bandarisantosh · bandarisantosh · Nov 26, 2024 · private-semgrep-app · Nov 26, 2024 · private-semgrep-app
diff --git a/sql_injection_login.py b/sql_injection_login.py
@@ -0,0 +1,48 @@
+from flask import render_template
+import hashlib
+
+
+def sql_injection_login_page(request, app):
+    return render_template(
+        'sql_injection/login.html',
+        sql='',
+        logged=None
+    )
+
+
+def sql_injection_login_api(request, app):
+    form = request.form
+
+    username = form.get('username')
+    password = form.get('password')
+    password_hash = _hash_password(password)
-    password_hash = _hash_password(password)
+    import os
+    import hashlib
+
+    def _hash_password(password):
+        # Generate a random salt
+        salt = os.urandom(16)
+        # Use scrypt for hashing the password with the generated salt
+        scrypt_pass = hashlib.scrypt(password.encode('utf-8'), salt=salt, n=16384, r=8, p=1)
+        # Return both the salt and the hash, as the salt is needed for verification
+        return salt + scrypt_pass
-    password_hash = _hash_password(password)
+    import os
+    import hashlib
+
+    def _hash_password(password):
+        # Generate a random salt
+        salt = os.urandom(16)
+        # Use scrypt for hashing the password with the generated salt
+        scrypt_pass = hashlib.scrypt(password.encode('utf-8'), salt=salt, n=16384, r=8, p=1)
+        # Return both the salt and the hash, as the salt is needed for verification
+        return salt + scrypt_pass
+
+    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    def sql_injection_login_api(request, app):
+        form = request.form
+
+        username = form.get('username')
+        password = form.get('password')
+        password_hash = _hash_password(password)
+
+        # Use parameterized query to prevent SQL injection
+        sql = "SELECT * FROM users WHERE username=%s AND password=%s"
+
+        # Pass parameters as a tuple
+        db_result = app.db_helper.execute_read(sql, (username, password_hash))
+
+        user = list(
+            map(
+                lambda u: {
+                    'id': u[0],
+                    'username': u[1],
+                    'password': u[2]
+                }, 
+                db_result
+            )
+        )[0] if len(db_result) > 0 else None
+
+        return render_template(
+            'sql_injection/login.html',
+            sql=sql,
+            logged=user is not None
+        )
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    def sql_injection_login_api(request, app):
+        form = request.form
+
+        username = form.get('username')
+        password = form.get('password')
+        password_hash = _hash_password(password)
+
+        # Use parameterized query to prevent SQL injection
+        sql = "SELECT * FROM users WHERE username=%s AND password=%s"
+
+        # Pass parameters as a tuple
+        db_result = app.db_helper.execute_read(sql, (username, password_hash))
+
+        user = list(
+            map(
+                lambda u: {
+                    'id': u[0],
+                    'username': u[1],
+                    'password': u[2]
+                }, 
+                db_result
+            )
+        )[0] if len(db_result) > 0 else None
+
+        return render_template(
+            'sql_injection/login.html',
+            sql=sql,
+            logged=user is not None
+        )
+    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    sql = "SELECT * FROM users WHERE username=:username AND password=:password"
+    db_result = app.db_helper.execute_read(sql, {"username": username, "password": password_hash})
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    sql = "SELECT * FROM users WHERE username=:username AND password=:password"
+    db_result = app.db_helper.execute_read(sql, {"username": username, "password": password_hash})
+    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    sql = "SELECT * FROM users WHERE username=%s AND password=%s"
+    db_result = app.db_helper.execute_read(sql, (username, password_hash))
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    sql = "SELECT * FROM users WHERE username=%s AND password=%s"
+    db_result = app.db_helper.execute_read(sql, (username, password_hash))
+    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    sql = "SELECT * FROM users WHERE username=:username AND password=:password_hash"
+    db_result = app.db_helper.execute_read(sql, {"username": username, "password_hash": password_hash})
-    sql = f"SELECT * FROM users WHERE username='{username}' AND password='{password_hash}'"
+    sql = "SELECT * FROM users WHERE username=:username AND password=:password_hash"
+    db_result = app.db_helper.execute_read(sql, {"username": username, "password_hash": password_hash})
+    flask.render_template_string(username)
-    flask.render_template_string(username)
+    return render_template('your_template.html', username=username)
-    flask.render_template_string(username)
+    return render_template('your_template.html', username=username)
+
+    db_result = app.db_helper.execute_read(sql)
+
+    user = list(
+        map(
+            lambda u: {
+                'id': u[0],
+                'username': u[1],
+                'password': u[2]
+            }, 
+            db_result
+        )
+    )[0] if len(db_result) > 0 else None
+
+    return render_template(
+        'sql_injection/login.html',
+        sql=sql,
+        logged=user is not None
+    )
+
+
+def _hash_password(password):
+    md5_pass = hashlib.md5(password.encode('utf-8')).hexdigest()
-    md5_pass = hashlib.md5(password.encode('utf-8')).hexdigest()
+    def _hash_password(password):
+        sha256_pass = hashlib.sha256(password.encode('utf-8')).hexdigest()
+        return sha256_pass
-    md5_pass = hashlib.md5(password.encode('utf-8')).hexdigest()
+    import os
+    import hashlib
+
+    def _hash_password(password):
+        # Generate a secure random salt
+        salt = os.urandom(16)
+        # Use scrypt for password hashing with the generated salt
+        scrypt_pass = hashlib.scrypt(password.encode('utf-8'), salt=salt, n=16384, r=8, p=1)
+        # Return the salt and hashed password as a hex string
+        return salt.hex() + scrypt_pass.hex()
-    md5_pass = hashlib.md5(password.encode('utf-8')).hexdigest()
+    def _hash_password(password):
+        sha256_pass = hashlib.sha256(password.encode('utf-8')).hexdigest()
+        return sha256_pass
-    md5_pass = hashlib.md5(password.encode('utf-8')).hexdigest()
+    import os
+    import hashlib
+
+    def _hash_password(password):
+        # Generate a secure random salt
+        salt = os.urandom(16)
+        # Use scrypt for password hashing with the generated salt
+        scrypt_pass = hashlib.scrypt(password.encode('utf-8'), salt=salt, n=16384, r=8, p=1)
+        # Return the salt and hashed password as a hex string
+        return salt.hex() + scrypt_pass.hex()
+    return md5_pass