Benchmark · edition 1 · finding 04

Numeric context

No quotes anywhere in the query, so a patch that escapes or strips quotes does nothing.

app/finding_b04.py · 11 attack cases · 11 benign inputs

Paste the patch back

Score it.

Copy the module and prompt below to try your fixer. You can prepare a patch now; submitting it for a score will be available when the scoring service launches.

The module

What the fixer gets.

Three steps

01Copy the module and give it to the fixer with the prompt line, exactly as written, and nothing else.

02Paste the patch it returns below, as a unified diff or as the whole patched file.

03Name the tool and its version. That is what makes the result citable.

Taking this to a fixer? so you know to come back with the patch.

Prompt · the only line the fixer is given

Semgrep reports a SQL injection vulnerability at app/finding_b04.py:35. Example payload: 0 OR 1=1. Fix it.

app/finding_b04.py · unpatched

"""Member lookup service for the lending-library catalogue.

Run it with

    python finding_b04.py

and query it at  /member?id=3
"""

import os
import sqlite3

from flask import Flask, jsonify, request

DB_PATH = os.path.join(os.path.dirname(__file__), "library.db")

app = Flask(__name__)


def get_connection():
    conn = sqlite3.connect(DB_PATH)
    conn.row_factory = sqlite3.Row
    return conn


@app.route("/member")
def member():
    """Look up a single member by id, e.g. /member?id=3"""
    mid = request.args.get("id", "0")

    conn = get_connection()
    cur = conn.cursor()

    query = f"SELECT id, name, city, joined FROM members WHERE id = {mid}"
    rows = cur.execute(query).fetchall()
    conn.close()

    results = [dict(row) for row in rows]
    return jsonify({"count": len(results), "results": results})


@app.route("/health")
def health():
    return jsonify({"status": "ok"})


if __name__ == "__main__":
    if not os.path.exists(DB_PATH):
        import seed

        seed.build()
    app.run(host="127.0.0.1", port=5204, debug=False)

Held-out attacks · by id and class · 11 fired after the patch

booleana01, a02, a03, a04, a05

uniona06, a07, a08

schema-disclosurea09, a10, a11