Skip to content

Security: msqd/anymodel

Security

SECURITY.md

Security Audit Report - AnyModel Data Mapper Library

Executive Summary

Comprehensive security audit conducted on 2025-08-21. Identified 12 security vulnerabilities ranging from Critical to Low severity. The library currently has 0% security test coverage.

Critical Issues

1. Unsafe Pickle Deserialization

  • Location: anymodel/storages/filesystem.py:8,47,53,67
  • CVSS Score: 9.8 (Critical)
  • Impact: Remote Code Execution (RCE) via malicious pickle files
  • Fix: Replace pickle with JSON serialization
  • Tests: Missing - write test for deserialization safety

High Severity Issues

2. Path Traversal Vulnerability

  • Location: anymodel/storages/filesystem.py:24-30,43,62
  • CVSS Score: 7.5 (High)
  • Impact: Write/read files outside intended directory via "../" in entity IDs
  • Fix: Validate and sanitize file paths, use pathlib.Path.resolve()
  • Tests: Missing - write test for path traversal attempts

3. Hardcoded Database Credentials

  • Location: docker-compose.yml:8-10
  • Impact: Exposes production database if default config used
  • Fix: Use environment variables for credentials
  • Tests: N/A - configuration issue

4. SQL Injection Risk in Relations

  • Location: anymodel/types/relations.py:37,42
  • CVSS Score: 8.1 (High)
  • Impact: SQL injection via unsanitized entity IDs in dynamic queries
  • Fix: Use parameterized queries consistently
  • Tests: Missing - write SQL injection test cases

5. Unsafe Entity State Mutation

  • Location: anymodel/types/entity.py:51
  • Impact: Direct dict manipulation bypasses validation
  • Fix: Add validation and use proper setters
  • Tests: Missing - write state manipulation tests

Medium Severity Issues

6. Mass Assignment Vulnerability

  • Location: examples/crm/crm/views/contacts.py:35-36,44
  • CVSS Score: 6.5 (Medium)
  • Impact: Modify unintended entity fields via JSON payloads
  • Fix: Implement field whitelisting in views
  • Tests: Missing - write mass assignment protection tests

7. Missing Input Validation in Mapper

  • Location: anymodel/mapper.py:103-126
  • Impact: Invalid primary keys cause crashes/unexpected behavior
  • Fix: Add comprehensive input validation
  • Tests: Missing - write input validation tests

8. Uncontrolled Database Migrations

  • Location: anymodel/utilities/migrations.py:25-48
  • Impact: Automatic schema changes could cause data loss
  • Fix: Add migration validation and require explicit approval for destructive changes
  • Tests: Missing - write migration safety tests

Low Severity Issues

9. Information Disclosure in Error Messages

  • Location: anymodel/storages/filesystem.py:78
  • Impact: Exposes internal file system paths
  • Fix: Use generic error messages
  • Tests: Missing - write error message sanitization tests

10. Weak Identity Map Implementation

  • Location: anymodel/utilities/identity_map.py:32-33
  • Impact: Simple tuple keys could be manipulated
  • Fix: Use cryptographic hashes for identity keys
  • Tests: Partial coverage - enhance security aspects

11. Missing CORS Security Headers

  • Location: examples/crm/crm/api.py:32
  • Impact: CORS allows all origins (*), insecure for production
  • Fix: Restrict CORS to specific trusted domains
  • Tests: Missing - write CORS configuration tests

12. No Rate Limiting

  • Location: All API endpoints
  • Impact: Enables potential DoS attacks
  • Fix: Implement rate limiting middleware
  • Tests: Missing - write rate limiting tests

Dependency Security Status

All dependencies are currently secure:

  • Pydantic 2.9.2: ✅ Not vulnerable to CVE-2024-3772
  • SQLAlchemy 2.0.36: ✅ No known CVEs
  • Alembic 1.14.0: ✅ No known CVEs
  • psycopg2-binary 2.9.9: ✅ No direct CVEs

Security Test Coverage

Current Coverage: 0%

Critical test gaps:

  • No input validation tests
  • No SQL injection prevention tests
  • No path traversal prevention tests
  • No authentication/authorization tests
  • No serialization security tests

OWASP Top 10 Compliance Status

  • A03 - Injection: ❌ SQL injection risks present
  • A04 - Insecure Design: ❌ Lacks security controls by design
  • A08 - Software and Data Integrity: ❌ Unsafe deserialization
  • A09 - Security Logging: ❌ No security event logging
  • A10 - SSRF: ⚠️ No URL validation in configurations

There aren’t any published security advisories