pilot e2e: buggy file for AI review #1

2026-08-17T18:22:43Z

gitea_admin commented

2026-08-17 18:22:43 +00:00

Test PR to validate the pragent pilot end-to-end. Contains intentional bugs (SQL concat, == token compare, mutable default arg). Safe to close after review.

gitea_admin added 1 commit 2026-08-17 18:22:44 +00:00

test: add buggy file for pilot e2e review

AI Review / review (pull_request) Successful in 17s

Details

7257de45c0

pragent-bot bot added the AI-REVIEW label 2026-08-17 18:22:48 +00:00

pragent-bot bot reviewed 2026-08-17 18:23:04 +00:00

pragent-bot bot left a comment

🤖 AI Review · pragent pilot · glm-5.2:cloud · 7257de45

[high] test_review_target.py:5 — SQL injection vulnerability via string concatenation. Use parameterized queries (e.g., conn.execute("SELECT * FROM users WHERE id = ?", (user_id,))).
[medium] test_review_target.py:9 — Token comparison using == is vulnerable to timing attacks. Use hmac.compare_digest().
[medium] test_review_target.py:13 — Mutable default argument [] retains state across function calls. Use items=None and initialize as items = [] inside the function.

🤖 **AI Review** · pragent pilot · glm-5.2:cloud · `7257de45` - [high] test_review_target.py:5 — SQL injection vulnerability via string concatenation. Use parameterized queries (e.g., `conn.execute("SELECT * FROM users WHERE id = ?", (user_id,))`). - [medium] test_review_target.py:9 — Token comparison using `==` is vulnerable to timing attacks. Use `hmac.compare_digest()`. - [medium] test_review_target.py:13 — Mutable default argument `[]` retains state across function calls. Use `items=None` and initialize as `items = []` inside the function.

gitea_admin closed this pull request

2026-08-17 18:23:59 +00:00

gitea_admin referenced this issue from a commit

2026-08-20 16:19:02 +00:00

feat(review): equivalent provider price + enriched .pr-review.json schema