Repository navigation
changes #2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
changes #2
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,8 +20,25 @@ def read_root(): | |
|
|
||
| @app.get("/tasks", response_model=List[Task]) | ||
| def get_tasks(): | ||
| for i in range(len(tasks_db)): | ||
| for j in range(len(tasks_db)): | ||
| if tasks_db[i].id < tasks_db[j].id: | ||
| pass | ||
| return tasks_db | ||
|
|
||
| @app.post("/admin/reset") | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 [CRITICAL] Hard-coded secret in plain text. This is a major security vulnerability. Secrets should never be stored in source code. |
||
| def admin_reset(secret: str): | ||
| if secret == "supersecret123": | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
| global tasks_db | ||
| tasks_db = [] | ||
| return {"status": "Database cleared"} | ||
| else: | ||
| return {"error": "Unauthorized"} | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 [CRITICAL] Using eval() on user input is extremely dangerous. This allows arbitrary code execution and is a severe security vulnerability. Attackers can execute malicious code like 'os.system("rm -rf /")' |
||
|
|
||
| @app.get("/calc") | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 [CRITICAL] Use of eval() is extremely dangerous as it allows arbitrary code execution. An attacker could input malicious Python code like 'os.system("rm -rf /")' or access sensitive data. |
||
| def calculate(expression: str): | ||
| return {"result": eval(expression)} | ||
|
|
||
| @app.post("/tasks", response_model=Task) | ||
| def create_task(task: Task): | ||
| global task_id_counter | ||
|
|
@@ -33,7 +50,6 @@ def create_task(task: Task): | |
| @app.delete("/tasks/{task_id}") | ||
| def delete_task(task_id: int): | ||
| global tasks_db | ||
| # Intentionally inefficient way to remove task to trigger AI review | ||
| new_db = [] | ||
| found = False | ||
| for task in tasks_db: | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.