test(fixture): intentionally vulnerable app for advisory-scanning pipeline [DO NOT MERGE] - #23
test(fixture): intentionally vulnerable app for advisory-scanning pipeline [DO NOT MERGE]#23matheusht wants to merge 3 commits into
Conversation
…ersions Intentionally vulnerable test fixture for the advisory-scanning pipeline. Pins PyYAML 5.3.1, Jinja2 2.10, requests 2.19.1, urllib3 1.24.1, Flask 0.12.2, Pillow 8.1.0 and cryptography 3.3.2 — each has a published GHSA — plus lodash/minimist/axios/handlebars on the npm side. Not installed by the project and not on any runtime path.
Plants SQL injection, OS command injection, unsafe yaml.load and pickle deserialization, SSTI, path traversal, SSRF, disabled TLS verification, MD5 password hashing and hardcoded credentials so code scanning has deterministic findings to report. Each weakness is annotated inline with the secure approach that the real implementation would use.
Runs on push/PR to main so the vulnerable fixture produces code-scanning alerts. Analysis only — it never opens pull requests.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| conn = sqlite3.connect("users.db") | ||
| cur = conn.cursor() | ||
| query = f"SELECT id, email FROM users WHERE username = '{username}'" # noqa: S608 | ||
| cur.execute(query) |
| validate ``host`` against a strict allowlist or an IP/hostname regex first. | ||
| """ | ||
| host = request.args.get("host", "127.0.0.1") | ||
| output = subprocess.check_output(f"ping -c 1 {host}", shell=True) |
| tags, and validate the resulting dict against a schema (pydantic) before | ||
| using any of it. | ||
| """ | ||
| return {"config": yaml.load(request.data)} |
| tags, and validate the resulting dict against a schema (pydantic) before | ||
| using any of it. | ||
| """ | ||
| return {"config": yaml.load(request.data)} |
| JSON, and if the payload must be trusted across a boundary, sign it | ||
| (HMAC-SHA256) and verify the signature before parsing. | ||
| """ | ||
| return {"session": str(pickle.loads(request.data))} |
| before the request goes out. | ||
| """ | ||
| url = request.args.get("url", "") | ||
| resp = requests.get(url, verify=False, timeout=10) |
| before the request goes out. | ||
| """ | ||
| url = request.args.get("url", "") | ||
| resp = requests.get(url, verify=False, timeout=10) |
| """ | ||
| url = request.args.get("url", "") | ||
| resp = requests.get(url, verify=False, timeout=10) | ||
| return {"body": resp.text[:500]} |
| MD5 is both broken for collision resistance and far too fast to resist | ||
| offline cracking. | ||
| """ | ||
| return hashlib.md5(password.encode()).hexdigest() # noqa: S324 |
| # SECURE APPROACH: bind 127.0.0.1 behind a reverse proxy, debug off, and | ||
| # serve through a production WSGI server (gunicorn/uvicorn) rather than | ||
| # Werkzeug's development server. | ||
| app.run(host="0.0.0.0", port=5000, debug=True) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0ad5900a28
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Opening this branch as a PR should produce Dependabot alerts for the manifests | ||
| above and code-scanning alerts for `app.py`. The follow-up "fix" PR reverses |
There was a problem hiding this comment.
Dependabot generates repository alerts from manifests on the default branch, not from manifests added only on a pull-request branch. Therefore, opening this fixture as the promised do-not-merge PR will produce the CodeQL results but not the Dependabot alerts needed for the advisory-to-commit experiment. Use a dependency-review/advisory scan that runs against the PR contents, or test the Dependabot portion in a disposable repository where the fixture can become the default branch.
Useful? React with 👍 / 👎.
| Every file here is deliberately insecure. It is not imported by `src/redthread`, | ||
| is not on any runtime path, and must never be packaged, deployed, or executed | ||
| outside a throwaway sandbox. |
There was a problem hiding this comment.
When a source distribution is built, Hatch includes tracked repository files by default because the project only restricts the wheel target and has no sdist exclusion. As a result, release builds can contain this executable vulnerable app and its deliberately vulnerable manifests despite the stated packaging boundary. Add an explicit Hatch sdist exclusion for fixtures/vulnerable-app/.
Useful? React with 👍 / 👎.
2 participants
Test fixture for the GitHub Advisory Database scanning pipeline. Everything
added here lives under
fixtures/vulnerable-app/, is not imported bysrc/redthread, and is not on any runtime path.What this PR plants
Dependency advisories (
requirements.txt,package.json) — pins chosen soeach maps to a published GHSA:
Source-level weaknesses (
app.py) — SQL injection, OS command injection,unsafe
yaml.loadandpickle.loads, SSTI, path traversal, SSRF,verify=False, MD5 password hashing, hardcoded credentials,debug=Trueon0.0.0.0. Each is annotated inline with the secure approach..github/workflows/codeql.yml— so the above actually producescode-scanning alerts. Analysis only; it never opens PRs.
Commit layout
Split into three commits so the introducing commit for each class of finding is
individually addressable when testing advisory → commit correlation:
130afd3dependency manifests138b297vulnerable application code0ad5900CodeQL workflowExisting CI
Unaffected — CI lints
src/and teststests/, neither of which this touches.Notes
Dependabot version-update PRs would need a
.github/dependabot.yml;deliberately left out here to avoid a burst of automated PRs. Easy to add if
you want fixing-PR signal to correlate against.
introducing-commit / fixing-commit pair.