Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python: add new Pandas sinks #15314

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Python: add new Pandas sinks #15314

wants to merge 1 commit into from

Conversation

R3x
Copy link

@R3x R3x commented Jan 12, 2024

Adding support for 2 new sinks in Pandas which can lead to Code Injection.

@R3x R3x requested a review from a team as a code owner January 12, 2024 17:11
@yoff
Copy link
Contributor

yoff commented Jan 16, 2024

Hi @R3x, the code looks good, thanks 👍 Did you mean to have a bug bounty submission associated with this, or should I just write a review right away?

@ghsecuritylab
Copy link
Collaborator

Hello R3x 👋
You have submitted this pull request as a bug bounty report in the github/securitylab repository and therefore this pull request has been put into draft state to give time for the GitHub Security Lab to assess the PR. When GitHub Security Lab has finished assessing your pull request, it will be marked automatically as Ready for review. Until then, please don't change the draft state.

In the meantime, feel free to make changes to the pull request. If you'd like to maximize payout for your this and future submissions, here are a few general guidelines, that we might take into consideration when reviewing a submission.

  • the submission models widely-used frameworks/libraries
  • the vulnerability modeled in the submission is impactful
  • the submission finds new true positive vulnerabilities
  • the submission finds very few false positives
  • code in the submission is easy to read and will be easy to maintain
  • documentation is written clearly, highlighting the impact of the issue it finds and is written without grammatical or other errors. The code samples clearly show the vulnerability
  • the submission includes tests, change note etc.

Please note that these are guidelines, not rules. Since we have a lot of different types of submissions, the guidelines might vary for each submission.

Happy hacking!

@ghsecuritylab ghsecuritylab marked this pull request as draft January 18, 2024 00:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants