CWE References

# VULNERABLE: Direct string concatenation
query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
cursor.execute(query)

# Input: username = "admin' OR '1'='1"
# Resulting query:
SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = '...'
# Result: Authentication bypass

# SECURE: Parameterized query
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))

# VULNERABLE: Unsanitized user input
message = request.args.get('message', '')
return render_template('dashboard.html', message=message)

<!-- VULNERABLE: Direct rendering -->
<div>{{ message | safe }}</div>

URL: /dashboard?message=<script>alert(document.cookie)</script>
Result: JavaScript executes in victim's browser

# SECURE: Output escaping
from markupsafe import escape
message = request.args.get('message', '')
return render_template('dashboard.html', message=escape(message))

# VULNERABLE: Hardcoded secret key
app.secret_key = 'clave_super_secreta_123'

# SECURE: Environment-based configuration
import os
from dotenv import load_dotenv

load_dotenv()
app.secret_key = os.getenv('SECRET_KEY')

SECRET_KEY=randomly_generated_key_here_32_bytes_minimum

# VULNERABLE: Plaintext password storage
# No hashing at all - passwords stored in clear text
query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"

-- VULNERABLE: Plaintext visible
SELECT * FROM users;
-- Result:
-- id | username | password  | email
-- 1  | admin    | admin123  | [email protected]

# SECURE: Strong password hashing
from werkzeug.security import generate_password_hash, check_password_hash

# Registration - Hash password
hashed_password = generate_password_hash(password)
# Default: pbkdf2:sha256 with salt

# Login - Verify password
if user and check_password_hash(user['password'], password):
    # Authenticated

# VULNERABLE: No authorization check
@app.route('/profile')
def profile():
    user_id = request.args.get('id', session['user_id'])
    
    # Directly uses user-provided ID without validation
    cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
    user = cursor.fetchone()
    return render_template('profile.html', user=user)

# Logged in as user ID 5
# Access someone else's profile:
GET /profile?id=1  # See admin's data
GET /profile?id=2  # See another user's data
GET /profile?id=3  # Enumerate all users

# SECURE: Authorization validation
@app.route('/profile')
def profile():
    if 'user_id' not in session:
        return redirect('/login')
    
    requested_id = request.args.get('id', session['user_id'])
    
    # Validate input type
    try:
        requested_id = int(requested_id)
    except ValueError:
        flash('ID inválido', 'danger')
        return redirect('/dashboard')
    
    # CRITICAL: Authorization check
    if requested_id != session['user_id'] and session.get('role') != 'admin':
        flash('No tienes permiso para ver este perfil', 'danger')
        return redirect('/dashboard')
    
    # Now safe to query
    cursor.execute(query, (requested_id,))

# VULNERABLE: Session not regenerated after login
if user:
    session['user_id'] = user['id']
    session['username'] = user['username']
    # Session ID remains the same from pre-auth to post-auth

# SECURE: Proper session configuration
if user and check_password_hash(user['password'], password):
    session.clear()  # Clear any existing session
    session['user_id'] = user['id']
    session['username'] = user['username']
    session['role'] = user['role']
    session.permanent = True  # Enable session timeout
    
    # Flask automatically regenerates session ID on modification

app.config.update(
    SESSION_COOKIE_SECURE=True,      # Only send over HTTPS
    SESSION_COOKIE_HTTPONLY=True,    # No JavaScript access
    SESSION_COOKIE_SAMESITE='Lax',   # CSRF protection
    PERMANENT_SESSION_LIFETIME=1800  # 30-minute timeout
)

# VULNERABLE: No CSRF protection
@app.route('/register', methods=['POST'])
def register():
    # Accepts any POST request without validating origin
    username = request.form['username']
    password = request.form['password']
    # Process without CSRF token validation

<!-- Attacker's malicious website -->
<form action="https://victim-app.com/register" method="POST">
  <input type="hidden" name="username" value="hacker">
  <input type="hidden" name="password" value="hacked123">
  <input type="hidden" name="email" value="[email protected]">
</form>
<script>document.forms[0].submit();</script>

# SECURE: CSRF protection enabled
from flask_wtf.csrf import CSRFProtect

csrf = CSRFProtect(app)

# All POST/PUT/DELETE requests now require valid CSRF token

<form method="POST">
  {{ csrf_token() }}  <!-- Flask-WTF generates token -->
  <input type="text" name="username">
  <button type="submit">Submit</button>
</form>

# VULNERABLE: Detailed SQL errors exposed
except sqlite3.Error as e:
    flash(f'Error SQL: {str(e)}', 'danger')
    print(f"ERROR SQL: {e}")

Error SQL: near "admin'": syntax error

# SECURE: Generic error messages
except sqlite3.IntegrityError:
    flash('El usuario ya existe', 'danger')
except Exception as e:
    flash('Error al registrar usuario', 'danger')
    # Log detailed error server-side only
    app.logger.error(f"Registration error: {e}")