OWASP Top 10¶

# VULNERABLE — l'utilisateur controle l'ID directement
@app.route("/api/orders/<int:order_id>")
def get_order(order_id):
    order = db.query("SELECT * FROM orders WHERE id = ?", order_id)
    return jsonify(order)  # N'importe qui peut lire n'importe quelle commande

# SECURISE — verifier que la ressource appartient a l'utilisateur
@app.route("/api/orders/<int:order_id>")
@login_required
def get_order(order_id):
    order = db.query(
        "SELECT * FROM orders WHERE id = ? AND user_id = ?",
        order_id, current_user.id
    )
    if not order:
        abort(404)
    return jsonify(order)

import hashlib
import bcrypt

# VULNERABLE — MD5 cassable en secondes
def store_password_bad(password):
    return hashlib.md5(password.encode()).hexdigest()

# VULNERABLE — SHA256 sans sel, vulnerable aux rainbow tables
def store_password_bad2(password):
    return hashlib.sha256(password.encode()).hexdigest()

# SECURISE — bcrypt avec facteur de cout adapte
def store_password(password):
    salt = bcrypt.gensalt(rounds=12)
    return bcrypt.hashpw(password.encode(), salt)

def verify_password(password, hashed):
    return bcrypt.checkpw(password.encode(), hashed)

from cryptography.fernet import Fernet

# VULNERABLE — AES-ECB, patterns identiques produisent des blocs identiques
# Ne jamais utiliser ECB pour des donnees structurees

# SECURISE — Fernet (AES-128-CBC + HMAC-SHA256)
key = Fernet.generate_key()  # stocker en secrets manager, pas dans le code
fernet = Fernet(key)

def encrypt_pii(data: str) -> bytes:
    return fernet.encrypt(data.encode())

def decrypt_pii(token: bytes) -> str:
    return fernet.decrypt(token).decode()

# VULNERABLE — concatenation directe
def get_user_bad(username):
    query = f"SELECT * FROM users WHERE username = '{username}'"
    return db.execute(query).fetchone()
    # username = "admin' OR '1'='1" => tous les utilisateurs

# SECURISE — requetes parametrees
def get_user(username):
    query = "SELECT * FROM users WHERE username = ?"
    return db.execute(query, (username,)).fetchone()

import subprocess
import shlex

# VULNERABLE — shell=True avec entree utilisateur
def ping_host_bad(host):
    result = subprocess.run(f"ping -c 1 {host}", shell=True, capture_output=True)
    return result.stdout
    # host = "8.8.8.8; cat /etc/passwd" => execution arbitraire

# SECURISE — liste d'arguments, validation stricte
import re

def ping_host(host):
    if not re.match(r'^[a-zA-Z0-9.\-]{1,253}$', host):
        raise ValueError("Hostname invalide")
    result = subprocess.run(["ping", "-c", "1", host], capture_output=True, timeout=5)
    return result.stdout

import urllib.parse
import ipaddress
import requests

# VULNERABLE — fetch d'URL utilisateur sans validation
def fetch_url_bad(url):
    response = requests.get(url)  # http://169.254.169.254/latest/meta-data/ => AWS metadata
    return response.text

# SECURISE — validation stricte de l'URL
ALLOWED_SCHEMES = {"https"}
BLOCKED_HOSTS = {"localhost", "127.0.0.1", "0.0.0.0"}

def is_safe_url(url: str) -> bool:
    parsed = urllib.parse.urlparse(url)
    if parsed.scheme not in ALLOWED_SCHEMES:
        return False
    host = parsed.hostname or ""
    if host in BLOCKED_HOSTS:
        return False
    try:
        addr = ipaddress.ip_address(host)
        if addr.is_private or addr.is_loopback or addr.is_link_local:
            return False
    except ValueError:
        pass  # hostname, pas une IP — continuer
    return True

def fetch_url(url: str) -> str:
    if not is_safe_url(url):
        raise ValueError("URL non autorisee")
    response = requests.get(url, timeout=5, allow_redirects=False)
    return response.text