{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "magdox", "version": "1.3.2", "informationUri": "https://magdox.io/", "rules": [ { "id": "CWE-306", "name": "CWE-306", "shortDescription": { "text": "CWE-306 security finding" }, "fullDescription": { "text": "Public security classification; each result carries its own evidence and actionable guidance." }, "help": { "text": "Review each result's message and properties for its remediation and analysis limitations." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe/cwe-306" ] } }, { "id": "CWE-89", "name": "CWE-89", "shortDescription": { "text": "CWE-89 security finding" }, "fullDescription": { "text": "Public security classification; each result carries its own evidence and actionable guidance." }, "help": { "text": "Review each result's message and properties for its remediation and analysis limitations." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe/cwe-89" ] } }, { "id": "CWE-328", "name": "CWE-328", "shortDescription": { "text": "CWE-328 security finding" }, "fullDescription": { "text": "Public security classification; each result carries its own evidence and actionable guidance." }, "help": { "text": "Review each result's message and properties for its remediation and analysis limitations." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe/cwe-328" ] } }, { "id": "CWE-494", "name": "CWE-494", "shortDescription": { "text": "CWE-494 security finding" }, "fullDescription": { "text": "Public security classification; each result carries its own evidence and actionable guidance." }, "help": { "text": "Review each result's message and properties for its remediation and analysis limitations." }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe/cwe-494" ] } } ] } }, "results": [ { "ruleId": "CWE-306", "ruleIndex": 0, "level": "error", "message": { "text": "REVIEW: View lacks an authentication requirement\n\nREVIEW: This view has no authentication applied at the view. Global middleware, URL wrappers or handler helpers may still protect it. Confirm the actual route and object or function permissions before confirming anonymous access.\n\nHow to fix: Protect the view with an authentication decorator such as flask_login's @login_required (or Django's login_required), then check that the signed-in user may access the specific record.\n\nWhat this rule cannot determine: Static analysis is not proof of exploitability. Validate the affected control and runtime behavior." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "app.py" }, "region": { "startLine": 16, "endLine": 20, "startColumn": 1 } } } ], "partialFingerprints": { "magdoxFingerprint/v1": "sha256:dbc1924bc2eb8c823dff89294261c3a105cd7789eaa420acca63d29d31c3a661" }, "properties": { "magdox:confidence": "low", "magdox:limits": "Static analysis is not proof of exploitability. Validate the affected control and runtime behavior.", "magdox:remediation": "Protect the view with an authentication decorator such as flask_login's @login_required (or Django's login_required), then check that the signed-in user may access the specific record.", "magdox:severity": "high", "magdox:title": "REVIEW: View lacks an authentication requirement", "tags": [ "security", "external/cwe/cwe-306", "external/cwe/cwe-862", "external/owasp/A01:2021" ] } }, { "ruleId": "CWE-306", "ruleIndex": 0, "level": "error", "message": { "text": "REVIEW: FastAPI route lacks an authentication dependency\n\nREVIEW: This route declares no authentication dependency. Application or router dependencies, middleware and checks in the handler may still enforce access. Verify effective registration and permissions before confirming forced browsing or authorisation bypass.\n\nHow to fix: Declare an authentication dependency on the route (viewer = Depends(current_user)) or on the APIRouter, and use the authenticated identity to scope the data returned.\n\nWhat this rule cannot determine: Static analysis is not proof of exploitability. Validate the affected control and runtime behavior." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "app.py" }, "region": { "startLine": 16, "endLine": 20, "startColumn": 1 } } } ], "partialFingerprints": { "magdoxFingerprint/v1": "sha256:728ed3927b77bbf90c9dc4e9bc1ae375b781c21ada95032c26baeedcffd9ad5f" }, "properties": { "magdox:confidence": "low", "magdox:limits": "Static analysis is not proof of exploitability. Validate the affected control and runtime behavior.", "magdox:remediation": "Declare an authentication dependency on the route (viewer = Depends(current_user)) or on the APIRouter, and use the authenticated identity to scope the data returned.", "magdox:severity": "high", "magdox:title": "REVIEW: FastAPI route lacks an authentication dependency", "tags": [ "security", "external/cwe/cwe-306", "external/owasp/A01:2021" ] } }, { "ruleId": "CWE-89", "ruleIndex": 1, "level": "error", "message": { "text": "SQL query built from untrusted input\n\nA SQL statement is assembled with string concatenation, formatting or an f-string from data that reaches the function untrusted. The database receives attacker-controlled syntax rather than data.\n\nHow to fix: Pass request values to the database as bound parameters, for example cursor.execute(\"SELECT * FROM orders WHERE id = %s\", (order_id,)), and never format them into the SQL string." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "app.py" }, "region": { "startLine": 19, "startColumn": 12 } } } ], "codeFlows": [ { "threadFlows": [ { "locations": [ { "location": { "physicalLocation": { "artifactLocation": { "uri": "app.py" }, "region": { "startLine": 18 } }, "message": { "text": "untrusted input" } } }, { "location": { "physicalLocation": { "artifactLocation": { "uri": "app.py" }, "region": { "startLine": 19 } }, "message": { "text": "reaches" } } } ] } ] } ], "partialFingerprints": { "magdoxFingerprint/v1": "sha256:5428c3e8e9c5121ec6a3829849ea58582a8fe09961fceb593bef5a84ce058e02" }, "properties": { "magdox:confidence": "medium", "magdox:remediation": "Pass request values to the database as bound parameters, for example cursor.execute(\"SELECT * FROM orders WHERE id = %s\", (order_id,)), and never format them into the SQL string.", "magdox:severity": "critical", "magdox:title": "SQL query built from untrusted input", "tags": [ "security", "external/cwe/cwe-89", "external/owasp/A03:2021" ] } }, { "ruleId": "CWE-328", "ruleIndex": 2, "level": "warning", "message": { "text": "MD5 or SHA-1 used where a collision-resistant hash is expected\n\nhashlib.md5, hashlib.sha1, hashlib.new('md5'|'sha1'), PyCryptodome MD5/SHA1 or cryptography's hashes.MD5/SHA1 are used without marking the call as non-security. Both algorithms have practical collision attacks: a digest used to identify, sign, deduplicate or protect sensitive data can be forged or matched by an attacker.\n\nHow to fix: Use SHA-256 or stronger (hashlib.sha256, hashlib.blake2b). For passwords use a password hashing function (argon2, scrypt, bcrypt, PBKDF2). Where MD5 or SHA-1 is required for a non-security checksum, pass usedforsecurity=False so the intent is explicit." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "app.py" }, "region": { "startLine": 26, "startColumn": 32 } } } ], "partialFingerprints": { "magdoxFingerprint/v1": "sha256:3c4329c8fac0a21dfe8a5ca4854d8cfebbae1782632af08a94f76a9dd6e34ca8" }, "properties": { "magdox:confidence": "medium", "magdox:remediation": "Use SHA-256 or stronger (hashlib.sha256, hashlib.blake2b). For passwords use a password hashing function (argon2, scrypt, bcrypt, PBKDF2). Where MD5 or SHA-1 is required for a non-security checksum, pass usedforsecurity=False so the intent is explicit.", "magdox:severity": "medium", "magdox:title": "MD5 or SHA-1 used where a collision-resistant hash is expected", "tags": [ "security", "external/cwe/cwe-328", "external/cwe/cwe-327", "external/owasp/A02:2021" ] } }, { "ruleId": "CWE-494", "ruleIndex": 3, "level": "warning", "message": { "text": "Pinned requirement without a hash\n\nThe requirement is pinned to a version but carries no --hash, so pip will install whatever the index serves under that version rather than the artefact that was reviewed.\n\nHow to fix: Record a hash for every pinned requirement and install with --require-hashes, so pip installs exactly the reviewed artefacts." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "requirements.txt" }, "region": { "startLine": 1, "startColumn": 1 } } } ], "partialFingerprints": { "magdoxFingerprint/v1": "sha256:ced7670289fff0791da8749d2cb53e967342689b0f4857bf4c538318529ec157" }, "properties": { "magdox:confidence": "medium", "magdox:remediation": "Record a hash for every pinned requirement and install with --require-hashes, so pip installs exactly the reviewed artefacts.", "magdox:severity": "medium", "magdox:title": "Pinned requirement without a hash", "tags": [ "security", "external/cwe/cwe-494", "external/owasp/A08:2021" ] } } ], "invocations": [ { "executionSuccessful": true, "properties": { "magdox:failures": null, "magdox:filesFailed": 0, "magdox:filesScanned": 4, "magdox:filesSkipped": 0, "magdox:rulesRun": 935, "magdox:rulesUnsupportedCount": 0 } } ], "properties": { "magdox:snippetsIncluded": false } } ] }