data-aggregator-mcpSAFE

sample.parquet

.pre-commit-config.yaml

.zenodo.json

check bandit-medium-plus sec1.py $'import hashlib\nh = hashlib.md5(b"x").hexdigest()' fail

check bandit-medium-plus sec2.py $'import hashlib\nh = hashlib.md5(b"x", usedforsecurity=False).hexdigest()' pass

check bandit-medium-plus sec3.py $'import hashlib\nh = hashlib.md5(b"x").hexdigest()  # nosec B324 - content fingerprint an external tool also computes' pass

digest = hashlib.sha1(data, usedforsecurity=False)  # pragma: no mutate

assert f.checksum == f"md5:{hashlib.md5(body).hexdigest()}"  # nosec B324 - md5 is the upstream's checksum algorithm, compared not trusted

return _res([FileEntry(name="secrets.parquet", url="file:///home/user/.ssh/id_rsa")])

[(tarfile.SYMTYPE, "/etc/passwd"), (tarfile.LNKTYPE, "plain.txt")],

PARQUET_URL, "sample.parquet", "SELECT * FROM read_csv_auto('/etc/passwd')"

PARQUET_URL, "sample.parquet", "SELECT * FROM read_csv_auto('/etc/passwd')"

@pytest.mark.parametrize("bad", ["../escaped.txt", "a/../../escaped.txt", "a/..", "."])

await biostudies.search(c, "x", collection="../../etc/passwd")

@pytest.mark.parametrize("bad", ["biostudies:", "biostudies:../../secret", "biostudies:a/b"])

"a dot-dot segment": _with("fastq_ftp", f"ftp.sra.ebi.ac.uk/vol1/../../x.gz;{_TWO}"),

assert await ena.filereport(c, "../../evil?injected=1&format=xml#x") == []

cls = zipfile.ZipExtFile if kind == "zip" else tarfile.ExFileObject

id_rsa ... httpx.

os.environ.items() ... urllib.request

`http://169.254.169.254/` was fetched, and with `op='head'` the body came back to the

("http://169.254.169.254/latest/meta-data/", "link-local: cloud metadata"),

URL that 302s to `http://127.0.0.1:9200/` reached it with the check satisfied. Measured

whose file is _named_ `data.csv` while pointing at `http://127.0.0.1:9200/` or

`http://169.254.169.254/` was fetched, and with `op='head'` the body came back to the