Skip to content

Finding an account by email

Security · Difficulty 1/5 · Python · 19 linesOrigin: Fictional

Task

What the AI was asked to do

Write a function that finds an account by email for the "forgot password" endpoint. Emails are stored in lower case; the lookup ignores leading and trailing spaces and letter case. Return the account's id and email if it exists, otherwise None. The endpoint answers the same way in every case; this function only finds the account.

Handoff note

What the AI wrote when it handed over the code:

“The email is trimmed and lowercased, and its length is checked. Only the two columns that are needed are read, so the password hash is never returned.”

The code the AI wrote

Python19 lines

Mark the lines you think are wrong; give each mark a severity and a one-sentence reason.

Click or tap a line. With a keyboard, move to the line and press Enter.

0 of 5 marks
How to pick a severity
  • CriticalData loss, a security hole or lost money
  • MajorThe user gets a wrong result in a case the task asks for
  • MinorA rare edge case outside the task, or readability

In the Testing topic, severity is set by the effect of the broken implementation the test doesn't catch.

Your reason isn't graded; you'll compare it with a sample answer.

import sqlite3
2
MAX_EMAIL_LENGTH = 254
4
5
def find_account(conn: sqlite3.Connection, email: str) -> dict | None:
    """Look up an account for the "forgot password" endpoint.
8
    Returns the account's id and email, or None if no account matches.
    """
    email = email.strip().lower()
    if not email or len(email) > MAX_EMAIL_LENGTH:
        return None
    row = conn.execute(
        f"SELECT id, email FROM accounts WHERE email = '{email}'"
    ).fetchone()
    if row is None:
        return None
    return {"id": row[0], "email": row[1]}

The test that proves it

The right option is the test that fails on this code, which means it exposes the bug.

Test options
Mark at least one line to submit.

Submitting sends seven pieces of information to a counter; your reason text stays on your device. Data