Benchmark PR 1

[celmis-codereviewer]

Benchmark reproduction of ai-code-review-evaluation#1

[celmis-codereviewer]

❌ CHANGES REQUESTED — blocking findings

Full findings and scope are in the review summary comment on this pull request — one persistent comment, updated in place on every run.

[celmis-codereviewer]

❌ CHANGES REQUESTED — blocking findings

Full findings and scope are in the review summary — one persistent comment, updated in place on every run.

[celmis-codereviewer]

❌ CHANGES REQUESTED — blocking findings

Full findings and scope are in the review summary comment on this pull request — one persistent comment, updated in place on every run.

[celmis-codereviewer]

Why: organization_context is referenced on line 70 without being defined or imported, raising a NameError when evaluated for non-superusers.

🔴 Undefined variable 'organization_context' raises NameError

On line 70, organization_context is accessed to check organization_context.member.has_global_access. However, organization_context is neither defined in this method nor imported in the file, which will cause a NameError whenever a non-superuser request passes optimized_pagination=true.

Suggested change

	use_optimized = request.GET.get("optimized_pagination") == "true"
	enable_advanced = request.user.is_superuser or (hasattr(request, 'organization') and request.organization)

_{agent: defect · rule: defect.undefined-variable · confidence: 0.95}

[celmis-codereviewer]

Why: On line 71, organization_context is referenced but is not defined in the endpoint scope, causing an unhandled NameError crash whenever a non-superuser passes optimized_pagination=true.

🟠 Reference to undefined variable organization_context causes runtime NameError

The variable organization_context is not defined in get(). When request.user.is_superuser is false and a user supplies optimized_pagination=true in the query string, accessing organization_context.member raises an unhandled NameError, resulting in a 500 Internal Server Error response.

Suggested change

	enable_advanced = request.user.is_superuser or organization_context.member.has_global_access
	enable_advanced = request.user.is_superuser or (hasattr(request, 'organization') and request.organization)

_{agent: security · rule: sec.cwe-754 · confidence: 0.95}

[celmis-codereviewer]

Why: On line 183, an attacker-supplied negative offset in the cursor GET parameter with is_prev=True sets start_offset to a negative integer, causing Django ORM to raise an unhandled AssertionError during QuerySet evaluation.

🟠 Negative QuerySet slicing causes unhandled AssertionError and 500 error

Django's QuerySet implementation explicitly forbids negative indexing and raises AssertionError: Negative indexing is not supported. when sliced with a negative integer. Because start_offset is allowed to be negative when cursor.is_prev is True, an attacker can send a cursor with a negative offset to trigger an unhandled exception and deny service on paginated endpoints.

Suggested change

	stop = start_offset + limit + extra
	start_offset = max(0, offset)
	stop = start_offset + limit + extra
	results = list(queryset[start_offset:stop])

_{agent: security · rule: sec.cwe-754 · confidence: 0.95}

[celmis-codereviewer]

Why: When start_offset is assigned a negative offset value on line 183 when cursor.is_prev is True, queryset[start_offset:stop] on line 185 raises AssertionError because Django QuerySets do not support negative slicing.

🟠 Django QuerySet sliced with negative offset raises AssertionError

Django's QuerySet.__getitem__ explicitly checks for negative slice indices and raises AssertionError: Negative indexing is not supported.. When cursor.is_prev is True and offset is negative, start_offset evaluates to a negative number, which causes the queryset slice evaluation on line 185 to fail with an AssertionError.

Suggested change

	start_offset = max(0, offset)
	stop = start_offset + limit + extra
	results = list(queryset[start_offset:stop])

_{agent: defect · rule: defect.invalid-slice · confidence: 0.95}

[celmis-codereviewer]

Why: When get_item_key runs on line 839, self.key is accessed without being initialized in OptimizedCursorPaginator or BasePaginator, raising an AttributeError.

🟠 Undefined self.key attribute accessed in OptimizedCursorPaginator.get_item_key

OptimizedCursorPaginator inherits from BasePaginator, which does not define or set self.key. When pagination builds the item key for a cursor result, getattr(item, self.key) is invoked on line 839, raising AttributeError: 'OptimizedCursorPaginator' object has no attribute 'key'.

Suggested change

	value = getattr(item, self.key)
	def __init__(self, *args, key=None, enable_advanced_features=False, **kwargs):
	super().__init__(*args, **kwargs)
	self.key = key
	self.enable_advanced_features = enable_advanced_features

_{agent: defect · rule: defect.undefined-attribute · confidence: 0.95}

[celmis-codereviewer]

Why: On line 880, an attacker-controlled negative cursor.offset is passed directly as a slice index to queryset, causing Django ORM to raise AssertionError ("Negative indexing is not supported") and crash the endpoint.

🟠 Negative offset slicing in OptimizedCursorPaginator crashes query evaluation

Django ORM QuerySet instances do not support negative slice bounds. When enable_advanced_features is active and cursor.offset < 0, queryset[start_offset:stop] executes negative indexing on the QuerySet, raising an AssertionError and returning an unhandled 500 error to the client.

Suggested change

	start_offset = cursor.offset # Allow negative offsets for advanced pagination
	start_offset = max(0, cursor.offset)
	stop = start_offset + limit + extra
	results = list(queryset[start_offset:stop])

_{agent: security · rule: sec.cwe-754 · confidence: 0.95}

[celmis-codereviewer]

Why: When cursor.offset is negative and enable_advanced_features is True, start_offset is assigned a negative integer on line 880, causing queryset[start_offset:stop] on line 882 to raise an AssertionError because Django QuerySets do not support negative slicing.

🟠 Negative slice index on Django QuerySet in advanced feature branch raises AssertionError

Django's ORM implementation (QuerySet.__getitem__) raises AssertionError: Negative indexing is not supported. when given a slice with a negative start bound. Line 880 sets start_offset = cursor.offset when cursor.offset < 0, so queryset[start_offset:stop] on line 882 will crash with an AssertionError at runtime.

Suggested change

	results = list(queryset[start_offset:stop])
	start_offset = max(0, cursor.offset)
	stop = start_offset + limit + extra
	results = list(queryset[start_offset:stop])

_{agent: defect · rule: defect.invalid-slice · confidence: 0.95}

[celmis-codereviewer]

Why: len(results) on line 891 cannot equal offset + limit + extra when offset is positive because results contains at most limit + extra items, preventing trimming of the trailing element.

🟡 Unreachable condition prevents trimming trailing pagination result when offset is positive

results is fetched via queryset[start_offset:stop], where stop = start_offset + limit + extra. Consequently, len(results) can be at most limit + extra. On line 891, len(results) == offset + limit + extra is checked when cursor.is_prev is true. Whenever offset > 0, offset + limit + extra strictly exceeds limit + extra, so this condition is mathematically impossible to evaluate to True and the extra trailing item is never trimmed.

Suggested change

	elif len(results) == offset + limit + extra:
	elif len(results) == limit + extra:

_{agent: defect · rule: defect.dead-branch · confidence: 0.90}

[celmis-codereviewer]

🤖 Code Review for PR #5

❌ CHANGES REQUESTED — blocking findings

Findings

• 🔴 Critical: 1
• 🟠 Error: 6
• 🟡 Warning: 1

Scope

• Files changed: 3
• Lines: +128 / -10

Performance

• Analysis time: 250.3s · agents: structural, cve, contract, defect, security · tokens: 19,728/20,612

---

_{Powered by Code Analyzer · context: tree-sitter graph + structural, cve, contract, defect, security}