259e56eb49cc8ab1cdaffd5); hardcoded-secrets 1.0.0 (sha256:9629e9c37fd168250f7286d2e8a3b2f62267425f8100dcc5f56c2bd31eddf7dd); code-injection 1.0.0 (sha256:b97fb5ac23bcd251fa0408c16a95e2a23be2496252e3f78596bd339d5f7335dd); command-injection 1.0.0 (sha256:a79f25466752e1a0cf5105b6194d99ad4bcdc16834598d7bf86a167a0c5fd3e0); insecure-deserialization 1.0.0 (sha256:197001f660f3286f015baf9f2ee7fe0e9c376d98f5fd45886b9ebf51261c93e6); nosql-injection 1.0.0 (sha256:24a28107a44322339da20f519b49506f73b772b1961f1c4acb19180bcc36f3f9); open-redirect 1.0.0 (sha256:e0d5ee69073fb54e13158651f801c80250056276f9a4eb59e3356fd8c4cef043); path-traversal 1.0.0 (sha256:26446a23fea57e6a2ff582b6c905d84b7cd04df19e1020c31a888b038b0b82f9); plaintext-credentials 1.0.0 (sha256:281eb1d021a92333ea35541a4a8dddd1e61e60cb48741f3f8bbac7311318fef5); sql-injection 1.0.0 (sha256:7c6202503365c70289c3d35dae63a4a9510d7d47d1c0a4e85aaf6e72c7dab699); ssrf 1.0.0 (sha256:4354049a2ad1487fbf8688901fe40528024f4ec58caa35bbee2c13452884d369); xss 1.0.0 (sha256:9c6a3f3c7f68fe2441f3bcd3f4be2f3dbcaa837f541e3a8c0944fc940c0f30d1); dangerous-eval 1.0.0 (sha256:0be6472598d8ec6357f4dc2c8b20f97a26f011e6edcfb40d613a7560151ddd0a); flask-debug 1.0.0 (sha256:667f4e76bee3c1dd3b70d19cbc4587611240de469a35e3e6214b8cdbb14d600d); insecure-temp-file 1.0.0 (sha256:51395d5b1518f754d663a8d09695f0b5b2da55255b2f5e699daaaec2d47ea8b3); insecure-tls 1.0.0 (sha256:97fe6370d985b93eb2fddef6ec9b8f255904c19d98ccedd5fd1b5afc932c9740); missing-timeout 1.0.0 (sha256:8ef60c32d47d632685ef001691360f93c83e127eebbbe252ab4fcb0fe76ed4db); unsafe-archive-extraction 1.0.0 (sha256:4109a4eb18c45e6c50004fd8f770c055cbb4154a713dd14664870dd1e03dfda4); unsafe-xml 1.0.0 (sha256:416083cda0ba7ab89581c0471606a806efa2a2049262f2d75201247209eb49ed); weak-crypto 1.0.0 (sha256:1236fdfb5a1b6583cec47d8c1e8183a4284d283413581ebd232873b19e50ce2a); weak-random 1.0.0 (sha256:0f6287a58ec2daafb13b7b011b68e81d00bc4e1e29b6c5dac9bf114c7ab21fa9); architecture-rules 1.0.0 (sha256:912f10abeb0dc954cab6ce0fd9e09c7d75ce64f20f916b3f143538317ffe0578); curated-advisories 2026.09.27 (sha256:445a0bd33b7905052cfaa8a945a3c1eb30df95507cc3325da995b60bfd321cb7); enterprise-validators 1.0.0 (sha256:bddec63ed9fb4b9d37308ff27c9732bd7827394e0bfba917c3ad1974e77bba83); exposure-prioritization 1.0.0 (sha256:c7d14dafb655bfbabd0f007a50b0e061a186e4817067938bd0c2582345551447); frameworks-models 1.0.0 (sha256:1479b437640ec047234a5273a30283fd45432f2b1d0338898aa559cc8ebf1f1d); orm-n-plus-one 1.0.0 (sha256:32f043bb2a27a81d9c8d1a4be455ed4227ac494acdc292f3316d0c2034b5823d); serverless-declarations 1.0.0 (sha256:ad06322d7173cefffb6b2a171aaa829b5b028c7e0bff989f70c3973c468d37db)", + "statements": [ + { + "vulnerability": { + "name": "CVE-2026-27199", + "description": "safe_join() accepts a Windows device name in a later segment of a multi-segment path (reports/NUL), so reading the path never ends", + "aliases": [ + "GHSA-29vq-49wr-vm6x", + "PYSEC-2026-2320" + ] + }, + "products": [ + { + "@id": "pkg:generic/mitmproxy", + "subcomponents": [ + { + "@id": "pkg:pypi/werkzeug@3.1.5" + } + ] + } + ], + "status": "affected", + "action_statement": "Update werkzeug to a version outside the vulnerable range <3.1.6.", + "status_notes": "Reached by the project's code at mitmproxy/addons/maplocal.py:47 python.werkzeug.security.safe_join (reachable)." + } + ] +}