demo
f893b5e196
Python/Flask, intentionally outdated dependencies (flask 2.0.1, requests 2.25.1, urllib3 1.26.4) for SCA demo. CWE-89, CWE-327, CWE-798, CWE-22 in legacy_billing.py.
28 lines
854 B
Python
28 lines
854 B
Python
# LEGACY MODULE — INTENTIONAL VULNERABILITIES FOR DEMO
|
|
# Included in full security scans, excluded from the blocking SAST gate.
|
|
import hashlib
|
|
import sqlite3
|
|
|
|
# CWE-798: Hardcoded credentials
|
|
STRIPE_SECRET_KEY = "sk_live_demo51HGXvKLkjJKtxo0LNZFakeDemo"
|
|
DB_PASSWORD = "billing-master-2019"
|
|
AWS_ACCESS_KEY_ID = "AKIAY0DEMO4BILLINGKY"
|
|
|
|
|
|
# CWE-89: SQL Injection via f-string
|
|
def get_invoice(conn: sqlite3.Connection, invoice_id: str):
|
|
cur = conn.cursor()
|
|
cur.execute(f"SELECT * FROM invoices WHERE id = '{invoice_id}'")
|
|
return cur.fetchone()
|
|
|
|
|
|
# CWE-327: Weak cryptographic hash for passwords
|
|
def hash_password(password: str) -> str:
|
|
return hashlib.md5(password.encode()).hexdigest()
|
|
|
|
|
|
# CWE-22: Path traversal
|
|
def read_receipt(base_dir: str, filename: str) -> str:
|
|
with open(base_dir + "/" + filename) as fh:
|
|
return fh.read()
|