Test/sast autofix validation py

scripts/user_lookup.py

@@ -0,0 +1,31 @@
+import sqlite3
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+def get_db():
+    conn = sqlite3.connect("signatures.db")
+    conn.row_factory = sqlite3.Row
+    return conn
+
+
+@app.route("/users")
+def lookup_user():
+    name = request.args.get("name", "")
+    role = request.args.get("role", "user")
+
+    conn = get_db()
+    cursor = conn.cursor()
+
+    query = "SELECT id, name, email, role FROM users WHERE name LIKE '%" + name + "%' AND role = '" + role + "'"
+    cursor.execute(query)
+
+    rows = cursor.fetchall()
+    conn.close()
+
+    return jsonify([dict(r) for r in rows])
+
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=5000)

src/jarno.ts

@@ -0,0 +1,66 @@
+// file: userRoutes.js
+
+// Line 10 - helper that builds the vulnerable query
+function buildUserQuery(userId) {
+    // Vulnerable: string interpolation of untrusted input
+    return `SELECT * FROM users WHERE id = ${userId}`;
+  }
+
+  // Line 16 - some unrelated utility code to push the fix further away
+  function logRequest(req) {
+    console.log(`[${new Date().toISOString()}] ${req.method} ${req.url}`);
+  }
+
+  function checkAuth(req) {
+    // placeholder for auth logic
+    return !!req.headers['x-api-key'];
+  }
+
+  function notFound(res) {
+    res.status(404).send('Not found');
+  }
+
+  function badRequest(res, message) {
+    res.status(400).send(message || 'Bad request');
+  }
+
+  // Many more unrelated helpers...
+  function trackMetric(name, value) {
+    console.log(`metric: ${name}=${value}`);
+  }
+
+  function sanitizeOutput(user) {
+    // pretend this is doing something complex
+    const { password, ...safeUser } = user;
+    return safeUser;
+  }
+
+  // Line ~50 – main Express route where SAST reports the issue
+  async function registerUserRoutes(app, db) {
+    app.get('/user', async (req, res) => {
+      logRequest(req);
+      trackMetric('user_route_hit', 1);
+
+      const userId = req.query.userId;
+      if (!userId) {
+        return badRequest(res, 'Missing userId');
+      }
+
+      // Line ~65 - SAST flags data flow here (sink)
+      const query = buildUserQuery(userId);
+      try {
+        const result = await db.query(query); // SAST points to this call / this line
+        if (!result.rows[0]) {
+          return notFound(res);
+        }
+
+        const safeUser = sanitizeOutput(result.rows[0]);
+        res.json(safeUser);
+      } catch (err) {
+        console.error('DB error', err);
+        res.status(500).send('Internal server error');
+      }
+    });
+  }
+
+  module.exports = { registerUserRoutes };

src/sast.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getPagesData } from "../../../utils/fetchingFunctions";
+import { DEFAULT_LOCALE } from "../../../utils/localization";
+import { draftMode } from "next/headers";
+import { redirect } from "next/navigation";
+
+const PREVIEW_SECRET = "preview";
+
+export async function GET(req: NextRequest) {
+  const secret = req.nextUrl.searchParams.get("secret");
+
+  if (secret !== PREVIEW_SECRET) {
+    return NextResponse.json({ error: "Invalid token" }, { status: 401 });
+  }
+
+  const slugFromParams = req.nextUrl.searchParams.get("slug");
+  const slug = slugFromParams
+    ? Array.isArray(slugFromParams)
+      ? slugFromParams[0]
+      : slugFromParams
+    : "";
+
+  const localeFromParams = req.nextUrl.searchParams.get("locale");
+  const locale = localeFromParams
+    ? Array.isArray(localeFromParams)
+      ? localeFromParams[0]
+      : localeFromParams
+    : DEFAULT_LOCALE;
+
+  const pageData = await getPagesData(slug, true, locale);
+
+  if (!pageData) {
+    return NextResponse.json({ message: "Invalid slug" }, { status: 401 });
+  }
+
+  draftMode().enable();
+  redirect(`/${locale}/${slug}`);
+}