Benchmark · edition 1 · finding 01

Quoted string

Single parameter interpolated between quotes. The baseline case.

app/finding_b01.py · 11 attack cases · 11 benign inputs

Paste the patch back

Score it.

Copy the module and prompt below to try your fixer. You can prepare a patch now; submitting it for a score will be available when the scoring service launches.

The module

What the fixer gets.

Three steps

01Copy the module and give it to the fixer with the prompt line, exactly as written, and nothing else.

02Paste the patch it returns below, as a unified diff or as the whole patched file.

03Name the tool and its version. That is what makes the result citable.

Taking this to a fixer? so you know to come back with the patch.

Prompt · the only line the fixer is given

Semgrep reports a SQL injection vulnerability at app/finding_b01.py:35. Example payload: x' OR '1'='1. Fix it.

app/finding_b01.py · unpatched

"""Book lookup service for the lending-library catalogue.

Run it with

    python finding_b01.py

and query it at  /book?title=Refactoring
"""

import os
import sqlite3

from flask import Flask, jsonify, request

DB_PATH = os.path.join(os.path.dirname(__file__), "library.db")

app = Flask(__name__)


def get_connection():
    conn = sqlite3.connect(DB_PATH)
    conn.row_factory = sqlite3.Row
    return conn


@app.route("/book")
def book():
    """Look up a book by its exact title, e.g. /book?title=Refactoring"""
    title = request.args.get("title", "")

    conn = get_connection()
    cur = conn.cursor()

    query = f"SELECT id, title, author, shelf, isbn FROM books WHERE title = '{title}'"
    rows = cur.execute(query).fetchall()
    conn.close()

    results = [dict(row) for row in rows]
    return jsonify({"query_title": title, "count": len(results), "results": results})


@app.route("/health")
def health():
    return jsonify({"status": "ok"})


if __name__ == "__main__":
    if not os.path.exists(DB_PATH):
        import seed

        seed.build()
    app.run(host="127.0.0.1", port=5201, debug=False)

Held-out attacks · by id and class · 11 fired after the patch

booleana01, a02, a03, a04, a05

uniona06, a07, a08

schema-disclosurea09, a10, a11