registry / @redpanda-data/docs-extensions-and-macros / 5.1.2

@redpanda-data/docs-extensions-and-macros@5.1.2

Antora extensions and macros developed for Redpanda documentation.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 154 file(s), 1.18 MB of source, external domains: api.github.com, artifacthub.io, docs.docker.com, docs.redpanda.com, git-scm.com, github.com, go.dev, hub.docker.com, nodejs.org, pandoc.org, python.org, raw.githubusercontent.com, redocly.com, redpanda.com, redpandadata.atlassian.net, www.redpanda.com, www.sitemaps.org

Source & flagged code

6 flagged

tools/generate-cli-docs.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * Generate CLI Reference Documentation

5 *

6 * This script automatically generates AsciiDoc documentation for the doc-tools CLI

7 * by executing commands with --help and parsing the output, then enhancing it with

8 * JSDoc comments from the source code.

9 */

11const { execSync } = require('child_process');

12const fs = require('fs');

High

Child Process

Package source references child process execution.

tools/generate-cli-docs.jsView on unpkg · L10

13const path = require('path');

15/**

16 * Execute a CLI command and capture help output

17 */

18function getHelpOutput(command) {

19 try {

20 return execSync(`npx doc-tools ${command} --help`, {

21 encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tools/generate-cli-docs.jsView on unpkg · L19

22 stdio: ['pipe', 'pipe', 'pipe']

23 });

24 } catch (error) {

25 // Commander exits with code 0 for help, but some shells treat it as error

26 return error.stdout || '';

27 }

28}

30/**

31 * Sanitize path values in option descriptions to remove user-specific absolute paths

32 */

33function sanitizePathInDescription(description) {

34 // Get the repository root path for relativization

35 const repoRoot = path.resolve(__dirname, '..');

37 let sanitized = description;

39 // First, handle repository root paths specifically

tools/property-extractor/generate-handlebars-docs.jsView file

Lines 1-23javascript

1const AUTOGEN_NOTICE = '// This content is autogenerated. Do not edit manually. To override descriptions, use the doc-tools CLI with the --overrides option: https://redpandadata.atlassian.net/wiki/spaces/DOC/pages/1396244485/Review+Redpanda+configuration+properties\n';

2'use strict';

4const fs = require('fs');

5const path =

tools/rpk-docs/generate-rpk-docs.jsView file

Lines 1-35javascript

1'use strict'

3const fs = require('fs')

4const path = require('path')

5const handlebars = require('handlebars')

docker-compose/25.1/transform/regex.wasmView file

•path = docker-compose/25.1/transform/regex.wasm kind = wasm_module sizeBytes = 334263 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

docker-compose/25.1/transform/regex.wasmView on unpkg

tools/metrics/metrics.pyView file

•path = tools/metrics/metrics.py kind = build_helper sizeBytes = 7735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/metrics/metrics.pyView on unpkg

Source & flagged code

6 flagged · loading source

tools/generate-cli-docs.jsView file

10L11: const { execSync } = require('child_process'); L12: const fs = require('fs');

High

Child Process

Package source references child process execution.

tools/generate-cli-docs.jsView on unpkg · L10

19try { L20: return execSync(`npx doc-tools ${command} --help`, { L21: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tools/generate-cli-docs.jsView on unpkg · L19

tools/property-extractor/generate-handlebars-docs.jsView file

3L4: const fs = require('fs'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/property-extractor/generate-handlebars-docs.jsView on unpkg · L3

tools/rpk-docs/generate-rpk-docs.jsView file

15// Template paths L16: const TEMPLATES_DIR = path.resolve(__dirname, './templates') L17: ... L705: function deepClone(obj) { L706: return JSON.parse(JSON.stringify(obj)) L707: } ... L1576: L1577: // Add backticks around home directory paths (~/.bashrc, ~/.zshrc, ~/.config/...) L1578: result = result.replace(/(?<![`\w])(~\/\.[^\s,;:)`]+)/g, '`$1`') ... L1591: // Pattern: #NNNN (4+ digits) when not inside backticks or code L1592: // e.g., "(see #2904)" → "(see https://github.com/redpanda-data/redpanda/issues/2904[#2904])" L1593: result = result.replace(/(?<![`\w])#(\d{4,})(?![`\w])/g, 'https://github.com/redpanda-data/redpanda/issues/$1[#$1]')

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

tools/rpk-docs/generate-rpk-docs.jsView on unpkg · L15

docker-compose/25.1/transform/regex.wasmView file

•path = docker-compose/25.1/transform/regex.wasm kind = wasm_module sizeBytes = 334263 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

docker-compose/25.1/transform/regex.wasmView on unpkg

tools/metrics/metrics.pyView file

•path = tools/metrics/metrics.py kind = build_helper sizeBytes = 7735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/metrics/metrics.pyView on unpkg

Findings

3 High7 Medium4 Low

HighChild Processtools/generate-cli-docs.js

HighShell

HighRuntime Package Installtools/generate-cli-docs.js

MediumDynamic Requiretools/property-extractor/generate-handlebars-docs.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencetools/rpk-docs/generate-rpk-docs.js

MediumShips Wasm Moduledocker-compose/25.1/transform/regex.wasm

MediumShips Build Helpertools/metrics/metrics.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

tools/generate-cli-docs.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * Generate CLI Reference Documentation

5 *

6 * This script automatically generates AsciiDoc documentation for the doc-tools CLI

7 * by executing commands with --help and parsing the output, then enhancing it with

8 * JSDoc comments from the source code.

9 */

11const { execSync } = require('child_process');

12const fs = require('fs');

High

Child Process

Package source references child process execution.

tools/generate-cli-docs.jsView on unpkg · L10

13const path = require('path');

15/**

16 * Execute a CLI command and capture help output

17 */

18function getHelpOutput(command) {

19 try {

20 return execSync(`npx doc-tools ${command} --help`, {

21 encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tools/generate-cli-docs.jsView on unpkg · L19

22 stdio: ['pipe', 'pipe', 'pipe']

23 });

24 } catch (error) {

25 // Commander exits with code 0 for help, but some shells treat it as error

26 return error.stdout || '';

27 }

28}

30/**

31 * Sanitize path values in option descriptions to remove user-specific absolute paths

32 */

33function sanitizePathInDescription(description) {

34 // Get the repository root path for relativization

35 const repoRoot = path.resolve(__dirname, '..');

37 let sanitized = description;

39 // First, handle repository root paths specifically

tools/property-extractor/generate-handlebars-docs.jsView file

Lines 1-23javascript

2'use strict';

4const fs = require('fs');

5const path =

tools/rpk-docs/generate-rpk-docs.jsView file

Lines 1-35javascript

1'use strict'

3const fs = require('fs')

4const path = require('path')

5const handlebars = require('handlebars')

docker-compose/25.1/transform/regex.wasmView file

•path = docker-compose/25.1/transform/regex.wasm kind = wasm_module sizeBytes = 334263 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

docker-compose/25.1/transform/regex.wasmView on unpkg

tools/metrics/metrics.pyView file

•path = tools/metrics/metrics.py kind = build_helper sizeBytes = 7735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/metrics/metrics.pyView on unpkg