registry / @redocly/openapi-core / 2.40.0

@redocly/openapi-core@2.40.0

See https://github.com/Redocly/redocly-cli

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 232 file(s), 731 KB of source, external domains: example.com, redocly.com

Source & flagged code

3 flagged

lib/types/asyncapi2.jsView file

Lines 400-440javascript

400 refreshUrl: { type: 'string' },

401 scopes: { type: 'object', additionalProperties: { type: 'string' } }, // TODO: validate scopes

402 tokenUrl: { type: 'string' },

403 },

404 required: ['tokenUrl', 'scopes'],

405 description: 'Configuration for the OAuth Client Credentials flow.',

406};

407const AuthorizationCode = {

408 properties: {

409 refreshUrl: { type: 'string' },

410 authorizationUrl: { type: 'string' },

411 scopes: { type: 'object', additionalProperties: { type: 'string' } }, // TODO: validate scopes

412 tokenUrl: { type: 'string' },

413 },

414 required: ['authorizationUrl', 'tokenUrl', 'scopes'],

415 description: 'Configuration for the OAuth Authorization Code flow.',

416};

417export const SecuritySchemeFlows = {

418 properties: {

419 implicit: 'ImplicitFlow',

420 password: 'PasswordFlow',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/types/asyncapi2.jsView on unpkg · L420

421 clientCredentials: 'ClientCredentials',

422 authorizationCode: 'AuthorizationCode',

423 },

424};

425const SecurityScheme = {

426 properties: {

427 type: {

428 enum: [

429 'userPassword',

430 'apiKey',

431 'X509',

432 'symmetricEncryption',

433 'asymmetricEncryption',

434 'httpApiKey',

435 'http',

436 'oauth2',

437 'openIdConnect',

438 'plain',

439 'scramSha256',

440 'scramSha512',

lib/config/plugins-cache.jsView file

Lines 42-82javascript

42 isEsmCacheBustHookRegistered = true;

43 if (typeof module.registerHooks !== 'function') {

44 logger.warn(`Redocly plugin reload requires Node.js >= 22.15 (current: ${process.version}). `

lib/types/oas3.jsView file

Lines 653-693javascript

653 refreshUrl: { type: 'string' },

654 authorizationUrl: { type: 'string' },

655 scopes: { type: 'object', additionalProperties: { type:

Source & flagged code

3 flagged · loading source

lib/types/asyncapi2.jsView file

420patternName = generic_password severity = medium line = 420 matchedText = password...ow',

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code