How to read your first event

[eyal-gabay]

Your first event has a lot on it. Read it in this order and it takes about a minute.

1. What this means. Three sentences: what happened (it starts with the Python call, so you can search your code for it), why it is risky, and what to do.
2. Was it made safe? Whether your program cleaned the value before using it: Yes, Only partly, No, or Not checked.
3. Value when the data came in, and when it was used. The same data at the two ends of the flow. The difference between them is what your program did to it on the way.
4. Call path. The chain of calls that led to the operation, innermost last. Your own function is usually a few lines from the bottom.
5. Where it came from. The connection or the file. For a file, whether other users on the machine can write it changes the severity.

An event says that untrusted data really reached the operation, and shows the path. It does not say the flow is exploitable: a check earlier in your code may make it harmless. You are the judge, and the evidence is there to judge with.

Every block is described in Event detail, and Triage covers labelling and hiding.

Which block on your first event was the hardest to make sense of?