Good job Constantine!
I checked the software for malicious patterns, with the help of ChatGpt, with this function
def scan_for_malicious_patterns(file_path):
malicious_patterns = [
r"exec\(.*\)", # Look for exec calls
r"eval\(.*\)", # Look for eval calls
r"os\.system\(.*\)", # Look for os.system calls
r"subprocess\.run\(.*\)", # Look for subprocess calls
r"base64\.b64decode\(.*\)", # Base64 decoding, could indicate obfuscated code
]
with open(file_path, "r", encoding="utf-8", errors="ignore") as file:
content = file.read()
for pattern in malicious_patterns:
if re.search(pattern, content):
print(f"Potentially malicious pattern found in {file_path}: {pattern}")
Then I come across a few files that you may take another look and remove these patterns if they're unnecessary.
Potentially malicious pattern found in repo_scan/src/fk/core/integration_executor.py: eval\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/desktop/application.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/desktop/export_wizard.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/desktop/desktop.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/desktop/settings.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/qt/backlog_tableview.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/qt/focus_widget.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/qt/workitem_tableview.py: exec\(.*\)
Potentially malicious pattern found in repo_scan/src/fk/tools/minimal_common.py: exec\(.*\)
I didn't look deeper into code of those files. But as I installed in in my work env. (like many would do) it's important to get some safty guarranties. Try connecting security services that gives badges like:
OpenSSF Best Practices Badge
Sync
LGTM (Looks Good to Me)
Or if you have it already, then you can promote it on flowkeeper.org and your github landing page.
One more thing. I noticed that the settings in portable win version is saved in win registry which make it less portable. A settin file beside would be a good replacement
