GroundTruth-MCPBLOCK

title: "pickle.loads() from untrusted source",

title: "eval() or exec() with dynamic input",

"`eval()` and `exec()` execute arbitrary Python code. If the argument is derived from user input or an external source, an attacker can run any code on the server.",

fix: "Never pass user-controlled data to `eval()` or `exec()`. Use `ast.literal_eval()` for safe parsing of Python literals.",

title: "requests with verify=False — TLS validation disabled",

"Setting `verify=False` disables TLS certificate verification, making the connection vulnerable to man-in-the-middle attacks. An attacker can intercept and modify traffic.",

fix: "Remove `verify=False`. If using a self-signed certificate, pass the CA bundle path: `verify='/path/to/ca-bundle.crt'`.",

docsQuery: "Python requests verify=False TLS SSL certificate security",

/!\[.*?\]\(https?:\/\/[^)]*(?:exfil|steal|leak|callback|webhook|requestbin|hookbin|burp|interact\.sh|oast\.(?:me|site|fun|live|pro)|canarytokens|pipedream\.net|ngrok(?:\.io|-free\.app)|webhook\.site|b

HEALTHCHECK CMD wget -qO- --header="Authorization: Bearer ${GT_AUTH_TOKEN}" "http://127.0.0.1:${GT_HTTP_PORT}/health" || exit 1

const matches = testLine("security", `const apiKey = "abcdefghijklmnopqrstuvwxyz1234";`);

.node-version

describe("pickle.loads()", () => {

it("flags pickle.loads()", () => {

expect(matchesPattern("pickle.loads() from untrusted source", `data = pickle.loads(raw_bytes)`)).toBe(true);

it("flags pickle.load()", () => {

describe("eval() / exec()", () => {

it("flags eval()", () => {

it("flags hashlib.md5()", () => {

`hashed = hashlib.md5(password.encode()).hexdigest()`,

it("flags hashlib.sha1()", () => {

`h = hashlib.sha1(data)`,

import { extractRelevantContent, tokenize } from "../../utils/extract.js";

import { sanitizeContent } from "../../utils/sanitize.js";

import { extractRelevantContent } from "../../utils/extract.js";