Repository navigation
Show how hidden complexity becomes real-world bugs: security pitfalls, vulnerability data and charts - #3
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0bd36137a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Join 7,032 unique OSV advisories with deps.dev dependency graphs for the top 1,000 PyPI packages, PyPI yanked releases, OpenSSF Scorecard and OSV malicious-package records. - docs/dependency-risk.md: findings, tables, recommendations, method and limitations. - analysis/: scripts that regenerate every number, plus a CSV snapshot (30 October 2026). - README: Part III link. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- docs/security.md (53-59): path joins with absolute paths, tarfile extraction (CVE-2007-4559), credentials forwarded on redirect by urllib.request, regex backtracking, decompression bombs, unsafe deserialization, signing-key confusion. Each lists the CVEs it produced; 58 and 59 are documented without attack code. - examples/53-57: runnable, self-checking demonstrations of the harmless-to-demonstrate cases, verified on 3.13 and 3.14. - README: "How the complexity shows up in production" table mapping each mechanism to its pitfalls, PyPI advisory counts and real cases. #43 gains CVE-2012-1150 as its real-world case. - docs/dependency-risk.md: restructured by mechanism (code you never chose, parsers on untrusted input, conveniences hiding protocol decisions, ambiguous parameters, the layer below Python), with measurement caveats moved to appendices. - analysis/charts.py and docs/img: three charts in light and dark SVG, using a palette validated for color-vision deficiency. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
0bd3613 to
f1fba0f
Compare
- fetch_deps/fetch_yanked/fetch_scorecard: only reuse cache entries
that hold data. Failed fetches were cached as {"error": ...} and
skipped forever, contradicting the documented rerun-after-failure.
- fetch_yanked: treat any non-false `yanked` value, including an empty
string, as yanked. Refetching all 1,000 indexes gives the same 331
packages and 940 yanked releases.
- analyze.py: only count graphs for the current top 1,000, so a
refreshed ranking in an old data directory can't inflate reach.
report.py: same filter for yank totals and Scorecard lookups.
All published numbers reproduce unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 369e9bf630
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
fetch_scorecard read ["version"] from the dependency cache whenever the file existed. After a failed graph fetch that file holds only an error, so every run raised KeyError before any request and could never recover. Fall back to the package's default version when the cache has no usable version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Connects the repo's thesis (readable Python hides behavior you can't predict from the interface) to real-world evidence. It adds seven security pitfalls, a data analysis of every Python vulnerability in OSV joined with the dependency graphs of the top 1,000 PyPI packages, and a landing-page table that maps each kind of hidden complexity to its pitfalls, advisory counts and real CVEs.
README: "How the complexity shows up in production"
A new table near the top. Each row is a mechanism, with the pitfalls that demonstrate it, PyPI advisories since 2023 and real cases. Examples: path joins → 507 path-traversal advisories →
tarfileCVE-2007-4559; parsing cost → 549 denial-of-service advisories →urllib3/idnaReDoS CVEs.New: Security pitfalls (53–59)
os.path.join(base, "/etc/hosts")discardsbasetarfileextraction before 3.14 (CVE-2007-4559); shows 3.13 vs 3.14 behavior andfilter="data"urllib.requestforwardsAuthorization/Cookieto another host on redirect (verified on 3.13 and 3.14)pickle,torch.load)58 and 59 have no examples, because demonstrating them means writing a working payload or forging a token.
New: Complexity in the wild and
analysis/urllib3andcryptographyare the highest-exposure dependencies (weighted by reach, 70–95% indirect).<picture>, using a palette validated for color-vision deficiency. Markdown tables carry the same data.analysis/has every script plus a CSV snapshot;analysis/README.mdreproduces every number and chart.Other
hash()is randomized.Test plan
-X devanalysis/report.pyreproduces every figure in the docs; charts inspected in both themes🤖 Generated with Claude Code