{ "findings": [ { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/database/repositories.py:52", "function_name": null, "line": 52, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 4.3, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 52; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [ { "access_declared": false, "access_evidence": [ "network entry file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "route", "line": null, "name": "network_surface", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:route:public", "rationale": "route surface classified as public at network_request", "registered_by": "", "trust_boundary": "network_request" }, { "access_declared": false, "access_evidence": [ "parser/deserialization file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "parser", "line": null, "name": "parser_input", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:parser:public", "rationale": "parser surface classified as public at attacker_controlled_input", "registered_by": "", "trust_boundary": "attacker_controlled_input" } ], "reachability_status": "inferred-file-surface", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "crypto", "injection", "network_entry", "parser" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/database/repositories.py:73", "function_name": null, "line": 73, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 4.3, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 73; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [ { "access_declared": false, "access_evidence": [ "network entry file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "route", "line": null, "name": "network_surface", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:route:public", "rationale": "route surface classified as public at network_request", "registered_by": "", "trust_boundary": "network_request" }, { "access_declared": false, "access_evidence": [ "parser/deserialization file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "parser", "line": null, "name": "parser_input", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:parser:public", "rationale": "parser surface classified as public at attacker_controlled_input", "registered_by": "", "trust_boundary": "attacker_controlled_input" } ], "reachability_status": "inferred-file-surface", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "crypto", "injection", "network_entry", "parser" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/database/repositories.py:80", "function_name": null, "line": 80, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 4.3, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 80; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [ { "access_declared": false, "access_evidence": [ "network entry file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "route", "line": null, "name": "network_surface", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:route:public", "rationale": "route surface classified as public at network_request", "registered_by": "", "trust_boundary": "network_request" }, { "access_declared": false, "access_evidence": [ "parser/deserialization file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "parser", "line": null, "name": "parser_input", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:parser:public", "rationale": "parser surface classified as public at attacker_controlled_input", "registered_by": "", "trust_boundary": "attacker_controlled_input" } ], "reachability_status": "inferred-file-surface", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "crypto", "injection", "network_entry", "parser" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/database/repositories.py:3024", "function_name": null, "line": 3024, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 4.3, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 3024; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [ { "access_declared": false, "access_evidence": [ "network entry file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "route", "line": null, "name": "network_surface", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:route:public", "rationale": "route surface classified as public at network_request", "registered_by": "", "trust_boundary": "network_request" }, { "access_declared": false, "access_evidence": [ "parser/deserialization file tag" ], "access_level": "public", "conditions": [], "defines_handler": true, "end_line": null, "function_name": null, "kind": "parser", "line": null, "name": "parser_input", "path": "src/malla/database/repositories.py", "provenance": "entrypoint:parser:public", "rationale": "parser surface classified as public at attacker_controlled_input", "registered_by": "", "trust_boundary": "attacker_controlled_input" } ], "reachability_status": "inferred-file-surface", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "crypto", "injection", "network_entry", "parser" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/mqtt_capture.py:344", "function_name": null, "line": 344, "path": "src/malla/mqtt_capture.py", "proposed_snippet": null, "ranking_priority": 1.5, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 344; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "auth_boundary", "crypto", "injection", "network_entry", "parser" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/services/analytics_service.py:182", "function_name": null, "line": 182, "path": "src/malla/services/analytics_service.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 182; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/services/analytics_service.py:250", "function_name": null, "line": 250, "path": "src/malla/services/analytics_service.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 250; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/services/analytics_service.py:443", "function_name": null, "line": 443, "path": "src/malla/services/analytics_service.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 443; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/services/analytics_service.py:493", "function_name": null, "line": 493, "path": "src/malla/services/analytics_service.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 493; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/services/gateway_service.py:205", "function_name": null, "line": 205, "path": "src/malla/services/gateway_service.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 205; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/utils/node_utils.py:225", "function_name": null, "line": 225, "path": "src/malla/utils/node_utils.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 225; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:src/malla/utils/node_utils.py:305", "function_name": null, "line": 305, "path": "src/malla/utils/node_utils.py", "proposed_snippet": null, "ranking_priority": 1.0, "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 305; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "injection" ], "title": "Python SQL string composition needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "python-ssti:tests/conftest/test_server.py:97", "function_name": null, "line": 97, "path": "tests/conftest/test_server.py", "proposed_snippet": null, "ranking_priority": 1.5, "rationale": "Static pattern python-ssti (CWE-94) matched render_template_string on line 97; manual verification still required.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "auth_boundary", "filesystem_entry", "injection", "network_entry" ], "title": "Python server-side template injection needs review" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:run_tests.py:19:os.system", "function_name": null, "line": 19, "path": "run_tests.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink os.system reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "critical", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: os.system" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/packet_repository_optimized.py:144:execute", "function_name": null, "line": 144, "path": "src/malla/database/packet_repository_optimized.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/packet_repository_optimized.py:316:execute", "function_name": null, "line": 316, "path": "src/malla/database/packet_repository_optimized.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:301:execute", "function_name": null, "line": 301, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:536:execute", "function_name": null, "line": 536, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:790:execute", "function_name": null, "line": 790, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:1089:execute", "function_name": null, "line": 1089, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:2133:execute", "function_name": null, "line": 2133, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:2739:execute", "function_name": null, "line": 2739, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/database/repositories.py:3059:execute", "function_name": null, "line": 3059, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/services/analytics_service.py:139:execute", "function_name": null, "line": 139, "path": "src/malla/services/analytics_service.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/services/analytics_service.py:343:execute", "function_name": null, "line": 343, "path": "src/malla/services/analytics_service.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink execute reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: execute" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/direct_receptions.js:73:outbound.request", "function_name": null, "line": 73, "path": "src/malla/static/js/direct_receptions.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink outbound.request reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: outbound.request" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/node-cache.js:117:outbound.request", "function_name": null, "line": 117, "path": "src/malla/static/js/node-cache.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink outbound.request reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: outbound.request" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/node-picker.js:581:outbound.request", "function_name": null, "line": 581, "path": "src/malla/static/js/node-picker.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink outbound.request reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: outbound.request" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:41:prototype.merge", "function_name": null, "line": 41, "path": "src/malla/static/js/url-filter-manager.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink prototype.merge reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "info", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: prototype.merge" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:110:outbound.request", "function_name": null, "line": 110, "path": "src/malla/static/js/url-filter-manager.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink outbound.request reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: outbound.request" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:171:outbound.request", "function_name": null, "line": 171, "path": "src/malla/static/js/url-filter-manager.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink outbound.request reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: outbound.request" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:183:outbound.request", "function_name": null, "line": 183, "path": "src/malla/static/js/url-filter-manager.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink outbound.request reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: outbound.request" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:279:prototype.merge", "function_name": null, "line": 279, "path": "src/malla/static/js/url-filter-manager.js", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink prototype.merge reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "info", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: prototype.merge" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:src/malla/web_ui.py:207:html.unescaped", "function_name": null, "line": 207, "path": "src/malla/web_ui.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink html.unescaped reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: html.unescaped" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:tests/conftest.py:119:path.open", "function_name": null, "line": 119, "path": "tests/conftest.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink path.open reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: path.open" }, { "confidence": "medium", "evidence_level": "static_corroboration", "finding_id": "overlay-coverage:tests/conftest/test_server.py:67:path.open", "function_name": null, "line": 67, "path": "tests/conftest/test_server.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "uninventoried sink path.open reached from parameter", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "overlay-originated" ], "title": "Overlay coverage: path.open" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:217:identity_constraint", "function_name": "api_nodes", "line": 217, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 0.3, "rationale": "protected_read on a resource in api_nodes is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "obligation:protected_read", "discharger:identity_constraint", "obligation_evidence:function_local" ], "title": "Obligation not discharged: protected_read on a resource without identity_constraint" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:267:identity_constraint", "function_name": "api_nodes_search", "line": 267, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 0.3, "rationale": "protected_read on a resource in api_nodes_search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "obligation:protected_read", "discharger:identity_constraint", "obligation_evidence:function_local" ], "title": "Obligation not discharged: protected_read on a resource without identity_constraint" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:374:identity_constraint", "function_name": "api_gateways_search", "line": 374, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 0.3, "rationale": "protected_read on a resource in api_gateways_search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "obligation:protected_read", "discharger:identity_constraint", "obligation_evidence:function_local" ], "title": "Obligation not discharged: protected_read on a resource without identity_constraint" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:386:identity_constraint", "function_name": "api_gateways_search", "line": 386, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 0.3, "rationale": "protected_read on a resource in api_gateways_search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "obligation:protected_read", "discharger:identity_constraint", "obligation_evidence:function_local" ], "title": "Obligation not discharged: protected_read on a resource without identity_constraint" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:895:identity_constraint", "function_name": "api_traceroute_hops_nodes", "line": 895, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 0.3, "rationale": "protected_read on a resource in api_traceroute_hops_nodes is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "obligation:protected_read", "discharger:identity_constraint", "obligation_evidence:function_local" ], "title": "Obligation not discharged: protected_read on a resource without identity_constraint" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:896:identity_constraint", "function_name": "api_traceroute_hops_nodes", "line": 896, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 0.3, "rationale": "protected_read on a resource in api_traceroute_hops_nodes is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "high", "status": "enabled", "tags": [ "obligation:protected_read", "discharger:identity_constraint", "obligation_evidence:function_local" ], "title": "Obligation not discharged: protected_read on a resource without identity_constraint" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/config.py:88", "function_name": null, "line": 88, "path": "src/malla/config.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "Comment at line 88 states 'Basic builtin types are fine to eval() in this restricted context.' eval() on configuration-derived strings is a code-execution sink if the config file or environment can be influenced. Confirmed the eval usage exists; the exact coercion scope was not fully read.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:code_execution" ], "title": "eval() used for config value coercion" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/database/packet_repository_optimized.py:311", "function_name": null, "line": 311, "path": "src/malla/database/packet_repository_optimized.py", "proposed_snippet": null, "ranking_priority": 0.0, "rationale": "Same pattern as repositories.py: order_by: str = \"timestamp\" (line 23) is interpolated into f\"... ORDER BY {order_by} {order_dir.upper()}\" (line 311), with where_clause also f-string built (lines 100-139, 295, 310). Identifier-position interpolation is injection-prone unless callers enforce an allowlist.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:sql_injection" ], "title": "order_by/order_dir interpolated into SQL ORDER BY clause" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/database/repositories.py:152", "function_name": null, "line": 152, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 18.7715, "rationale": "get_packets accepts order_by: str = \"timestamp\" and the query is built with f-string interpolation ({where_clause} and ORDER BY {order_by} {order_dir.upper()} at line 296 area). If order_by/order_dir reach this from request args without an allowlist, this is SQL injection via identifier position. Confirmed the f-string query construction exists in this file; the caller-side validation was not established by the tools.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:sql_injection" ], "title": "order_by parameter interpolated into SQL ORDER BY clause" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/database/repositories.py:53", "function_name": null, "line": 53, "path": "src/malla/database/repositories.py", "proposed_snippet": null, "ranking_priority": 18.7715, "rationale": "get_stats builds gateway_filter = \" AND gateway_id = ?\" and interpolates it into an f-string query (lines 53, 74, 81). The fragment itself is a constant with a bound parameter, so this is low risk, but it is the same f-string SQL construction pattern flagged across the file and worth confirming no caller-controlled fragment is ever substituted.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:sql_injection" ], "title": "f-string SQL with gateway_filter fragment in DashboardRepository.get_stats" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/mqtt_capture.py:157", "function_name": null, "line": 157, "path": "src/malla/mqtt_capture.py", "proposed_snippet": null, "ranking_priority": 17.2018, "rationale": "decrypt_packet constructs a Cipher (line 157) and decrypts attacker-reachable MQTT payloads (try_decrypt_mesh_packet, line 175; called from the capture loop around line 1063). Decrypted bytes are then ParseFromString'd as protobuf (line 241). This is the crypto/network_entry/parser hotspot; the decryption path handles untrusted input and feeds a protobuf parser.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:crypto" ], "title": "AES decryption of network-received MQTT payloads" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/mqtt_capture.py:241", "function_name": null, "line": 241, "path": "src/malla/mqtt_capture.py", "proposed_snippet": null, "ranking_priority": 17.2018, "rationale": "decoded_data.ParseFromString(decrypted_payload) parses bytes derived from network MQTT traffic after decryption. Protobuf parsing of untrusted input is the parser sink in this high-complexity module; malformed input is caught (parse_error handling at line 260) but the parse itself operates on attacker-influenced bytes.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:parser" ], "title": "Protobuf ParseFromString on decrypted network payload" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/routes/api_routes.py:88", "function_name": null, "line": 88, "path": "src/malla/routes/api_routes.py", "proposed_snippet": null, "ranking_priority": 16.79, "rationale": "api_analytics (line 88) reads gateway_id, from_node, hop_count from request.args and forwards to AnalyticsService.get_analytics_data. api_packets (line 111) similarly builds filters from request args. These are the network_entry points feeding the repository query builders flagged above; whether the args reach order_by/where fragments was not established by the tools.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:sql_injection" ], "title": "api_analytics route passes request args into service layer" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/routes/packet_routes.py:1369", "function_name": null, "line": 1369, "path": "src/malla/routes/packet_routes.py", "proposed_snippet": null, "ranking_priority": 17.7787, "rationale": "packet_detail (line 1369) and packets (line 1347) are the flagged high-band functions in this 1202-LOC module. get_packet_details (line 24) executes parameterized SQL (WHERE id = ?, line 41) which is safe, but the route layer builds filters and calls repositories; the complexity/nesting (10) makes filter-construction paths worth auditing for identifier interpolation. Confirmed the route definitions and the parameterized query.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:sql_injection" ], "title": "packet_detail route with high nesting and DB access" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/static/js/location-cache.js:18", "function_name": null, "line": 18, "path": "src/malla/static/js/location-cache.js", "proposed_snippet": null, "ranking_priority": 18.0874, "rationale": "location-cache.js parses localStorage (JSON.parse(raw), line 18) and returns parsed.locations, used for map/coordinate rendering. Same untrusted-storage deserialization pattern as node-cache.js; no validation of the parsed object shape beyond a typeof check.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:untrusted_deserialization" ], "title": "JSON.parse of localStorage cache without schema validation" }, { "confidence": "low", "evidence_level": "suspicion", "finding_id": "tool-hunter:src/malla/static/js/node-cache.js:19", "function_name": null, "line": 19, "path": "src/malla/static/js/node-cache.js", "proposed_snippet": null, "ranking_priority": 18.2639, "rationale": "node-cache.js parses localStorage (JSON.parse(raw), line 19) and returns parsed.nodes, which is then used by getNode/search and rendered elsewhere. localStorage is attacker-writable in XSS scenarios; the parsed node objects flow into UI rendering (innerHTML usage exists in sibling files like node-picker.js/modern-table.js). Deserialization of untrusted storage without validation.", "reachability_conditions": [], "reachability_evidence": [], "reachability_status": "unknown", "rung": "suspicion", "severity": "medium", "status": "enabled", "tags": [ "tool-hunter", "family:untrusted_deserialization" ], "title": "JSON.parse of localStorage cache without schema validation" } ] }