T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bridge/app.py:51- Finding
Unauthenticated Access Allows Arbitrary Task Disclosure and State Mutation
- Content
View full analysis
TaskResponse: """Request human actuation — create a task with escrow.""" task = create_task( description=request.description, budget_usdc=request.budget_usdc, location=request.location, verification_criteria=request.verification_criteria, priority=request.priority, deadline_hours=request.deadline_hours, ) return _task_to_response(task) @app.get("/v1/tasks", response_model=TaskListResponse) async def list_all(status: str | None = Query(default=None)) -> TaskListResponse: """List all tasks, optionally filtered by status.""" tasks = list_tasks(status) return TaskListResponse( tasks=[_task_to_response(t) for t in tasks], total=len(tasks), ) @app.get("/v1/tasks/{task_id}", response_model=TaskResponse) async def get_by_id(task_id: str) -> TaskResponse: """Get a task by ID.""" task = get_task(task_id) if task is None: raise HTTPException(status_code=404, detail=f"Task not found: {task_id}") return _task_to_response(task) @app.post("/v1/tasks/{task_id}/verify", response_model=VerifyResponse) async def verify(task_id: str, request: VerifyRequest) -> VerifyResponse: """Submit proof and verify against criteria.""" task = get_task(task_id) if task is None: raise HTTPException(status_code=404, detail=f"Task not found: {task_id}") if task.status == "disputed": raise HTTPException(status_code=409, detail="Task is disputed — cannot verify") update_task_status(task_id, "proof_submitted", worker_id=request.worker_id) all_passed, results = verify_all(task.verification_criteria, request.proofs) if all_passed ...[truncated 2384 chars]- Remediation
View remediation