T09 · Insecure Skill Coding Practices
Error
- Location
guides/07-ingestion-pipeline.md:78- Finding
Tenant-unqualified point identities and filters permit cross-tenant data modification
- Content
View full analysis
str: """Generate a stable UUID from a doc_id string (deterministic).""" return str(uuid.uuid5(uuid.NAMESPACE_DNS, doc_id)) ``` The related lookup and mutation methods also omit tenant identifiers: ```python def _is_duplicate_chunk(self, content_hash: str, source_record_id: str, collection: str) -> bool: """Check if a chunk with this content_hash already exists for this source record.""" results = self.client.scroll( collection_name=collection, scroll_filter=models.Filter( must=[ models.FieldCondition(key="content_hash", match=models.MatchValue(value=content_hash)), models.FieldCondition(key="source_record_id", match=models.MatchValue(value=source_record_id)), ] ), limit=1, ) return len(results[0]) > 0 def _refresh_metadata_only(self, source_metadata: dict, collection: str): """For unchanged content, update only the ingested_at and source_last_modified timestamps.""" now = datetime.now(timezone.utc).isoformat() self.client.set_payload( collection_name=collection, payload={ "ingested_at": now, "source_last_modified": source_metadata.get("source_last_modified", now), "ingestion_run_id": self.run_id, }, points=models.Filter( must=[ models.FieldCondition( key="source_record_id", mat ...[truncated 3643 chars]- Remediation
View remediation