# The findings of the semgrep job that were already there when this file was written, one per
# line: fingerprint, tool, rule, file:line (where it was then; the fingerprint does not
# use the number), message, and - where its triage said - why it is known rather than
# fixed. The job fails only on a finding whose fingerprint is not here.
# Written by build/ci/security-findings.py --write-baseline; do not edit by hand, except to
# delete the line of a finding that has been fixed. docs/ContinuousIntegration.md,
# "Security scanning", says when and how to regenerate it.
#
# 125 findings, 56 of them with a reason.
1352dbe76834091c4110	semgrep	python.lang.security.use-defused-xml-parse.use-defused-xml-parse	build/check-catalogues.py:94	The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to par
ee7649b170f19cc77a4b	semgrep	python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args	build/check-deck-script.py:271	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.
78a4eeeb4420bc74d0a8	semgrep	python.lang.security.use-defused-xml-parse.use-defused-xml-parse	build/check-localisation.py:406	The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to par
389578e0f4e884cdf7e5	semgrep	python.lang.security.use-defused-xml-parse.use-defused-xml-parse	build/check-mnemonics.py:237	The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to par
542c74e9dfd86da3ea10	semgrep	python.lang.security.use-defused-xml-parse.use-defused-xml-parse	build/check-package-manifests.py:253	The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to par
f13e17193535c02d729e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/build-linux-image.sh:57	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
a8a6fc34e69b9ccb0a37	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/linux-build.sh:139	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting
afb8d4ffdc382ae58928	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/linux-build.sh:206	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
b801bd3ee3580028956d	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/linux-build.sh:216	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
b119045993b83cc687e9	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/linux-build.sh:228	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
b281255191cc1b26a25e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/linux-coverage.sh:112	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
e6decfe8bd85fda25548	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/linux-coverage.sh:153	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( ($(date +%s) - started) / 60 )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
8d71f995bbc9b201c3ed	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/linux-coverage.sh:227	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: $raws, the .profraw files find listed, is split into llvm-profdata's arguments on purpose (the shellcheck disable=SC2086 above it). Every name is one LLVM_PROFILE_FILE made - hm-%p%c.profraw, or <tester>-%p%c.profraw - in $cov/profiles-*, and $cov is HM_COV_DIR or $root/linux-coverage (root=$PWD, the checkout); a directory with a space in its name would make llvm-profdata fail and the script exit 4, never merge other files.
e86dc81aabb05ee37554	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/linux-repro.sh:139	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted say argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
ffce5bed8129babf7dbf	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/linux-suite.sh:280	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting
baf0c592069caa6ee585	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/appimage-build.sh:126	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $tools is the script's own "build-essential cmake ninja-build", or empty with a prebuilt server so that it adds no argument; the other words are literal package names. None has a space or a glob character.
8f2d08c103d9611e78c6	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/appimage-build.sh:172	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
4ec7d83512a26f83817f	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/appimage-cross.sh:111	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
0e3fe61ad7d5f3f310b6	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/appimage-runtime.sh:74	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $packages is the script's own list of Alpine package names, one apk argument each; none has a glob character.
35c33cb33f3d55e60334	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/appimage-runtime.sh:104	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $static_libs is what pkg-config --static --libs prints for squashfuse_ll, squashfuse and fuse3 and five -l flags the script adds, each one -l or -L word for cc; quoted, they would reach the linker as one argument.
197f1afdf501b7205edd	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/deb-build.sh:222	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $tools and $dev are the script's own lists of Debian package names (with :arm64 for a cross build), one apt-get argument each; none has a space or a glob character.
532f9d3c36f8aa513d96	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-build.sh:283	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - boost_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
f402ddf3e07b92ec7e15	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/deb-build.sh:297	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: $CXX is set by this script a few lines above to g++, or aarch64-linux-gnu-g++ for a cross build, and exported for CMake: one word with no glob character, run for its --version line.
f18edf0733e86022dd7b	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-build.sh:322	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - build_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, the value of an assignment (build_seconds=), which is not split either, where the shell splits no words and expands no globs, and date +%s prints digits only.
1831255bd956640bf897	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/deb-build.sh:345	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: $CXX is set by this script to g++, or aarch64-linux-gnu-g++ for a cross build (this step runs for a native build only), and exported for CMake: one word with no glob character, run for its --version line.
4e7a342b61c9f9630a4e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-build.sh:413	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - package_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
cf799b463eb9ce6e44ec	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-build.sh:413	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
aadcf4b886472a1004de	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-build.sh:435	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
d3f011c8963ca9509d4f	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-install.sh:170	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
06ffd691954a2175b1fb	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-install.sh:172	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
d1c0d0bf4d029e4438dd	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-local.sh:62	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - build_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
6a84eac57a69668a7cf6	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/deb-local.sh:68	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - install_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
944396237b26ed2cfa97	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-build.sh:181	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started_all )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
d0095d2d6abfc59ba840	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/rpm-build.sh:238	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $wanted is $host_pkgs, and $sys_pkgs on x86_64 - the script's own lists of package names for each distribution - one install_host argument each; none has a space or a glob character.
5b3b6c0d31141cd47532	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/rpm-build.sh:273	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $sys_pkgs is the script's own list of the distribution's -devel package names, one dnf argument each; none has a space or a glob character.
8bf2868e5aa30dba5b9a	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/rpm-build.sh:304	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split into words on purpose (the shellcheck disable=SC2086 above it says so): $sys_pkgs is the script's own list of the distribution's -devel package names, one zypper argument each; none has a space or a glob character.
01c664fbb585445fcbf9	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-build.sh:483	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
22f0dfc04ab1bbb7111e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/ci/packages/rpm-build.sh:575	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 27 September 2026: split at its spaces on purpose, one name per line (the comment above says so): $suggests is CPACK_RPM_PACKAGE_SUGGESTS as CMakeLists.txt sets it ("p7zip python3"), read back from CPackConfig.cmake; it has no glob character.
84c29fb1496c08ef4a3c	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-build.sh:647	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started_all )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
0c7abac3ddc381b59360	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-build.sh:677	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started_all )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
a8342fc3837fe2bdc636	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-install-test.sh:160	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
99415c98fdaa8f1fb0f3	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-install-test.sh:245	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
a646f051d2b455baec59	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-local.sh:65	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - build_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
7be2e2da7d86904f2564	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/ci/packages/rpm-local.sh:70	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 27 September 2026: a false positive. Semgrep's bash parser reads the arithmetic expansion $(( $(date +%s) - install_started )) as a command substitution holding a subshell, and so the $(date +%s) in it as an unquoted command; it is an operand of arithmetic, inside a double-quoted echo argument, where the shell splits no words and expands no globs, and date +%s prints digits only.
0cccd5575933ed9ec295	semgrep	python.lang.security.use-defused-xml-parse.use-defused-xml-parse	build/ci/security-gate.py:396	The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to par	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml): dependency_scan() parses only DEPENDENCY_JUNIT (line 82), which the manual, protected-tag-only release job takes from the same pipeline's dependency-scan job (needs: artifacts: true); that job's junit() (build/ci/dependency-scan.py 432-448) writes it with escape/quoteattr and no DOCTYPE, so scanner text cannot add markup. ElementTree never fetches an external entity (a reference to one is an ET.ParseError), the expat in python:3.13-slim-trixie is 2.6 or later and caps entity amplification, and every ParseError or OSError is caught at line 382 and appended to problems, so a malformed or hostile file can only hold the release. The comment at the end of the line does not suppress the finding: Semgrep reads the words after 'nosemgrep:' as rule ids, and none of them is this rule's.
6ecd9fec15226efb6300	semgrep	python.lang.security.use-defused-xml-parse.use-defused-xml-parse	build/ci/trx-to-junit.py:68	The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to par
2cfad4dece081079c413	semgrep	python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5	build/db-upgrade-greylist.py:56	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.	Triaged 2 October 2026: not a defect. build/db-upgrade-greylist.py is the database-upgrade gate's fixture script, never shipped; its key() recomputes the greylisting row key the server's upgrade (PreReqGreyListKeys) backfills - the MD5 of the trimmed address with its domain folded, docs/Greylisting.md - independently, so that the gate holds the server to the documented function. The digest is that lookup key, not a signature or a password hash, and the script must compute the same one.
4e3d465c0bf12a4c3f1a	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/linux-compile-one.sh:66	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
06de25c330ba8fa5c23e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/linux-compile-one.sh:81	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
e4b3fd5ce4c4e90356d0	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/linux-tu-census.sh:193	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
eec460ad0629c51d679b	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:65	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
59f707582aaaeff47bc7	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:66	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
b38c1f3401e4903fbb73	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:67	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
5298ba3d07a6ee851122	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:68	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
9e76f21db3b5de797d27	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:96	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
78acd7a9732211a32c41	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:97	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
880e20a8d89f9909b713	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:98	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
2bda1848c4f8de624726	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:99	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
5916566fbeb09ee3142a	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:100	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
069ba70303c12620f04c	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:101	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
0448210aa7e94655ee55	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:109	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
84a9419fe43f0c2fd754	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:110	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
aa7839761fa5acb6146c	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:115	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
ae0e221e2cb68e10753b	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:116	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
70300a734a3973d5acab	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:117	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
d93a9953c73a49e1d663	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:118	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
7f43c6227aeb817e3f10	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:119	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
d47878ea62a0d51e0068	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:122	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
ef420e1704962a58870a	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:124	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
65667d5072e23ade164d	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:126	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
6cec95f4ff105d650b49	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:128	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
68dc933cb850db696496	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:130	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
92cf09f31d2bf0d16cf7	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:132	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
ca70ad2cb9bbd23f3672	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/make-openpgp-fixtures.sh:134	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
88902ff8399da6639dd9	semgrep	python.lang.security.audit.insecure-file-permissions.insecure-file-permissions	build/scan-secrets.py:240	These permissions `0o777` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyo	Triaged 26 September 2026 for the 6.3.4 release gate as a defect, fixed on batch41 and read again 27 September 2026 (.gitlab/security-exceptions.yml): The image's user, whoever it is, writes gitleaks' report into /work, so /work is 0777; work_directory() makes it with os.mkdir inside tempfile.mkdtemp's directory, which mkdtemp creates 0700 and owned by the invoking user, so no other local account can traverse to it to read the ignore file or the staged-lines stream, plant a symlink where run_docker() opens them, or put a report of its own in place of gitleaks'. Docker mounts /work by its path, which the daemon resolves itself, and run_docker() removes the private directory in its finally. remote_script() does the same on the ssh host: /work under mktemp -d, removed by the EXIT trap, and only /work is chmod 0777. The self-test holds both: the modes 0700 and 0777 on a POSIX host and the order of the steps in the ssh script. This was a real defect for 6.3.4, when the mkdtemp directory itself was 0777; batch41 fixed it (a Docker scan on linix and one over ssh from the laptop both ran to their reports), and the flagged line kept its text and so its fingerprint.
ae69f7d5b9ddd25fb168	semgrep	python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args	build/scan-secrets.py:300	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml): In run_ssh(), subprocess.run gets an argv list with no local shell. The host (line 288) and key path (line 295) come only from the invoking user's own environment, which neither git (the hooks) nor the repository sets, and whoever sets them can already set PATH for that user, so no boundary is crossed. In the script piped to 'sh -s', remote_script() single-quotes every docker argument with ' escaped as '"'"' (line 266), container_script quotes every gitleaks argument the same way (line 209) and strips quotes from the tip in the echo text (line 214), and the ignore text and staged stream arrive as base64 inside heredocs with quoted delimiters, which base64 output cannot contain.
5204c2209b47035105c1	semgrep	python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args	build/scan-secrets.py:315	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.	Triaged 26 September 2026 for the 6.3.4 release gate (.gitlab/security-exceptions.yml): In run_gitleaks(), the argv list runs without a shell. After the binary it holds only the mode ('git' or 'stdin', from scan()), constant flags, two paths inside its own mkdtemp directory, the repository path, and log_opts. log_opts is the user's own --range (main refuses a leading '-'; a later space-separated token, which gitleaks splits out, is still the same user's argument) or pre_push_ranges' ranges built from git's SHA lines and the remote name git passes the hook. HM_GITLEAKS names a program from the invoking user's own environment, exactly as PATH does for shutil.which, so it crosses no boundary.
a84f924192de08e9afff	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	build/test-autoban-hook.sh:100	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: the test's $tool is one of the loop's three words, mv, basename and awk, so command -v is given one word.
6e7b56223984ca79190b	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	build/test-autoban-hook.sh:123	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting	Triaged 3 October 2026: $(date +%s) inside an arithmetic expansion, $(( ... - started )), assigned to a variable: arithmetic is not split, and date +%s prints one number.
f7173077063b29c1764e	semgrep	bash.lang.best-practice.useless-cat.useless-cat	build/test-hmailserver-update.sh:715	Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.
519908f94b39a2c7162c	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:105	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
f594ad1602829fed4919	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:105	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
1adb4a21657f32c71a33	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:106	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
a6975408e180f3d653f5	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:106	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
281ed6bee9bd4df9d721	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:107	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
abcf7b085226c3ff8f4e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:107	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
0f622fb0607b2621f9f4	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:108	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
e7a1c81c9cbbc9e98c5e	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:108	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
46ccef06185799dfce4d	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:109	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
ca2602fd156f4f44aeaa	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:109	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
1ef5271bdb8b2e2d9c94	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:110	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
1844963ba4a5c600ad01	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:111	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
282ec5204d0229b899c0	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:113	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
d3451f745da87e6337cf	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:114	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
953d983740967e0a1c75	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:121	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
1248db994a0f609b3e58	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:122	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
56e4ce8387e80e247691	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:129	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
3f3fd6f0eefcd7f1e1c9	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:130	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
47e4fb8593e55ba1bb6c	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:134	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
de54dc548f34b26294e1	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:136	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
d1f9983ccb01e506009d	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:140	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
9c7bdb111fc32a9d38e8	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:140	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
11452a2cb2dc82e24f36	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:163	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: ipt_ensure's $1 is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
bb7f626b754e5adebec0	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:163	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: ipt_ensure's $1 is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
3af19211d6b81a26f104	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:164	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: ipt_ensure's $1 is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
e0d53bebe10e13fcc6f1	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:164	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: ipt_ensure's $1 is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
abfbc0f3c3fd8a1c76f5	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:171	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split; the address and the ports are quoted, and checked to the character before. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
826dd0e720d442ebfdbf	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:171	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split; the address and the ports are quoted, and checked to the character before. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
3fc226728aa4b6ec94ef	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:173	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split; the address and the ports are quoted, and checked to the character before. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
bab3db590019be08621b	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:174	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split; the address and the ports are quoted, and checked to the character before. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
6d2ef6edd43ca672f011	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:180	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
d51a19e2ed5d1efd9f1d	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:182	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
16772c3044fc0dba3a84	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:183	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
32d71d22d64aafe26163	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:183	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer) and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w, which moved the findings the baseline held for them.
4c8072911bbd60984f3f	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:185	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables (ipt_for's answer), and $rule the rule iptables -S printed for the address with its -A taken off, split on purpose into the words -D takes to delete that rule (SC2086 is disabled there for the same reason); the address was checked to hex digits, colons and dots before. b42-sweep4 gave the call -w, which moved the finding the baseline held for it.
eb3f738ec9eedb534361	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:192	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables, the two words ipt_reset's loop takes, and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w and the loop that removes every jump to the chain, which moved and added findings of the kind the baseline held for this function.
9f12cf760a75dc658bbb	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:196	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables, the two words ipt_reset's loop takes, and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w and the loop that removes every jump to the chain, which moved and added findings of the kind the baseline held for this function.
7d7ad2211153a067a3a8	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:197	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables, the two words ipt_reset's loop takes, and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w and the loop that removes every jump to the chain, which moved and added findings of the kind the baseline held for this function.
da791b8fc75ff17739e3	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/autoban-hook:198	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split	Triaged 3 October 2026: $ipt is iptables or ip6tables, the two words ipt_reset's loop takes, and $CHAIN the constant HMAILSERVER-AUTOBAN, each one word with no space or pattern character, so nothing is split. b42-sweep4 gave these iptables calls -w and the loop that removes every jump to the chain, which moved and added findings of the kind the baseline held for this function.
6dae17de6ee81b15a77d	semgrep	bash.lang.security.ifs-tampering.ifs-tampering	hmailserver/source/Server/platform/packaging/hmailserver-update:207	The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data.
7e3e8a6aa248d02d92b9	semgrep	bash.lang.security.ifs-tampering.ifs-tampering	hmailserver/source/Server/platform/packaging/hmailserver-update:211	The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data.
37e1701a613e81ec2c76	semgrep	bash.lang.security.ifs-tampering.ifs-tampering	hmailserver/source/Server/platform/packaging/hmailserver-update:235	The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data.
ba465b81e1bf9ece2091	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-command-substitution-in-command	hmailserver/source/Server/platform/packaging/hmailserver-update:467	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting
1bea2aa90709ca2604c6	semgrep	bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command	hmailserver/source/Server/platform/packaging/hmailserver-update:527	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split
d5406f440b0a1da74933	semgrep	python.lang.security.unverified-ssl-context.unverified-ssl-context	hmailserver/source/Tools/Cli/hmctl:339	Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.
