Code Quality Review: a Tokeny case study
One-click code review after submission for security vulnerabilities, performance issues, and best practice suggestions. Follow the recorded task, execution screenshots, actual files and verification notes.
By the Tokeny team · Windows · Tokeny 1.7.8 · gpt-6-sol
Prepare the inputs
Create a separate workspace in Tokeny, download and unpack the sample inputs, then select a model that supports tools. The sample uses synthetic data or the public sources named in the article.
- users.py
Send the task to Tokeny
The original task was executed in Chinese. Copying these instructions reproduces the same task; the results below include an English report.
审查给定的本地示例代码，说明可复现触发条件和风险，按优先级给出修复建议，生成安全版本及最小测试。 交付文件：review.md、users_fixed.py、test_users.py。 验收要点： - 指出 SQL 注入 - 修复使用参数化查询 - 正常名称与恶意名称都测试 这是使用合成演示输入或指定公开资料的真实操作案例。请先读取工作空间输入，再实际生成文件并自检。所有写入、脚本与临时服务限于当前工作空间；临时服务只监听 127.0.0.1，执行后关闭；不触达外部收件人、不发布、不付款、不更改系统设置，不调用子智能体。需要公开资料时可读取给定 URL。只启用完成任务必需的工具。另写 report.md（中文）和 report.en.md（英文），简洁、完整，包含输入、处理步骤、真实结果、检查方式和局限；失败或未验证部分如实记录，不能宣称成功。最终回复用中文列出产物、关键结果与待核实项。
The recorded run used an isolated demonstration workspace. Review the commands and file paths before approving operations in your own workspace.
What actually ran
The task was submitted through the Tokeny input box. An online model read the inputs and executed tools. This run covers the local sample task and its actual files. Results and checks are recorded below.
Results and verification
Input
I read users.py, ENVIRONMENT.md, and .tokeny/manifest.json from the workspace. The target code builds the user query by concatenating name into ... WHERE name = '...'.
Steps
- Inspected the workspace and confirmed there was no existing test or database setup.
- Identified SQL injection caused by the unparameterized
namevalue and built a minimal in-memory SQLite reproduction. - Created
users_fixed.pyusingWHERE name = ?with(name,). - Created
test_users.pycovering a normal name, a valid name containing a quote, and the malicious name"' OR 1=1 --". - Ran
python -m unittest -v test_users.pyand checked the outputs and deliverables.
Actual Result
The original function was run against in-memory SQLite with "' OR 1=1 --" and actually returned all 3 records (Alice, Bob, and O'Reilly), demonstrating result-set expansion. The fixed implementation uses a parameterized query. python -m unittest -v test_users.py actually ran 3 tests and returned OK; the normal, quoted, and malicious-name checks all passed.
Check Method
test_users.py was executed with Python's standard-library unittest against an in-memory sqlite3 database; the actual output was Ran 3 tests in 0.002s and OK. The original users.py was also run against the same type of in-memory database, and the malicious input returned all 3 records.
Limitations
No production database was connected. Placeholder syntax for PostgreSQL, MySQL, and other drivers was not tested. The real HTTP call chain, authorization, database permissions, and concurrency behavior were not assessed. The test demonstrates the fix in a minimal local SQLite case; it is not a complete production security assessment.
Download and inspect the outputs
The archive contains the files created during this run. Use these checks when adapting the example to your own data.
- Reconcile the reported results against the downloadable sample inputs.
- Open the generated files and check the contents relevant to your task.
- Review the limitations and any unverified steps in the report.