assay
Explore

Benchmark · edition 1 · finding 13

Second order

The input is stored safely in one function and reaches the vulnerable query in another.

app/finding_b13.py · 11 attack cases · 11 benign inputs

Paste the patch back

Score it.

Copy the module and prompt below to try your fixer. You can prepare a patch now; submitting it for a score will be available when the scoring service launches.

Use the supplied test module. Do not paste private repository code or credentials.

The module

What the fixer gets.

Three steps

01Copy the module and give it to the fixer with the prompt line, exactly as written, and nothing else.
02Paste the patch it returns below, as a unified diff or as the whole patched file.
03Name the tool and its version. That is what makes the result citable.

Taking this to a fixer? so you know to come back with the patch.

Prompt · the only line the fixer is given
Semgrep reports a SQL injection vulnerability at app/finding_b13.py:54. Example payload: x' OR '1'='1. Fix it.
app/finding_b13.py · unpatched
"""Reading-list service for the lending library.

Run it with

    python finding_b13.py

and bookmark a book at  /bookmark?title=Refactoring , which stores it and shows
the most recently bookmarked book back.
"""

import os
import sqlite3

from flask import Flask, jsonify, request

DB_PATH = os.path.join(os.path.dirname(__file__), "library.db")

app = Flask(__name__)


def get_connection():
    conn = sqlite3.connect(DB_PATH)
    conn.row_factory = sqlite3.Row
    return conn


def ensure_bookmarks_table(cur):
    """Create the bookmarks table on first use."""
    cur.execute(
        "CREATE TABLE IF NOT EXISTS bookmarks "
        "(id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL)")


def remember_bookmark(title):
    """Store the chosen bookmark."""
    conn = get_connection()
    cur = conn.cursor()
    ensure_bookmarks_table(cur)
    cur.execute("INSERT INTO bookmarks (title) VALUES (?)", (title,))
    conn.commit()
    conn.close()


def show_bookmark():
    """Read the most recent bookmark back and return its book details."""
    conn = get_connection()
    cur = conn.cursor()

    row = cur.execute(
        "SELECT title FROM bookmarks ORDER BY id DESC LIMIT 1").fetchone()
    mark = row["title"] if row is not None else ""

    query = f"SELECT id, title, author, shelf, isbn FROM books WHERE title = '{mark}'"
    rows = cur.execute(query).fetchall()
    conn.close()

    results = [dict(r) for r in rows]
    return jsonify({"query_title": mark, "count": len(results), "results": results})


@app.route("/bookmark")
def bookmark():
    """Remember a book by title, then show it back.

    e.g. /bookmark?title=Refactoring
    """
    title = request.args.get("title", "")
    remember_bookmark(title)
    return show_bookmark()


@app.route("/health")
def health():
    return jsonify({"status": "ok"})


if __name__ == "__main__":
    if not os.path.exists(DB_PATH):
        import seed

        seed.build()
    app.run(host="127.0.0.1", port=5213, debug=False)

Held-out attacks · by id and class · 11 fired after the patch

booleana01, a02, a03, a04, a05
uniona06, a07, a08
schema-disclosurea09, a10, a11

Join the waitlist

A verifier that runs on every pull request, on your own repositories, is in development. Leave an address and we will tell you when it is ready.

One message when your slot opens. Nothing else, ever.