検出された脆弱性への Factory AI と Snyk Studio によるパッチ適用

curl -fsSL https://app.factory.ai/cli | sh

        █████████    █████████     ████████    ███   █████████
        ███    ███   ███    ███   ███    ███   ███   ███    ███
        ███    ███   ███    ███   ███    ███   ███   ███    ███
        ███    ███   █████████    ███    ███   ███   ███    ███
        ███    ███   ███    ███   ███    ███   ███   ███    ███
        ███    ███   ███    ███   ███    ███   ███   ███    ███
        █████████    ███    ███    ████████    ███   █████████

                                v0.19.9

   You are standing in an open terminal. An AI awaits your commands.

     ENTER to send • \ + ENTER for a new line • @ to mention files

    Current folder: /home/owler/Documents/Snyk/snyk-mcp-demos/pygoat

 Auto (Low) - edits and read-only commands  shift+tab cycles  Sonnet 4
╭─────────────────────────────────────────────────────────────────────╮
│ > Try "Search the documentation for this library"                   │
╰─────────────────────────────────────────────────────────────────────╯
 ? for help                                              IDE ◌ | MCP ✓

●  Usage: mcp add [options] <name> <command>

   Add a new MCP server to the configuration

   Arguments:
     name                      Server name
     command                   Command to start the server

   Options:
     -e, --env <key=value...>  Environment variables (can be used multiple
   times)
     --transport <type>        Transport type (defaults to "stdio") (default:
   "stdio")
     -h, --help                display help for command

 shift+tab to cycle modes                                                Sonnet 4
╭────────────────────────────────────────────────────────────────────────────────╮
│ > /mcp add -h                                                                  │
╰────────────────────────────────────────────────────────────────────────────────╯
 ? for help                                                                 IDE ◌

/mcp add SNYK "snyk mcp -t stdio"
●  Starting MCP server "SNYK"...
     Command: snyk
     Args: ["mcp","-t","stdio"]
     Environment variables: none

>  Please run a code scan on the codebase with Snyk.

⛬  I'll help you run a Snyk code scan on the pygoat codebase. Let me first check the
   authentication status and then perform the scan.

 PLAN   Updated: 3 total (2 pending, 1 in progress, 0 completed)

 ○ Check Snyk authentication status
 ○ Run Snyk code scan on pygoat codebase
 ○ Review and report scan results

 [MCP] SNYK:SNYK_AUTH_STATUS 
 ↳stephen.thoemmes

⛬  Great! You're authenticated as stephen.thoemmes. Now I'll run the Snyk code scan on
    the pygoat codebase to identify security vulnerabilities.

 PLAN   Updated: 3 total (1 pending, 1 in progress, 1 completed)

 ○ Check Snyk authentication status
 ○ Run Snyk code scan on pygoat codebase
 ○ Review and report scan results

 [MCP] SNYK:SNYK_CODE_SCAN  (/home/owler/Documents/Snyk/factory/pygoat)
 ↳
 Testing /home/owler/Documents/Snyk/factory/pygoat ...

  ✗ [Low] Use of Hardcoded Credentials 
    Path: introduction/playground/A9/api.py, line 17 
    Info: Do not hardcode credentials in code. Found hardcoded credential used in a 
 condition.

…

  ✗ [High] SQL Injection 
    Path: introduction/views.py, line 871 
    Info: Unsanitized input from an HTTP parameter flows into 
 introduction.models.sql_lab_table.objects.raw, where it is used in an SQL query. This 
 may result in an SQL Injection vulnerability.

…

 ✔ Test completed

 Organization:      stephen.thoemmes
 Test type:         Static code analysis
 Project path:      /home/owler/Documents/Snyk/factory/pygoat

 Summary:

   101 Code issues found
   15 [High]   44 [Medium]   42 [Low] 

 PLAN   Updated: 3 total (0 pending, 0 in progress, 3 completed)

 ○ Check Snyk authentication status
 ○ Run Snyk code scan on pygoat codebase
 ○ Review and report scan results

⛬  The Snyk code scan has completed successfully! Here's a summary of the security
   findings:

   Scan Results Summary

   Total Issues Found: 101
   •  15 High severity vulnerabilities
   •  44 Medium severity vulnerabilities
   •  42 Low severity vulnerabilities

   Key High-Severity Issues Found:
   1. SQL Injection - Multiple instances in views.py
   2. Code Injection - eval() usage with unsanitized input
   3. Command Injection - subprocess.Popen with unsanitized input
   4. Path Traversal - File operations with unsanitized paths
   5. XML External Entity (XXE) Injection - Insecure XML parsing
   6. Deserialization vulnerabilities - pickle.loads and yaml.load with untrusted data
   7. Hardcoded cryptographic keys - JWT keys hardcoded in source
   8. Hardcoded secrets - Non-cryptographic secrets in code

   Medium/Low Severity Issues:
   •  Hardcoded passwords and credentials
   •  CSRF protection disabled on multiple endpoints
   •  Insecure cookie configurations (missing HttpOnly/Secure flags)
   •  Weak hashing algorithms (MD5)
   •  Debug mode enabled in production
   •  SSRF vulnerabilities

   This is a comprehensive security assessment showing that pygoat (being a
   deliberately vulnerable application for educational purposes) contains numerous
   intentional security flaws across all severity levels, making it an excellent
   training platform for learning about web application security vulnerabilities.