⚠ Se detectaron 7 vulnerabilidades de nivel ERROR. Este PR no debe mergearse hasta resolver al menos los hallazgos de inyección de credenciales y JWT.
| # | Severidad | Herramienta | Regla | Descripción | Archivo / Línea |
|---|---|---|---|---|---|
| 1 | CRÍTICO | Semgrep | SQL query built with string concatenation from user-controlled input `recipe_name`. Use parameterized queries instead. | recipes/queries.py L47 |
|
| 2 | CRÍTICO | Semgrep | JWT decoder accepts 'none' algorithm. An attacker can forge tokens without a secret key. Set algorithms=['HS256'] explicitly. | auth/jwt_utils.py L23 |
|
| 3 | CRÍTICO | Semgrep | Hard-coded database password found: `DB_PASS = 'nutrisync2024!'`. Move to environment variable. | core/config.py L12 |
|
| 4 | CRÍTICO | Semgrep | AWS access key `AKIA...` hardcoded in test fixture. Revoke immediately and use IAM roles or secrets manager. | fixtures/aws_mock.py L8 |
|
| 5 | CRÍTICO | CodeQL | Cross-site scripting: user-supplied `recipeName` flows from HTTP request into `innerHTML` in RecipeCard component without sanitization. | components/RecipeCard.tsx L67 |
|
| 6 | CRÍTICO | CodeQL | Path traversal: `fileName` parameter from user upload request used directly in `fs.readFile()` without normalization or allowlist check. | utils/fileManager.ts L43 |
|
| 7 | CRÍTICO | CodeQL | Hard-coded API key `sk_live_...` found in Stripe integration helper. Move to environment variable STRIPE_SECRET_KEY. | lib/stripe.ts L5 |
|
| 8 | AVISO | Semgrep | User-supplied `ingredient_name` written directly to HTML response without escaping. | ingredients/views.py L89 |
|
| 9 | AVISO | Semgrep | Credentials passed in Authorization header over plain HTTP to external nutrition API. | integrations/fatsecret_client.py L34 |
|
| 10 | AVISO | Semgrep | MD5 used to hash user profile images cache key. Use SHA-256 for hash integrity. | utils/cache.py L61 |
|
| 11 | AVISO | Semgrep | subprocess called with shell=True and partial user input in PDF export command. | reports/pdf_exporter.py L112 |
|
| 12 | AVISO | Semgrep | SSL certificate verification disabled (`verify=False`) in webhook delivery client. | webhooks/dispatcher.py L78 |
|
| 13 | AVISO | CodeQL | Potential SQL injection in Supabase raw query: `patientId` string interpolated into query template. | lib/supabase-helpers.ts L88 |
|
| 14 | AVISO | CodeQL | Prototype pollution via `Object.assign({}, req.query)` in settings merge utility. | utils/settingsMerge.ts L22 |
|
| 15 | AVISO | CodeQL | Open redirect: `returnUrl` from query string passed directly to `router.push()` without domain validation. | auth/callback.tsx L31 |
|
| 16 | AVISO | CodeQL | Reflected XSS risk: `searchTerm` reflected into page title tag via `document.title` without encoding. | pages/search.tsx L54 |
|
| 17 | NOTA | Semgrep | Function `get_patient_plan` may return None if plan not found; callers don't check. | patients/service.py L203 |
|
| 18 | NOTA | Semgrep | Function `resolve_dietitian` may return None; callers should handle explicitly. | dietitians/resolver.py L56 |
|
| 19 | NOTA | Semgrep | Static test password 'testpass123' in unit test. Consider using test fixtures. | unit/test_auth.py L17 |
|
| 20 | NOTA | CodeQL | SHA-1 used for password reset token generation. Use crypto.randomBytes(32) instead. | lib/auth-tokens.ts L18 |
|
| 21 | NOTA | CodeQL | Test fixture contains hardcoded JWT secret 'test-secret-jwt'. Acceptable in tests but ensure this never reaches production config. | __tests__/auth.test.ts L9 |
tests/fixtures/aws_mock.pySTRIPE_SECRET_KEYsrc/auth/jwt_utils.pysrc/api/recipes/queries.pyrecipeName antes de innerHTML en RecipeCardreturnUrl contra allowlist de dominios propiossubprocess shell=True por lista de argumentoscrypto.randomBytes(32) en reset tokensNone en get_patient_plan y resolve_dietitian