Push review · 559e88e
Serve uploaded invoice attachments
GitHub check
All clear
No verified vulnerabilities and code craft 291/300.
Points
+9ptsTotal972981
Security700700
Craft272281
What changed: Adds GET /files/uploads/{filename}. The static rule flagged os.path.join with a caller-controlled name in storage.read_attachment.Scripted demo replay
Security agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.routes.files:download_uploadStart with the changed symbol.
What it found
{ "id": "app.routes.files:download_upload", "kind": "function", "file": "app/routes/files.py", "lines": [ 20, 25 ], "params": [ "filename", "user" ], "entry_point": true, "route": "GET /uploads/{filename}", "depends_on": [ "get_current_user" ], "untrusted_inputs": [ "route_param:filename" ], "dangerous_calls": [], "has_docstring": true } callers: (none) callees: app.auth:get_current_user (app/auth.py:9-15) via line 20 app.services.storage:read_attachment (app/services/storage.py:18-21) [sinks=file@L20(tainted)] via line 24 [tainted args]