Open
Conversation
added 17 commits
May 8, 2024 12:11
…_access_lab_2.html
…_access_lab_1.html
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request from patched fixes 54 issues.
Fix CSRF vulnerability and handle cookies securely for auth_failure_lab3
Removed @csrf_exempt decorator and added secure=True, httponly=True, and samesite='Lax' parameters to the set_cookie method when setting the session_id cookie.Fixed Django cookie security misconfiguration
Set secure=True, httponly=True, and samesite='Lax' for the "auth_cookie" in the response.set_cookie() method.Fix insecure cookie handling in crypto_failure_lab3 view
Added secure=True, httponly=True, and samesite='Lax' parameters when setting the cookie in the response.Fix insecure password hashing vulnerability
Replaced the usage of MD5 with the more secure scrypt hashing function from hashlib.Fix potential SSTI vulnerability in ssti_lab view function
Escaped blog data before writing to file to prevent SSTI vulnerability.Fix SSRF vulnerability by validating URL before making the request
Added URL validation to mitigate SSRF vulnerability by checking that the URL provided in the request is allowed based on an allowlist before making the external request.Fix path traversal vulnerability
Used os.path.abspath instead of os.path.join to mitigate path traversal vulnerability.Fix SQL injection vulnerability in injection_sql_lab
Removed @csrf_exempt decorator to enforce CSRF protection. Refactored the SQL query to use parameterized queries instead of manual string concatenation to prevent SQL injection attacks.Remove @csrf_exempt decorator to prevent CSRF vulnerability
Removed @csrf_exempt decorator from theinjectionfunction to prevent CSRF vulnerability.Removed @csrf_exempt decorator to prevent CSRF vulnerability
Removed @csrf_exempt decorator from the function to ensure a CSRF token is required for this route.Fix vulnerability by removing @csrf_exempt decorator
Removed the @csrf_exempt decorator from the view function to ensure CSRF token protection.Fix vulnerability in A1_BrokenAccessControl view function
Removed @csrf_exempt decorator from the view function to ensure that a CSRF token is set for this route.Remove @csrf_exempt decorator from a9_lab2 function
Removed @csrf_exempt decorator from the a9_lab2 function to ensure CSRF token protection for the route.Fix potential vulnerabilities in a9_lab route
Removed @csrf_exempt decorator and replaced insecure yaml.load() method with safe alternative yaml.safe_load()Remove @csrf_exempt decorator from the Otp function
Removed @csrf_exempt decorator from the Otp function to ensure CSRF token protection for the route.Fix code injection vulnerability in cmd_lab2 route
Removed @csrf_exempt decorator and replaced the use of eval with a safer alternative to prevent code injection vulnerability in the cmd_lab2 route.Fixed command injection vulnerability in cmd_lab function
Removed @csrf_exempt decorator from the function and modified the subprocess.Popen call to use shell=False to prevent command injection. Used shlex.quote to escape user-controlled data before passing it to the subprocess call.Fix CSRF vulnerability in ba_lab view function
Removed @csrf_exempt decorator from the ba_lab view function to prevent CSRF vulnerability.Fix CSRF vulnerability in ba route
Removed @csrf_exempt decorator from the 'ba' view function to prevent CSRF vulnerability.Fix XSS vulnerability by rendering HTML safely in Django template
Instead of rendering the 'err_msg' directly to HttpResponse, pass the context to the template and render it safely using Django's template engine.Fix XSS and secure cookie handling vulnerabilities
Fixed XSS vulnerability by rendering HTML safely using Django's template engine instead of directly using 'HttpResponse'. Updated cookie settings to secure=True, httponly=True, and samesite='Lax' for secure cookie handling.Fixed XSS and improved cookie handling in auth_lab_signup view
Used Django's template engine to render HTML safely instead of directly using HttpResponse. Updated cookie settings to make them more secure by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie().Removed @csrf_exempt decorator for the xxe_parse function
Removed the @csrf_exempt decorator from the xxe_parse function to ensure that a CSRF token is required for this route.Remove @csrf_exempt decorator for xxe_see route
Removed @csrf_exempt decorator from the xxe_see route to ensure CSRF protection.Fix insecure deserialization vulnerability in insec_des_lab view
- Added secure=True, httponly=True, and samesite='Lax' parameters in the response.set_cookie() method.Fixed SQL injection vulnerability by using parameterized query
Replaced the manual construction of the SQL query with a parameterized query to prevent SQL injection vulnerability.Remove @csrf_exempt decorator from mitre_lab_17_api function
Removed @csrf_exempt decorator from the mitre_lab_17_api function to ensure CSRF token protection.Fix subprocess.Popen shell=True vulnerability
Changed the shell parameter in subprocess.Popen from True to False to prevent shell injection vulnerability.Fix vulnerability in mitre_lab_25_api function
Removed @csrf_exempt decorator to protect against CSRF attacks. Refactored the code to avoid using eval function.Remove @csrf_exempt decorator
Removed @csrf_exempt decorator from the view function to ensure CSRF protection for the route.Fix security vulnerabilities in csrf_lab_login function
Replaced usage of MD5 with hashlib.scrypt for hashing the password. Updated the JWT secret key with a recommendation to use a more secure method for managing secrets. Added secure=True, httponly=True, and samesite='Lax' parameters to set_cookie for handling Django cookies securely.Add CSRF token to the manually-created form
Added the csrf_token tag to the form to prevent CSRF attacks.Add csrf_token to the form in Django template
Added{% csrf_token %}to the form in the Django template to prevent CSRF attacks.Fix CSRF vulnerability in the form
Added csrf_token tag to the form to prevent CSRF attacks.Fix CSRF vulnerability by adding csrf_token to the form
Added csrf_token to the form to prevent CSRF attacks.Remove @csrf_exempt decorator and ensure proper sanitization of request data in A6_disscussion_api_2
Removed @csrf_exempt decorator to protect against CSRF attacks and added proper sanitization to escape request data before writing to file.Remove @csrf_exempt decorator for A6 discussion API
Removed @csrf_exempt decorator from the A6_disscussion_api function.Fix vulnerability by removing @csrf_exempt decorator
Removed @csrf_exempt decorator from the A7_disscussion_api function.Remove @csrf_exempt decorator and properly sanitize request data before writing to files
Removed @csrf_exempt decorator to ensure CSRF token protection and properly sanitized request data before writing to files using appropriate escaping mechanisms.Removed @csrf_exempt decorator for SSRF code checker function.
Removed the @csrf_exempt decorator from the SSRF code checker function to ensure CSRF protection for the endpoint.Fix XSS vulnerability by escaping template variable properly in script tag
Escaped the template variable properly to prevent XSS vulnerability by using the Django 'json_script' template tagAdd csrf_token to the form in Django template
Added csrf_token to the form in Django templateFix security vulnerabilities in Docker configuration
Added 'security_opt' with 'no-new-privileges:true' and 'read_only: true' to services 'db', 'web', and 'migration'.Remove @csrf_exempt decorator
Removed @csrf_exempt decorator from the log_function_target to ensure CSRF token protection.Remove @csrf_exempt decorator from log_function_target
Removed @csrf_exempt decorator from the log_function_target function to ensure CSRF token protection for the route.Fix XSS vulnerability in a9.js
Avoided setting user-controlled data directly into the innerHTML of the createdAdd CSRF token to form in A9 template
Added {% csrf_token %} to the form in the template to prevent CSRF attacks.Fix CSRF vulnerability in manual form
Added a CSRF token to the form in the Django template to prevent CSRF attacks.Add csrf_token to prevent CSRF attacks
Added csrf_token to the forms in the Django template to prevent CSRF attacks.Fix CSRF vulnerability by adding csrf_token to form
Added {% csrf_token %} tag to the form in the Django template to prevent CSRF attacks.Add csrf_token to form in Django template
Added csrf_token to the form in the Django template to prevent CSRF attacks.Fix XSS vulnerability in LAB 3
Moved the template variable 'code' outside of the script tag to prevent XSS vulnerability.Add csrf_token to prevent CSRF attacks
Added {% csrf_token %} to the form in order to prevent CSRF attacks.Add csrf_token to prevent CSRF attacks
Added {% csrf_token %} to the form in order to prevent CSRF attacks.