GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (141)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

scripts/js/build.js (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
const shell = require('shelljs');
2
const fs = require('fs');
3
const chalk = require('chalk');
4
const emoji = require('node-emoji');
5
6
const enviroment = process.env.npm_package_config_enviroment;
7
8
const servername = process.env.npm_package_config_server;
9
10
shell.mkdir('-p',['applications/assets/icons']);
11
12
process.stdout.write(chalk.gray(emoji.emojify('[  ] Build Server Vagrant (' + enviroment + ")")) + "\n");
13
14
if ( enviroment === 'dev' ){
15
16
  let vagrantId = shell.exec("vagrant global-status | grep d1b0server | awk '{ print $1}'", {silent:true});
17
18
  var vagrantCode;
19
  if ( vagrantId.code !== 0 ){
20
    process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore: "+vagrantId.stderr+ " - "+vagrantId.stdout)));
21
    process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
22
  } else {
23
    vagrantCode = vagrantId.stdout.trim();
24
  }
25
26
  if ( !vagrantCode ) {
27
    process.stdout.write(chalk.yellow(emoji.emojify("[:raised_hand: ] Vagrant server not found")) + "\n");
28
29
    //gKey = shell.exec('./scripts/generatekey.sh', {silent:true});
30
    if (!fs.existsSync('./server/plays/ssh/root.key')) {
31
      process.stdout.write(chalk.gray(emoji.emojify('[  ] ssh-keygen root key')) + "\n");
32
      let gKey = shell.exec('ssh-keygen -t rsa -b 4096 -N "" -f ./server/plays/ssh/root.key', {silent:true});
33
      if ( gKey.code !== 0 ){
34
        process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore generazione ssh root key per vagrant"))+ "\n");
35
        process.stderr.write(chalk.gray(gKey.stdout+"\n"));
36
        process.stderr.write(chalk.red(gKey.stderr+"\n"));
37
        process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
38
      }
39
    } else {
40
      process.stdout.write(chalk.yellow(emoji.emojify("[:raised_hand: ] root key already exist")) + "\n");
41
    }
42
43
    if (!fs.existsSync('./server/plays/ssh/developer.key')) {
44
      process.stdout.write(chalk.gray(emoji.emojify('[  ] ssh-keygen developer key')) + "\n");
45
      let dKey = shell.exec('ssh-keygen -t rsa -b 4096 -N "" -f ./server/plays/ssh/developer.key', {silent:true});
46
      if ( dKey.code !== 0 ){
47
        process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore generazione ssh developer key per vagrant")) + "\n");
48
        process.stderr.write(chalk.gray(dKey.stdout+"\n"));
49
        process.stderr.write(chalk.red(dKey.stderr+"\n"));
50
        process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
51
      }
52
    } else {
53
      process.stdout.write(chalk.yellow(emoji.emojify("[:raised_hand: ] root key already exist")) + "\n");
54
    }
55
56
    //gSSL = shell.exec('./scripts/generateSSL.sh', {silent:true});
57
    if (!fs.existsSync('./server/plays/ssl/selfsigned.crt')) {
58
      process.stdout.write(chalk.gray(emoji.emojify('[  ] openssl generate self certificate')) + "\n");
59
      let gSSL = shell.exec('openssl req -x509 -nodes -days 365 -newkey rsa:2048 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=' + servername + '" -keyout ./server/plays/ssl/selfsigned.key -out ./server/plays/ssl/selfsigned.crt', {silent:true});
60
      if ( gSSL.code !== 0 ){
61
        process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore generazione certificati SSL per vagrant"))+ "\n");
62
        process.stderr.write(chalk.gray(gSSL.stdout+"\n"));
63
        process.stderr.write(chalk.red(gSSL.stderr+"\n"));
64
        process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
65
      }
66
67
      process.stdout.write(chalk.gray(emoji.emojify('[  ] assemble combo pem certificate with certificate'))+ "\n");
68
      let contentsScrt = fs.readFileSync('./server/plays/ssl/selfsigned.crt','utf8');
69
      fs.writeFileSync('./server/plays/ssl/selfsigned.combo.pem', contentsScrt);
70
71
72
      // gSSLcrt1 = shell.exec('cat ./server/plays/ssl/selfsigned.crt > ./server/plays/ssl/selfsigned.combo.pem', {silent:false});
73
      // if ( gSSLcrt1.code !== 0 ){
74
      //   process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore creazione combo certificato SSL per vagrant"))+ "\n");
75
      //   process.stderr.write(chalk.gray(gSSLcrt1.stdout+"\n"));
76
      //   process.stderr.write(chalk.red(gSSLcrt1.stderr+"\n"));
77
      //   process.exit(1);
78
      // }
79
80
      process.stdout.write(chalk.gray(emoji.emojify('[  ] assemble combo pem certificate with key'))+ "\n");
81
82
      let contentsSkey = fs.readFileSync('./server/plays/ssl/selfsigned.key','utf8');
83
      fs.appendFileSync('./server/plays/ssl/selfsigned.combo.pem', contentsSkey);
84
85
      // gSSLcrt2 = shell.exec('cat  >> ', {silent:false});
86
      // if ( gSSLcrt2.code !== 0 ){
87
      //   process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore generazione combo certificato SSL per vagrant"))+ "\n");
88
      //   process.stderr.write(chalk.gray(gSSLcrt2.stdout+"\n"));
89
      //   process.stderr.write(chalk.red(gSSLcrt2.stderr+"\n"));
90
      //   process.exit(1);
91
      // }
92
93
      //# RICHIEDE MOLTO TEMPO!
94
      var dhparamLength = 4096;
95
      if ( enviroment === 'dev' || enviroment === 'vagrant' ){
96
        dhparamLength = 1024;
97
      }
98
      process.stdout.write(chalk.gray(emoji.emojify('[  ] generate '+ dhparamLength +' dhparam key'))+ "\n");
99
      let gSSLcrt3 = shell.exec('openssl dhparam -out ./server/plays/ssl/dhparam.pem ' + dhparamLength, {silent:true});
100
      if ( gSSLcrt3.code !== 0 ){
101
        process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore generazione dhparam SSL random key per vagrant"))+ "\n");
102
        process.stderr.write(chalk.gray(gSSLcrt3.stdout+"\n"));
103
        process.stderr.write(chalk.red(gSSLcrt3.stderr+"\n"));
104
        process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
105
      }
106
107
      process.stdout.write(chalk.gray(emoji.emojify('[  ] assemble combo pem with dhparam'))+ "\n");
108
      let contentsDparam = fs.readFileSync('./server/plays/ssl/dhparam.pem','utf8');
109
      fs.appendFileSync('./server/plays/ssl/selfsigned.combo.pem', contentsDparam);
110
111
      // gSSLcrt4 = shell.exec('cat ./server/plays/ssl/dhparam.pem >> ./server/plays/ssl/selfsigned.combo.pem', {silent:false});
112
      // if ( gSSLcrt4.code !== 0 ){
113
      //   process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore generazione dhparam SSL random key per vagrant"))+ "\n");
114
      //   process.stderr.write(chalk.gray(gSSLcrt4.stdout+"\n"));
115
      //   process.stderr.write(chalk.red(gSSLcrt4.stderr+"\n"));
116
      //   process.exit(1);
117
      // }
118
119
    } else {
120
      process.stdout.write(chalk.yellow(emoji.emojify("[:raised_hand: ] ssl certificate already exist\n")));
121
    }
122
123
    process.stdout.write(chalk.gray(emoji.emojify('[  ] update ansible external role'))+ "\n");
124
    let rUpdate = shell.exec('./scripts/roles_update.sh', {silent:true});
125
    if ( rUpdate.code !== 0 ){
126
      process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore download role ansible esterni"))+ "\n");
127
      process.stderr.write(chalk.gray(rUpdate.stdout+"\n"));
128
      process.stderr.write(chalk.red(rUpdate.stderr+"\n"));
129
      process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
130
    }
131
132
    shell.cd('server/');
133
134
    process.stdout.write(chalk.gray(emoji.emojify("[  ] Evaluate Cache APT."))+ "\n");
135
136
    const cache = process.env.npm_package_config_cache;
137
138
    process_enviroment = process.env;
0 ignored issues
show
The variable process_enviroment seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.process_enviroment.
Loading history...
139
140
    if ( !cache  ){
141
      process.stdout.write(chalk.gray(emoji.emojify("[  ] Cache disable."))+ "\n");
142
      shell.exec('unset APT_PROXY', {silent:true});
143
    } else {
144
145
      //docker-compose
146
      let dockerCacheProc = shell.exec('cd cache/ && docker-compose up -d', {silent:true});
147
      if ( dockerCacheProc.code !== 0 ){
148
        process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore up cache"))+ "\n");
149
        process.stderr.write(chalk.gray(dockerCacheProc.stdout+"\n"));
150
151
        process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
152
      }
153
154
      process_enviroment.APT_PROXY = 'true';
155
156
      process.stdout.write(chalk.bgGreen.black(emoji.emojify('[:heavy_check_mark: ] Cache APT enabled.')) + "\n");
157
    }
158
159
    process.stdout.write(chalk.gray(emoji.emojify("[  ] Vagrant server UP."))+ "\n");
160
161
    let upVagrant = shell.exec("vagrant up", {silent: true, env: process_enviroment});
162
    if ( upVagrant.code !== 0 ){
163
      process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore: "+upVagrant.stderr+ " - "+upVagrant.stdout)));
164
      process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
165
    }
166
167
    process.stdout.write(chalk.gray(emoji.emojify("[  ] Install Server Required Package and Config.")) + "\n");
168
    let ansibleProc = shell.exec('ansible-playbook -i '+enviroment+'.hosts site.yml', {silent: true, env: process_enviroment});
169
    if ( ansibleProc.code !== 0 ){
170
      process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore ansible site.yml"))+ "\n");
171
      process.stderr.write(chalk.gray(ansibleProc.stdout+"\n"));
172
      process.stderr.write(chalk.red(ansibleProc.stderr+"\n"));
173
174
      process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
175
    }
176
177
    process.stdout.write(chalk.bgGreen.black(emoji.emojify('[:heavy_check_mark: ] Vagrant server installation packages completed.' + "\n")));
178
179
    shell.cd('..');
180
181
  } else {
182
    process.stdout.write(chalk.gray(emoji.emojify("[:world_map: ] Find vagrant server: "+vagrantCode+". Skip creation." ))+ "\n");
183
    // non funziona vagrant up by name or uuid
184
    // var upVagrant = shell.exec("vagrant up "+vagrantCode);
185
186
    shell.cd('server/');
187
188
    let upVagrant = shell.exec("vagrant up", {silent:true});
189
    if ( upVagrant.code !== 0 ){
190
      process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore during vagrant - check ansible plays/vagrant.yml")) + "\n");
191
      process.stderr.write(chalk.gray(upVagrant.stdout+"\n"));
192
      process.stderr.write(chalk.red(upVagrant.stderr+"\n"));
193
      process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
194
    }
195
196
    process.stdout.write(chalk.bgGreen.black(emoji.emojify('[:heavy_check_mark: ] Vagrant server UP!'))+ "\n");
197
198
    shell.cd('..');
199
  }
200
201
} else {
202
203
    process.stdout.write(chalk.gray(emoji.emojify("[  ] Install Server Required Package and Config."))+ "\n");
204
205
    let ansibleProc = shell.exec('ansible-playbook -i '+enviroment+'.hosts site.yml', {silent:true});
206
    if ( ansibleProc.code !== 0 ){
207
      process.stderr.write(chalk.bgRed.white(emoji.emojify("[:heavy_multiplication_x: ] Errore: "+ansibleProc.stderr+ " - "+ansibleProc.stdout))+ "\n");
208
      process.exit(1);
0 ignored issues
show
Compatibility Debugging Code Best Practice introduced by
Use of process.exit() is discouraged as it will potentially stop the complete node.js application. Consider quitting gracefully instead by throwing an Error.
Loading history...
209
    }
210
211
}
212