shine-cli 2.4.0 → 2.5.0
Evidence: 1 changed. Static findings: 23 new, 9 gone. Run full: 0 changed.
50
high
50
high
Evidence
1 changed, 11 the same.
| Change | Points | Signal | What |
|---|---|---|---|
| added | 0 | static:environment_enumeration shine-cli |
high severity environment_enumeration in build_script code: std::env::vars_os |
Package
- Build script
- no change
- Proc macro
- no change
- links
- no change
- New dependencies
- unicode-normalization
Static findings
23 new, 9 gone, 213 the same. Code that only moved counts as the same.
New in 2.5.0
high secret_environment_variable build_script 2
GH_TOKEN=TOKENcli/src/dispatch/tests.rs:45NPM_TOKEN=NODE_AUTH_TOKENcli/src/dispatch/tests.rs:76
high shell_command build_script 2
powershellcli/src/dispatch/tests.rs:1909#!/bin/sh\u{a}shift\u{a}exec /bin/sh -c "$*"\u{a}cli/src/ssh/agent.rs:1238
high downloader_pattern build_script 1
https://example.test at cli/src/apps/refresh.rs:215 with std::process::Command::new at cli/build.rs:49cli/src/apps/refresh.rs:215
high environment_enumeration build_script 1
std::env::vars_oscli/src/env/workspace/file_groups/filesystem.rs:167
medium process_spawn build_script 11
std::process::Command::newcli/src/env/workspace/file_groups/filesystem.rs:162 cli/src/presets.rs:862tokio::process::Commandcli/src/git_pull.rs:13 cli/src/ssh/agent.rs:504tokio::process::Command::newcli/src/secret/age.rs:319 cli/src/secret/age.rs:372 cli/src/secret/exec.rs:289 cli/src/secret/exec.rs:315 cli/src/secret/exec.rs:339 cli/src/secret/gpg.rs:148 cli/src/secret/gpg.rs:174
low url_literal build_script 1
https://example.com/overlay.gitcli/src/dispatch/tests.rs:817
info unsafe_code build_script 5
10 unsafe blocks, functions or implscli/src/env/workspace/file_groups/platform.rs:12722 unsafe blocks, functions or implscli/src/env/workspace/file_groups/platform/windows.rs:363 unsafe blocks, functions or implscli/src/secret/exec.rs:2792 unsafe blocks, functions or implscli/src/self_install.rs:8004 unsafe blocks, functions or implscli/src/ssh/agent.rs:854
Gone since 2.4.0
9 findings
high secret_environment_variable build_script 2
GH_TOKEN=TOKENcli/src/main.rs:1024NPM_TOKEN=NODE_AUTH_TOKENcli/src/main.rs:1055
high downloader_pattern build_script 1
https://example.test at cli/src/apps/refresh.rs:208 with std::process::Command::new at cli/build.rs:49cli/src/apps/refresh.rs:208
high shell_command build_script 1
powershellcli/src/main.rs:2901
medium process_spawn build_script 2
tokio::process::Command::newcli/src/git_pull.rs:285 cli/src/git_pull.rs:426
low url_literal build_script 1
https://example.com/overlay.gitcli/src/main.rs:1803
info unsafe_code build_script 2
1 unsafe blocks, functions or implscli/src/secret/exec.rs:1932 unsafe blocks, functions or implscli/src/ssh/agent.rs:769
Run: full
Processes 0 new, 0 gone, 52 the same
The same processes ran.
Network 0 changed, 0 the same
No change.
Files 0 changed, 0 the same
No change.
Behavior
1 new, 0 gone, 8 the same.
New in 2.5.0
static:environment_enumeration