Skip to content

Commit 981b331

Browse files
ChhinnaChhinna
committed
Preserve real warning and enforcement run reports and logs
1 parent d860b95 commit 981b331

15 files changed

Lines changed: 3059 additions & 0 deletions

‎examples/security-pipeline/README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,23 @@ to demonstrate that capability.
7979

8080
ReportLab 4.5.1 is installed only to produce the example PDF. Gate evaluation uses
8181
Python's standard library. No third-party report dependency is needed for gates.
82+
83+
## Real run evidence
84+
85+
Both runs scanned the public repository and returned 48 findings: 1 secret,
86+
9 SAST findings (8 HIGH/CRITICAL), and 38 SCA findings (16 HIGH/CRITICAL).
87+
88+
| Mode | Run | Outcome |
89+
| --- | --- | --- |
90+
| Warning | [42304719043](https://github.com/codeanttesting/codeant-demo/actions/runs/42304719043) | All policy jobs recorded warnings; staging readiness ran. |
91+
| Enforcement | [42305066053](https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053) | All three policy jobs failed; staging readiness was skipped. |
92+
93+
The original report files and selected runner output are preserved under
94+
[`evidence/warn`](evidence/warn) and [`evidence/enforce`](evidence/enforce), so the
95+
examples remain available after Actions artifacts expire. These are historical
96+
outputs for the commits identified in `codeant-run.json`, not a claim about every
97+
future scan. Credential/setup log lines are omitted from the saved excerpts.
98+
99+
In these runs, the native verdict was PASSED with no native gate conditions
100+
enabled. The explicit example policy still blocked enforcement, which illustrates
101+
why a native verdict must be interpreted alongside its evaluated conditions.

‎examples/security-pipeline/evidence/enforce/codeant-findings.csv‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
engine,severity,file,line,rule,message
2+
sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,23,sql-injection-db-cursor-execute,"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."
3+
sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,27,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead.
4+
sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,34,python-subprocess-shell-true-format,"Subprocess call with `shell=True` and a dynamically constructed command string (f-string or format). This is vulnerable to shell injection. Use a list of arguments without `shell=True`, or use `shlex.quote()` to sanitize inputs."
5+
sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,40,python-weak-hash-md5,Use of MD5 hash algorithm detected. MD5 is cryptographically broken and should not be used for security purposes such as password hashing or integrity verification. Use a stronger algorithm like SHA-256 or bcrypt.
6+
sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,48,path-traversal-open,"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."
7+
sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,54,user-eval,"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."
8+
sast,CRITICAL,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,56,eval-detected,"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."
9+
sast,MEDIUM,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/security_vulns.py,61,debug-endpoints-enabled,"Debug mode is enabled in a web application. This can expose sensitive information such as stack traces, environment variables, and internal application state to attackers. Disable debug features in production environments."
10+
sast,HIGH,/mnt/lambda/github/github.com/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/feature/main2.py,30,formatted-sql-query,Detected possible formatted SQL query. Use parameterized queries instead.
11+
sca,MEDIUM,azure-identity,,CVE-2024-35255,Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
12+
sca,HIGH,langchain-community,,CVE-2025-6984,Langchain Community Vulnerable to XML External Entity (XXE) Attacks
13+
sca,MEDIUM,litellm,,CVE-2026-84377,LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
14+
sca,MEDIUM,litellm,,CVE-2026-59823,LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
15+
sca,LOW,litellm,,CVE-2026-12799,BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
16+
sca,LOW,litellm,,CVE-2026-12798,BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
17+
sca,LOW,litellm,,CVE-2026-12797,BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
18+
sca,LOW,litellm,,CVE-2026-12796,BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
19+
sca,MEDIUM,litellm,,CVE-2026-12795,LiteLLM: SSO Debug Flow Has Improper Authentication
20+
sca,LOW,litellm,,CVE-2026-12770,LiteLLM: Admin Key Handler Has Improper Authorization
21+
sca,MEDIUM,litellm,,CVE-2026-12773,LiteLLM: MCP Proxy Has Improper Authentication
22+
sca,LOW,litellm,,CVE-2026-12771,LiteLLM: M2M JWT Handler Has Improper Authorization
23+
sca,LOW,litellm,,CVE-2026-12772,LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
24+
sca,CRITICAL,litellm,,CVE-2026-37004,LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
25+
sca,LOW,litellm,,CVE-2026-59821,LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
26+
sca,HIGH,litellm,,CVE-2026-59822,LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
27+
sca,LOW,litellm,,CVE-2026-59819,LiteLLM: Local file read via request-supplied OIDC file references
28+
sca,MEDIUM,litellm,,CVE-2026-59820,LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
29+
sca,HIGH,litellm,,CVE-2026-47102,LiteLLM allows a user to modify their own user_role via the /user/update endpoint
30+
sca,HIGH,litellm,,CVE-2026-47101,LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
31+
sca,CRITICAL,litellm,,CVE-2026-49468,LiteLLM: Authentication Bypass via Host Header Injection
32+
sca,CRITICAL,litellm,,CVE-2026-35030,LiteLLM: Authentication bypass via OIDC userinfo cache key collision
33+
sca,HIGH,litellm,,CVE-2026-35029,LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
34+
sca,HIGH,litellm,,CVE-2025-0628,LiteLLM Has an Improper Authorization Vulnerability
35+
sca,HIGH,litellm,,,LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
36+
sca,HIGH,litellm,,,LiteLLM: Password hash exposure and pass-the-hash authentication bypass
37+
sca,HIGH,starlette,,CVE-2026-54283,Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
38+
sca,LOW,starlette,,CVE-2026-54282,Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
39+
sca,HIGH,starlette,,CVE-2026-48818,Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
40+
sca,MEDIUM,starlette,,CVE-2026-48817,Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
41+
sca,MEDIUM,starlette,,CVE-2026-48710,"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks"
42+
sca,MEDIUM,starlette,,CVE-2025-54121,Starlette has possible denial-of-service vector when parsing large files in multipart forms
43+
sca,HIGH,starlette,,CVE-2024-47874,Starlette Denial of service (DoS) via multipart/form-data
44+
sca,HIGH,black,,CVE-2026-114134,Black: GitHub Action installs unvalidated required-version from pyproject.toml
45+
sca,MEDIUM,black,,CVE-2024-21503,Black vulnerable to Regular Expression Denial of Service (ReDoS)
46+
sca,HIGH,langchain-core,,CVE-2026-34070,LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
47+
sca,LOW,langchain-core,,CVE-2026-26013,LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
48+
sca,MEDIUM,langchain-text-splitters,,CVE-2026-41481,LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
49+
secrets,HIGH,/mnt/lambda/codeanttesting/codeant-demo/d860b95a2ef978cc9bfd188a35476a6e7bdb333e/IaC.yaml,47,generic-password,generic-password

‎examples/security-pipeline/evidence/enforce/codeant-qg.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version='1.0' encoding='utf-8'?>
2+
<testsuite name="CodeAnt Quality Gate" tests="2" failures="0"><properties><property name="quality_gate_status" value="PASSED" /><property name="total_findings" value="48" /><property name="sast_rating_full_code" value="C" /><property name="sca_rating_full_code" value="D" /><property name="findings.severity.HIGH" value="19" /><property name="findings.severity.CRITICAL" value="6" /><property name="findings.severity.MEDIUM" value="12" /><property name="findings.severity.LOW" value="11" /><property name="findings.engine.sast" value="9" /><property name="findings.engine.sca" value="38" /><property name="findings.engine.secrets" value="1" /></properties><testcase name="CodeAnt - SAST:sast_rating_full_code" /><testcase name="CodeAnt - SCA:sca_rating_full_code" /><system-out>Quality Gate: PASSED
3+
Total findings: 48
4+
By severity: HIGH=19, CRITICAL=6, MEDIUM=12, LOW=11
5+
By engine: sast=9, sca=38, secrets=1
6+
Ratings: sast_rating_full_code=C, sca_rating_full_code=D</system-out></testsuite>

‎examples/security-pipeline/evidence/enforce/codeant-run.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"repository": "codeanttesting/codeant-demo",
3+
"commit": "d860b95a2ef978cc9bfd188a35476a6e7bdb333e",
4+
"run_url": "https://github.com/codeanttesting/codeant-demo/actions/runs/42305066053"
5+
}

‎examples/security-pipeline/evidence/enforce/codeant-summary.pdf‎

2.33 KB
Binary file not shown.

0 commit comments

Comments
 (0)