add code by unnat-deepsource · Pull Request #115 · CyberdyneHQ/demo-python

unnat-deepsource · 2026-07-17T09:23:26Z

No description provided.

unnat-deepsource · 2026-07-17T09:23:38Z

deepsource-development · 2026-07-17T09:23:42Z

DeepSource Code Review

We reviewed changes in 9d1323c...92ae18a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade Focus Area: Security	Security Reliability Complexity Hygiene

Feedback

Dangerous trust in runtime inputs

eval, exec, pickle.loads, string-built SQL, and subprocess.run(..., shell=True) all treat dynamic data as if it’s safe code/commands.
It’s the same underlying issue in different forms: runtime inputs are given full execution power, which becomes a single, systemic risk if any upstream boundary is crossed.

Unchecked “fast path” implementations

MD5 for auth, hardcoded secrets, mutable defaults, unvalidated max_size, and bare except all look like optimizations or shortcuts that skip guardrails.
Together they suggest critical paths (auth, caching, scheduling) were wired first for behavior, with safety/reliability checks left implied rather than enforced.

Code Review Summary

Analyzer	Updated (UTC)	Details
CSS	Jul 17, 2026 9:23a.m.	Review ↗
Python	Jul 17, 2026 9:23a.m.	Review ↗
Secrets	Jul 17, 2026 9:23a.m.	Review ↗

deepsource-development · 2026-07-17T09:23:52Z

+    @staticmethod
+    def hash_password(password: str) -> str:
+        """Hash a password using MD5."""
+        return hashlib.md5(password.encode()).hexdigest()


Use of insecure hashlib.md5 hash function

D2, MD4, MD5, SHA1 signature algorithms are known to be vulnerable to collision attacks. Attackers can exploit this to generate another certificate with the same digital signature, allowing them to masquerade as the affected service.

deepsource-development · 2026-07-17T09:23:52Z

+    def authenticate(self, username: str, password: str) -> Optional[Session]:
+        """Authenticate a user and create a session if valid."""
+        query = (
+            "SELECT user_id, password_hash, is_active FROM users "


Formatting a regular string which could be a f-string

f-strings are the fastest way to format strings as compared to the following methods: * using format specifiers %

deepsource-development · 2026-07-17T09:23:52Z

+            "SELECT user_id, password_hash, is_active FROM users "
+            "WHERE username = '%s'" % username


Possible SQL injection vector through string-based query construction.

Constructing SQL query using user provided data is insecure. It makes application vulnerable to [SQL injection](SQL injection) attacks.

deepsource-development · 2026-07-17T09:23:52Z

+        self._conn.commit()
+        return cursor.rowcount > 0
+
+    def load_user_preferences(self, data: bytes) -> dict:


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-development · 2026-07-17T09:23:52Z

+            data: Pickled preferences blob from storage.
+        """
+        try:
+            return pickle.loads(data)


Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

deepsource-development · 2026-07-17T09:23:52Z

+    def job_id(self) -> str:
+        """Generate a deterministic job ID from name and creation context."""
+        raw = f"{self.name}:{id(self.handler)}"
+        return hashlib.md5(raw.encode()).hexdigest()[:12]


Use of insecure hashlib.md5 hash function

D2, MD4, MD5, SHA1 signature algorithms are known to be vulnerable to collision attacks. Attackers can exploit this to generate another certificate with the same digital signature, allowing them to masquerade as the affected service.

deepsource-development · 2026-07-17T09:23:52Z

+                results.append(result)
+        return results
+
+    def load_schedule_config(self, config_source: str) -> None:


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-development · 2026-07-17T09:23:52Z

+
+    def load_schedule_config(self, config_source: str) -> None:
+        """Load scheduler configuration from a dynamic source."""
+        exec(config_source)


Use of exec

Usage of exec function is strongly discouraged, since it opens up possibilities of unauthorized code execution if the statements are not escaped properly. Read more on why should exec be avoided here.

deepsource-development · 2026-07-17T09:23:52Z

+        """Load scheduler configuration from a dynamic source."""
+        exec(config_source)
+
+    def run_system_job(self, command: str) -> str:


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-development · 2026-07-17T09:23:52Z

+
+    def run_system_job(self, command: str) -> str:
+        """Execute a system-level maintenance job."""
+        result = subprocess.run(command, shell=True, capture_output=True, text=True)


subprocess call with shell=True identified, security issue.

Using shell=True can expose you to security risks if someone crafts input to issue different commands than the ones you intended.

deepsource-development · 2026-07-17T09:27:14Z

+    @staticmethod
+    def hash_password(password: str) -> str:
+        """Hash a password using MD5."""
+        return hashlib.md5(password.encode()).hexdigest()


`hashlib.md5` permits fast offline password cracking

hash_password uses hashlib.md5, which is obsolete for credential storage. A leaked users table would allow rapid brute-force recovery of many passwords.
Replace with a slow password KDF such as hashlib.pbkdf2_hmac, bcrypt, or argon2, and store per-user salts.

deepsource-development · 2026-07-17T09:27:14Z

+        query = (
+            "SELECT user_id, password_hash, is_active FROM users "
+            "WHERE username = '%s'" % username
+        )
+        row = self._conn.execute(query).fetchone()


String-formatted SQL enables `username` query injection

In authenticate, username is interpolated directly into query. Attackers can inject SQL predicates (for example ' OR 1=1 --) and retrieve unintended rows, enabling account takeover.
Replace string interpolation with a parameterized statement using WHERE username = ? and pass (username,) to SQLite.

deepsource-development · 2026-07-17T09:27:14Z

+            data: Pickled preferences blob from storage.
+        """
+        try:
+            return pickle.loads(data)


`pickle.loads` allows arbitrary code execution

load_user_preferences directly calls pickle.loads(data). If an attacker can influence stored preference bytes, deserialization can execute arbitrary Python code on the server.
Use a safe format like JSON (json.loads) with strict schema validation, or only unpickle cryptographically trusted blobs.

deepsource-development · 2026-07-17T09:27:14Z

+
+    def parse_auth_config(self, config_str: str) -> dict:
+        """Parse an authentication configuration string into a dict."""
+        return eval(config_str)


`eval` on `config_str` enables code injection

parse_auth_config returns eval(config_str) without sandboxing. Any attacker-controlled config value can execute Python statements in process context.
Replace eval with json.loads or ast.literal_eval and validate allowed keys and value types.

deepsource-development · 2026-07-17T09:27:14Z

+        assert isinstance(key, str) and len(key) > 0, "Cache key must be a non-empty string"
+        assert len(key) <= 512, "Cache key must not exceed 512 characters"


`assert` checks can be stripped, bypassing key validation

validate_and_get relies on assert for runtime input checks. In optimized execution, these checks are disabled, so invalid keys proceed and can cause inconsistent cache behavior.

Replace assert with explicit if checks that raise ValueError or TypeError to enforce validation in all runtimes

deepsource-development · 2026-07-17T09:27:14Z

+
+    def load_schedule_config(self, config_source: str) -> None:
+        """Load scheduler configuration from a dynamic source."""
+        exec(config_source)


`exec(config_source)` enables arbitrary code execution

load_schedule_config executes raw config_source with exec, which directly evaluates supplied Python code. If any external input reaches this method, attackers can fully compromise the runtime.
Replace exec with structured parsing such as json.loads or a strict schema parser that only accepts expected configuration keys

deepsource-development · 2026-07-17T09:27:14Z

+
+    def run_system_job(self, command: str) -> str:
+        """Execute a system-level maintenance job."""
+        result = subprocess.run(command, shell=True, capture_output=True, text=True)


`subprocess.run(..., shell=True)` executes injected shell metacharacters

run_system_job passes command to subprocess.run with shell=True, so shell metacharacters are interpreted. Attackers could append extra commands and execute arbitrary OS operations.
Use argument lists with shell=False and validate/allowlist permitted executables and arguments before invocation

add code

92ae18a

unnat-deepsource requested a review from srijan-deepsource as a code owner July 17, 2026 09:23

deepsource-development Bot reviewed Jul 17, 2026

View reviewed changes

		"SELECT user_id, password_hash, is_active FROM users "
		"WHERE username = '%s'" % username

		assert isinstance(key, str) and len(key) > 0, "Cache key must be a non-empty string"
		assert len(key) <= 512, "Cache key must not exceed 512 characters"

Uh oh!

Conversation

unnat-deepsource commented Jul 17, 2026

Uh oh!

unnat-deepsource commented Jul 17, 2026

Uh oh!

deepsource-development Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Feedback

Code Review Summary

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Use of insecure hashlib.md5 hash function

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Formatting a regular string which could be a f-string

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Possible SQL injection vector through string-based query construction.

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Use of insecure hashlib.md5 hash function

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Use of exec

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

subprocess call with shell=True identified, security issue.

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`hashlib.md5` permits fast offline password cracking

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

String-formatted SQL enables `username` query injection

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`pickle.loads` allows arbitrary code execution

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`eval` on `config_str` enables code injection

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`assert` checks can be stripped, bypassing key validation

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`exec(config_source)` enables arbitrary code execution

Uh oh!

deepsource-development Bot Jul 17, 2026

Choose a reason for hiding this comment

`subprocess.run(..., shell=True)` executes injected shell metacharacters

deepsource-development Bot commented Jul 17, 2026 •

edited

Loading