Test bot vulns titan

[Anandb71]

No description provided.

[arbor-cloud]

🔴 Arbor — Blast Radius Analysis

Risk	HIGH ██░░░░░░░░ 28%
Branch	test-bot-vulns-titan → main-1
Impact	29 files · 176 symbols · 13 in blast radius
Entry Points	7 production endpoints reached
Languages	C, C#, C++, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Swift, TypeScript

Changed Files

	File	Symbols	Direct	Transitive	Risk
🔴	backend/app/api/dashboard.py	70	5	—	HIGH
🟡	titan_app/utils/helpers.py	5	3	2	MEDIUM
🟡	titan_app/services/system_tasks.py	4	2	—	MEDIUM
🟡	multilang_vulns/vuln.rs	1	1	1	MEDIUM
🟢	titan_app/services/auth.py	2	1	—	LOW
🟢	titan_app/services/user_manager.py	2	1	1	LOW
🟢	titan_app/services/payment.py	5	1	—	LOW
⚪	multilang_vulns/vuln.java	2	—	—	NONE
⚪	generate_vulns.py	1	—	—	NONE
⚪	multilang_vulns/vuln.rb	1	—	—	NONE
⚪	generate_titan_vulns.py	3	—	—	NONE
⚪	backend/app/vulnerabilities_test.py	16	—	—	NONE
⚪	multilang_vulns/vuln.c	1	—	—	NONE
⚪	multilang_vulns/vuln.go	2	—	—	NONE
⚪	multilang_vulns/vuln.js	1	—	—	NONE
⚪	multilang_vulns/vuln.ts	2	—	—	NONE
⚪	backend/app/api/documents.py	48	—	—	NONE
⚪	multilang_vulns/vuln.cpp	1	—	—	NONE
⚪	multilang_vulns/vuln.swift	1	—	—	NONE
⚪	multilang_vulns/vuln.cs	2	—	—	NONE
⚪	multilang_vulns/vuln.kt	1	—	—	NONE
⚪	titan_app/core/router.py	5	—	—	NONE

⚠️ High-Risk Symbols

• execute_db_query in …is/.tmpeFIFM7/repo/titan_app/utils/helpers.py — centrality 68%, 2 callers

  High-centrality function with 68% graph connectivity score.

🎯 Production Entry Points Reached

This change propagates to these entry points (HTTP handlers, jobs, CLI commands):

• checkout
• custom_metric
• execute_legacy
• export_report
• get_dashboard_metrics
• get_logs
• login

✅ Before You Merge

• Manually verify the affected entry points: checkout, custom_metric, execute_legacy (+4).
• Trace the 13 affected callers for unintended side-effects.
• Request a senior engineer review before merging.

🛑 Security Analysis — GATE

28 security surfaces · 4 entry points reachable · Confidence: 80%

Category	File	Symbols
Authentication	titan_app/core/router.py	login
Authentication	titan_app/services/auth.py	login_user
Payment Processing	titan_app/services/payment.py	process_payment
File I/O	backend/app/vulnerabilities_test.py	read_file
Database Access	multilang_vulns/vuln.rb	SQL Injection (CWE-89), line 3
Input Validation	multilang_vulns/vuln.sh	Arbitrary Code Execution (CWE-94), line 3
Input Validation	multilang_vulns/vuln.c	Format String Vulnerability (CWE-134), line 4
Input Validation	multilang_vulns/vuln.rs	Command Injection (CWE-78), line 4
Input Validation	multilang_vulns/vuln.java	Insecure Deserialization (RCE) (CWE-502), line 5
Input Validation	multilang_vulns/vuln.php	Command Injection (CWE-78), line 5
Input Validation	multilang_vulns/vuln.rb	Command Injection (CWE-78), line 5
Input Validation	multilang_vulns/vuln.scala	Command Injection (CWE-78), line 5
Input Validation	titan_app/legacy/old_api.js	Arbitrary Code Execution (CWE-94), line 7
Input Validation	generate_vulns.py	Arbitrary Code Execution (CWE-94), line 10
Database Access	titan_app/utils/helpers.py	SQL Injection (CWE-89), line 11
Input Validation	titan_app/utils/helpers.py	Command Injection (CWE-78), line 17
Input Validation	backend/app/api/dashboard.py	Arbitrary Code Execution (CWE-94), line 19
Input Validation	titan_app/utils/helpers.py	Insecure Deserialization (RCE) (CWE-502), line 24
Database Access	generate_titan_vulns.py	SQL Injection (CWE-89), line 99
Input Validation	generate_titan_vulns.py	Command Injection (CWE-78), line 105
Input Validation	generate_titan_vulns.py	Insecure Deserialization (RCE) (CWE-502), line 112
Input Validation	generate_titan_vulns.py	Arbitrary Code Execution (CWE-94), line 122
Input Validation	backend/app/api/documents.py	Arbitrary Code Execution (CWE-94), line 143
Database Access	backend/app/api/documents.py	SQL Injection (CWE-89), line 203
Input Validation	backend/app/api/documents.py	Insecure Deserialization (RCE) (CWE-502), line 225
Input Validation	backend/app/api/dashboard.py	Command Injection (CWE-78), line 235
Input Validation	multilang_vulns/vuln.cpp	Buffer Overflow (CWE-120), line 6
Network	backend/app/api/documents.py	Server-Side Request Forgery (SSRF) (CWE-918), line 214

Security call paths

• change reaches sink: analyze_document → Document (1 hop) — changed code reaches Document (Database Access) in 1 hop
• change reaches sink: analyze_document → save_file (1 hop) — changed code reaches save_file (File I/O) in 1 hop
• change reaches sink: get_document_file → read_file (1 hop) — changed code reaches read_file (File I/O) in 1 hop
• caller reaches change: login_user → execute_db_query (1 hop) — login_user (Authentication) depends on changed code, 1 hop away
• caller reaches change: process_payment → unsafe_deserialize (1 hop) — process_payment (Payment Processing) depends on changed code, 1 hop away
• caller reaches change: login → login_user (1 hop) — login (Authentication) depends on changed code, 1 hop away
• caller reaches change: process_payment → get_user_profile (1 hop) — process_payment (Payment Processing) depends on changed code, 1 hop away
• change reaches sink: checkout → process_payment (1 hop) — changed code reaches process_payment (Payment Processing) in 1 hop

• 🔴 Fix SQL Injection in vuln.rb (line 3) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — ActiveRecord query with string interpolation — use ? or named bind params.
• 🔴 Fix Arbitrary Code Execution in vuln.sh (line 3) [not in call graph — reachability unknown; manual exposure check required] — Shell eval with variable — evaluates attacker-controlled string as shell command.
• 🔴 Fix Format String Vulnerability in vuln.c (line 4) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — printf/fprintf with non-literal format string — enables read/write to arbitrary memory.
• 🔴 Fix Command Injection in vuln.rs (line 4) [2 internal callers — inspect full call path before merge] — Command::new with shell interpreter — any subsequent .arg() from user input enables injection.
• 🔴 Fix Insecure Deserialization (RCE) in vuln.java (line 5) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — Java ObjectInputStream deserialization of untrusted data can lead to RCE.
• 🔴 Fix Command Injection in vuln.php (line 5) [not in call graph — reachability unknown; manual exposure check required] — PHP system with non-literal argument — OS command injection.
• 🔴 Fix Command Injection in vuln.rb (line 5) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — Ruby system( with string concatenation — OS command injection.
• 🔴 Fix Command Injection in vuln.scala (line 5) [not in call graph — reachability unknown; manual exposure check required] — Scala process execution (!) with interpolated string — OS command injection.
• 🔴 Fix Arbitrary Code Execution in old_api.js (line 7) [called by local process launcher: titan_app/services/system_tasks.py:12, generate_titan_vulns.py:77] — eval() with dynamic argument executes arbitrary code.
• 🔴 Fix Arbitrary Code Execution in generate_vulns.py (line 10) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — exec() with dynamic argument executes arbitrary code.
• 🔴 Fix SQL Injection in helpers.py (line 11) [5 internal callers — inspect full call path before merge] — Dynamic string in SQL sink cursor.execute — use parameterized queries.
• 🔴 Fix Command Injection in helpers.py (line 17) [5 internal callers — inspect full call path before merge] — os.system with dynamic arg allows OS command injection.
• 🔴 Fix Arbitrary Code Execution in dashboard.py (line 19) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — exec() with dynamic argument executes arbitrary code.
• 🔴 Fix Insecure Deserialization (RCE) in helpers.py (line 24) [5 internal callers — inspect full call path before merge] — pickle.loads() on untrusted data enables RCE. Use json.loads().
• 🔴 Fix SQL Injection in generate_titan_vulns.py (line 99) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — Dynamic string in SQL sink cursor.execute — use parameterized queries.
• 🔴 Fix Command Injection in generate_titan_vulns.py (line 105) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — os.system with dynamic arg allows OS command injection.
• 🔴 Fix Insecure Deserialization (RCE) in generate_titan_vulns.py (line 112) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — pickle.loads() on untrusted data enables RCE. Use json.loads().
• 🔴 Fix Arbitrary Code Execution in generate_titan_vulns.py (line 122) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — eval() with dynamic argument executes arbitrary code.
• 🔴 Fix Arbitrary Code Execution in documents.py (line 143) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — exec() with dynamic argument executes arbitrary code.
• 🔴 Fix SQL Injection in documents.py (line 203) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — Dynamic string in SQL sink cursor.execute — use parameterized queries.
• 🔴 Fix Insecure Deserialization (RCE) in documents.py (line 225) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — pickle.loads() on untrusted data enables RCE. Use json.loads().
• 🔴 Fix Command Injection in dashboard.py (line 235) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — String concat decodes to 'subprocess' — obfuscation.
• 🟡 Fix Buffer Overflow in vuln.cpp (line 6) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — strcpy() with no bounds check — use strncpy() or strlcpy().
• 🟡 Fix Server-Side Request Forgery (SSRF) in documents.py (line 214) [zero internal callers found — not proven externally exposed; verify dead-code vs runtime entry] — HTTP request via urllib.request.urlopen to non-literal URL — allowlist before fetching.
• 🔴 Review authentication changes with a security-aware engineer
• 🔴 Test payment flows end-to-end in staging before merging
• 🟡 Verify input validation still rejects malformed and malicious input
• 🟡 Check for SQL injection risks and verify query parameterization
• 🟡 Test affected entry points manually: get_document, target_name, get_document_file
• 💬 Verify behavior of downstream sensitive functions: read_file, process_payment, login_user
• 🔴 Require security team sign-off before merging

📊 Analysis confidence: High · 1100 nodes · 5437ms

• Python, Ruby, JavaScript use dynamic typing — cross-file call edges are best-effort (may miss some relationships)
• Graph has 1100 nodes and 168 edges — well-connected codebase
• 176 symbols changed, 13 upstream nodes analyzed

Suggestions to improve accuracy:

• Add type annotations (Python) or use TypeScript (JavaScript) for more precise analysis

---

_{Arbor · View full report → · 5437ms · 1100 nodes analyzed · Know what breaks before you merge}