Push review · b41b1fd
Fix invoice search to use bound parameters
GitHub check
All clear
No verified vulnerabilities and code craft 273/300.
Points
+284ptsTotal406690
Security210455
Craft196235
What changed: Replaces the interpolated SQL in search_invoices with bound parameters; the injection introduced on day 2 is closed.Scripted demo replay
Security agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.routes.invoices:searchStart with the changed symbol.
What it found
{ "id": "app.routes.invoices:search", "kind": "function", "file": "app/routes/invoices.py", "lines": [ 18, 21 ], "params": [ "customer", "status", "user" ], "entry_point": true, "route": "GET /search", "depends_on": [ "get_current_user" ], "untrusted_inputs": [ "route_param:customer", "route_param:status" ], "dangerous_calls": [], "has_docstring": true } callers: (none) callees: app.auth:get_current_user (app/auth.py:9-15) via line 19 app.services.billing:BillingService.search_invoices (app/services/billing.py:21-27) via line 21 [tainted args]