From d72b58a35ea8617482c676f8920079000c7e018d Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 26 Jul 2026 17:17:58 -0700 Subject: [PATCH] Baseline the fastapi SSE keepalive loop after its 0.140.0 rewrite (#7480) Security audit fails on main with 1 unsuppressed CRITICAL: CRITICAL C2 polling/beaconing loop detected Package: fastapi File: fastapi/routing.py The same file and check are already baselined, but the entry is keyed on a digest of the matched code, so fastapi 0.140.0 rewriting the block reopened it. That is the baseline working as intended, not a stale pin, so the new code needs its own review rather than a regenerated file. The flagged block is the SSE keepalive inserter: async def _keepalive_inserter() -> None: async with send_keepalive, receive_stream: try: while True: try: with anyio.fail_after(_PING_INTERVAL): data = await receive_stream.receive() await send_keepalive.send(data) except TimeoutError: await send_keepalive.send(KEEPALIVE_COMMENT) except anyio.EndOfStream: pass It forwards one in-memory anyio stream to another and emits a keepalive comment when the read times out. No socket, no outbound host, no fetched command, and it terminates on EndOfStream. The heuristic matches it on the shape alone, a loop with a timeout and a send, so it is a false positive. Adds that one entry. The existing fastapi entry stays, since the requirement is unpinned and an older resolve still needs it. Co-authored-by: danielhanchen --- scripts/scan_packages_baseline.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/scripts/scan_packages_baseline.json b/scripts/scan_packages_baseline.json index 1c21f8da86..58b7f95ab1 100644 --- a/scripts/scan_packages_baseline.json +++ b/scripts/scan_packages_baseline.json @@ -98,6 +98,14 @@ "evidence": "L587: while True: sha256:06c2c7f15d73bf192e5e3272c5ff5fcaeff7f6774fef5f4eca6ef473ae50e2b3", "evidence_hash": "57acd497f404c203e4450d0580ad85aa8a33406e8d64ad06fbac6cf47d97b24d" }, + { + "package": "fastapi", + "file": "fastapi/routing.py", + "check": "C2 polling/beaconing loop detected", + "severity": "CRITICAL", + "evidence": "L592: while True: sha256:84283c09277ded3296998b2a6a838744457b606829cf5ab5d0da6f222ff020a0", + "evidence_hash": "a7295004315e26a8f3c64fb837521e9fdd7268219bb43e000fb0236ab0259223" + }, { "package": "fastmcp-slim", "file": "fastmcp/cli/apps_dev.py",