Socket Reachability Demo - Python

A comprehensive demo showing Socket's Precomputed Reachability feature with many Python packages that have CVEs in transitive dependencies.

What This Demonstrates

This project includes a wide variety of Python packages across different categories. Many of these packages have CVEs in their transitive dependencies that should show as "Unreachable" because the vulnerable code paths are never called.

Packages Included

Web Frameworks

• Flask, Django, FastAPI, Falcon, Pyramid, Bottle, Tornado

HTTP Clients

• requests, boto3, httpx, aiohttp

Crypto/SSH

• paramiko, cryptography, pyjwt

Data Processing

• pyyaml, pillow, lxml, beautifulsoup4

Task Queues

• celery

Database

• sqlalchemy

Web Scraping

• scrapy

Templating

• jinja2, mako

Servers

• gunicorn, uvicorn, werkzeug

Other

• graphene (GraphQL), markdown, defusedxml

Expected Unreachable CVE Patterns

Pattern	Example	Why Unreachable
Client vs Server	aiohttp CVE-2024-23334	Client usage doesn't serve static files
Safe API variant	PyYAML CVE-2020-14343	safe_load() not yaml.load()
Protocol mismatch	cryptography TLS CVEs	paramiko uses SSH
Specific function	Pillow CVE-2023-50447	Basic ops, not ImageMath.eval()
Debug mode only	Werkzeug CVE-2024-34069	Production runs debug=False
Unused feature	Jinja2 sandbox escape	Templates are developer-controlled

Running the App

poetry install
poetry run python app.py

How to Trigger Socket Scan

Option 1: GitHub App

1. Install Socket GitHub App
2. Push to trigger scan
3. View results in Dashboard

Option 2: Socket CLI

socket scan create --repo . --branch main

Option 3: Manual Upload

Upload poetry.lock in Socket Dashboard → New Scan

Filtering Results

In Socket Dashboard, filter by:

• Reachability Status: Unreachable - CVEs safe to deprioritize
• Reachability Status: Potentially Reachable - CVEs that may need attention

Why Poetry?

Socket's Precomputed Reachability requires the full dependency graph. Poetry's poetry.lock contains complete transitive dependency resolution.