add pillar #13
add pillar #13
Conversation
src/latio/core.py
Outdated
| googleapikey = os.environ.get('GEMINI_API_KEY') | ||
|
|
||
| genai.configure(api_key=googleapikey) | ||
| pillar = Pillar( |
There was a problem hiding this comment.
This is not required for this kind of implementation - since you use the /v0/sessions API.
We are working on an updated SDK version that will simplify the integration, but for now, you can use the logic implemented in guardrails.py module.
Co-authored-by: guygr99 <165662976+guygr99@users.noreply.github.com>
![arnica-github-connector[bot]](https://avatars.githubusercontent.com/in/144692?s=60&v=4){kind=small}
| username = data.get('username', '') | ||
| password = data.get('password', '') | ||
|
|
||
| query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'" |
There was a problem hiding this comment.
Static Code Analysis Risk: Injection - Tainted SQL string
Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.
Severity: Medium
Status: Open 🔴
References:
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
- https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column
Suggested reviewers 🧐: @confusedcrib
Details
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
[arnica] ack <message>
Acknowledge the finding as a valid code risk.
Examples
[arnica] ack looking into it
[a] ack triaged by the security team
[arnica] dismiss <fp|accept|capacity> <message>
Dismiss the risk with a reason.
-
fp: False positive, i.e. the result is incorrect and indicates no actual risk. -
accept: Tolerable risk, i.e. risk severity is lower than what has been reported or is accepted as it stands. -
capacity: No capacity, i.e. leave me alone, please.
Examples
[arnica] dismiss fp test function
[arnica] dismiss accept ChatGPT assures us that we will be just fine
[a] dismiss capacity not enough caffeine to fix it
| def get_user(): | ||
| username = request.args.get('username', '') | ||
|
|
||
| query = "SELECT * FROM users WHERE username = '" + username + "'" |
There was a problem hiding this comment.
Static Code Analysis Risk: Injection - Tainted SQL string
Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.
Severity: Medium
Status: Open 🔴
References:
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
- https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column
Suggested reviewers 🧐: @confusedcrib
Details
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
[arnica] ack <message>
Acknowledge the finding as a valid code risk.
Examples
[arnica] ack looking into it
[a] ack triaged by the security team
[arnica] dismiss <fp|accept|capacity> <message>
Dismiss the risk with a reason.
-
fp: False positive, i.e. the result is incorrect and indicates no actual risk. -
accept: Tolerable risk, i.e. risk severity is lower than what has been reported or is accepted as it stands. -
capacity: No capacity, i.e. leave me alone, please.
Examples
[arnica] dismiss fp test function
[arnica] dismiss accept ChatGPT assures us that we will be just fine
[a] dismiss capacity not enough caffeine to fix it
|
|
||
| if __name__ == '__main__': | ||
| init_db() | ||
| app.run(debug=True, host='0.0.0.0', port=5000) No newline at end of file |
There was a problem hiding this comment.
Static Code Analysis Risk: Security Misconfiguration - Debug enabled
Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.
Severity: High 🚨
Status: Open 🔴
References:
Suggested reviewers 🧐: @confusedcrib
Details
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
[arnica] ack <message>
Acknowledge the finding as a valid code risk.
Examples
[arnica] ack looking into it
[a] ack triaged by the security team
[arnica] dismiss <fp|accept|capacity> <message>
Dismiss the risk with a reason.
-
fp: False positive, i.e. the result is incorrect and indicates no actual risk. -
accept: Tolerable risk, i.e. risk severity is lower than what has been reported or is accepted as it stands. -
capacity: No capacity, i.e. leave me alone, please.
Examples
[arnica] dismiss fp test function
[arnica] dismiss accept ChatGPT assures us that we will be just fine
[a] dismiss capacity not enough caffeine to fix it
|
|
||
| if __name__ == '__main__': | ||
| init_db() | ||
| app.run(debug=True, host='0.0.0.0', port=5000) No newline at end of file |
There was a problem hiding this comment.
Static Code Analysis Risk: Broken Access Control - Avoid app run with bad host
Running flask app with host 0.0.0.0 could expose the server publicly.
Severity: High 🚨
Status: Open 🔴
References:
Suggested reviewers 🧐: @confusedcrib
Details
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
[arnica] ack <message>
Acknowledge the finding as a valid code risk.
Examples
[arnica] ack looking into it
[a] ack triaged by the security team
[arnica] dismiss <fp|accept|capacity> <message>
Dismiss the risk with a reason.
-
fp: False positive, i.e. the result is incorrect and indicates no actual risk. -
accept: Tolerable risk, i.e. risk severity is lower than what has been reported or is accepted as it stands. -
capacity: No capacity, i.e. leave me alone, please.
Examples
[arnica] dismiss fp test function
[arnica] dismiss accept ChatGPT assures us that we will be just fine
[a] dismiss capacity not enough caffeine to fix it
No description provided.