Conversation
Mayhem for API Automated API Testing Report❗ 3 Errors Found
✔️ 🎆 0 Warnings FoundTesting details and issue reproduction found at https://app.mayhem.security/forallsecure-demo/mapi-action-examples/fastapi/276 |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @app.get("/login") | ||
| async def login(email: str, password: str): | ||
| cur = con.cursor() | ||
| cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password)) |
Check failure
Code scanning / mAPI
Internal Server Error (sqlite3.Warning)
| @app.get("/login") | ||
| async def login(email: str, password: str): | ||
| cur = con.cursor() | ||
| cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password)) |
Check failure
Code scanning / mAPI
Internal Server Error (ValueError)
| @app.get("/login") | ||
| async def login(email: str, password: str): | ||
| cur = con.cursor() | ||
| cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password)) |
Check failure
Code scanning / mAPI
Internal Server Error (sqlite3.OperationalError)
| @app.get("/login") | ||
| async def login(email: str, password: str): | ||
| cur = con.cursor() | ||
| cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password)) |
Check failure
Code scanning / mAPI
Internal Server Error (sqlite3.OperationalError)
| @app.get("/login") | ||
| async def login(email: str, password: str): | ||
| cur = con.cursor() | ||
| cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password)) |
Check failure
Code scanning / mAPI
Internal Server Error (ValueError)
| @app.get("/login") | ||
| async def login(email: str, password: str): | ||
| cur = con.cursor() | ||
| cur.execute("SELECT * FROM users WHERE email = '%s' and password = '%s'" % (email, password)) |
Check failure
Code scanning / mAPI
Internal Server Error (sqlite3.Warning)
vlussenburg
force-pushed
the
bad-login-endpoint
branch
from
bb780ed to
69a1cdc
Compare
vlussenburg
force-pushed
the
bad-login-endpoint
branch
from
d89ff4a to
13afeba
Compare
vlussenburg
force-pushed
the
bad-login-endpoint
branch
3 times, most recently
from
0c8cfbb to
f9014dd
Compare
vlussenburg
force-pushed
the
bad-login-endpoint
branch
4 times, most recently
from
863be11 to
b3f647d
Compare
vlussenburg
force-pushed
the
bad-login-endpoint
branch
2 times, most recently
from
44168ec to
c7ad466
Compare
vlussenburg
force-pushed
the
bad-login-endpoint
branch
from
dd2fb53 to
c7ad466
Compare
vlussenburg
force-pushed
the
bad-login-endpoint
branch
from
c7ad466 to
cd4a8e2
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2 +/- ##
==========================================
- Coverage 69.23% 59.52% -9.71%
==========================================
Files 2 2
Lines 26 42 +16
==========================================
+ Hits 18 25 +7
- Misses 8 17 +9
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
4 participants
This PR introduces a SQL Injection and a Path Traversal in new login, logout and attachments endpoints, which Mayhem for API detects, preventing the PR from being merged.