sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

[high] semgrep: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. #25

New Issue
Closed
opened 2026-03-18 16:01:23 +00:00 by sharang · 1 comment
sharang commented 2026-03-18 16:01:23 +00:00
Owner
Copy Link
Copy Source

high Finding

Scanner: semgrep
Severity: high
Rule: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket

Description

Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.

Location

File: /tmp/compliance-scanner/repos/Compliance Scanner/compliance-agent/src/pentest/report/pdf.rs (line 62)

Code

requires login

Fingerprint: cdd662ca6394f15d7b19ee19c90232ca5a0a697bcd0226b27828e43f8abcc85b
Generated by compliance-scanner

Labels: severity:high, scanner:semgrep, compliance-scanner

## high Finding **Scanner:** semgrep **Severity:** high **Rule:** javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket ### Description Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. ### Location **File:** `/tmp/compliance-scanner/repos/Compliance Scanner/compliance-agent/src/pentest/report/pdf.rs` (line 62) ### Code ``` requires login ``` --- *Fingerprint:* `cdd662ca6394f15d7b19ee19c90232ca5a0a697bcd0226b27828e43f8abcc85b` *Generated by compliance-scanner* **Labels:** severity:high, scanner:semgrep, compliance-scanner
sharang commented 2026-07-10 07:52:24 +00:00
Author
Owner
Copy Link
Copy Source

Closing as intentional: the ws:// here is the Chrome DevTools Protocol connection to the internal headless-Chrome container (CHROME_WS_URL) used for PDF rendering. It never leaves the internal Docker network and the URL is config-driven — wss:// can be used if the deployment provides it.

Closing as intentional: the `ws://` here is the Chrome DevTools Protocol connection to the internal headless-Chrome container (`CHROME_WS_URL`) used for PDF rendering. It never leaves the internal Docker network and the URL is config-driven — `wss://` can be used if the deployment provides it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#25