openqodex 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (90) hide show
  1. package/LICENSE +202 -0
  2. package/NOTICE +35 -0
  3. package/README.md +160 -0
  4. package/demo/baseline/.github/workflows/ci.yml +18 -0
  5. package/demo/baseline/Dockerfile +12 -0
  6. package/demo/baseline/app/__init__.py +0 -0
  7. package/demo/baseline/app/server.py +37 -0
  8. package/demo/baseline/package-lock.json +21 -0
  9. package/demo/baseline/package.json +9 -0
  10. package/demo/baseline/requirements.txt +1 -0
  11. package/demo/baseline/scripts/deploy.sh +13 -0
  12. package/demo/expected.json +126 -0
  13. package/demo/planted/.github/workflows/ci.yml +20 -0
  14. package/demo/planted/Dockerfile +11 -0
  15. package/demo/planted/app/config.py +3 -0
  16. package/demo/planted/app/search.py +17 -0
  17. package/demo/planted/app/server.py +40 -0
  18. package/demo/planted/package-lock.json +21 -0
  19. package/demo/planted/package.json +9 -0
  20. package/demo/planted/scripts/deploy.sh +13 -0
  21. package/dist/bin.js +42546 -0
  22. package/docs/agents.md +121 -0
  23. package/docs/cli.md +161 -0
  24. package/docs/config.md +165 -0
  25. package/docs/custom-scanners.md +164 -0
  26. package/docs/faq.md +54 -0
  27. package/docs/github-action.md +73 -0
  28. package/docs/index.md +29 -0
  29. package/docs/llms.txt +13 -0
  30. package/docs/quickstart.md +82 -0
  31. package/docs/scanners.md +148 -0
  32. package/docs/security.md +74 -0
  33. package/docs/telemetry.md +9 -0
  34. package/lenses/a11y-icon-only-button-no-aria-label.md +51 -0
  35. package/lenses/array-iteration-missing-key-prop.md +31 -0
  36. package/lenses/async-await-in-loop-n-plus-one.md +42 -0
  37. package/lenses/async-click-double-fire-race.md +59 -0
  38. package/lenses/async-floating-promise.md +40 -0
  39. package/lenses/async-promise-all-swallows-errors.md +42 -0
  40. package/lenses/async-unhandled-rejection-in-handler.md +42 -0
  41. package/lenses/auth-missing-on-state-change-route.md +60 -0
  42. package/lenses/auth-role-from-user-input.md +49 -0
  43. package/lenses/auth-timing-attack-password-compare.md +59 -0
  44. package/lenses/cookie-missing-secure-httponly.md +46 -0
  45. package/lenses/cors-wildcard-with-credentials.md +47 -0
  46. package/lenses/crypto-jwt-verify-without-algo-allowlist.md +41 -0
  47. package/lenses/crypto-math-random-for-tokens.md +53 -0
  48. package/lenses/crypto-md5-sha1-for-secrets.md +60 -0
  49. package/lenses/env-vars-read-at-module-top.md +42 -0
  50. package/lenses/eval-on-user-input.md +51 -0
  51. package/lenses/fetch-without-timeout.md +41 -0
  52. package/lenses/id-enumeration-sequential.md +49 -0
  53. package/lenses/interactive-state-decoupled-from-output.md +67 -0
  54. package/lenses/json-parse-no-try-catch.md +41 -0
  55. package/lenses/missing-rate-limit-on-auth.md +49 -0
  56. package/lenses/oauth-scope-wider-than-use.md +79 -0
  57. package/lenses/object-spread-clobber.md +44 -0
  58. package/lenses/open-redirect-from-untrusted-host.md +55 -0
  59. package/lenses/orm-drizzle-on-conflict-clobber.md +47 -0
  60. package/lenses/path-traversal-in-fs-access.md +59 -0
  61. package/lenses/pii-in-url-or-log.md +48 -0
  62. package/lenses/race-check-then-act.md +49 -0
  63. package/lenses/react-dangerously-set-inner-html.md +32 -0
  64. package/lenses/react-fetch-in-effect-without-abort.md +31 -0
  65. package/lenses/react-stale-closure-in-callback.md +28 -0
  66. package/lenses/react-state-set-in-render.md +33 -0
  67. package/lenses/react-use-effect-missing-cleanup.md +29 -0
  68. package/lenses/react-use-effect-missing-deps.md +30 -0
  69. package/lenses/regexp-from-user-input.md +43 -0
  70. package/lenses/return-shape-contract-break.md +71 -0
  71. package/lenses/secrets-logged-in-error-path.md +60 -0
  72. package/lenses/sql-migration-references-later-object.md +47 -0
  73. package/lenses/sql-string-concatenation.md +63 -0
  74. package/lenses/ssrf-server-side-fetch.md +69 -0
  75. package/lenses/supabase-comment-on-function-unqualified.md +37 -0
  76. package/lenses/supabase-function-default-public-execute.md +50 -0
  77. package/lenses/supabase-security-definer-no-search-path.md +34 -0
  78. package/lenses/supabase-single-500-on-no-match.md +65 -0
  79. package/lenses/upsert-state-column.md +57 -0
  80. package/lenses/url-not-encoded-for-user-id.md +78 -0
  81. package/lenses/use-state-default-not-functional.md +30 -0
  82. package/package.json +57 -0
  83. package/skills/openqodex/SKILL.md +141 -0
  84. package/templates/README.md +67 -0
  85. package/templates/claude-code/settings-hook.json +16 -0
  86. package/templates/cline/openqodex.md +9 -0
  87. package/templates/codex/AGENTS-section.md +8 -0
  88. package/templates/codex/hooks.json +16 -0
  89. package/templates/cursor/openqodex.mdc +15 -0
  90. package/toolchain.json +345 -0
@@ -0,0 +1,11 @@
1
+ FROM python:latest
2
+
3
+ RUN apt-get update && apt-get install curl
4
+
5
+ WORKDIR /app
6
+ ADD requirements.txt .
7
+ RUN pip install -r requirements.txt
8
+ COPY app ./app
9
+
10
+ EXPOSE 5000
11
+ CMD ["python", "-m", "flask", "--app", "app.server", "run", "--host", "0.0.0.0"]
@@ -0,0 +1,3 @@
1
+ # Payment settings for the demo shop.
2
+ STRIPE_KEY = "{{GENERATED_SECRET}}"
3
+ CURRENCY = "usd"
@@ -0,0 +1,17 @@
1
+ import sqlite3
2
+
3
+ from flask import Blueprint, jsonify, request
4
+
5
+ search = Blueprint("search", __name__)
6
+
7
+
8
+ @search.get("/search")
9
+ def search_items():
10
+ q = request.args.get("q", "")
11
+ conn = sqlite3.connect("items.db")
12
+ conn.row_factory = sqlite3.Row
13
+ cur = conn.cursor()
14
+ cur.execute(f"SELECT id, name, price FROM items WHERE name = '{q}'")
15
+ rows = cur.fetchall()
16
+ conn.close()
17
+ return jsonify([dict(row) for row in rows])
@@ -0,0 +1,40 @@
1
+ import sqlite3
2
+
3
+ from flask import Flask, jsonify, request
4
+
5
+ from app.search import search
6
+
7
+ app = Flask(__name__)
8
+ app.register_blueprint(search)
9
+
10
+ DATABASE = "items.db"
11
+ PAGE_SIZE = 20
12
+
13
+
14
+ def get_db():
15
+ conn = sqlite3.connect(DATABASE)
16
+ conn.row_factory = sqlite3.Row
17
+ return conn
18
+
19
+
20
+ @app.get("/items")
21
+ def list_items():
22
+ page = max(int(request.args.get("page", "1")), 1)
23
+ offset = page * PAGE_SIZE
24
+ with get_db() as conn:
25
+ rows = conn.execute(
26
+ "SELECT id, name, price FROM items ORDER BY id LIMIT ? OFFSET ?",
27
+ (PAGE_SIZE, offset),
28
+ ).fetchall()
29
+ return jsonify([dict(row) for row in rows])
30
+
31
+
32
+ @app.get("/items/<int:item_id>")
33
+ def get_item(item_id):
34
+ with get_db() as conn:
35
+ row = conn.execute(
36
+ "SELECT id, name, price FROM items WHERE id = ?", (item_id,)
37
+ ).fetchone()
38
+ if row is None:
39
+ return jsonify({"error": "not found"}), 404
40
+ return jsonify(dict(row))
@@ -0,0 +1,21 @@
1
+ {
2
+ "name": "demo-shop",
3
+ "version": "1.0.0",
4
+ "lockfileVersion": 3,
5
+ "requires": true,
6
+ "packages": {
7
+ "": {
8
+ "name": "demo-shop",
9
+ "version": "1.0.0",
10
+ "dependencies": {
11
+ "lodash": "4.17.15"
12
+ }
13
+ },
14
+ "node_modules/lodash": {
15
+ "version": "4.17.15",
16
+ "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
17
+ "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==",
18
+ "license": "MIT"
19
+ }
20
+ }
21
+ }
@@ -0,0 +1,9 @@
1
+ {
2
+ "name": "demo-shop",
3
+ "version": "1.0.0",
4
+ "private": true,
5
+ "description": "Front-end helpers for the demo shop.",
6
+ "dependencies": {
7
+ "lodash": "4.17.15"
8
+ }
9
+ }
@@ -0,0 +1,13 @@
1
+ #!/usr/bin/env bash
2
+ # Copies the app to the deploy folder and lists what was deployed.
3
+ set -euo pipefail
4
+
5
+ DEPLOY_DIR="${DEPLOY_DIR:-/srv/demo}"
6
+
7
+ rm -rf $DEPLOY_DIR/
8
+ mkdir -p "$DEPLOY_DIR"
9
+ cp -R app requirements.txt "$DEPLOY_DIR/"
10
+
11
+ for file in $(ls $DEPLOY_DIR); do
12
+ echo "deployed: $file"
13
+ done