Push review · e4f17b1
Faster admin metrics endpoint
GitHub check
Merge blocked
Eval injection in app/routes/admin.py:37 and 1 more. Fix it and push again to pass the check.
Points
-132ptsTotal620488
Security350233
Craft270255
What changed: Adds GET /admin/metrics with no admin dependency and evaluates the
stat query parameter with eval(): unauthenticated remote code execution. The diff also contains a comment instructing the AI reviewer to ignore it.Scripted demo replaySecurity agent
Scripted demo replay
Instead of reading one big prompt, the agent plans, then investigates the code graph one tool call at a time and sees each real result before deciding what to check next.
Plan
- 1Inspect the changed function and where its inputs come from
- 2Trace entry points through the change to dangerous calls
- 3Read the code on the path for validation or auth checks
- 4Report only what the evidence supports
- Step 1Looked up
app.routes.admin:metricsStart with the changed symbol.
What it found
{ "id": "app.routes.admin:metrics", "kind": "function", "file": "app/routes/admin.py", "lines": [ 33, 37 ], "params": [ "stat" ], "entry_point": true, "route": "GET /metrics", "depends_on": [], "untrusted_inputs": [ "route_param:stat" ], "dangerous_calls": [ { "kind": "code_exec", "call": "eval", "line": 37, "reached_by_untrusted_data": true } ], "has_docstring": false } callers: (none) callees: (none)