35:"/_next/static/chunks/0_6qdgbl18thf.js" 36:"/_next/static/chunks/3316o_1ddm9ab.js" 37:I[96601,["$1","$22","$23","$35","$36"],"default"] 38:I[58709,["$1","$22","$23","$35","$36"],"default"] 39:I[80423,["$1","$22","$23","$35","$36"],"default"] 3a:Taa0,import sqlite3 # Setup a dummy database conn = sqlite3.connect(':memory:') cursor = conn.cursor() cursor.execute(''' CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT, password TEXT) ''') cursor.execute("INSERT INTO users VALUES (1, 'alice', 'password123')") conn.commit() # ❌ VULNERABLE: Building query with f-string def insecure_login(username, password): """This function is vulnerable to SQL Injection.""" # NEVER do this. The f-string allows an attacker to inject SQL code. query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'" print(f"Executing vulnerable query: {query}") cursor.execute(query) return cursor.fetchone() # --- The Attack --- # Attacker enters a malicious username and a random password. malicious_username = "' OR '1'='1" # This string breaks out of the quotes random_password = "randompass" # The query becomes: # SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'randompass' # The '1'='1' is always true, so the WHERE clause is true for the first user. result = insecure_login(malicious_username, random_password) print(f"Attacker logged in as: {result}") # Attacker is now logged in as Alice! # ✅ SECURE: Using Parameterized Queries def secure_login(username, password): """This function uses parameterized queries to prevent SQLi.""" # The '?' is a placeholder. The database driver safely inserts the values. query = "SELECT * FROM users WHERE username = ? AND password = ?" print(f"Executing secure query with params: ('{username}', '{password}')") # The database treats the input as data, NEVER as executable code. cursor.execute(query, (username, password)) return cursor.fetchone() # --- The Defense --- # The attacker tries the same input. result = secure_login(malicious_username, random_password) # The database looks for a user with the literal username "' OR '1'='1". # No such user exists, so the login fails correctly. print(f"Secure login result: {result}") # Correctly returns None # --- Another Example: Union-based SQLi --- # Attacker tries to extract all usernames malicious_username_2 = "' UNION SELECT 1, username, password FROM users --" # Vulnerable query becomes: # SELECT * FROM users WHERE username = '' UNION SELECT 1, username, password FROM users --' AND password = '...' # The '--' comments out the rest of the query. # The attacker gets all usernames and passwords! # With parameterized queries, this is treated as a literal string and fails. # Key Takeaway: # NEVER use string formatting (+, %, .format(), f-strings) to build SQL queries. # ALWAYS use your database driver's parameterization feature (placeholders like ?, %s).3b:Tb07,from flask import Flask, request, render_template_string, escape app = Flask(__name__) # In-memory 'database' of comments comments = [] # ❌ VULNERABLE: Directly rendering user input @app.route('/insecure', methods=['GET', 'POST']) def insecure_page(): if request.method == 'POST': comment = request.form.get('comment') comments.append(comment) # This template does NOT escape the comment. It's rendered as raw HTML. template = """

Insecure Comments

Comments:

{{ c | safe }}

""" return render_template_string(template, comments=comments) # --- The Attack --- # 1. Attacker posts a malicious comment: # # 2. This script is now stored in the `comments` list. # 3. Every user who visits the page will have this script rendered and executed in their browser. # ✅ SECURE: Escaping user input before rendering @app.route('/secure', methods=['GET', 'POST']) def secure_page(): if request.method == 'POST': comment = request.form.get('comment') comments.append(comment) # By default, Jinja2 (and other modern template engines) automatically escapes data. # The '<' becomes '<', '>' becomes '>', etc. template = """

Secure Comments

Comments:

{{ c }}

""" return render_template_string(template, comments=comments) # --- The Defense --- # 1. Attacker posts the same malicious comment. # 2. When the page is rendered, the output HTML for the comment is: #

# 3. The browser displays the literal text of the script. It does NOT execute it. # Manual escaping (if not using a template engine) from markupsafe import escape def generate_html_manually(comment): # Always escape data that will be placed into an HTML context. return f"

{escape(comment)}

" # Key Takeaway: # ALWAYS use a modern templating engine that performs context-aware auto-escaping (like Jinja2, Django Templates). # NEVER disable auto-escaping (e.g., with `| safe`) unless you are 100% certain the content is safe HTML.3c:Te3b,from pydantic import BaseModel, validator, EmailStr, Field, ValidationError from typing import Optional # Define a validation model for user registration class UserRegistration(BaseModel): username: str = Field(..., min_length=3, max_length=20, pattern=r'^[a-zA-Z0-9_]+$') email: EmailStr age: int = Field(..., gt=18) # Must be greater than 18 password: str = Field(..., min_length=8) confirm_password: str # Custom validator to check if passwords match @validator('confirm_password') def passwords_match(cls, v, values, **kwargs): if 'password' in values and v != values['password']: raise ValueError('passwords do not match') return v # --- Usage in an API (e.g., FastAPI) --- # 1. Valid input valid_data = { 'username': 'test_user', 'email': 'test@example.com', 'age': 25, 'password': 'a_strong_password', 'confirm_password': 'a_strong_password' } try: user = UserRegistration(**valid_data) print(f"Validation successful for: {user.username}") except ValidationError as e: print(f"Validation failed: {e}") # 2. Invalid input: username too short invalid_data_1 = valid_data.copy() invalid_data_1['username'] = 'a' try: UserRegistration(**invalid_data_1) except ValidationError as e: print(f"\nValidation failed as expected: {e}") # 3. Invalid input: age too low invalid_data_2 = valid_data.copy() invalid_data_2['age'] = 17 try: UserRegistration(**invalid_data_2) except ValidationError as e: print(f"\nValidation failed as expected: {e}") # 4. Invalid input: passwords don't match invalid_data_3 = valid_data.copy() invalid_data_3['confirm_password'] = 'wrong_password' try: UserRegistration(**invalid_data_3) except ValidationError as e: print(f"\nValidation failed as expected: {e}") # --- Other Common Vulnerabilities & Defenses --- # Insecure Deserialization import pickle import os class EvilPickle: """This class executes code when deserialized.""" def __reduce__(self): # This command will run on the server! return (os.system, ('echo "PWNED!" > pwned.txt',)) # Attacker creates a malicious pickle payload malicious_payload = pickle.dumps(EvilPickle()) # ❌ VULNERABLE: Deserializing untrusted data # pickle.loads(malicious_payload) # This would create pwned.txt! # ✅ DEFENSE: Use a safe serialization format like JSON for untrusted data. # If you must use pickle, only do so on data you trust completely. # Path Traversal from flask import Flask, request app_fs = Flask(__name__) # ❌ VULNERABLE: User controls the file path @app_fs.route('/files') def get_file(): filename = request.args.get('name') # Attacker can request `?name=../../../../etc/passwd` with open(f'/var/www/uploads/{filename}') as f: return f.read() # ✅ DEFENSE: Sanitize the filename and ensure it stays within the intended directory. import os @app_fs.route('/secure-files') def get_secure_file(): filename = request.args.get('name') # Use a library to securely join paths base_dir = '/var/www/uploads' safe_path = os.path.join(base_dir, filename) # Check that the final path is still within the base directory if os.path.commonprefix((os.path.realpath(safe_path), base_dir)) != base_dir: return "Invalid path", 400 with open(safe_path) as f: return f.read() # Key Takeaway: # Validate EVERYTHING: format, length, range, type. # Use a library like Pydantic to declare validation rules, not imperative code. # Be aware of 'dangerous' functions like `pickle.loads`, `os.system`, and file access with user input.3d:T183e,# vulnerable_app.py - SQL Injection Demo import sqlite3 import hashlib # Setup database def init_db(): conn = sqlite3.connect(':memory:') c = conn.cursor() # Create tables c.execute('''CREATE TABLE users ( id INTEGER PRIMARY KEY, username TEXT NOT NULL, password_hash TEXT NOT NULL, email TEXT, is_admin INTEGER DEFAULT 0 )''') c.execute('''CREATE TABLE products ( id INTEGER PRIMARY KEY, name TEXT NOT NULL, price REAL, description TEXT )''') c.execute('''CREATE TABLE orders ( id INTEGER PRIMARY KEY, user_id INTEGER, product_id INTEGER, quantity INTEGER, total REAL )''') # Insert test data users = [ ('alice', hashlib.sha256(b'password123').hexdigest(), 'alice@example.com', 0), ('admin', hashlib.sha256(b'admin123').hexdigest(), 'admin@example.com', 1), ('bob', hashlib.sha256(b'bobpass').hexdigest(), 'bob@example.com', 0), ] for username, password_hash, email, is_admin in users: c.execute( "INSERT INTO users (username, password_hash, email, is_admin) VALUES (?, ?, ?, ?)", (username, password_hash, email, is_admin) ) products = [ ('Laptop', 999.99, 'High-performance laptop'), ('Mouse', 29.99, 'Wireless mouse'), ('Keyboard', 79.99, 'Mechanical keyboard'), ] for name, price, desc in products: c.execute( "INSERT INTO products (name, price, description) VALUES (?, ?, ?)", (name, price, desc) ) conn.commit() return conn # VULNERABLE FUNCTIONS - String concatenation in SQL def login_vulnerable(conn, username, password): """VULNERABLE: Uses string formatting in SQL query. Attack example: username = "admin' OR '1'='1" password = "anything" This bypasses authentication! """ c = conn.cursor() password_hash = hashlib.sha256(password.encode()).hexdigest() # VULNERABLE: String concatenation query = f"SELECT * FROM users WHERE username = '{username}' AND password_hash = '{password_hash}'" print(f"Executing query: {query}") c.execute(query) user = c.fetchone() if user: return {'success': True, 'username': user[1], 'is_admin': user[4]} return {'success': False} def search_products_vulnerable(conn, search_term): """VULNERABLE: Uses string formatting. Attack example: search_term = "laptop' UNION SELECT id, username, password_hash, email FROM users--" This exposes user data! """ c = conn.cursor() # VULNERABLE query = f"SELECT * FROM products WHERE name LIKE '%{search_term}%' OR description LIKE '%{search_term}%'" print(f"Executing query: {query}") c.execute(query) return c.fetchall() def get_user_orders_vulnerable(conn, user_id): """VULNERABLE: Uses string formatting.""" c = conn.cursor() # VULNERABLE query = f"SELECT * FROM orders WHERE user_id = {user_id}" print(f"Executing query: {query}") c.execute(query) return c.fetchall() # SECURE FUNCTIONS - TODO: Implement these def login_secure(conn, username, password): """SECURE: Uses parameterized query. TODO: Implement using ? placeholders and tuple of values. Example: c.execute("SELECT * FROM users WHERE username = ?", (username,)) """ c = conn.cursor() password_hash = hashlib.sha256(password.encode()).hexdigest() # TODO: Use parameterized query # query = "SELECT * FROM users WHERE username = ? AND password_hash = ?" # c.execute(query, (username, password_hash)) pass def search_products_secure(conn, search_term): """SECURE: Uses parameterized query. TODO: Implement with parameterization. Note: For LIKE queries, include % in the parameter value, not the SQL. """ c = conn.cursor() # TODO: Implement pass def get_user_orders_secure(conn, user_id): """SECURE: Uses parameterized query.""" c = conn.cursor() # TODO: Implement pass # Testing and demonstration if __name__ == '__main__': conn = init_db() print("=== DEMONSTRATING SQL INJECTION ==>") print("\n1. Login Bypass Attack") print("-" * 50) # Normal login result = login_vulnerable(conn, 'alice', 'password123') print(f"Normal login result: {result}") # SQL injection attack print("\nAttempting SQL injection...") result = login_vulnerable(conn, "admin' OR '1'='1", "wrongpassword") print(f"Injection attack result: {result}") print("^ This should NOT work! But it does because of string concatenation.") print("\n2. Data Extraction Attack") print("-" * 50) # Normal search results = search_products_vulnerable(conn, 'laptop') print(f"Normal search found {len(results)} products") # UNION injection to extract user data print("\nAttempting UNION injection...") malicious_search = "laptop' UNION SELECT id, username, password_hash, email FROM users--" results = search_products_vulnerable(conn, malicious_search) print(f"Injection found {len(results)} results:") for row in results: print(f" {row}") print("^ Exposed sensitive user data!") print("\n=== TESTING SECURE FUNCTIONS ==>") print("\nTODO: Implement secure functions and test:") print("1. Normal login should work") print("2. SQL injection attempts should be treated as literal strings") print("3. Attacks should fail harmlessly") # TODO: Test secure functions # result = login_secure(conn, 'alice', 'password123') # print(f"Secure login: {result}") # result = login_secure(conn, "admin' OR '1'='1", 'wrongpassword') # print(f"Injection attempt (should fail): {result}") conn.close() # Expected output: # - Vulnerable functions allow SQL injection # - Login bypass works with ' OR '1'='1 # - UNION injection exposes user data # - Secure functions treat injection attempts as literal strings # - Attacks fail harmlessly after fix3e:T1f29,# secure_api.py - Secure FastAPI with validation from fastapi import FastAPI, HTTPException, Request from fastapi.responses import HTMLResponse from pydantic import BaseModel, EmailStr, validator, Field import sqlite3 import bcrypt import re import logging import html from typing import Optional from datetime import datetime, timedelta logging.basicConfig(level=logging.INFO) logger = logging.getLogger(__name__) app = FastAPI(title="Secure User API") # Database setup def init_db(): conn = sqlite3.connect('users.db') c = conn.cursor() c.execute('''CREATE TABLE IF NOT EXISTS users ( id INTEGER PRIMARY KEY, username TEXT UNIQUE NOT NULL, email TEXT UNIQUE NOT NULL, password_hash TEXT NOT NULL, bio TEXT, created_at TEXT )''') conn.commit() conn.close() init_db() # Pydantic Models with Validation class UserRegistration(BaseModel): """User registration with strict validation.""" username: str = Field(..., min_length=3, max_length=20) email: EmailStr # Pydantic validates email format password: str = Field(..., min_length=8) bio: Optional[str] = None @validator('username') def username_alphanumeric(cls, v): """Username must be alphanumeric + underscore only.""" if not re.match(r'^[a-zA-Z0-9_]+$', v): raise ValueError('Username must be alphanumeric (and underscore)') return v @validator('password') def password_strength(cls, v): """Enforce password complexity.""" if not re.search(r'[A-Z]', v): raise ValueError('Password must contain uppercase letter') if not re.search(r'[a-z]', v): raise ValueError('Password must contain lowercase letter') if not re.search(r'[0-9]', v): raise ValueError('Password must contain digit') return v @validator('bio') def sanitize_bio(cls, v): """Prevent XSS in bio field.""" if v: # Remove any HTML tags v = re.sub(r'<[^>]+>', '', v) # Limit length v = v[:500] return v class UserLogin(BaseModel): username: str password: str class UserResponse(BaseModel): id: int username: str email: str bio: Optional[str] created_at: str # Rate Limiting (simple in-memory) rate_limit_tracker = {} def check_rate_limit(ip: str, max_requests: int = 5, window_minutes: int = 1) -> bool: """Simple rate limiting by IP.""" now = datetime.now() if ip not in rate_limit_tracker: rate_limit_tracker[ip] = [] # Remove old requests rate_limit_tracker[ip] = [ req_time for req_time in rate_limit_tracker[ip] if now - req_time < timedelta(minutes=window_minutes) ] if len(rate_limit_tracker[ip]) >= max_requests: return False rate_limit_tracker[ip].append(now) return True # Endpoints @app.post("/register", response_model=UserResponse) async def register(user: UserRegistration, request: Request): """Register new user with validation and security.""" # Rate limiting client_ip = request.client.host if not check_rate_limit(client_ip): logger.warning(f"Rate limit exceeded from {client_ip}") raise HTTPException(status_code=429, detail="Too many requests") logger.info(f"Registration attempt: {user.username}") try: # Hash password with bcrypt password_hash = bcrypt.hashpw( user.password.encode('utf-8'), bcrypt.gensalt() ).decode('utf-8') # Store user with PARAMETERIZED QUERY conn = sqlite3.connect('users.db') c = conn.cursor() # TODO: Use parameterized query to prevent SQL injection # c.execute( # "INSERT INTO users (username, email, password_hash, bio, created_at) VALUES (?, ?, ?, ?, ?)", # (user.username, user.email, password_hash, user.bio, datetime.now().isoformat()) # ) conn.commit() user_id = c.lastrowid conn.close() logger.info(f"User registered: {user.username}") return UserResponse( id=user_id, username=user.username, email=user.email, bio=user.bio, created_at=datetime.now().isoformat() ) except sqlite3.IntegrityError: logger.warning(f"Duplicate registration attempt: {user.username}") raise HTTPException(status_code=400, detail="Username or email already exists") except Exception as e: logger.error(f"Registration error: {e}") raise HTTPException(status_code=500, detail="Registration failed") @app.post("/login") async def login(credentials: UserLogin): """Login with secure password verification.""" conn = sqlite3.connect('users.db') c = conn.cursor() # TODO: Use parameterized query # c.execute("SELECT * FROM users WHERE username = ?", (credentials.username,)) user = c.fetchone() conn.close() if not user: logger.warning(f"Failed login: user not found - {credentials.username}") raise HTTPException(status_code=401, detail="Invalid credentials") # Verify password with bcrypt password_hash = user[3] if not bcrypt.checkpw(credentials.password.encode('utf-8'), password_hash.encode('utf-8')): logger.warning(f"Failed login: wrong password - {credentials.username}") raise HTTPException(status_code=401, detail="Invalid credentials") logger.info(f"Successful login: {credentials.username}") return {"message": "Login successful", "username": credentials.username} @app.get("/profile/{user_id}", response_class=HTMLResponse) async def get_profile(user_id: int): """Get user profile with XSS prevention.""" conn = sqlite3.connect('users.db') c = conn.cursor() # TODO: Use parameterized query # c.execute("SELECT * FROM users WHERE id = ?", (user_id,)) user = c.fetchone() conn.close() if not user: raise HTTPException(status_code=404, detail="User not found") # Sanitize output to prevent XSS safe_username = html.escape(user[1]) safe_bio = html.escape(user[4]) if user[4] else 'No bio' # Return HTML with escaped content return f"""

Profile: {safe_username}

Email: {html.escape(user[2])}

Bio: {safe_bio}

Joined: {user[5]}

""" # Security headers middleware @app.middleware("http") async def add_security_headers(request: Request, call_next): response = await call_next(request) response.headers["X-Content-Type-Options"] = "nosniff" response.headers["X-Frame-Options"] = "DENY" return response # Testing if __name__ == "__main__": import uvicorn uvicorn.run(app, host="0.0.0.0", port=8000) # Test with curl or Python requests: # 1. Valid registration: # curl -X POST http://localhost:8000/register \ # -H "Content-Type: application/json" \ # -d '{"username":"alice","email":"alice@example.com","password":"SecurePass123"}' # # 2. SQL injection attempt (should fail): # curl -X POST http://localhost:8000/register \ # -H "Content-Type: application/json" \ # -d '{"username":"admin' OR '1'='1","email":"test@test.com","password":"Test123"}' # # 3. XSS attempt in bio (should be sanitized): # curl -X POST http://localhost:8000/register \ # -H "Content-Type: application/json" \ # -d '{"username":"bob","email":"bob@test.com","password":"Pass123","bio":""}' # # 4. Invalid password (should fail validation): # curl -X POST http://localhost:8000/register \ # -H "Content-Type: application/json" \ # -d '{"username":"charlie","email":"charlie@test.com","password":"weak"}' 3f:T1960,# vulnerable_blog.py - Deliberately Vulnerable Application # DO NOT USE IN PRODUCTION - FOR LEARNING ONLY from flask import Flask, request, render_template_string, session, send_file import sqlite3 import pickle import os import base64 app = Flask(__name__) app.secret_key = 'hardcoded_secret_key_123' # VULNERABILITY: Hardcoded secret # VULNERABILITY: Hardcoded credentials DB_NAME = 'blog.db' ADMIN_PASSWORD = 'admin123' API_KEY = 'sk_live_1234567890abcdef' # Database setup def init_db(): conn = sqlite3.connect(DB_NAME) c = conn.cursor() c.execute('''CREATE TABLE IF NOT EXISTS users ( id INTEGER PRIMARY KEY, username TEXT, password TEXT, is_admin INTEGER )''') c.execute('''CREATE TABLE IF NOT EXISTS posts ( id INTEGER PRIMARY KEY, title TEXT, content TEXT, author TEXT )''') c.execute('''CREATE TABLE IF NOT EXISTS comments ( id INTEGER PRIMARY KEY, post_id INTEGER, comment TEXT, author TEXT )''') # Insert test data c.execute("INSERT OR IGNORE INTO users VALUES (1, 'admin', 'admin123', 1)") c.execute("INSERT OR IGNORE INTO users VALUES (2, 'alice', 'password', 0)") c.execute("INSERT OR IGNORE INTO posts VALUES (1, 'First Post', 'Hello World', 'admin')") conn.commit() conn.close() init_db() # VULNERABILITY 1: SQL Injection in login @app.route('/login', methods=['POST']) def login(): username = request.form['username'] password = request.form['password'] conn = sqlite3.connect(DB_NAME) c = conn.cursor() # VULNERABLE: String concatenation in SQL query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'" print(f"Executing: {query}") # VULNERABILITY: Logging sensitive data c.execute(query) user = c.fetchone() conn.close() if user: # VULNERABILITY 4: Insecure deserialization session_data = pickle.dumps({'user_id': user[0], 'username': user[1]}) session['data'] = base64.b64encode(session_data).decode() return f"Login successful! Welcome {user[1]}" return "Login failed" # VULNERABILITY 2: Stored XSS in comments @app.route('/post/') def view_post(post_id): conn = sqlite3.connect(DB_NAME) c = conn.cursor() # VULNERABILITY 1: SQL Injection in post retrieval c.execute(f"SELECT * FROM posts WHERE id = {post_id}") post = c.fetchone() # VULNERABILITY 1: SQL Injection in comment retrieval c.execute(f"SELECT * FROM comments WHERE post_id = {post_id}") comments = c.fetchall() conn.close() if not post: return "Post not found", 404 # VULNERABILITY 2: XSS - rendering user content without escaping html = f""" {post[1]}

{post[1]}

{post[2]}

By: {post[3]}

Comments

""" for comment in comments: # XSS: Comment content rendered without escaping html += f"

{comment[3]}: {comment[2]}

" html += "" return render_template_string(html) # VULNERABILITY 2: XSS in comment submission @app.route('/comment', methods=['POST']) def add_comment(): post_id = request.form['post_id'] comment = request.form['comment'] # No sanitization! author = request.form['author'] conn = sqlite3.connect(DB_NAME) c = conn.cursor() # VULNERABILITY 1: SQL Injection c.execute(f"INSERT INTO comments (post_id, comment, author) VALUES ({post_id}, '{comment}', '{author}')") conn.commit() conn.close() return "Comment added" # VULNERABILITY 3: Path Traversal in file download @app.route('/download') def download_file(): filename = request.args.get('file') # VULNERABLE: No path validation filepath = os.path.join('uploads', filename) try: return send_file(filepath) except Exception as e: return str(e), 400 # VULNERABILITY: Leaking error details # VULNERABILITY 4: Insecure deserialization @app.route('/profile') def profile(): if 'data' not in session: return "Not logged in" # VULNERABLE: Unpickling untrusted data session_data = pickle.loads(base64.b64decode(session['data'])) return f"Welcome {session_data['username']}" # VULNERABILITY 1: SQL Injection in search @app.route('/search') def search(): query = request.args.get('q', '') conn = sqlite3.connect(DB_NAME) c = conn.cursor() # VULNERABLE sql = f"SELECT * FROM posts WHERE title LIKE '%{query}%' OR content LIKE '%{query}%'" c.execute(sql) results = c.fetchall() conn.close() return {'results': results} if __name__ == '__main__': # VULNERABILITY: Debug mode in production app.run(debug=True, host='0.0.0.0') # SECURITY AUDIT TASK: # # 1. SQL Injection (Critical): # - Found in: login, view_post, add_comment, search # - PoC: username="admin' OR '1'='1" bypasses auth # - Fix: Use parameterized queries # # 2. Stored XSS (High): # - Found in: view_post, comment rendering # - PoC: comment="" # - Fix: Use html.escape() or template auto-escaping # # 3. Path Traversal (High): # - Found in: download_file # - PoC: /download?file=../../etc/passwd # - Fix: Validate filename, use os.path.basename() # # 4. Insecure Deserialization (Critical): # - Found in: session handling # - PoC: Craft malicious pickle to execute code # - Fix: Use JSON for sessions, never unpickle untrusted data # # 5. Hardcoded Secrets (Medium): # - Found in: secret_key, API_KEY, ADMIN_PASSWORD # - Impact: Secrets in source control, anyone can compromise # - Fix: Use environment variables # # 6. Information Disclosure (Low): # - Found in: Debug mode, logging passwords, detailed errors # - Fix: Disable debug, sanitize logs, generic errors # # YOUR TASK: # 1. Create secure_blog.py with ALL vulnerabilities fixed # 2. Write security_report.md documenting: # - Executive Summary # - Detailed Findings (each vulnerability with PoC) # - Risk Assessment (CVSS-like scoring) # - Remediation Steps (code before/after) # - Testing Validation # 3. Create test_security.py with tests for each fix # 4. Document secure coding guidelines 40:Taa0,import sqlite3 # Setup a dummy database conn = sqlite3.connect(':memory:') cursor = conn.cursor() cursor.execute(''' CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT, password TEXT) ''') cursor.execute("INSERT INTO users VALUES (1, 'alice', 'password123')") conn.commit() # ❌ VULNERABLE: Building query with f-string def insecure_login(username, password): """This function is vulnerable to SQL Injection.""" # NEVER do this. The f-string allows an attacker to inject SQL code. query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'" print(f"Executing vulnerable query: {query}") cursor.execute(query) return cursor.fetchone() # --- The Attack --- # Attacker enters a malicious username and a random password. malicious_username = "' OR '1'='1" # This string breaks out of the quotes random_password = "randompass" # The query becomes: # SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'randompass' # The '1'='1' is always true, so the WHERE clause is true for the first user. result = insecure_login(malicious_username, random_password) print(f"Attacker logged in as: {result}") # Attacker is now logged in as Alice! # ✅ SECURE: Using Parameterized Queries def secure_login(username, password): """This function uses parameterized queries to prevent SQLi.""" # The '?' is a placeholder. The database driver safely inserts the values. query = "SELECT * FROM users WHERE username = ? AND password = ?" print(f"Executing secure query with params: ('{username}', '{password}')") # The database treats the input as data, NEVER as executable code. cursor.execute(query, (username, password)) return cursor.fetchone() # --- The Defense --- # The attacker tries the same input. result = secure_login(malicious_username, random_password) # The database looks for a user with the literal username "' OR '1'='1". # No such user exists, so the login fails correctly. print(f"Secure login result: {result}") # Correctly returns None # --- Another Example: Union-based SQLi --- # Attacker tries to extract all usernames malicious_username_2 = "' UNION SELECT 1, username, password FROM users --" # Vulnerable query becomes: # SELECT * FROM users WHERE username = '' UNION SELECT 1, username, password FROM users --' AND password = '...' # The '--' comments out the rest of the query. # The attacker gets all usernames and passwords! # With parameterized queries, this is treated as a literal string and fails. # Key Takeaway: # NEVER use string formatting (+, %, .format(), f-strings) to build SQL queries. # ALWAYS use your database driver's parameterization feature (placeholders like ?, %s).29:["$","div",null,{"className":"min-h-screen bg-gray-50 dark:bg-gray-900 pt-20","children":[["$","$L37",null,{"topicSlug":"python","topicTitle":"Python Engineer's Expedition","dayNumber":56,"dayTitle":"Application Security: Input Validation & Common Vulnerabilities","sprintNumber":3,"estimatedTime":"120-150 minutes","totalDays":66}],["$","div",null,{"className":"w-full px-4 sm:px-6 lg:px-8 py-8","children":["$","$L38",null,{"dayNumber":56,"topicSlug":"python","children":["$","$L39",null,{"day":{"dayNumber":56,"sprintNumber":3,"title":"Application Security: Input Validation & Common Vulnerabilities","subtitle":"Master secure coding practices from OWASP, Google, and Netflix","description":"Learn to defend against common web vulnerabilities like SQL Injection, XSS, and insecure deserialization. Master input validation, output encoding, and parameterized queries—the foundational pillars of secure application development.","slug":"application-security-and-input-validation","week":8,"duration":"120-150 minutes","lastUpdated":"2025-12-01","learningGoals":[{"id":"goal-56-1","text":"Understand and prevent SQL Injection vulnerabilities","measurable":"Write secure database queries using parameterization"},{"id":"goal-56-2","text":"Understand and prevent Cross-Site Scripting (XSS)","measurable":"Implement output encoding in web templates to neutralize scripts"},{"id":"goal-56-3","text":"Implement robust input validation for all external data","measurable":"Use Pydantic and validation rules to reject malicious input"},{"id":"goal-56-4","text":"Recognize and mitigate other common vulnerabilities","measurable":"Identify risks like insecure deserialization and path traversal"}],"whyThisMatters":{"productionStory":"The 2017 Equifax breach, exposing 147 million people's data, was caused by a failure to patch a known vulnerability. The 2019 Capital One breach (100 million records) resulted from a misconfigured web application firewall. Security isn't a feature; it's the foundation. At Google, every line of code goes through security review. Netflix's security team builds tools to proactively find vulnerabilities. A single security flaw can destroy user trust and bankrupt a company. 'Move fast and break things' does not apply to security.","realWorldContext":"You build a simple login form. An attacker enters `' OR '1'='1` as the username. Your insecure query becomes `SELECT * FROM users WHERE username = '' OR '1'='1'`. The attacker is now logged in as the first user in your database. Or, a user posts a comment containing ``. Now every user who views that comment has their session cookie stolen. These aren't complex hacks; they are the most common vulnerabilities found on the web.","industryRelevance":"Every developer is expected to write secure code. Security is a standard topic in interviews at all major tech companies. The Open Web Application Security Project (OWASP) Top 10 is required reading for web developers. Roles like 'Application Security Engineer' and 'Product Security Engineer' are in high demand. Understanding these vulnerabilities is a baseline requirement for any backend or full-stack developer."},"missionAlignment":{"ourMission":"Learn Today teaches you to build production-ready applications. Secure coding is non-negotiable in production.","thisLesson":"Today, you will learn to think like an attacker to defend like an expert. We'll cover the most critical vulnerabilities and the exact patterns to prevent them.","yourGrowth":"You are transitioning from a developer who writes functional code to an engineer who writes secure, resilient, and trustworthy code. This is a critical step in your professional journey."},"coreValues":{"clarity":"We demonstrate vulnerabilities with simple, clear examples. We show the insecure code and the secure code side-by-side.","practicality":"These are not theoretical attacks. We focus on the OWASP Top 10 vulnerabilities that appear in real-world applications and the practical defense mechanisms you can implement today.","depth":"We go beyond just 'use this function.' We explain *why* a vulnerability exists, how an attacker exploits it, and how the recommended defense mitigates the risk at a fundamental level.","empowerment":"By the end of this lesson, you will be able to identify and prevent the most common and dangerous security flaws in your own applications."},"topics":["Application Security","SQL Injection","XSS","Input Validation","OWASP Top 10","Secure Coding"],"coreContent":{"sections":[{"id":"section-1","type":"introduction","title":"The Security Mindset: Never Trust Input","order":1,"content":{"explanation":"The fundamental principle of application security is: **Never trust data from an external source.** This includes user input from forms, API requests, URL parameters, database results, and even files. All external data must be treated as potentially malicious until it has been validated and properly handled. An attacker's goal is to make your application do something it wasn't designed to do by providing crafted input. Our job is to ensure that can't happen. We do this through two primary defenses: rigorous **input validation** (rejecting bad data) and safe **output encoding** (neutralizing malicious data before display)."}},{"id":"section-2","type":"concept","title":"SQL Injection (SQLi)","order":2,"content":{"explanation":"SQL Injection occurs when an attacker can manipulate a SQL query by inserting their own SQL code. This is almost always caused by using string formatting to build queries with user input. The consequences are catastrophic: data theft, data corruption, or complete server takeover. The defense is simple and absolute: **always use parameterized queries (prepared statements).**","codeExamples":[{"title":"SQL Injection: Vulnerability and Defense","code":"$3a","language":"python","explanation":"The vulnerable code mixes code (the SQL query) and data (the user input). The secure code keeps them separate. The database driver ensures that the input from the user is only ever treated as data, never as part of the SQL command. This one practice prevents virtually all SQL injection attacks."}]}},{"id":"section-3","type":"concept","title":"Cross-Site Scripting (XSS)","order":3,"content":{"explanation":"XSS occurs when an attacker injects malicious scripts (usually JavaScript) into a web page, which then execute in the browsers of other users. This can be used to steal session cookies, redirect users, or deface websites. The primary defense is **output encoding**: converting special characters into their HTML entity equivalents before rendering them in a template.","codeExamples":[{"title":"XSS: Vulnerability and Defense","code":"$3b","language":"python","explanation":"The vulnerability exists because the application allows user-supplied data to be interpreted as code (JavaScript) by the browser. The fix is to ensure all user data is treated only as text. Auto-escaping template engines are the best defense, as they handle this automatically. They understand the context (HTML body, attribute, URL) and apply the correct encoding."}]}},{"id":"section-4","type":"hands-on","title":"Input Validation with Pydantic","order":4,"content":{"explanation":"Input validation is the process of ensuring that any data entering your system is in the correct format, type, and range. It's your first line of defense. If you expect an integer, reject anything that isn't. If you expect an email, validate its format. Pydantic is a powerful library for data validation using Python type hints.","codeExamples":[{"title":"Robust Input Validation with Pydantic","code":"$3c","language":"python","explanation":"Pydantic allows you to declaratively define the expected shape and constraints of your data. If the incoming data doesn't match the model, a descriptive error is raised immediately. This prevents invalid or malicious data from ever reaching your application logic. It's a powerful way to enforce the 'fail fast' principle for security."}]}}]},"videoResources":{"primary":{"title":"Python Tutorial: Preparing to Deploy a Flask Application with Proper Error Handling and Security","creator":"Corey Schafer","embedId":"goToXTC96Co","duration":"16:52","description":"⭐ Essential security practices for web applications including environment variables, secret key management, error handling, and production configuration. Covers how to handle secrets properly, avoid exposing sensitive data in errors, and configure applications securely. Directly applicable to any Python web application.","when":"MUST WATCH - Security fundamentals for production applications"},"secondary":{"title":"Python Tutorial: How to Set Environment Variables","creator":"Corey Schafer","embedId":"IolxqkL7cD8","duration":"14:57","description":"Complete guide to managing environment variables in Python using os.environ, python-dotenv, and .env files. Critical for security - teaches how to keep API keys, database passwords, and secrets out of source code. Shows cross-platform approaches for Windows, Mac, Linux.","when":"Watch for proper secrets management and configuration"}},"challenges":[{"id":"challenge-56-1","difficulty":"basecamp","title":"Fix SQL Injection Vulnerabilities","description":"Given a vulnerable login and search system using string concatenation in SQL queries, identify the SQL injection vulnerabilities, demonstrate the attacks, then fix them using parameterized queries. Learn why parameterization completely prevents SQL injection and how to apply it correctly.","requirements":["Review provided vulnerable code with 3 functions using string formatting in SQL","Demonstrate SQL injection attack: login bypass using ' OR '1'='1","Demonstrate data extraction attack using UNION SELECT","Explain why string concatenation enables SQL injection","Refactor login() function to use parameterized queries","Refactor search_products() to use parameterized queries","Refactor get_user_orders() to use parameterized queries","Test that attacks no longer work after fix","Verify legitimate users can still login and search","Write comments explaining how parameterization prevents injection"],"starterCode":"$3d","hints":["Parameterized query syntax: cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))","Use ? as placeholder, pass values as tuple in second argument","For LIKE queries: execute('SELECT * FROM x WHERE name LIKE ?', (f'%{term}%',))","Never use f-strings or % formatting with SQL - always use ?","Parameterization works because SQL and data are sent separately","Test with malicious inputs to verify they're treated as literal strings","Original attack ' OR '1'='1 becomes literal string, not SQL code","Parameterization is ONLY defense - no amount of input validation is enough","This applies to all databases: SQLite, MySQL, PostgreSQL, etc.","ORMs like SQLAlchemy use parameterization internally"],"expectedOutcome":"Complete understanding of SQL injection vulnerability and its prevention. Demonstration of two attack vectors: authentication bypass (' OR '1'='1) and data extraction (UNION SELECT). Clear explanation of why string concatenation enables injection - attacker's input becomes SQL code. Correct implementation of parameterized queries preventing all injection attempts. Testing showing attacks fail harmlessly - malicious input treated as literal data, not executable code. Recognition that parameterization is the ONLY complete defense against SQL injection. Understanding that this is #1 web vulnerability and must be prevented in every SQL query."},{"id":"challenge-56-2","difficulty":"ridge","title":"Build Secure FastAPI Endpoint with Input Validation","description":"Create a complete FastAPI user registration and profile management system with comprehensive input validation using Pydantic, SQL injection prevention with parameterized queries, XSS prevention with output encoding, and proper error handling. Demonstrate security by attempting attacks that all fail gracefully.","requirements":["Create FastAPI app with 3 endpoints: POST /register, POST /login, GET /profile/{user_id}","Use Pydantic models for request validation: username (alphanumeric, 3-20 chars), email (valid format), password (min 8 chars, complexity rules)","Validate input strictly: reject invalid usernames, malformed emails, weak passwords","Use SQLite with parameterized queries for all database operations","Hash passwords with bcrypt (never store plaintext)","Sanitize HTML output to prevent XSS in profile display","Add proper error handling: return 400 for validation errors, 401 for auth errors, 404 for not found","Implement rate limiting: max 5 registration attempts per minute","Add logging: log registration attempts, failed logins, validation errors","Write tests: valid registration, SQL injection attempts, XSS attempts, invalid inputs","Demonstrate security: show injection/XSS attempts failing","Include security headers: X-Content-Type-Options, X-Frame-Options"],"starterCode":"$3e","hints":["Pydantic automatically validates email format with EmailStr","Use @validator decorator for custom validation rules","bcrypt.hashpw() and bcrypt.checkpw() for secure password handling","html.escape() converts