PatchWork AutoFix

[CTY-git]

This pull request from patched fixes 48 issues.

---

• File changed: introduction/views.py
  Fix CSRF vulnerability and secure cookie settings

  - Removed @csrf_exempt decorator from the auth_failure_lab3 function to enable CSRF protection.

  • Added secure=True, httponly=True, and samesite='Lax' settings to the response.set_cookie function to enhance cookie security.

  Set secure, httponly and samesite flags on cookie

  The cookie 'auth_cookie' is set with secure, httponly, and samesite='Lax' flags to mitigate XSS attacks.
  Set cookie security parameters

  The changes made in the diff are:

• Added secure=True, httponly=True, and samesite='Lax' to response.set_cookie in the crypto_failure_lab3 function.

• The cookies are set to be secure, preventing them from being transmitted over HTTP.

• They are marked as HttpOnly, making them inaccessible to client-side JavaScript.

• The samesite attribute is set to 'Lax' to prevent Cross-Site Request Forgery (CSRF) attacks.

  Upgrade password hashing algorithm to scrypt

  The original code used MD5 for password hashing, which is insecure. This commit upgrades the hashing algorithm to scrypt, a more secure alternative.
  Sanitize user input before writing to file

  The code was vulnerable to a cross-site scripting (XSS) attack because it was writing user-provided data to a file without sanitizing it first. This commit fixes the vulnerability by escaping the user input before writing it to the file.
  Fix SSRF vulnerability in ssrf_lab2

  The code was vulnerable to a Server-Side Request Forgery (SSRF) attack. This was mitigated by validating the URL against an allowlist of schemes and hosts, preventing the response from being forwarded to the user, and ensuring proper authentication and transport-layer security in the proxied request.
  Fix path traversal vulnerability in ssrf_lab

  The code was vulnerable to path traversal. The fix uses os.path.abspath to sanitize the user-provided filename.
  Fix SQL injection vulnerability and CSRF vulnerability in injection_sql_lab function

  Removed @csrf_exempt decorator and used parameterized query instead of raw SQL queries.
  Removed csrf_exempt decorator from injection view

  The csrf_exempt decorator was removed from the injection view to ensure that CSRF protection is enabled. This will prevent attackers from manipulating the user's account and exfiltrating private data.
  Remove @csrf_exempt decorator

  The @csrf_exempt decorator was removed to ensure CSRF protection is enabled for the a1_broken_access_lab_2 function.
  Remove @csrf_exempt decorator from a1_broken_access_lab_1 function

  Removed the @csrf_exempt decorator from the a1_broken_access_lab_1 function. This will require the use of CSRF tokens to protect against Cross-Site Request Forgery attacks.
  Remove csrf_exempt decorator from a1_broken_access

  Removed the @csrf_exempt decorator from the a1_broken_access function. This prevents CSRF attacks and ensures that the user's account is properly protected.
  Remove csrf_exempt decorator from a9_lab2

  The @csrf_exempt decorator was removed from the a9_lab2 function. This prevents Cross-Site Request Forgery (CSRF) attacks by ensuring that the CSRF token is validated for all POST requests to this route.
  Remove @csrf_exempt decorator from ba view

  Removed the @csrf_exempt decorator from the ba view to mitigate potential CSRF vulnerabilities.
  Fix: Securely handle cookies and XSS vulnerability

  The code has been updated to use Django's template engine to safely render HTML, preventing XSS vulnerabilities. Cookies are now set securely with secure=True, httponly=True, and samesite='Lax'.
  Remove csrf_exempt decorator

  Removed the @csrf_exempt decorator from the xxe_parse view function.
  Remove csrf_exempt decorator from xxe_see view

  Removed the @csrf_exempt decorator from the xxe_see view, requiring a CSRF token for requests to this endpoint. This prevents unauthorized modification of user data.
  Fix insecure deserialization vulnerability

  Removed the use of pickle.loads() to deserialize the token, which is vulnerable to code injection. Replaced it with a safe alternative to handle the user information, such as using a secure hash function.
  Remove pickle dependency to prevent potential code execution vulnerabilities

  The original code used pickle to serialize and deserialize data, which can lead to code execution vulnerabilities. This commit removes the use of pickle and replaces it with a more secure alternative, such as JSON serialization.
  Fix: SQL injection vulnerability in sql_lab view

  The original code used raw SQL queries to retrieve data from the database, which is vulnerable to SQL injection attacks. This commit replaces the raw SQL queries with Django ORM queries, which are protected from SQL injection.

• File changed: introduction/mitre.py
  Remove @csrf_exempt decorator from mitre_lab_17_api route

  Removed the @csrf_exempt decorator from the mitre_lab_17_api function to enable CSRF protection. This will require the user to authenticate before making requests to this route, preventing unauthorized access and data manipulation.
  Fix: Remove shell=True from subprocess.Popen

  Removed the shell=True argument from the subprocess.Popen call, preventing the execution of commands through a shell. This helps mitigate the risk of arbitrary code execution by preventing the injection of malicious shell commands.
  Remove CSRF exemption and eval usage for secure MITRE Lab 25 API endpoint

  Removed the @csrf_exempt decorator to enforce CSRF protection. Replaced the eval function with a safe alternative, ensuring user input does not lead to code execution.
  Remove @csrf_exempt decorator and add CSRF token validation

  Removed the @csrf_exempt decorator from the csrf_transfer_monei function and added CSRF token validation using the csrf_token middleware. This ensures that requests to this endpoint are protected against CSRF attacks.
  Fix: Use scrypt for password hashing and secure JWT secret

  - The password hash function has been changed from MD5 to scrypt for improved security.

  • The JWT secret key is now stored in an environment variable instead of being hardcoded.
  • The set_cookie method now sets the secure, httponly, and samesite options for improved security.

• File changed: introduction/templates/Lab/ssrf/ssrf_discussion.html
  Add csrf_token to manually created form

  Added a csrf_token to the form in the template to prevent CSRF attacks.
  Fix CSRF vulnerability in /ssrf_lab form

  Added csrf_token to the form to prevent CSRF attacks.
  Add csrf_token to form in templates/Lab/ssrf/blogs/blog2.html

  Added csrf_token to the form in templates/Lab/ssrf/blogs/blog2.html to prevent CSRF attacks.
  Add csrf_token to form

  Added the csrf_token to the form to prevent CSRF attacks.

• File changed: introduction/apis.py
  Fix CSRF vulnerability and sanitize user input

  Removed @csrf_exempt decorator and sanitized user input before writing to file.
  Remove csrf_exempt decorator

  The @csrf_exempt decorator was removed from the A6_disscussion_api function to enforce CSRF protection.
  Remove @csrf_exempt decorator from A7_disscussion_api

  Removed the @csrf_exempt decorator from the A7_disscussion_api function to mitigate CSRF vulnerability.
  Fix: CSRF vulnerability and insecure file writing in log_function_checker

  Removed the @csrf_exempt decorator to enforce CSRF protection. Sanitized the input from 'log_code' and 'api_code' before writing to files.
  Remove csrf_exempt decorator from ssrf_code_checker

  The @csrf_exempt decorator was removed from the ssrf_code_checker function. This prevents CSRF attacks by ensuring that a CSRF token is required for requests to this function.

• File changed: introduction/templates/Lab/A9/a9_lab2.html
  Fix XSS vulnerability in script tag

  Removed the template variable from the script tag and moved it to a separate HTML element.
  Add CSRF token to manually created form

  Added a csrf_token to the manually created form to prevent CSRF attacks.

• File changed: docker-compose.yml
  Fix security vulnerabilities in docker-compose.yml

  Added security options to the docker-compose.yml to prevent privilege escalation and writable root filesystem for the 'db', 'web' and 'migration' services.

• File changed: introduction/playground/A9/api.py
  Remove csrf_exempt decorator from log_function_target

  The @csrf_exempt decorator was removed from the log_function_target function. This prevents CSRF attacks by ensuring that a CSRF token is present for each request.

• File changed: introduction/playground/A9/archive.py
  Remove @csrf_exempt decorator from log_function_target

  Removed the @csrf_exempt decorator from the log_function_target view function. This change ensures that the CSRF token is validated for all requests.

• File changed: introduction/static/js/a9.js
  Fix XSS vulnerability in a9.js

  The code was vulnerable to XSS attacks because it was using innerHTML to inject user-controlled data into the DOM. This change uses textContent instead to prevent XSS attacks.

• File changed: introduction/templates/Lab/A9/a9_lab.html
  Add csrf_token to form in template

  Added a csrf_token to the form in the template to prevent CSRF attacks.

• File changed: introduction/templates/Lab/BrokenAccess/ba_lab.html
  CSRF protection added to form in broken access control lab

  The Django template now includes the csrf_token to prevent Cross-Site Request Forgery attacks. The csrf_token is included within the form using the {% csrf_token %} template tag.

• File changed: introduction/templates/Lab/BrokenAuth/otp.html
  Fix CSRF vulnerability in login form

  Added csrf_token to the login form to prevent CSRF attacks.

• File changed: introduction/templates/Lab/CMD/cmd_lab.html
  Add CSRF token to form

  Added csrf_token to the form to prevent CSRF attacks.

• File changed: introduction/templates/Lab/CMD/cmd_lab2.html
  Add CSRF protection to /cmd_lab2 form

  Added a csrf_token to the form in the template.

• File changed: introduction/templates/Lab/XSS/xss_lab_3.html
  Removed insecure use of template variable in JavaScript

  Removed the use of the code template variable directly within a script tag. The variable is now used outside of the script tag, allowing for safer handling of the data.

• File changed: introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html
  Add csrf_token to login form

  Added csrf_token to the login form to prevent CSRF attacks

• File changed: introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html
  Add csrf token to login form

  Added csrf_token to the login form to prevent CSRF attacks