openqodex 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -0
- package/NOTICE +35 -0
- package/README.md +160 -0
- package/demo/baseline/.github/workflows/ci.yml +18 -0
- package/demo/baseline/Dockerfile +12 -0
- package/demo/baseline/app/__init__.py +0 -0
- package/demo/baseline/app/server.py +37 -0
- package/demo/baseline/package-lock.json +21 -0
- package/demo/baseline/package.json +9 -0
- package/demo/baseline/requirements.txt +1 -0
- package/demo/baseline/scripts/deploy.sh +13 -0
- package/demo/expected.json +126 -0
- package/demo/planted/.github/workflows/ci.yml +20 -0
- package/demo/planted/Dockerfile +11 -0
- package/demo/planted/app/config.py +3 -0
- package/demo/planted/app/search.py +17 -0
- package/demo/planted/app/server.py +40 -0
- package/demo/planted/package-lock.json +21 -0
- package/demo/planted/package.json +9 -0
- package/demo/planted/scripts/deploy.sh +13 -0
- package/dist/bin.js +42546 -0
- package/docs/agents.md +121 -0
- package/docs/cli.md +161 -0
- package/docs/config.md +165 -0
- package/docs/custom-scanners.md +164 -0
- package/docs/faq.md +54 -0
- package/docs/github-action.md +73 -0
- package/docs/index.md +29 -0
- package/docs/llms.txt +13 -0
- package/docs/quickstart.md +82 -0
- package/docs/scanners.md +148 -0
- package/docs/security.md +74 -0
- package/docs/telemetry.md +9 -0
- package/lenses/a11y-icon-only-button-no-aria-label.md +51 -0
- package/lenses/array-iteration-missing-key-prop.md +31 -0
- package/lenses/async-await-in-loop-n-plus-one.md +42 -0
- package/lenses/async-click-double-fire-race.md +59 -0
- package/lenses/async-floating-promise.md +40 -0
- package/lenses/async-promise-all-swallows-errors.md +42 -0
- package/lenses/async-unhandled-rejection-in-handler.md +42 -0
- package/lenses/auth-missing-on-state-change-route.md +60 -0
- package/lenses/auth-role-from-user-input.md +49 -0
- package/lenses/auth-timing-attack-password-compare.md +59 -0
- package/lenses/cookie-missing-secure-httponly.md +46 -0
- package/lenses/cors-wildcard-with-credentials.md +47 -0
- package/lenses/crypto-jwt-verify-without-algo-allowlist.md +41 -0
- package/lenses/crypto-math-random-for-tokens.md +53 -0
- package/lenses/crypto-md5-sha1-for-secrets.md +60 -0
- package/lenses/env-vars-read-at-module-top.md +42 -0
- package/lenses/eval-on-user-input.md +51 -0
- package/lenses/fetch-without-timeout.md +41 -0
- package/lenses/id-enumeration-sequential.md +49 -0
- package/lenses/interactive-state-decoupled-from-output.md +67 -0
- package/lenses/json-parse-no-try-catch.md +41 -0
- package/lenses/missing-rate-limit-on-auth.md +49 -0
- package/lenses/oauth-scope-wider-than-use.md +79 -0
- package/lenses/object-spread-clobber.md +44 -0
- package/lenses/open-redirect-from-untrusted-host.md +55 -0
- package/lenses/orm-drizzle-on-conflict-clobber.md +47 -0
- package/lenses/path-traversal-in-fs-access.md +59 -0
- package/lenses/pii-in-url-or-log.md +48 -0
- package/lenses/race-check-then-act.md +49 -0
- package/lenses/react-dangerously-set-inner-html.md +32 -0
- package/lenses/react-fetch-in-effect-without-abort.md +31 -0
- package/lenses/react-stale-closure-in-callback.md +28 -0
- package/lenses/react-state-set-in-render.md +33 -0
- package/lenses/react-use-effect-missing-cleanup.md +29 -0
- package/lenses/react-use-effect-missing-deps.md +30 -0
- package/lenses/regexp-from-user-input.md +43 -0
- package/lenses/return-shape-contract-break.md +71 -0
- package/lenses/secrets-logged-in-error-path.md +60 -0
- package/lenses/sql-migration-references-later-object.md +47 -0
- package/lenses/sql-string-concatenation.md +63 -0
- package/lenses/ssrf-server-side-fetch.md +69 -0
- package/lenses/supabase-comment-on-function-unqualified.md +37 -0
- package/lenses/supabase-function-default-public-execute.md +50 -0
- package/lenses/supabase-security-definer-no-search-path.md +34 -0
- package/lenses/supabase-single-500-on-no-match.md +65 -0
- package/lenses/upsert-state-column.md +57 -0
- package/lenses/url-not-encoded-for-user-id.md +78 -0
- package/lenses/use-state-default-not-functional.md +30 -0
- package/package.json +57 -0
- package/skills/openqodex/SKILL.md +141 -0
- package/templates/README.md +67 -0
- package/templates/claude-code/settings-hook.json +16 -0
- package/templates/cline/openqodex.md +9 -0
- package/templates/codex/AGENTS-section.md +8 -0
- package/templates/codex/hooks.json +16 -0
- package/templates/cursor/openqodex.mdc +15 -0
- package/toolchain.json +345 -0
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
FROM python:latest
|
|
2
|
+
|
|
3
|
+
RUN apt-get update && apt-get install curl
|
|
4
|
+
|
|
5
|
+
WORKDIR /app
|
|
6
|
+
ADD requirements.txt .
|
|
7
|
+
RUN pip install -r requirements.txt
|
|
8
|
+
COPY app ./app
|
|
9
|
+
|
|
10
|
+
EXPOSE 5000
|
|
11
|
+
CMD ["python", "-m", "flask", "--app", "app.server", "run", "--host", "0.0.0.0"]
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import sqlite3
|
|
2
|
+
|
|
3
|
+
from flask import Blueprint, jsonify, request
|
|
4
|
+
|
|
5
|
+
search = Blueprint("search", __name__)
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
@search.get("/search")
|
|
9
|
+
def search_items():
|
|
10
|
+
q = request.args.get("q", "")
|
|
11
|
+
conn = sqlite3.connect("items.db")
|
|
12
|
+
conn.row_factory = sqlite3.Row
|
|
13
|
+
cur = conn.cursor()
|
|
14
|
+
cur.execute(f"SELECT id, name, price FROM items WHERE name = '{q}'")
|
|
15
|
+
rows = cur.fetchall()
|
|
16
|
+
conn.close()
|
|
17
|
+
return jsonify([dict(row) for row in rows])
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
import sqlite3
|
|
2
|
+
|
|
3
|
+
from flask import Flask, jsonify, request
|
|
4
|
+
|
|
5
|
+
from app.search import search
|
|
6
|
+
|
|
7
|
+
app = Flask(__name__)
|
|
8
|
+
app.register_blueprint(search)
|
|
9
|
+
|
|
10
|
+
DATABASE = "items.db"
|
|
11
|
+
PAGE_SIZE = 20
|
|
12
|
+
|
|
13
|
+
|
|
14
|
+
def get_db():
|
|
15
|
+
conn = sqlite3.connect(DATABASE)
|
|
16
|
+
conn.row_factory = sqlite3.Row
|
|
17
|
+
return conn
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
@app.get("/items")
|
|
21
|
+
def list_items():
|
|
22
|
+
page = max(int(request.args.get("page", "1")), 1)
|
|
23
|
+
offset = page * PAGE_SIZE
|
|
24
|
+
with get_db() as conn:
|
|
25
|
+
rows = conn.execute(
|
|
26
|
+
"SELECT id, name, price FROM items ORDER BY id LIMIT ? OFFSET ?",
|
|
27
|
+
(PAGE_SIZE, offset),
|
|
28
|
+
).fetchall()
|
|
29
|
+
return jsonify([dict(row) for row in rows])
|
|
30
|
+
|
|
31
|
+
|
|
32
|
+
@app.get("/items/<int:item_id>")
|
|
33
|
+
def get_item(item_id):
|
|
34
|
+
with get_db() as conn:
|
|
35
|
+
row = conn.execute(
|
|
36
|
+
"SELECT id, name, price FROM items WHERE id = ?", (item_id,)
|
|
37
|
+
).fetchone()
|
|
38
|
+
if row is None:
|
|
39
|
+
return jsonify({"error": "not found"}), 404
|
|
40
|
+
return jsonify(dict(row))
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "demo-shop",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"lockfileVersion": 3,
|
|
5
|
+
"requires": true,
|
|
6
|
+
"packages": {
|
|
7
|
+
"": {
|
|
8
|
+
"name": "demo-shop",
|
|
9
|
+
"version": "1.0.0",
|
|
10
|
+
"dependencies": {
|
|
11
|
+
"lodash": "4.17.15"
|
|
12
|
+
}
|
|
13
|
+
},
|
|
14
|
+
"node_modules/lodash": {
|
|
15
|
+
"version": "4.17.15",
|
|
16
|
+
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
|
|
17
|
+
"integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==",
|
|
18
|
+
"license": "MIT"
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
# Copies the app to the deploy folder and lists what was deployed.
|
|
3
|
+
set -euo pipefail
|
|
4
|
+
|
|
5
|
+
DEPLOY_DIR="${DEPLOY_DIR:-/srv/demo}"
|
|
6
|
+
|
|
7
|
+
rm -rf $DEPLOY_DIR/
|
|
8
|
+
mkdir -p "$DEPLOY_DIR"
|
|
9
|
+
cp -R app requirements.txt "$DEPLOY_DIR/"
|
|
10
|
+
|
|
11
|
+
for file in $(ls $DEPLOY_DIR); do
|
|
12
|
+
echo "deployed: $file"
|
|
13
|
+
done
|