python-codeql-demo/app.py at main · sroyad/python-codeql-demo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
#!/usr/bin/env python3
"""
Vulnerable Python Web Application for CodeQL Testing
Contains intentional security vulnerabilities for demonstration
"""

import os
import sqlite3
import subprocess
import urllib.parse
import pickle
import hashlib
from flask import Flask, request, render_template_string, redirect, url_for

app = Flask(__name__)

# SQL Injection vulnerability
@app.route('/user')
def get_user():
    user_id = request.args.get('id')

    # VULNERABLE: Direct string concatenation with user input
    query = "SELECT * FROM users WHERE id = " + user_id

    conn = sqlite3.connect('users.db')
    cursor = conn.cursor()

    # VULNERABLE: Executing query with user input
    cursor.execute(query)
    result = cursor.fetchone()
    conn.close()

    return f"User: {result}"

# Command Injection vulnerability
@app.route('/ping')
def ping_host():
    host = request.args.get('host')

    # VULNERABLE: Direct command execution with user input
    command = f"ping -c 4 {host}"
    result = subprocess.run(command, shell=True, capture_output=True, text=True)

    return f"Ping result: {result.stdout}"

# Path Traversal vulnerability
@app.route('/file')
def read_file():
    filename = request.args.get('file')

    # VULNERABLE: No validation of filename
    with open(filename, 'r') as f:
        content = f.read()

    return f"File content: {content}"

# XSS vulnerability
@app.route('/search')
def search():
    query = request.args.get('q')

    # VULNERABLE: Direct output without sanitization
    template = f"""
    <html>
        <body>
            <h1>Search Results for: {query}</h1>
            <p>No results found for your query.</p>
        </body>
    </html>
    """

    return render_template_string(template)

# Hardcoded credentials
@app.route('/admin')
def admin_login():
    username = request.args.get('username')
    password = request.args.get('password')

    # VULNERABLE: Hardcoded credentials
    if username == "admin" and password == "password123":
        return "Admin access granted!"
    else:
        return "Access denied!"

# Insecure deserialization
@app.route('/data')
def process_data():
    data = request.args.get('data')

    # VULNERABLE: Insecure deserialization
    obj = pickle.loads(data.encode())
    return f"Processed: {obj}"

# Weak cryptography
@app.route('/encrypt')
def encrypt_data():
    data = request.args.get('data')

    # VULNERABLE: Using weak MD5 hash
    hash_value = hashlib.md5(data.encode()).hexdigest()
    return f"Hash: {hash_value}"

# File upload vulnerability
@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return "No file uploaded"

    file = request.files['file']
    if file.filename == '':
        return "No file selected"

    # VULNERABLE: No file type validation
    filename = file.filename
    file.save(os.path.join('/tmp', filename))

    return f"File {filename} uploaded successfully"

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0', port=5000)