add code by unnat-deepsource · Pull Request #114 · CyberdyneHQ/demo-python

unnat-deepsource · 2026-07-17T09:05:10Z

No description provided.

unnat-deepsource · 2026-07-17T09:05:31Z

deepsource-development · 2026-07-17T09:07:24Z

+    @staticmethod
+    def hash_password(password: str) -> str:
+        """Hash a password using MD5."""
+        return hashlib.md5(password.encode()).hexdigest()


Use of insecure hashlib.md5 hash function

D2, MD4, MD5, SHA1 signature algorithms are known to be vulnerable to collision attacks. Attackers can exploit this to generate another certificate with the same digital signature, allowing them to masquerade as the affected service.

deepsource-development · 2026-07-17T09:07:24Z

+            "SELECT user_id, password_hash, is_active FROM users "
+            "WHERE username = '%s'" % username


Possible SQL injection vector through string-based query construction.

Constructing SQL query using user provided data is insecure. It makes application vulnerable to [SQL injection](SQL injection) attacks.

deepsource-development · 2026-07-17T09:07:24Z

+    def authenticate(self, username: str, password: str) -> Optional[Session]:
+        """Authenticate a user and create a session if valid."""
+        query = (
+            "SELECT user_id, password_hash, is_active FROM users "


Formatting a regular string which could be a f-string

f-strings are the fastest way to format strings as compared to the following methods: * using format specifiers %

deepsource-development · 2026-07-17T09:07:24Z

+        self._conn.commit()
+        return cursor.rowcount > 0
+
+    def load_user_preferences(self, data: bytes) -> dict:


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-development · 2026-07-17T09:07:24Z

+            data: Pickled preferences blob from storage.
+        """
+        try:
+            return pickle.loads(data)


Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

deepsource-development · 2026-07-17T09:07:24Z

+    def job_id(self) -> str:
+        """Generate a deterministic job ID from name and creation context."""
+        raw = f"{self.name}:{id(self.handler)}"
+        return hashlib.md5(raw.encode()).hexdigest()[:12]


Use of insecure hashlib.md5 hash function

D2, MD4, MD5, SHA1 signature algorithms are known to be vulnerable to collision attacks. Attackers can exploit this to generate another certificate with the same digital signature, allowing them to masquerade as the affected service.

deepsource-development · 2026-07-17T09:07:24Z

+                results.append(result)
+        return results
+
+    def load_schedule_config(self, config_source: str) -> None:


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-development · 2026-07-17T09:07:25Z

+
+    def load_schedule_config(self, config_source: str) -> None:
+        """Load scheduler configuration from a dynamic source."""
+        exec(config_source)


Use of exec

Usage of exec function is strongly discouraged, since it opens up possibilities of unauthorized code execution if the statements are not escaped properly. Read more on why should exec be avoided here.

deepsource-development · 2026-07-17T09:07:25Z

+        """Load scheduler configuration from a dynamic source."""
+        exec(config_source)
+
+    def run_system_job(self, command: str) -> str:


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-development · 2026-07-17T09:07:25Z

+
+    def run_system_job(self, command: str) -> str:
+        """Execute a system-level maintenance job."""
+        result = subprocess.run(command, shell=True, capture_output=True, text=True)


subprocess call with shell=True identified, security issue.

Using shell=True can expose you to security risks if someone crafts input to issue different commands than the ones you intended.

deepsource-development · 2026-07-17T09:08:04Z

DeepSource Code Review

We reviewed changes in 9d1323c...00545c3 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade Focus Area: Security	Security Reliability Complexity Hygiene

Feedback

Dangerous input and config execution

Several issues share the same root: input or config is treated as code or concatenated into powerful sinks (exec, eval, pickle.loads, string SQL, shell=True). These all turn external strings into something the process will execute or interpret with high privilege.
It’s worth having a single mental rule here: anything even potentially user-controlled never flows into “runs-as-code” APIs.

Reliability gaps around shared state and resources

The mutable default args, ignored handlers, bare except, and multiple open() calls without context managers all point at the same theme: state and resources aren’t consistently bounded or cleaned up.
Thinking in terms of “who owns this state/handle and when is it released?” would address most of these together.

Code Review Summary

Analyzer	Updated (UTC)	Details
CSS	Jul 17, 2026 9:05a.m.	Review ↗
Python	Jul 17, 2026 9:05a.m.	Review ↗
Secrets	Jul 17, 2026 9:05a.m.	Review ↗

deepsource-development · 2026-07-17T09:11:31Z

+    @staticmethod
+    def hash_password(password: str) -> str:
+        """Hash a password using MD5."""
+        return hashlib.md5(password.encode()).hexdigest()


`hashlib.md5` enables fast offline password cracking

Password storage uses hashlib.md5, which is unsuitable for credentials. Attackers can crack hashes quickly with commodity hardware and reuse recovered passwords on other services.
Use hashlib.pbkdf2_hmac, bcrypt, or argon2 with per-user salt and strong work factor

deepsource-development · 2026-07-17T09:11:31Z

+        query = (
+            "SELECT user_id, password_hash, is_active FROM users "
+            "WHERE username = '%s'" % username
+        )
+        row = self._conn.execute(query).fetchone()


`%`-formatted SQL enables SQLite injection

The query string is built with % interpolation and executed directly. An attacker controlling username can inject SQL fragments, potentially authenticating as another user without knowing a valid password.
Replace string formatting with a parameterized statement using WHERE username = ? and pass (username,) to execute

deepsource-development · 2026-07-17T09:11:31Z

+            data: Pickled preferences blob from storage.
+        """
+        try:
+            return pickle.loads(data)


`pickle.loads` permits arbitrary code execution

pickle.loads on externally sourced bytes is code execution, not just parsing. A malicious payload can execute arbitrary Python instructions during deserialization.
Replace with json.loads for structured preferences, and validate schema/types before returning

deepsource-development · 2026-07-17T09:11:31Z

+
+    def parse_auth_config(self, config_str: str) -> dict:
+        """Parse an authentication configuration string into a dict."""
+        return eval(config_str)


`eval(config_str)` executes attacker-supplied Python code

eval treats configuration as executable code. If config_str is influenced by external input, attackers can run arbitrary code in the application process.
Use json.loads or ast.literal_eval for non-executable parsing and enforce expected key/value types

deepsource-development · 2026-07-17T09:11:31Z

+
+    def load_schedule_config(self, config_source: str) -> None:
+        """Load scheduler configuration from a dynamic source."""
+        exec(config_source)


`exec()` on `config_source` enables arbitrary code execution

load_schedule_config executes raw config_source as code. Any attacker-controlled value can run arbitrary commands, read secrets, and tamper scheduler state.
Replace exec() with strict parsing like json.loads/yaml.safe_load and validate an allowlisted schema before applying settings

add code

00545c3

unnat-deepsource requested a review from srijan-deepsource as a code owner July 17, 2026 09:05

deepsource-development Bot reviewed Jul 17, 2026

View reviewed changes

		"SELECT user_id, password_hash, is_active FROM users "
		"WHERE username = '%s'" % username

Uh oh!

Conversation

unnat-deepsource commented Jul 17, 2026

Uh oh!

unnat-deepsource commented Jul 17, 2026

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Use of insecure hashlib.md5 hash function

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Possible SQL injection vector through string-based query construction.

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Formatting a regular string which could be a f-string

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Use of insecure hashlib.md5 hash function

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Use of exec

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

subprocess call with shell=True identified, security issue.

Uh oh!

deepsource-development Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Feedback

Code Review Summary

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`hashlib.md5` enables fast offline password cracking

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`%`-formatted SQL enables SQLite injection

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`pickle.loads` permits arbitrary code execution

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`eval(config_str)` executes attacker-supplied Python code

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`exec()` on `config_source` enables arbitrary code execution

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

deepsource-development Bot commented Jul 17, 2026 •

edited

Loading