diff --git a/seed.py b/seed.py
index 98a316d..0e7d756 100644
--- a/seed.py
+++ b/seed.py
@@ -289,7 +289,7 @@ def get_md5_hash(password: str):
reviews = [
Review(product_id=p1.id, user_id=user.id, rating=5, comment="These guys are hilarious! They really do play dead.", is_approved=True),
- Review(product_id=p1.id, user_id=hacker.id, rating=1, comment=" Boring.", is_approved=True), # V-003 XSS payload
+ Review(product_id=p1.id, user_id=hacker.id, rating=1, comment=" Boring.", is_approved=True),
Review(product_id=p2.id, user_id=user.id, rating=4, comment="Strong pincers! Watch your fingers.", is_approved=True)
]
db.add_all(reviews)
diff --git a/src/auth.py b/src/auth.py
index 0054fc7..4918193 100644
--- a/src/auth.py
+++ b/src/auth.py
@@ -2,15 +2,11 @@
from jose import jwt, JWTError
import hashlib
-# V-011: Weak secret hardcoded
SECRET_KEY = "bugstore_secret_2024"
ALGORITHM = "HS256"
def create_access_token(data: dict):
- """
- Generate JWT.
- V-011: Weak configuration and potential for 'alg: none' (simulated by allowing varied algs if needed).
- """
+ """Generate JWT."""
to_encode = data.copy()
expire = datetime.utcnow() + timedelta(days=1) # 24h as per F-007
to_encode.update({"exp": expire})
@@ -18,10 +14,7 @@ def create_access_token(data: dict):
return encoded_jwt
def decode_access_token(token: str):
- """
- Decode JWT.
- V-011: Insecure decoding - accepts weak algorithms.
- """
+ """Decode JWT."""
try:
# Deliberately allowing 'none' algorithm if user specifies it?
# Actually HS256 is the default but we can mock it.
@@ -31,9 +24,7 @@ def decode_access_token(token: str):
return None
def get_password_hash(password: str):
- """
- V-006: Insecure MD5 hashing.
- """
+ """Hash password for storage."""
return hashlib.md5(password.encode()).hexdigest()
def verify_password(plain_password: str, hashed_password: str):
@@ -52,9 +43,7 @@ def verify_password(plain_password: str, hashed_password: str):
oauth2_scheme_optional = OAuth2PasswordBearer(tokenUrl="auth/login", auto_error=False)
def get_current_user(token: str = Depends(oauth2_scheme), db: Session = Depends(get_db)):
- """
- V-011: Weak JWT validation.
- """
+ """Resolve the current user from the bearer token."""
payload = decode_access_token(token)
if not payload:
raise HTTPException(
diff --git a/src/cart.py b/src/cart.py
index e98bafb..2702758 100644
--- a/src/cart.py
+++ b/src/cart.py
@@ -2,10 +2,7 @@
from src.models import CartItem, Product, Coupon
class CartManager:
- """
- Handles shopping cart logic using session_id for persistence.
- Deliberately maintains simplicity to allow for vulnerabilities V-023 and V-024 later.
- """
+ """Handles shopping cart logic using session_id for persistence."""
def __init__(self, db: Session, session_id: str):
self.db = db
self.session_id = session_id
@@ -71,10 +68,7 @@ def clear(self):
self.db.commit()
def get_totals(self):
- """
- Calculate totals.
- Note: Frontend will try to override this in F-004 (V-023).
- """
+ """Calculate totals."""
items = self.get_items()
subtotal = sum(item.product.price * item.quantity for item in items if item.product)
tax = subtotal * 0.08
@@ -89,14 +83,10 @@ def get_totals(self):
}
def apply_coupon(self, code: str):
- """
- Apply a discount code.
- Deliberately vulnerable to V-024 (unlimited reuse/stacking logic flaws).
- """
+ """Apply a discount code."""
coupon = self.db.query(Coupon).filter(
Coupon.code == code,
Coupon.active == True
).first()
- # We don't check if it was already applied in this session (V-024)
return coupon
diff --git a/src/email_service.py b/src/email_service.py
index deaafaf..d84b035 100644
--- a/src/email_service.py
+++ b/src/email_service.py
@@ -3,18 +3,13 @@
from src.models import EmailTemplate
def render_template(template_name: str, context: dict):
- """
- Renders an email template by name.
- V-027: Vulnerable to Server-Side Template Injection (SSTI).
- """
+ """Renders an email template by name."""
db = SessionLocal()
try:
template = db.query(EmailTemplate).filter(EmailTemplate.name == template_name).first()
if not template:
return None
- # V-027: Using Jinja2 Template directly on user-controllable input (DB content)
- # without sandbox.
jinja_template = jinja2.Template(template.body)
rendered_body = jinja_template.render(**context)
diff --git a/src/frontend/index.html b/src/frontend/index.html
index e183418..6431add 100644
--- a/src/frontend/index.html
+++ b/src/frontend/index.html
@@ -11,10 +11,8 @@
-
-