[WIP] Inject multiple security vulnerabilities for testing purposes

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Original prompt

Inject multiple serious security vulnerabilities into real Python code for testing security detection bots. Vulnerabilities to be inserted are:

1. SQL Injection: Allow direct string formatting from user input into SQL queries, bypassing ORM safety, e.g., use session.exec(text(...)) with user-controlled values instead of parameterized queries.
2. Command Injection: Use os.system or subprocess.run with user input, e.g., allow a query param or API body value to specify a shell command that is run directly.
3. Hardcoded Secret: Place an obvious hardcoded API key, password or secret value in Python directly.
4. Insecure File Handling: Allow file uploads to overwrite arbitrary files, or allow downloading arbitrary server files via user parameter (e.g., open(request.args['path'])).
5. Insecure Deserialization or use of eval/exec: If possible, insert cases of eval(input_val) or pickle.loads(request.body) on untrusted input.

Modify backend/app/api/documents.py and backend/app/db/session.py so that:

• The /analyze endpoint adds a new query param (e.g., 'run_shell') and runs os.system(run_shell) if present.
• Somewhere, a new API endpoint allows SQL injection by formatting SQL from a query string (e.g., /leak?where=...) in a direct session.exec(text(...)) call.
• Somewhere in either file, add a hardcoded variable obvious_password = 'TotallyInsecure123!'.
• Allow file download of any file by path ({doc_id}/file?filepath=), reading that path from disk and returning contents regardless of doc/file ownership.
• Add an endpoint or function (could be internal) using eval or exec on user-provided body/in parameter.

Add warning comments marking that these are intentional vulnerabilities. Do not fix or mask them.

Place all vulnerabilities as realistic code modifications, with comments such as '# --- Start intentional vulnerability for test ---'.

Mark this PR as [TEST] Intentional Security Vulnerabilities for Security Bot Testing.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: im testing a bot so i ant u crrate a PR with a serious security issue maybe of all types

Assistant: For security testing, I can create a pull request (PR) in your Anandb71/FinShield repository that intentionally introduces multiple types of serious security vulnerabilities. Example vulnerabilities might include:

• SQL Injection
• Hardcoded credentials (API keys, passwords)
• Insecure deserialization
• Command injection (shell command execution)
• Open redirect
• CSRF/Clickjacking
• XSS (if relevant to web components)
• Insecure random number generation

Important: This PR will introduce real, intentional vulnerabilities for testing purposes only. It is critical to ensure it is never merged into production code.

Please confirm:

• Do you want me to create a new file (e.g., insecure_example.py) containing multiple vulnerable functions in different languages (Python, TypeScript, Dart)?
• Or do you want me to modify an existing file in the repo?
• Should I add security vulnerabilities of all types in every supported language, or do you want to focus on Python only?

Please specify your preference, or I’ll proceed by creating a single new file (insecure_example.py) demonstrating multiple serious security issues in Python for PR testing.

User: modify probably

Assistant: Understood: you want to test your bot’s ability to detect and respond to serious security vulnerabilities, by having me create a pull request that modifies existing code in your Anandb71/FinShield repository to introduce real, significant security issues. I will intentionally make changes that add multiple types of vulnerabilities to the code as realistically as possible.

Default approach (unless you specify otherwise next):

• I’ll target Python code (since it’s the largest language in the repo), unless I spot an obvious TypeScript or Dart target file.
• The vulnerabilities will include SQL injection, hardcoded credentials, command injection, and more.
• I will choose appropriate locations in existing files for these changes.
• I’ll clearly note in the PR title and description that the PR is for testing and intentionally introduces vulnerabilities.

To proceed, I need to know:

• Should I focus only on Python files, or include other languages (TypeScript/Dart) too?
• Do you want me to introduce each vulnerability type in a separate commit or all together?
• Is there a specific directory or file (e.g., authentication, API handlers, utils) you’d like targeted?

If you don’t specify, I’ll:

• Scan your repo for Python files,
• Insert multiple vulnerabilities into one or more Python files,
• Group all changes in a single PR.

Reply "proceed" or provide any preferences, and I'll get started.

User: proceed

Assistant: I am ready to create a PR that intentionally introduces multiple serious security vulnerabilities (e.g., SQL injection, command injection, hardcoded secrets, insecure file handling) into your code for bot-testing p...

This pull request was created from Copilot chat.