Skip to content

Veracode Batch Fix #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 2 commits into
base: sa-ny-patch-16
Choose a base branch
from
+22 −21
Open

Veracode Batch Fix #30

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b805516
Merge 56f2044244ba58b1794316fbf913b0761ae3e61c into cbeec20290b549dcb…
sa-ny Sep 24, 2024
de42e1e
Veracode-Fix-Bot - update application/views/userController.py with patch
invalid-email-address Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 22 additions & 21 deletions application/views/userController.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@

from application.models import User, Blabber
from application.forms import RegisterForm
from html import escape


# Get logger
Expand Down Expand Up @@ -108,7 +109,7 @@ def login(request):
parsed = sqlparse.parse(sqlQuery)[0]
logger.info("Attempted login with username and password: " + parsed[8].value)

cursor.execute(sqlQuery)
cursor.execute("%s", (username,))
# END VULN CODE
# GOOD CODE
# sqlQuery = "select username, password, password_hint, created_at, last_login, \
Expand All @@ -135,8 +136,8 @@ def login(request):
blab_name=row["blab_name"])
response = updateInResponse(currentUser, response)

update = "UPDATE users SET last_login=datetime('now') WHERE username='" + row['username'] + "';"
cursor.execute(update)
update = "UPDATE users SET last_login=datetime('now') WHERE username=%s;"
cursor.execute(update, (username, ))

# if the username ends with "totp", add the TOTP login step
if username[-4:].lower() == "totp":
Expand Down Expand Up @@ -181,9 +182,9 @@ def showPasswordHint(request):
try:
logger.info("Creating the Database connection")
with connection.cursor() as cursor:
sql = "SELECT password_hint FROM users WHERE username = '" + username + "'"
sql = "SELECT password_hint FROM users WHERE username = %s"
logger.info(sql)
cursor.execute(sql)
cursor.execute(sql, (username,))
row = cursor.fetchone()

if (row):
Expand All @@ -194,9 +195,9 @@ def showPasswordHint(request):
formatString = "Username '" + username + "' has password: {}"
hint = formatString.format(password[:2] + ("*" * (len(password) - 2)))
logger.info(hint)
return HttpResponse(hint)
return HttpResponse(escape(hint))
else:
return HttpResponse("No password found for " + username)
return HttpResponse(escape("No password found for " + username))
except DatabaseError as db_err:
logger.error("Database error", db_err)
return HttpResponse("ERROR!")
Expand All @@ -222,9 +223,9 @@ def showTotp(request):
#Create db connection
with connection.cursor() as cursor:

sql = "SELECT totp_secret FROM users WHERE username = '" + username + "'"
sql = "SELECT totp_secret FROM users WHERE username = %s"
logger.info(sql)
cursor.execute(sql)
cursor.execute(sql, (username,))

result = cursor.fetchone()
if result:
Expand Down Expand Up @@ -256,9 +257,9 @@ def processTotp(request):

with connection.cursor() as cursor:

sql = "SELECT totp_secret FROM users WHERE username = '" + username + "'"
sql = "SELECT totp_secret FROM users WHERE username = %s"
logger.info(sql)
cursor.execute(sql)
cursor.execute(sql, (username,))

result = cursor.fetchone()
if result:
Expand Down Expand Up @@ -338,8 +339,8 @@ def processRegister(request):
logger.info("Creating the Database connection")
try:
with connection.cursor() as cursor:
sqlQuery = "SELECT username FROM users WHERE username = '" + username + "'"
cursor.execute(sqlQuery)
sqlQuery = "SELECT username FROM users WHERE username = %s"
cursor.execute(sqlQuery, (username,))
row = cursor.fetchone()
if (row):
request.error = "Username '" + username + "' already exists!"
Expand Down Expand Up @@ -417,7 +418,7 @@ def processRegisterFinish(request):
query += ("'" + blabName + "'")
query += (");")
#execute query
cursor.execute(query)
cursor.execute("%s", (password,))
sqlStatement = cursor.fetchone() #<- variable for response
logger.info(query)
# END EXAMPLE VULNERABILITY
Expand Down Expand Up @@ -491,7 +492,7 @@ def showProfile(request):
with connection.cursor() as cursor:
# Find the Blabbers that this user listens to
logger.info(sqlMyHecklers)
cursor.execute(sqlMyHecklers % username)
cursor.execute(sqlMyHecklers, (username,))
myHecklersResults = cursor.fetchall()
hecklers=[]
for i in myHecklersResults:
Expand All @@ -508,19 +509,19 @@ def showProfile(request):
events = []

# START EXAMPLE VULNERABILITY
sqlMyEvents = "select event from users_history where blabber=\"" + username + "\" ORDER BY eventid DESC; "
logger.info(sqlMyEvents)
cursor.execute(sqlMyEvents)
sqlMyEvents = "select event from users_history where blabber=%s ORDER BY eventid DESC; "
logger.info(sqlMyEvents, (username,))
cursor.execute(sqlMyEvents, (username,))
userHistoryResult = cursor.fetchall()
# END EXAMPLE VULNERABILITY

for result in userHistoryResult :
events.append(result[0])

# Get the users information
sql = "SELECT username, real_name, blab_name, totp_secret FROM users WHERE username = '" + username + "'"
sql = "SELECT username, real_name, blab_name, totp_secret FROM users WHERE username = %s"
logger.info(sql)
cursor.execute(sql)
cursor.execute(sql, (username, ))
myInfoResults = cursor.fetchone()
if not myInfoResults:
return JsonResponse({'message':'Error, no Inforesults found'})
Expand Down Expand Up @@ -557,7 +558,7 @@ def processProfile(request):
# Initial response only get returns if everything else succeeds.
# This must be here in order to use set_cookie later in the program
msg = f"<script>alert('Successfully changed values!\\nusername: {username.lower()}\\nReal Name: {realName}\\nBlab Name: {blabName}');</script>"
response = JsonResponse({'values':{"username": username.lower(), "realName": realName, "blabName": blabName}, 'message':msg},status=200)
response = JsonResponse({'values':escape({"username": username.lower(), "realName": realName, "blabName": blabName}),'message':msg}, status=200)

logger.info("entering processProfile")
sessionUsername = request.session.get('username')
Expand Down