filename = secure_filename(request.form['filename'])
filepath = os.path.join(UPLOAD_DIR, filename)

# check_licenses.py
import pkg_resources
import json

ALLOWED_LICENSES = [
    'MIT', 'Apache-2.0', 'BSD-3-Clause', 
    'BSD-2-Clause', 'ISC', 'Python-2.0'
]

DENIED_LICENSES = [
    'GPL-3.0', 'AGPL-3.0', 'SSPL'
]

def check_dependencies():
    issues = []
    
    for dist in pkg_resources.working_set:
        license = get_license(dist)
        
        if license in DENIED_LICENSES:
            issues.append({
                'package': dist.project_name,
                'version': dist.version,
                'license': license,
                'severity': 'high'
            })
        elif license not in ALLOWED_LICENSES:
            issues.append({
                'package': dist.project_name,
                'version': dist.version,
                'license': license,
                'severity': 'medium'
            })
    
    return issues

# 脆弱なコード（CodeQLで検出）
def read_file(filename):
    # CWE-22: Path Traversal
    with open(f"/var/data/{filename}", 'r') as f:
        return f.read()

# Copilot提案の修正
def read_file(filename):
    # Validate filename to prevent path traversal
    if '..' in filename or filename.startswith('/'):
        raise ValueError("Invalid filename")
    
    # Use pathlib for safe path construction
    from pathlib import Path
    safe_path = Path("/var/data") / filename
    
    # Ensure the resolved path is within allowed directory
    if not safe_path.resolve().is_relative_to("/var/data"):
        raise ValueError("Access denied")
        
    with open(safe_path, 'r') as f:
        return f.read()

# test_security_fixes.py
import pytest
from security_tests import *

class TestSecurityFixes:
    
    @pytest.mark.security
    def test_path_traversal_fix(self):
        """Path traversal攻撃が防げることを確認"""
        vulnerable_inputs = [
            "../../../etc/passwd",
            "..\\..\\..\\windows\\system32\\config\\sam",
            "/etc/shadow",
            "data/../../../secret.txt"
        ]
        
        for malicious_input in vulnerable_inputs:
            with pytest.raises(ValueError):
                read_file(malicious_input)
    
    @pytest.mark.security
    def test_sql_injection_fix(self):
        """SQLインジェクションが防げることを確認"""
        malicious_queries = [
            "'; DROP TABLE users; --",
            "1' OR '1'='1",
            "admin'--"
        ]
        
        for query in malicious_queries:
            result = search_users(query)
            # 正常に動作し、インジェクションが起きないことを確認
            assert isinstance(result, list)

class SecurityTriage:
    def __init__(self):
        self.severity_scores = {
            'critical': 10,
            'high': 7,
            'medium': 4,
            'low': 1
        }
        
        self.exploitability_scores = {
            'publicly_exploited': 10,
            'poc_available': 7,
            'theoretical': 3
        }
        
    def calculate_priority(self, alert):
        base_score = self.severity_scores[alert.severity]
        exploit_score = self.exploitability_scores[alert.exploitability]
        
        # ビジネスクリティカルなコンポーネントか
        if alert.component in CRITICAL_COMPONENTS:
            business_impact = 10
        else:
            business_impact = 5
            
        # 外部公開されているか
        exposure = 10 if alert.is_external else 3
        
        priority = (base_score * 0.3 + 
                   exploit_score * 0.3 + 
                   business_impact * 0.2 + 
                   exposure * 0.2)
                   
        return round(priority, 1)

# security_notifier.py
import requests
from typing import Dict, Any

class SecurityNotifier:
    def __init__(self, webhook_url: str):
        self.webhook_url = webhook_url
        
    def send_alert(self, alert: Dict[str, Any]):
        severity_emoji = {
            'critical': '🚨',
            'high': '🔴',
            'medium': '🟡',
            'low': '🔵'
        }
        
        message = {
            "blocks": [
                {
                    "type": "header",
                    "text": {
                        "type": "plain_text",
                        "text": f"{severity_emoji[alert['severity']]} Security Alert"
                    }
                },
                {
                    "type": "section",
                    "fields": [
                        {
                            "type": "mrkdwn",
                            "text": f"*Repository:*\n{alert['repository']}"
                        },
                        {
                            "type": "mrkdwn",
                            "text": f"*Severity:*\n{alert['severity'].upper()}"
                        },
                        {
                            "type": "mrkdwn",
                            "text": f"*Type:*\n{alert['type']}"
                        },
                        {
                            "type": "mrkdwn",
                            "text": f"*File:*\n`{alert['file']}:{alert['line']}`"
                        }
                    ]
                },
                {
                    "type": "section",
                    "text": {
                        "type": "mrkdwn",
                        "text": f"*Description:*\n{alert['description']}"
                    }
                },
                {
                    "type": "actions",
                    "elements": [
                        {
                            "type": "button",
                            "text": {
                                "type": "plain_text",
                                "text": "View Alert"
                            },
                            "url": alert['url']
                        },
                        {
                            "type": "button",
                            "text": {
                                "type": "plain_text",
                                "text": "Create Issue"
                            },
                            "url": f"{alert['repository']}/issues/new?title=Security: {alert['title']}"
                        }
                    ]
                }
            ]
        }
        
        requests.post(self.webhook_url, json=message)