Veria AIVeria AI

Sign in

Enter your email to continue.

Don't have an account? Sign up

What's new

Findings come with fixes now

New findings arrive with a ready fix. Review the diff, approve it, and Veria opens the PR.

Remote code execution in report export2m
Critical·VERIA-482·acme/api-gateway·+1−1
src/reports/export.ts
42-exec(`wkhtmltopdf ${url} out.pdf`)
42+execFile("wkhtmltopdf", [url, "out.pdf"])
DismissApprove and open PR
SQL injection in invoice search14m
High·VERIA-478·acme/api-gateway
Path traversal in asset upload handler1h
Medium·VERIA-471·acme/web
fix: parameterize report export query #1288
Openveria-ai wants to merge 2 commits into main from veria/482-remote-code-execution-in-report-export
Conversation1Commits2Checks6Files changed1
Some checks haven't completed yet6 in progress checksAll checks have passed6 successful checks
This branch has no conflicts with the base branchMerging can be performed automatically
Merge pull request
veria-aiBotcommented just now

Report export passed the request url straight into a shell command. This change moves it into an argument array so shell metacharacters are never interpreted, and adds a regression test that covers the report endpoint.

What's new

Every pull request gets a review

Veria reviews each PR before merge and leaves findings as comments, with the fix inline.

veria-aiBotrequested changes on pull request #241 · just now
src/api/invoices.ts
11+const invoice = await db.invoice.findFirst({
12+  where: { id: params.id },
HighCross-workspace invoice access

This lookup only filters by id, so any signed-in user can read another workspace's invoices by changing it. Scope the query to the caller's workspace.

Suggested change
  where: { id: params.id },
  where: { id: params.id, orgId: ctx.orgId },