ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Baseline the fastapi SSE keepalive loop after its 0.140.0 rewrite (#7480)

Browse source 
Security audit fails on main with 1 unsuppressed CRITICAL:

  CRITICAL  C2 polling/beaconing loop detected
  Package:  fastapi
  File:     fastapi/routing.py

The same file and check are already baselined, but the entry is keyed on a
digest of the matched code, so fastapi 0.140.0 rewriting the block reopened it.
That is the baseline working as intended, not a stale pin, so the new code
needs its own review rather than a regenerated file.

The flagged block is the SSE keepalive inserter:

  async def _keepalive_inserter() -> None:
      async with send_keepalive, receive_stream:
          try:
              while True:
                  try:
                      with anyio.fail_after(_PING_INTERVAL):
                          data = await receive_stream.receive()
                      await send_keepalive.send(data)
                  except TimeoutError:
                      await send_keepalive.send(KEEPALIVE_COMMENT)
          except anyio.EndOfStream:
              pass

It forwards one in-memory anyio stream to another and emits a keepalive comment
when the read times out. No socket, no outbound host, no fetched command, and it
terminates on EndOfStream. The heuristic matches it on the shape alone, a loop
with a timeout and a send, so it is a false positive.

Adds that one entry. The existing fastapi entry stays, since the requirement is
unpinned and an older resolve still needs it.

Co-authored-by: danielhanchen <unslothai@gmail.com>
This commit is contained in:
Daniel Han 2026-07-26 17:17:58 -07:00 • committed by GitHub
commit d72b58a35e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/scan_packages_baseline.json
View file

@ -98,6 +98,14 @@
"evidence": "L587: while True: sha256:06c2c7f15d73bf192e5e3272c5ff5fcaeff7f6774fef5f4eca6ef473ae50e2b3",
"evidence_hash": "57acd497f404c203e4450d0580ad85aa8a33406e8d64ad06fbac6cf47d97b24d"
},
{
"package": "fastapi",
"file": "fastapi/routing.py",
"check": "C2 polling/beaconing loop detected",
"severity": "CRITICAL",
"evidence": "L592: while True: sha256:84283c09277ded3296998b2a6a838744457b606829cf5ab5d0da6f222ff020a0",
"evidence_hash": "a7295004315e26a8f3c64fb837521e9fdd7268219bb43e000fb0236ab0259223"
},
{
"package": "fastmcp-slim",
"file": "fastmcp/cli/apps_dev.py",