Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions buggy_script.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
import time

# 1. 逻辑/语法错误:函数定义缺少冒号,且缩进不规范
def calculate_discount(price, discount):
final_price = price * (1 - discount)
return final_price

# 2. 陷阱:使用可变对象(列表)作为默认参数
def add_item_to_cart(item, cart=[]):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

默认参数使用可变对象(列表)。每次调用函数时,如果未提供 cart 参数,则使用相同的列表对象,可能导致意外的行为。

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 AI 代码审查发现问题

📋 问题概述

使用可变默认参数(列表)是Python中的经典陷阱。默认参数在函数定义时求值,所有调用共享同一个列表实例,导致意外的数据污染。

📍 问题详情

🟢 问题 1 | 严重程度: LOW | 行号: 9

💬 详细说明:

  • 高风险:后续调用会累积之前调用的数据,导致逻辑错误且难以调试

📝 问题代码:

def add_item_to_cart(item, cart=[]):

💡 修复建议:

将默认参数设为None,并在函数内部初始化新列表

✅ 修复示例:

def add_item_to_cart(item, cart=None):
    if cart is None:
        cart = []
    cart.append(item)
    return cart

cart.append(item)
return cart

class User:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

类的初始化方法拼写错误,应该是 init 而不是 init

# 3. 拼写错误:初始化方法写成了 _init_ 而不是 __init__
def _init_(self, name, age):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

初始化方法拼写错误,应该是 init 而不是 init

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

拼写错误 - __init__方法名拼写错误

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 15

💬 详细说明:

  • 类的初始化方法不会被调用,导致对象初始化失败

💡 修复建议:

将_init_改为__init__

✅ 修复示例:

    def __init__(self, name, age):
        self.name = name
        self.age = age

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

构造函数名称错误。Python中构造函数应为双下划线__init__,单下划线_init_不会被识别为构造函数,导致对象初始化失败。

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 15

💬 详细说明:

  • 严重:对象无法正确初始化,所有属性访问可能返回未定义值

📝 问题代码:

def _init_(self, name, age):

💡 修复建议:

修正为双下划线__init__

✅ 修复示例:

def __init__(self, name, age):

self.name = name
self.age = age

def greet(self):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

尝试将字符串和整数直接连接,会导致 TypeError。

# 4. 类型错误:尝试将字符串和整数直接连接
print("Hello, I am " + self.name + " and I am " + self.age + " years old.")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

类型错误 - 尝试将字符串与整数直接连接

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 21

💬 详细说明:

  • 运行时会抛出TypeError异常

💡 修复建议:

将整数转换为字符串后再进行连接

✅ 修复示例:

        print("Hello, I am " + self.name + " and I am " + str(self.age) + " years old.")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

类型错误:尝试将字符串与整数直接连接。self.age是整数类型,不能与字符串拼接。

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 21

💬 详细说明:

  • 运行时错误:TypeError: can only concatenate str (not "int") to str

📝 问题代码:

        print("Hello, I am " + self.name + " and I am " + self.age + " years old.")

💡 修复建议:

使用f-string格式化或转换整数为字符串

✅ 修复示例:

        print(f"Hello, I am {self.name} and I am {self.age} years old.")


def main():

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

使用了错误的运算符 (^ 是异或而不是幂运算)。

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

在 if 条件中使用了赋值运算符 (=) 而不是比较运算符 (==)。

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

存在 IndexError,循环范围超出了列表长度。

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

存在 ZeroDivisionError,除数为零。

print("Welcome to the shop!")

# 5. 逻辑错误:运算符误用 (^ 在 Python 中是异或,不是幂运算)
square_area = 10 ^ 2
print(f"Area calculation check: {square_area}")

# 6. 语法错误:在 if 条件中使用了赋值运算符 (=) 而不是比较运算符 (==)
user_input = "yes"
if user_input = "yes":
print("User agreed.")

# 7. 运行时错误:IndexError (索引越界)
items = ["Apple", "Banana", "Orange"]
for i in range(len(items) + 1):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

发现 3 个邻近问题(Line 27-37)

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 27

💬 详细说明:

  • 计算结果错误,10^2的结果是8而不是100

💡 修复建议:

使用**运算符进行幂运算

✅ 修复示例:

    square_area = 10 ** 2
🔴 问题 2 | 严重程度: HIGH | 行号: 32

💬 详细说明:

  • 代码无法运行,会抛出语法错误

💡 修复建议:

将赋值运算符改为比较运算符

✅ 修复示例:

    user_input = "yes"
    if user_input == "yes":
        print("User agreed.")
🟡 问题 3 | 严重程度: MEDIUM | 行号: 37

💬 详细说明:

  • 循环访问超出列表范围的索引,导致IndexError异常

💡 修复建议:

修改循环范围以避免访问超出列表长度的索引

✅ 修复示例:

    items = ["Apple", "Banana", "Orange"]
    for i in range(len(items)):
        print(f"Item {i}: {items[i]}")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

发现 3 个邻近问题(Line 27-37)

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 27

💬 详细说明:

  • 中等:计算结果错误,可能导致业务逻辑错误

📝 问题代码:

    square_area = 10 ^ 2

💡 修复建议:

使用**运算符进行幂运算

✅ 修复示例:

    square_area = 10 ** 2
🔴 问题 2 | 严重程度: HIGH | 行号: 32

💬 详细说明:

  • 严重:代码无法解析,程序无法运行

📝 问题代码:

    if user_input = "yes":

💡 修复建议:

将赋值运算符改为比较运算符

✅ 修复示例:

    if user_input == "yes":
🔴 问题 3 | 严重程度: HIGH | 行号: 37

💬 详细说明:

  • 高风险:程序崩溃,可能被利用进行拒绝服务攻击

📝 问题代码:

    for i in range(len(items) + 1):

💡 修复建议:

移除+1,使用range(len(items))

✅ 修复示例:

    for i in range(len(items)):

print(f"Item {i}: {items[i]}")

# 8. 运行时错误:ZeroDivisionError (除以零)
count = 0
total = 100
average = total / count
print("Average: " + average)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Type error: cannot concatenate string and float.

Line 44 attempts to concatenate a string with average (a float), which will raise a TypeError at runtime.

🔎 Proposed fix
-    print("Average: " + average)
+    print("Average: " + str(average))

Or use f-strings:

-    print("Average: " + average)
+    print(f"Average: {average}")
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
print("Average: " + average)
print("Average: " + str(average))
🤖 Prompt for AI Agents
In buggy_script.py around line 44, the print statement concatenates a string
with the float variable `average`, causing a TypeError; update the print to
convert `average` to a string or use an f-string/formatting instead (e.g., use
f"Average: {average}" or "Average: {}".format(average)) so the types are
compatible and no runtime error occurs.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

发现 2 个邻近问题(Line 43-44)

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 43

💬 详细说明:

  • 高风险:程序崩溃,可能被利用进行拒绝服务攻击

📝 问题代码:

    average = total / count

💡 修复建议:

添加除零检查或使用异常处理

✅ 修复示例:

    average = total / count if count != 0 else 0
🟡 问题 2 | 严重程度: MEDIUM | 行号: 44

💬 详细说明:

  • 运行时错误:TypeError: can only concatenate str (not "float") to str

📝 问题代码:

    print("Average: " + average)

💡 修复建议:

使用f-string格式化或转换为字符串

✅ 修复示例:

    print(f"Average: {average}")


# 9. 拼写错误:name 变量拼写错误
if __name__ == "__main__":

mian()

26 changes: 25 additions & 1 deletion c_security_test.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,33 @@ int integer_overflow_vuln(int count, int size) {
return total_bytes;
}

void memoryLeakVuln() {
int* data = new int[100];
if (data == nullptr) return;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

经工具 clang-tidy:readability-braces-around-statements 检出并确认:if语句体应使用大括号包围以提高代码可读性和避免维护错误。

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 22

💬 详细说明:

  • 中等:单行if语句在后续维护中容易出错

📝 问题代码:

    if (data == nullptr) return;

💡 修复建议:

为if语句体添加大括号

✅ 修复示例:

    if (data == nullptr) {
        return;
    }


data[0] = 1;
std::cout << "Memory allocated and leaked." << std::endl;
}
Comment on lines +20 to +26

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

缺少 #include <iostream> 导致编译失败

代码使用了 std::coutstd::endl,但未包含 <iostream> 头文件。这将导致编译错误。

此外,文件扩展名为 .c,但使用了 C++ 特性(newdeletestd::coutnullptr),应将文件重命名为 .cpp

🔧 建议修复:添加缺失的头文件

在文件顶部添加:

 `#include` <stdio.h>
 `#include` <stdlib.h>
 `#include` <string.h>
 `#include` <limits.h>
+#include <iostream>
🧰 Tools
🪛 Cppcheck (2.19.0)

[error] 25-25: Code 'std

(syntaxError)

🤖 Prompt for AI Agents
In `@c_security_test.c` around lines 20 - 26, The function memoryLeakVuln uses C++
features (new, nullptr, std::cout, std::endl) but the file lacks the <iostream>
include and has a .c extension; to fix, add the missing `#include` <iostream> at
the top of the file and rename the source file from .c to .cpp (or alternatively
convert the function to valid C by replacing new/nullptr/std::cout usage),
ensuring memoryLeakVuln compiles as C++ and that std::cout/std::endl are
available.

void memoryLeakVuln2() {
int* data = new int[100];
if (data == nullptr) return;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

经工具 clang-tidy:readability-braces-around-statements 检出并确认:if语句体应使用大括号包围以提高代码可读性和避免维护错误。

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 29

💬 详细说明:

  • 中等:单行if语句在后续维护中容易出错

📝 问题代码:

    if (data == nullptr) return;

💡 修复建议:

为if语句体添加大括号

✅ 修复示例:

    if (data == nullptr) {
        return;
    }


data[0] = 1;
delete[] data;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

缓冲区溢出漏洞 - 使用strcpy函数可能导致缓冲区溢出

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 32

💬 详细说明:

  • 攻击者可以输入超过MAX_BUFFER长度的字符串导致缓冲区溢出,可能执行任意代码

💡 修复建议:

使用strncpy或snprintf等安全函数替代strcpy

✅ 修复示例:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>

#define MAX_BUFFER 10

void buffer_overflow_vuln(char* user_input) {
    char buffer[MAX_BUFFER];
    strncpy(buffer, user_input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
}

std::cout << "Memory allocated and leaked." << std::endl;
}
Comment on lines +27 to +34

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

日志信息与实际行为不符

函数正确释放了内存(使用 delete[]),但打印消息仍显示 "Memory allocated and leaked.",这与实际行为矛盾,可能造成测试结果误解。

另外,Line 32 的缩进与其他行不一致。

💡 建议修复
 void memoryLeakVuln2() {
     int* data = new int[100];
     if (data == nullptr) return;

     data[0] = 1;
-  delete[] data;
-    std::cout << "Memory allocated and leaked." << std::endl;
+    delete[] data;
+    std::cout << "Memory allocated and freed properly." << std::endl;
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
void memoryLeakVuln2() {
int* data = new int[100];
if (data == nullptr) return;
data[0] = 1;
delete[] data;
std::cout << "Memory allocated and leaked." << std::endl;
}
void memoryLeakVuln2() {
int* data = new int[100];
if (data == nullptr) return;
data[0] = 1;
delete[] data;
std::cout << "Memory allocated and freed properly." << std::endl;
}
🤖 Prompt for AI Agents
In `@c_security_test.c` around lines 27 - 34, The log message in memoryLeakVuln2
is misleading: the function correctly deletes the allocated array but still
prints "Memory allocated and leaked."; update the printed message to reflect
that memory was freed (e.g., "Memory allocated and freed.") and correct the
inconsistent indentation on the line with delete[] data so it matches the
surrounding lines; ensure the nullptr check and delete[] remain unchanged and
only adjust the message text and indentation in memoryLeakVuln2.

void memoryLeakVuln3() {
int* data = new int[100];
if (data == nullptr) return;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

发现 2 个邻近问题(Line 35-37)

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 35

💬 详细说明:

  • 高风险:内存泄漏累积可能导致系统资源耗尽

📝 问题代码:

void memoryLeakVuln3() {

💡 修复建议:

使用delete[]匹配new[]进行数组释放

✅ 修复示例:

void memoryLeakVuln3() {
    int* data = new int[100];
    if (data == nullptr) return;

    data[0] = 1;
    delete[] data;
    std::cout << "Memory allocated and leaked." << std::endl;
}
🟡 问题 2 | 严重程度: MEDIUM | 行号: 37

💬 详细说明:

  • 中等:单行if语句在后续维护中容易出错,添加新行时可能忽略条件范围

📝 问题代码:

    if (data == nullptr) return;

💡 修复建议:

为if语句体添加大括号

✅ 修复示例:

    if (data == nullptr) {
        return;
    }


data[0] = 1;
delete data;
std::cout << "Memory allocated and leaked." << std::endl;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

发现 2 个邻近问题(Line 37-41)

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 37

💬 详细说明:

  • 当count和size相乘结果超过INT_MAX时会发生整数溢出,导致意外行为

💡 修复建议:

在乘法操作前检查是否会导致溢出

✅ 修复示例:

int integer_overflow_vuln(int count, int size) {
    if (count > 0 && size > 0 && count > INT_MAX / size) {
        // 处理溢出情况
        return -1; // 或其他适当的错误指示
    }
    int total_bytes = count * size; 
    return total_bytes;
}
🔴 问题 2 | 严重程度: HIGH | 行号: 41

💬 详细说明:

  • 每次调用此函数都会分配100个整数的内存但不释放,导致内存泄漏

💡 修复建议:

在函数结束前使用delete[]释放分配的内存

✅ 修复示例:

void memoryLeakVuln() {
    int* data = new int[100];
    if (data == nullptr) return;

    data[0] = 1;
    std::cout << "Memory allocated and used." << std::endl;
    delete[] data; // 释放内存
}

}
Comment on lines +35 to +42

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

使用 delete 释放数组导致未定义行为

Line 40 使用 delete data 释放通过 new int[100] 分配的数组。这是未定义行为——用 new[] 分配的内存必须用 delete[] 释放,否则可能导致内存泄漏、内存损坏或程序崩溃。

🐛 建议修复
 void memoryLeakVuln3() {
     int* data = new int[100];
     if (data == nullptr) return;

     data[0] = 1;
-  delete data;
+    delete[] data;
     std::cout << "Memory allocated and leaked." << std::endl;
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
void memoryLeakVuln3() {
int* data = new int[100];
if (data == nullptr) return;
data[0] = 1;
delete data;
std::cout << "Memory allocated and leaked." << std::endl;
}
void memoryLeakVuln3() {
int* data = new int[100];
if (data == nullptr) return;
data[0] = 1;
delete[] data;
std::cout << "Memory allocated and leaked." << std::endl;
}
🤖 Prompt for AI Agents
In `@c_security_test.c` around lines 35 - 42, The function memoryLeakVuln3 uses
new int[100] but frees it with delete, which is undefined behavior; change the
deallocation to delete[] data in memoryLeakVuln3 (replace the existing delete
data statement with delete[] data) to correctly free the array allocated by
new[].


int main(int argc, char* argv[]) {
buffer_overflow_vuln(argv[1]);
int result = integer_overflow_vuln(INT_MAX, 2);
return 0;
}

}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

内存释放方式不匹配 - 使用new[]分配但函数中仍有内存泄漏风险

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 49

💬 详细说明:

  • 虽然使用了delete[],但在某些情况下仍可能出现内存泄漏

💡 修复建议:

确保所有路径都正确释放内存,并考虑使用智能指针

✅ 修复示例:

void memoryLeakVuln2() {
    int* data = new int[100];
    if (data == nullptr) return;

    data[0] = 1;
    std::cout << "Memory allocated and used." << std::endl;
    delete[] data; // 正确释放数组内存
}

Comment on lines 44 to +49

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for all references to memoryLeakVuln functions
rg -n "memoryLeakVuln" --type=c --type=cpp

Repository: SoftSec-Tech/big_num_cal

Length of output: 206


三个新增函数未被调用

函数 memoryLeakVulnmemoryLeakVuln2memoryLeakVuln3 仅在文件中定义(第 20、27、35 行),但在代码中未被调用。若这些函数用于安全测试,请在测试入口(如 main 函数)中调用它们,或确认这是否为占位符代码。

🤖 Prompt for AI Agents
In `@c_security_test.c` around lines 44 - 49, The three functions memoryLeakVuln,
memoryLeakVuln2, and memoryLeakVuln3 are defined but never invoked; update main
to call these functions (e.g., after validating argc and argv) so the security
tests run, or explicitly remove/mark them as placeholders if they’re not needed;
reference the functions memoryLeakVuln, memoryLeakVuln2, memoryLeakVuln3 and
ensure you perform any required setup (argument/null checks) before calling them
from main.