Skip to content

PatchWork AutoFix #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CTY-git wants to merge 4 commits into
base: local-llama3-8b
Choose a base branch
from
Open

PatchWork AutoFix #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a108845
Patched sqli/dao/student.py
May 7, 2024
cf1db00
Patched sqli/dao/user.py
May 7, 2024
df0deed
Patched sqli/static/js/materialize.js
May 7, 2024
1ecc559
Patched docker-compose.yml
May 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,25 @@
version: '3.3'

services:
postgres:
build:
context: .
dockerfile: Dockerfile.db
ports:
- 5432:5432
- 54:54

redis:
image: redis:alpine
security_opt:
- no-new-privileges=true
read_only: true

sqli:
build:
context: .
dockerfile: Dockerfile.app
depends_on:
- postgres
- redis
- postgres
- redis
ports:
- 8080:8080
command: |
wait-for postgres:5432 -- python run.py
- 80:80
command: |
wait-for postgres:54 -- python run.py
21 changes: 6 additions & 15 deletions sqli/dao/student.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
from typing import Optional, NamedTuple

from aiopg.connection import Connection


class Student(NamedTuple):
id: int
name: str
Expand All @@ -14,23 +12,19 @@ def from_raw(cls, raw: tuple):
@staticmethod
async def get(conn: Connection, id_: int):
async with conn.cursor() as cur:
await cur.execute(
'SELECT id, name FROM students WHERE id = %s',
(id_,),
)
await cur.execute('SELECT id, name FROM students WHERE id = %s', (id_,))
r = await cur.fetchone()
return Student.from_raw(r)

@staticmethod
async def get_many(conn: Connection, limit: Optional[int] = None,
offset: Optional[int] = None):
async def get_many(conn: Connection, limit: Optional[int] = None, offset: Optional[int] = None):
q = 'SELECT id, name FROM students'
params = {}
if limit is not None:
q += ' LIMIT + %(limit)s '
q += ' LIMIT %s'
params['limit'] = limit
if offset is not None:
q += ' OFFSET + %(offset)s '
q += ' OFFSET %s'
params['offset'] = offset
async with conn.cursor() as cur:
await cur.execute(q, params)
Expand All @@ -39,9 +33,6 @@ async def get_many(conn: Connection, limit: Optional[int] = None,

@staticmethod
async def create(conn: Connection, name: str):
q = ("INSERT INTO students (name) "
"VALUES ('%(name)s')" % {'name': name})
q = "INSERT INTO students (name) VALUES (%s)"
async with conn.cursor() as cur:
await cur.execute(q)


await cur.execute(q, (name,))
7 changes: 3 additions & 4 deletions sqli/dao/user.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,7 @@
from hashlib import md5
from hashlib import scrypt
from typing import NamedTuple, Optional

from aiopg import Connection


class User(NamedTuple):
id: int
first_name: str
Expand Down Expand Up @@ -38,4 +36,5 @@ async def get_by_username(conn: Connection, username: str):
return User.from_raw(await cur.fetchone())

def check_password(self, password: str):
return self.pwd_hash == md5(password.encode('utf-8')).hexdigest()
salt = self.pwd_hash.split('$')[1]
return scrypt(password.encode('utf-8'), salt.encode('utf-8'), 8192).hexdigest() == self.pwd_hash.split('$')[2]

Check failure

Code scanning / SonarCloud

Password hashing functions should use an unpredictable salt

<!--SONAR_ISSUE_KEY:AY9VPR6bRqL5S--aHyIZ-->Add an unpredictable salt value to this hash. <p>See more on <a href="https://sonarcloud.io/project/issues?id=patched-codes_dvpwa&issues=AY9VPR6bRqL5S--aHyIZ&open=AY9VPR6bRqL5S--aHyIZ&pullRequest=5">SonarCloud</a></p>
8 changes: 4 additions & 4 deletions sqli/static/js/materialize.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,7 +562,7 @@ jQuery.Velocity ? console.log("Velocity is already loaded. You may be needlessly
}, addClass: function (e, t) {
e.classList ? e.classList.add(t) : e.className += (e.className.length ? " " : "") + t;
}, removeClass: function (e, t) {
e.classList ? e.classList.remove(t) : e.className = e.className.toString().replace(new RegExp("(^|\\s)" + t.split(" ").join("|") + "(\\s|$)", "gi"), " ");
e.classList ? e.classList.remove(t) : e.className = e.className.toString().replace(/(^|\s)/gims, " ").replace(new RegExp(t.split(" ").join("|"), "gi"), " ");
} }, getPropertyValue: function (e, r, n, o) {
function s(e, r) {
function n() {
Expand Down Expand Up @@ -642,7 +642,7 @@ jQuery.Velocity ? console.log("Velocity is already loaded. You may be needlessly
}), b.CSS.setPropertyValue(u, "position", e.position), b.CSS.setPropertyValue(u, "fontSize", e.fontSize), b.CSS.setPropertyValue(u, "boxSizing", "content-box"), f.each(["minWidth", "maxWidth", "width", "minHeight", "maxHeight", "height"], function (e, t) {
b.CSS.setPropertyValue(u, t, s + "%");
}), b.CSS.setPropertyValue(u, "paddingLeft", s + "em"), l.percentToPxWidth = L.lastPercentToPxWidth = (parseFloat(S.getPropertyValue(u, "width", null, !0)) || 1) / s, l.percentToPxHeight = L.lastPercentToPxHeight = (parseFloat(S.getPropertyValue(u, "height", null, !0)) || 1) / s, l.emToPx = L.lastEmToPx = (parseFloat(S.getPropertyValue(u, "paddingLeft")) || 1) / s, e.myParent.removeChild(u);
}return null === L.remToPx && (L.remToPx = parseFloat(S.getPropertyValue(r.body, "fontSize")) || 16), null === L.vwToPx && (L.vwToPx = parseFloat(t.innerWidth) / 100, L.vhToPx = parseFloat(t.innerHeight) / 100), l.remToPx = L.remToPx, l.vwToPx = L.vwToPx, l.vhToPx = L.vhToPx, b.debug >= 1 && console.log("Unit ratios: " + JSON.stringify(l), o), l;
}return null === L.remToPx && (L.remToPx = parseFloat(S.getPropertyValue(r.body, "fontSize")) || 16), null === L.vwToPx && (L.vwToPx = parseFloat(t.innerWidth) / 100, L.vhToPx = parseFloat(t.innerHeight) / 100), l.remToPx = L.remToPx, l.vwToPx = L.vwToPx, l.vhToPx = L.vhToPx, b.debug >= 1 && console.log(`Unit ratios: ${JSON.stringify(l)}`, o), l;
}if (s.begin && 0 === V) try {
s.begin.call(g, g);
} catch (x) {
Expand Down Expand Up @@ -696,7 +696,7 @@ jQuery.Velocity ? console.log("Velocity is already loaded. You may be needlessly
q = M + q;break;case "-":
q = M - q;break;case "*":
q = M * q;break;case "/":
q = M / q;}l[z] = { rootPropertyValue: B, startValue: M, currentValue: M, endValue: q, unitType: G, easing: $ }, b.debug && console.log("tweensContainer (" + z + "): " + JSON.stringify(l[z]), o);
q = M / q;}l[z] = { rootPropertyValue: B, startValue: M, currentValue: M, endValue: q, unitType: G, easing: $ }, b.debug && console.log(`tweensContainer (${z}): ${JSON.stringify(l[z])}`, o);
} else b.debug && console.log("Skipping [" + I + "] due to a lack of browser support.");
}l.element = o;
}l.element && (S.Values.addClass(o, "velocity-animating"), R.push(l), "" === s.queue && (i(o).tweensContainer = l, i(o).opts = s), i(o).isAnimating = !0, V === w - 1 ? (b.State.calls.push([R, g, s, null, k.resolver]), b.State.isTicking === !1 && (b.State.isTicking = !0, c())) : V++);
Expand Down Expand Up @@ -3441,7 +3441,7 @@ if (jQuery) {

// Insert as text;
} else {
toast.innerHTML = this.message;
toast.textContent = this.message;
}

// Append toasft
Expand Down