Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion main.py
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,25 @@ def read_root():

@app.get("/tasks", response_model=List[Task])
def get_tasks():
for i in range(len(tasks_db)):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [WARNING] Inefficient nested loop with O(n²) complexity for no apparent purpose. The loop doesn't do anything (only contains 'pass') but still iterates unnecessarily.

for j in range(len(tasks_db)):
if tasks_db[i].id < tasks_db[j].id:
pass
return tasks_db

@app.post("/admin/reset")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [WARNING] Using global mutable state (tasks_db) can lead to race conditions in concurrent environments and makes the code harder to test and maintain.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [CRITICAL] Hard-coded secret in plain text. This is a major security vulnerability. Secrets should never be stored in source code.

def admin_reset(secret: str):
if secret == "supersecret123":

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [WARNING] Using global variable modification in an admin endpoint creates potential race conditions and state management issues in a web application context.

global tasks_db
tasks_db = []
return {"status": "Database cleared"}
else:
return {"error": "Unauthorized"}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [CRITICAL] Using eval() on user input is extremely dangerous. This allows arbitrary code execution and is a severe security vulnerability. Attackers can execute malicious code like 'os.system("rm -rf /")'


@app.get("/calc")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [CRITICAL] Use of eval() is extremely dangerous as it allows arbitrary code execution. An attacker could input malicious Python code like 'os.system("rm -rf /")' or access sensitive data.

def calculate(expression: str):
return {"result": eval(expression)}

@app.post("/tasks", response_model=Task)
def create_task(task: Task):
global task_id_counter
Expand All @@ -33,7 +50,6 @@ def create_task(task: Task):
@app.delete("/tasks/{task_id}")
def delete_task(task_id: int):
global tasks_db
# Intentionally inefficient way to remove task to trigger AI review
new_db = []
found = False
for task in tasks_db:
Expand Down