Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

[Security] Automated static analysis findings for clips/pattern (academic research)

Aberta
  • Algo errado?
#348 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
25/100
Tipo de issue
Bug
Clareza
Precisa de esclarecimento
Status de atividade
Ativa
Stack de tecnologia
github, python
Domínio
security

Direção de pesquisa

Start by requesting the detailed CodeQL findings mentioned in the report; this issue provides only aggregated counts and no affected files, rules, or reproductions. Review each candidate against the relevant source and determine whether it is a false positive. Done means the findings have been verified and any confirmed issues have a clear remediation path.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Hello maintainers,

We are reaching out as part of an academic study on software security in the open-source Artificial Intelligence (AI) supply chain. As part of this study, we ran automated static analysis on clips/pattern and would like to share the aggregated results with you, so that the project can verify them and act if needed.

Context of the research

This analysis is part of the doctoral thesis "Reducing Software Vulnerabilities in the Artificial Intelligence Supply Chain", developed under a joint supervision (cotutelle) between:

  • Universidade de São Paulo (USP): Programa de Pós-Graduação em Sistemas de Informação (PPgSI), Escola de Artes, Ciências e Humanidades (EACH), Brazil;
  • Nantes Université: LS2N (UMR CNRS 6004), NaoMod team, France.

Researchers:

  • Felipe Cordeiro Alves Dias, PhD candidate (USP / Nantes Université);
  • Prof. Dr. Daniel de Angelis Cordeiro, advisor (EACH-USP);
  • Prof. Dr. Gerson Sunyé, co-advisor (Nantes Université, LS2N / NaoMod).

The methodology and the first results of this study were published at the XXII Brazilian Symposium on Information Systems (SBSI 2026):
https://sol.sbc.org.br/index.php/sbsi/article/view/41368

What we did

On 2026-08-16, a fork of this repository, synchronized with the upstream default branch, was analyzed with GitHub CodeQL (source code), GitHub Dependabot (declared dependencies) and Semgrep Supply Chain (dependencies, including a reachability verdict). No code was executed against any deployment of the project, and no exploitation was attempted.

Aggregated findings
Tool What it analyzes Open findings By severity
CodeQL source code 5 4 high / 1 medium
Dependabot declared Python dependencies 0 -
Semgrep Supply Chain Python dependencies, with reachability 0 (0 reachable) -
Evidence
  • Snapshot of the analysis data: 2026-08-16
  • Analyzed commit(s) of the upstream code: bd5471bf46d0
  • Each identifier below links to its public reference (NVD/GitHub Advisory Database, MITRE CWE, MITRE CAPEC, MITRE ATT&CK, OWASP).
  • CAPEC and ATT&CK entries are derived from the CWEs found, through MITRE's own mappings (CAPEC Related_Weaknesses and Taxonomy_Mappings); they describe how such weaknesses are typically exploited, not attacks observed against this project.
Findings by security standard
CVE / GHSA: vulnerabilities in declared dependencies: none
CWE: weakness types (7)
CAPEC: attack patterns related to the CWEs above (60)
  • CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters (likelihood: Medium, severity: Medium); via CWE-20
  • CAPEC-7: Blind SQL Injection (likelihood: High, severity: High); via CWE-20
  • CAPEC-8: Buffer Overflow in an API Call (likelihood: High, severity: High); via CWE-20
  • CAPEC-9: Buffer Overflow in Local Command-Line Utilities (likelihood: High, severity: High); via CWE-20
  • CAPEC-10: Buffer Overflow via Environment Variables (likelihood: High, severity: High); via CWE-20
  • CAPEC-13: Subverting Environment Variable Values (likelihood: High, severity: Very High); via CWE-20
  • CAPEC-14: Client-side Injection-induced Buffer Overflow (likelihood: Medium, severity: High); via CWE-20
  • CAPEC-22: Exploiting Trust in Client (likelihood: High, severity: High); via CWE-20
  • CAPEC-23: File Content Injection (likelihood: High, severity: Very High); via CWE-20
  • CAPEC-24: Filter Failure through Buffer Overflow (likelihood: High, severity: High); via CWE-20
  • CAPEC-28: Fuzzing (likelihood: High, severity: Medium); via CWE-20
  • CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies (likelihood: High, severity: High); via CWE-20
  • CAPEC-37: Retrieve Embedded Sensitive Data (likelihood: High, severity: Very High); via CWE-312
  • CAPEC-42: MIME Conversion (likelihood: High, severity: High); via CWE-20
  • CAPEC-43: Exploiting Multiple Input Interpretation Layers (likelihood: Medium, severity: High); via CWE-20
  • CAPEC-45: Buffer Overflow via Symbolic Links (likelihood: High, severity: High); via CWE-20
  • CAPEC-46: Overflow Variables and Tags (likelihood: High, severity: High); via CWE-20
  • CAPEC-47: Buffer Overflow via Parameter Expansion (likelihood: Medium, severity: High); via CWE-20
  • CAPEC-52: Embedding NULL Bytes (likelihood: High, severity: High); via CWE-20
  • CAPEC-53: Postfix, Null Terminate, and Backslash (likelihood: High, severity: High); via CWE-20
  • CAPEC-63: Cross-Site Scripting (XSS) (likelihood: High, severity: Very High); via CWE-20
  • CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic (likelihood: High, severity: High); via CWE-20
  • CAPEC-67: String Format Overflow in syslog() (likelihood: High, severity: Very High); via CWE-20
  • CAPEC-71: Using Unicode Encoding to Bypass Validation Logic (likelihood: Medium, severity: High); via CWE-20
  • CAPEC-72: URL Encoding (likelihood: High, severity: High); via CWE-20
  • CAPEC-73: User-Controlled Filename (likelihood: High, severity: High); via CWE-20
  • CAPEC-78: Using Escaped Slashes in Alternate Encoding (likelihood: High, severity: High); via CWE-20
  • CAPEC-79: Using Slashes in Alternate Encoding (likelihood: High, severity: High); via CWE-20
  • CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic (likelihood: High, severity: High); via CWE-20
  • CAPEC-81: Web Server Logs Tampering (likelihood: Medium, severity: High); via CWE-20
  • CAPEC-83: XPath Injection (likelihood: High, severity: High); via CWE-20
  • CAPEC-85: AJAX Footprinting (likelihood: High, severity: Low); via CWE-20
  • CAPEC-88: OS Command Injection (likelihood: High, severity: High); via CWE-20
  • CAPEC-101: Server Side Include (SSI) Injection (likelihood: High, severity: High); via CWE-20
  • CAPEC-104: Cross Zone Scripting (likelihood: Medium, severity: High); via CWE-20
  • CAPEC-108: Command Line Execution through SQL Injection (likelihood: Low, severity: Very High); via CWE-20
  • CAPEC-109: Object Relational Mapping Injection (likelihood: Low, severity: High); via CWE-20
  • CAPEC-110: SQL Injection through SOAP Parameter Tampering (likelihood: High, severity: Very High); via CWE-20
  • CAPEC-120: Double Encoding (likelihood: Low, severity: Medium); via CWE-20
  • CAPEC-135: Format String Injection (likelihood: High, severity: High); via CWE-20
  • ... and 20 more (full list available on request)
MITRE ATT&CK: techniques related to the CAPECs above (11)
  • T1005: Data from Local System; via CAPEC-37
  • T1027: Obfuscated Files or Information; via CAPEC-267
  • T1036.001: Invalid Code Signature; via CAPEC-473
  • T1499: Endpoint Denial of Service; via CAPEC-227
  • T1539: Steal Web Session Cookie; via CAPEC-31
  • T1552.004: Private Keys; via CAPEC-37
  • T1553.002: Code Signing; via CAPEC-473
  • T1562.003: n/a; via CAPEC-13
  • T1574.006: Dynamic Linker Hijacking; via CAPEC-13
  • T1574.007: Path Interception by PATH Environment Variable; via CAPEC-13
  • T1606.001: Web Cookies; via CAPEC-464
OWASP Top 10: risk categories (Semgrep rule metadata): none

Automated tools produce false positives, and a vulnerable dependency is not necessarily exploitable in this project's context (see the reachability column). These numbers should be read as candidates for verification, not as confirmed vulnerabilities.

Recommendations
  1. Verify the findings above; we can share the detailed list privately on request.
  2. Check the latest security reports and advisories relevant to the project's dependencies, such as the GitHub Advisory Database, the NVD, OSV.dev and the OWASP Top 10 for LLM Applications.
  3. If not yet enabled, consider enabling Dependabot alerts, code scanning, secret scanning and Private Vulnerability Reporting in the repository settings.
Ethical principles
  • Defensive purpose only. The goal is to help improve the security of the AI ecosystem; the fork was used exclusively for static analysis.
  • No exploitation. No finding was tested against running systems, and no attempt was made to validate credentials or access third-party services.
  • Responsible disclosure. Sensitive details (file paths, line numbers, exploit conditions, and anything related to credentials) are never posted publicly. This report is sent through the repository itself: privately, through GitHub Private Vulnerability Reporting, whenever the project has it enabled, and as a public issue only otherwise.
  • Aggregated publication. Research outputs report results only in aggregated or anonymized form, and never disclose secret values.
  • Voluntary participation. Maintainers are under no obligation to reply. If you prefer not to receive further contact about this study, just say so in this thread and we will not contact you again.

Thank you for maintaining this project. If you have questions about this analysis, you can reply here or contact us at [email protected].

Felipe Cordeiro Alves Dias, on behalf of the research team

Linguagem predominante
Python
Estrelas
8.9k
Forks
1.6k
Nenhum PR com merge em 30d

Preparar o ambiente

Este projeto não oferece contêiner de desenvolvimento, Dockerfile nem guia de contribuição, então a configuração fica por sua conta: comece pelo README e veja nosso guia da primeira contribuição para os passos gerais.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de clips/pattern

Todas as issues de clips/pattern

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.