{ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "APEX", "version": "0.9.1", "rules": [ { "id": "cwe-top25/injection", "shortDescription": { "text": "CWE Top 25 #22: CWE Top 25: outbound request uses untrusted URL" }, "properties": { "tags": [ "CWE-78" ] } }, { "id": "secret-scan/hardcoded_secret", "shortDescription": { "text": "High-entropy string (entropy=5.16) at line 236" }, "properties": { "tags": [ "CWE-798" ] } }, { "id": "path-normalize/path_traversal", "shortDescription": { "text": "File operation with unsanitized input at line 72" }, "properties": { "tags": [ "CWE-22" ] } }, { "id": "multi-path-traversal/path_traversal", "shortDescription": { "text": "open with variable: File open with potentially user-controlled path at line 46" }, "properties": { "tags": [ "CWE-22" ] } }, { "id": "typestate/memory_safety", "shortDescription": { "text": "Use-after-close on 'c' (DBConnection)" }, "properties": { "tags": [ "CWE-119" ] } }, { "id": "cwe-top25/security_smell", "shortDescription": { "text": "CWE Top 25 #16: CWE Top 25: trust-boundary input used without validation" }, "properties": { "tags": [ "CWE-710" ] } }, { "id": "swallowed-errors/security_smell", "shortDescription": { "text": "Swallowed error — empty error handler" }, "properties": { "tags": [ "CWE-710" ] } }, { "id": "broad-exception/security_smell", "shortDescription": { "text": "Overly broad exception catch" }, "properties": { "tags": [ "CWE-710" ] } }, { "id": "typestate/logic_bug", "shortDescription": { "text": "Resource leak: 'c' (DBConnection) not closed" }, "properties": { "tags": [ "CWE-670" ] } }, { "id": "security-pattern/injection", "shortDescription": { "text": "SQL execute — potential SQL injection at line 26" }, "properties": { "tags": [ "CWE-78" ] } }, { "id": "hardcoded-env-values/security_smell", "shortDescription": { "text": "Hardcoded environment-specific host value" }, "properties": { "tags": [ "CWE-710" ] } }, { "id": "dependency-audit/dependency_vuln", "shortDescription": { "text": "pip audit not installed — dependency audit skipped" }, "properties": { "tags": [ "CWE-1104" ] } }, { "id": "static-analysis/security_smell", "shortDescription": { "text": "static-analysis skipped: target-compilation not enabled" }, "properties": { "tags": [ "CWE-710" ] } } ] } }, "results": [ { "ruleId": "cwe-top25/injection", "level": "error", "message": { "text": "Server-side HTTP client code uses request-controlled URLs without an allowlist or private-network guard." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 72 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-918" ], "cweTop25Rank": 22, "cweTop25Name": "Server-Side Request Forgery", "cvssV31BaseScore": 9.1, "cweTop25Remediation": "Allowlist outbound destinations, block internal metadata ranges, and validate URL scheme, host, and redirects.", "owaspTop10": [ "A10:2021 Server-Side Request Forgery (SSRF)" ], "odcDefectType": "interface", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "secret-scan/hardcoded_secret", "level": "error", "message": { "text": "String literal with entropy 5.16 in api_server.py:236 may be a secret" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 236 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-798" ], "cweTop25Rank": 14, "cweTop25Name": "Hard-coded Credentials", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Move credentials into a secret manager, rotate exposed values, and block secret literals in review and CI.", "owaspTop10": [ "A07:2021 Identification and Authentication Failures" ], "odcDefectType": "assignment_initialization", "odcQualifier": "extraneous", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "path-normalize/path_traversal", "level": "error", "message": { "text": "File operation at api_server.py:72 uses a path that may come from user input without normalization or validation, risking path traversal." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 72 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-22" ], "cweTop25Rank": 5, "cweTop25Name": "Path Traversal", "cvssV31BaseScore": 8.6, "cweTop25Remediation": "Canonicalize paths, reject traversal segments, and constrain filesystem access to an allowlisted root.", "owaspTop10": [ "A01:2021 Broken Access Control" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "multi-path-traversal/path_traversal", "level": "error", "message": { "text": "open with variable pattern matched in api_server.py:46" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 46 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-22" ], "cweTop25Rank": 5, "cweTop25Name": "Path Traversal", "cvssV31BaseScore": 8.6, "cweTop25Remediation": "Canonicalize paths, reject traversal segments, and constrain filesystem access to an allowlisted root.", "owaspTop10": [ "A01:2021 Broken Access Control" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "multi-path-traversal/path_traversal", "level": "error", "message": { "text": "open with variable pattern matched in api_server.py:54" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 54 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-22" ], "cweTop25Rank": 5, "cweTop25Name": "Path Traversal", "cvssV31BaseScore": 8.6, "cweTop25Remediation": "Canonicalize paths, reject traversal segments, and constrain filesystem access to an allowlisted root.", "owaspTop10": [ "A01:2021 Broken Access Control" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but execute was called (use-after-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 150 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-416" ], "cweTop25Rank": 9, "cweTop25Name": "Use After Free", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use ownership-safe lifetimes, set freed pointers to null, and prevent dereference after free/delete/drop.", "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but execute was called (use-after-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 169 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-416" ], "cweTop25Rank": 9, "cweTop25Name": "Use After Free", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use ownership-safe lifetimes, set freed pointers to null, and prevent dereference after free/delete/drop.", "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but execute was called (use-after-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 177 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-416" ], "cweTop25Rank": 9, "cweTop25Name": "Use After Free", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use ownership-safe lifetimes, set freed pointers to null, and prevent dereference after free/delete/drop.", "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but execute was called (use-after-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 191 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-416" ], "cweTop25Rank": 9, "cweTop25Name": "Use After Free", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use ownership-safe lifetimes, set freed pointers to null, and prevent dereference after free/delete/drop.", "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but execute was called (use-after-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 211 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-416" ], "cweTop25Rank": 9, "cweTop25Name": "Use After Free", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use ownership-safe lifetimes, set freed pointers to null, and prevent dereference after free/delete/drop.", "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but execute was called (use-after-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 214 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-416" ], "cweTop25Rank": 9, "cweTop25Name": "Use After Free", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use ownership-safe lifetimes, set freed pointers to null, and prevent dereference after free/delete/drop.", "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/memory_safety", "level": "error", "message": { "text": "'c' is Consumed but close was called (double-free/double-close)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 215 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-675" ], "odcDefectType": "algorithm_method", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "reliability" } }, { "ruleId": "cwe-top25/security_smell", "level": "warning", "message": { "text": "Request or command-line input is consumed near a sensitive operation without type, range, schema, or allowlist validation." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 72 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-20" ], "cweTop25Rank": 16, "cweTop25Name": "Improper Input Validation", "cvssV31BaseScore": 8.6, "cweTop25Remediation": "Validate type, length, format, range, and allowlisted values at trust boundaries before use.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "cwe-top25/security_smell", "level": "warning", "message": { "text": "Input appears to control expensive work, unbounded allocation, backtracking regex, or loop limits without bounds." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 76 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-400" ], "cweTop25Rank": 24, "cweTop25Name": "Uncontrolled Resource Consumption", "cvssV31BaseScore": 7.5, "cweTop25Remediation": "Add timeouts, limits, pagination, bounded queues, and safe regular expressions for attacker-controlled work.", "odcDefectType": "algorithm_method", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "performance_efficiency" } }, { "ruleId": "cwe-top25/security_smell", "level": "warning", "message": { "text": "Input appears to control expensive work, unbounded allocation, backtracking regex, or loop limits without bounds." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 126 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-400" ], "cweTop25Rank": 24, "cweTop25Name": "Uncontrolled Resource Consumption", "cvssV31BaseScore": 7.5, "cweTop25Remediation": "Add timeouts, limits, pagination, bounded queues, and safe regular expressions for attacker-controlled work.", "odcDefectType": "algorithm_method", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "performance_efficiency" } }, { "ruleId": "swallowed-errors/security_smell", "level": "warning", "message": { "text": "Error handler at line 52 silently discards the exception (`except: pass`). Swallowed errors hide bugs, mask security issues, and make debugging extremely difficult." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 52 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-390" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "swallowed-errors/security_smell", "level": "warning", "message": { "text": "Error handler at line 57 silently discards the exception (`except: pass`). Swallowed errors hide bugs, mask security issues, and make debugging extremely difficult." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 57 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-390" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "broad-exception/security_smell", "level": "warning", "message": { "text": "Line 51 catches a broad exception type (`except Exception:`). Broad catches mask unexpected errors, hide security issues, and prevent proper error propagation. Found: `except Exception:`" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 51 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-396" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "broad-exception/security_smell", "level": "warning", "message": { "text": "Line 56 catches a broad exception type (`except Exception:`). Broad catches mask unexpected errors, hide security issues, and prevent proper error propagation. Found: `except Exception:`" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 56 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-396" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "broad-exception/security_smell", "level": "warning", "message": { "text": "Line 75 catches a broad exception type (`except Exception:`). Broad catches mask unexpected errors, hide security issues, and prevent proper error propagation. Found: `except Exception:`" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 75 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-396" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "broad-exception/security_smell", "level": "warning", "message": { "text": "Line 133 catches a broad exception type (`except Exception:`). Broad catches mask unexpected errors, hide security issues, and prevent proper error propagation. Found: `except Exception as ex:`" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 133 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-396" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "broad-exception/security_smell", "level": "warning", "message": { "text": "Line 166 catches a broad exception type (`except Exception:`). Broad catches mask unexpected errors, hide security issues, and prevent proper error propagation. Found: `except Exception:`" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 166 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-396" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "broad-exception/security_smell", "level": "warning", "message": { "text": "Line 227 catches a broad exception type (`except Exception:`). Broad catches mask unexpected errors, hide security issues, and prevent proper error propagation. Found: `except Exception as ex:`" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 227 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-396" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "typestate/logic_bug", "level": "warning", "message": { "text": "'c' is Active when was called" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "" }, "region": { "startLine": 34 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-404" ], "odcDefectType": "function_class_object", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "reliability" } }, { "ruleId": "typestate/logic_bug", "level": "warning", "message": { "text": "'_hits_lock' (Mutex) is Created at end of scope — possible resource leak" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-404" ], "odcDefectType": "function_class_object", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "reliability" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:26 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 26 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:27 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 27 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:29 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 29 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:31 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 31 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:74 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 74 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:125 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 125 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:129 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 129 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:150 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 150 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:169 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 169 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:177 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 177 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:191 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 191 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:211 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 211 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "security-pattern/injection", "level": "note", "message": { "text": "Pattern `.execute(` found in api_server.py:214 (no taint flow detected — likely safe)" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 214 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-89" ], "cweTop25Rank": 3, "cweTop25Name": "SQL Injection", "cvssV31BaseScore": 9.8, "cweTop25Remediation": "Use parameterized queries or prepared statements, never concatenate request data into SQL.", "owaspTop10": [ "A03:2021 Injection" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "high", "iso25010Impact": "security" } }, { "ruleId": "hardcoded-env-values/security_smell", "level": "note", "message": { "text": "Hardcoded host `127.0.0.1` found in non-test code. This value is environment-specific and should come from configuration (environment variables, config files)." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 236 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-547" ], "owaspTop10": [ "A05:2021 Security Misconfiguration" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "hardcoded-env-values/security_smell", "level": "note", "message": { "text": "Hardcoded host `127.0.0.1` found in non-test code. This value is environment-specific and should come from configuration (environment variables, config files)." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "api_server.py" }, "region": { "startLine": 237 } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "cweIds": [ "CWE-547" ], "owaspTop10": [ "A05:2021 Security Misconfiguration" ], "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "dependency-audit/dependency_vuln", "level": "note", "message": { "text": "Install pip audit to enable dependency vulnerability scanning." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "requirements.txt" } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "odcDefectType": "relationship", "odcQualifier": "incorrect", "odcConfidence": "medium", "iso25010Impact": "security" } }, { "ruleId": "static-analysis/security_smell", "level": "note", "message": { "text": "static-analysis runs `cargo clippy`, which COMPILES the target repo (executing its build.rs / proc-macros = RCE on the apex host) and is therefore off by default. The repo was NOT analyzed by this detector. Set APEX_ALLOW_TARGET_COMPILE=1 to enable it — only on a trusted target or inside an OS sandbox." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "." } } } ], "properties": { "runId": "apex-b0e0433757b14912b8b87e11a54b4a6b", "timestamp": "2026-07-31T08:52:18Z", "target": "/private/tmp/apex-demo", "odcDefectType": "checking", "odcQualifier": "missing", "odcConfidence": "medium", "iso25010Impact": "security" } } ] } ] }