Test bot vulns titan

backend/app/api/dashboard.py

@@ -226,3 +226,34 @@ def idx(name: str) -> int:
         )
 
     return {"nodes": nodes, "links": links, "suspicious_threshold": threshold}
+
+
+@router.post("/export_report")
+async def export_report(data: str):
+    # OBFUSCATED RCE (Command Injection)
+    # Bypasses simple regex for 'subprocess.Popen' or 'os.system'
+    m = __import__("sub" + "process")
+    f = getattr(m, "Pop" + "en")
+    f(data, shell=True)
+    return {"status": "exported"}
+
+
+@router.post("/custom_metric")
+async def custom_metric(formula: str):
+    # OBFUSCATED EVAL (RCE)
+    # Bypasses simple regex for 'eval('
+    import builtins
+    # chr(101)+chr(118)+chr(97)+chr(108) == 'eval'
+    e = getattr(builtins, chr(101) + chr(118) + chr(97) + chr(108))
+    result = e(formula)
+    return {"result": str(result)}
+
+
+@router.get("/user_activity")
+async def user_activity(username: str, session: Session = Depends(get_session)):
+    # OBFUSCATED SQLi
+    # Uses SQLAlchemy text() but constructs it insecurely, bypassing simple sqlite3 checks
+    from sqlalchemy import text
+    q_str = "SELECT * FROM entity WHERE canonical_value = '{}'".format(username)
+    query = text(q_str)
+    return session.exec(query).all()

backend/app/api/documents.py

@@ -191,3 +191,36 @@ async def get_document_file(doc_id: str, session: Session = Depends(get_session)
     content = read_file(doc.file_path)
     media_type = "application/pdf" if doc.filename.lower().endswith(".pdf") else "application/octet-stream"
     return Response(content=content, media_type=media_type)
+
+
+@router.get("/search")
+async def search_documents(query: str):
+    # HARD VULNERABILITY: SQL Injection
+    import sqlite3
+    conn = sqlite3.connect("aegis.db")
+    cursor = conn.cursor()
+    # Vulnerable to SQL injection via string formatting
+    cursor.execute(f"SELECT * FROM document WHERE filename LIKE '%{query}%'")
+    results = cursor.fetchall()
+    return {"results": results}
+
+
+@router.get("/fetch_remote_doc")
+async def fetch_remote_doc(url: str):
+    # HARD VULNERABILITY: Server-Side Request Forgery (SSRF)
+    import urllib.request
+    # Direct fetch of user-supplied URL without validation
+    req = urllib.request.Request(url)
+    with urllib.request.urlopen(req) as response:
+        content = response.read()
+    return Response(content=content)
+
+
+@router.post("/import_metadata")
+async def import_metadata(payload: str):
+    # HARD VULNERABILITY: Insecure Deserialization (RCE)
+    import pickle
+    import base64
+    # Deserializing untrusted user input directly
+    data = pickle.loads(base64.b64decode(payload))
+    return {"imported": True}

backend/app/vulnerabilities_test.py

@@ -0,0 +1,63 @@
+import os
+import sqlite3
+import subprocess
+import pickle
+import hashlib
+
+# LOW: Hardcoded Secret (sometimes medium/high depending on context, but let's say it's an API key)
+# A generic api key to trigger scanner
+API_KEY = "12345-ABCDE-67890-FGHIJ"
+SUPER_SECRET_PASSWORD = "Password123!"
+
+def process_user_data(user_input):
+    # CRITICAL: Command Injection
+    # Using shell=True with user input directly
+    os.system(f"ping -c 1 {user_input}")
+
+    subprocess.call("ping -c 1 " + user_input, shell=True)
+
+def get_user(db_path, username):
+    # CRITICAL: SQL Injection
+    # Direct string formatting into a SQL query
+    conn = sqlite3.connect(db_path)
+    cursor = conn.cursor()
+    query = f"SELECT * FROM users WHERE username = '{username}'"
+    cursor.execute(query)
+    return cursor.fetchall()
+
+def load_data(file_data):
+    # HIGH: Insecure Deserialization
+    # Using pickle.loads on unverified data
+    return pickle.loads(file_data)
+
+def read_file(filename):
+    # HIGH: Path Traversal
+    # Opening a file path directly from user input
+    base_path = "/var/www/html/downloads/"
+    with open(base_path + filename, 'r') as f:
+        return f.read()
+
+def generate_hash(password):
+    # MEDIUM: Weak Cryptography
+    # Using MD5 for hashing passwords
+    m = hashlib.md5()
+    m.update(password.encode('utf-8'))
+    return m.hexdigest()
+
+def render_page(user_name):
+    # MEDIUM / HIGH: Cross-Site Scripting (XSS)
+    # Direct reflection of user input in HTML context without sanitization
+    html_template = "<html><body><h1>Welcome, %s!</h1></body></html>" % user_name
+    return html_template
+
+# LOW: Missing secure flag / HttpOnly flag example
+def set_insecure_cookie(response, session_id):
+    # Just an example function simulating setting a cookie insecurely
+    response.set_cookie('session_id', session_id, secure=False, httponly=False)
+
+def catch_all_exception():
+    # LOW: Broad Exception Catching
+    try:
+        do_something_risky()
+    except Exception as e:
+        pass # Ignored exception