Application Architecture

from flask import Flask, render_template, request, redirect
from flask_cors import CORS
import user_management as dbHandler

app = Flask(__name__)
CORS(app)  # ⚠️ Allows all origins - CSRF vulnerability

@app.route("/", methods=["POST", "GET"])
@app.route("/index.html", methods=["POST", "GET", "PUT", "PATCH", "DELETE"])
def home():
    # ⚠️ Open redirect vulnerability
    if request.method == "GET" and request.args.get("url"):
        url = request.args.get("url", "")
        return redirect(url, code=302)
    # Login processing
    elif request.method == "POST":
        username = request.form["username"]
        password = request.form["password"]
        isLoggedIn = dbHandler.retrieveUsers(username, password)
        if isLoggedIn:
            return render_template("/success.html", value=username, state=isLoggedIn)
        else:
            return render_template("/index.html")
    else:
        msg = request.args.get("msg", "")
        return render_template("/index.html", msg=msg)

if __name__ == "__main__":
    app.run(debug=True, host="0.0.0.0", port=5000)

import sqlite3 as sql

def insertUser(username, password, DoB):
    con = sql.connect("database_files/database.db")
    cur = con.cursor()
    # ✅ Secure: Uses parameterized query
    cur.execute(
        "INSERT INTO users (username,password,dateOfBirth) VALUES (?,?,?)",
        (username, password, DoB)
    )
    con.commit()
    con.close()

def retrieveUsers(username, password):
    con = sql.connect("database_files/database.db")
    cur = con.cursor()
    # ⚠️ SQL Injection vulnerability
    cur.execute(f"SELECT * FROM users WHERE username = '{username}'")
    if cur.fetchone() == None:
        con.close()
        return False
    else:
        # ⚠️ SQL Injection vulnerability
        cur.execute(f"SELECT * FROM users WHERE password = '{password}'")
        # ⚠️ Side-channel timing attack vulnerability
        time.sleep(random.randint(80, 90) / 1000)
        if cur.fetchone() == None:
            con.close()
            return False
        else:
            con.close()
            return True

def insertFeedback(feedback):
    con = sql.connect("database_files/database.db")
    cur = con.cursor()
    # ⚠️ SQL Injection vulnerability
    cur.execute(f"INSERT INTO feedback (feedback) VALUES ('{feedback}')")
    con.commit()
    con.close()

def listFeedback():
    con = sql.connect("database_files/database.db")
    cur = con.cursor()
    data = cur.execute("SELECT * FROM feedback").fetchall()
    con.close()
    # ⚠️ XSS vulnerability - writes unescaped user input to HTML
    f = open("templates/partials/success_feedback.html", "w")
    for row in data:
        f.write("<p>\n")
        f.write(f"{row[1]}\n")
        f.write("</p>\n")
    f.close()