Security Review

# VULNERABLE: No security headers
@app.route('/')
def index():
    return render_template('index.html')

# SAFE: Security headers configured
@app.after_request
def add_security_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
    response.headers['Permissions-Policy'] = 'geolocation=(), microphone=()'
    return response

# VULNERABLE: Overly permissive CSP
"Content-Security-Policy: default-src *"
"Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval'"

# SAFE: Restrictive CSP
"Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'"

# VULNERABLE: Allow all origins
CORS(app, origins='*')
Access-Control-Allow-Origin: *

# VULNERABLE: Reflect origin without validation
@app.after_request
def add_cors(response):
    response.headers['Access-Control-Allow-Origin'] = request.headers.get('Origin')
    response.headers['Access-Control-Allow-Credentials'] = 'true'
    return response

# VULNERABLE: Wildcard with credentials (browsers block, but shows misconfiguration)
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

# VULNERABLE: Null origin allowed
Access-Control-Allow-Origin: null

# SAFE: Explicit allowlist
ALLOWED_ORIGINS = {
    'https://app.example.com',
    'https://admin.example.com'
}

@app.after_request
def add_cors(response):
    origin = request.headers.get('Origin')
    if origin in ALLOWED_ORIGINS:
        response.headers['Access-Control-Allow-Origin'] = origin
        response.headers['Access-Control-Allow-Credentials'] = 'true'
        response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
        response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
    return response

# VULNERABLE: Debug mode enabled
# Flask
app.run(debug=True)
DEBUG = True

# Django
DEBUG = True  # in settings.py

# Express
app.set('env', 'development')

# Spring Boot
spring.devtools.restart.enabled=true
management.endpoints.web.exposure.include=*

# Check for debug indicators
if app.debug:
    # Exposes stack traces, allows code execution in some frameworks
    pass

# Check environment variables
if os.environ.get('DEBUG') == 'true':
    pass
if os.environ.get('FLASK_ENV') == 'development':
    pass

# VULNERABLE: Default/weak credentials
username = 'admin'
password = 'admin'
password = 'password'
password = '123456'
password = 'changeme'
password = 'default'

# VULNERABLE: Well-known default credentials
# Database defaults
DB_PASSWORD = 'root'
DB_PASSWORD = 'postgres'
DB_PASSWORD = 'mysql'

# Admin panel defaults
ADMIN_PASSWORD = 'admin123'
SECRET_KEY = 'development-secret-key'

# Docker Compose
services:
  db:
    environment:
      MYSQL_ROOT_PASSWORD: root  # VULNERABLE
      POSTGRES_PASSWORD: postgres  # VULNERABLE

# Kubernetes Secrets (base64 encoded defaults)
apiVersion: v1
kind: Secret
data:
  password: YWRtaW4=  # 'admin' base64 encoded - VULNERABLE

# VULNERABLE: Exposed debug endpoints
@app.route('/debug')
@app.route('/admin')  # without authentication
@app.route('/metrics')  # without authentication
@app.route('/health')  # may expose sensitive info
@app.route('/env')
@app.route('/config')
@app.route('/phpinfo.php')
@app.route('/.git')
@app.route('/.env')

# Spring Boot Actuator endpoints
/actuator/env
/actuator/heapdump
/actuator/configprops
/actuator/mappings

# SAFE: Protect sensitive endpoints
@app.route('/admin')
@require_admin
def admin_panel():
    pass

@app.route('/metrics')
@require_internal_network
def metrics():
    pass

# Spring Boot: Restrict actuator
management.endpoints.web.exposure.include=health,info
management.endpoint.health.show-details=never

# VULNERABLE: SSL verification disabled
requests.get(url, verify=False)
urllib3.disable_warnings()

# VULNERABLE: Weak TLS versions
ssl_context.minimum_version = ssl.TLSVersion.TLSv1  # Use TLS 1.2+

# VULNERABLE: Weak cipher suites
ssl_context.set_ciphers('ALL')
ssl_context.set_ciphers('DEFAULT')

# SAFE: Proper TLS configuration
import ssl

context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.minimum_version = ssl.TLSVersion.TLSv1_2
context.set_ciphers('ECDHE+AESGCM:DHE+AESGCM:ECDHE+CHACHA20')
context.verify_mode = ssl.CERT_REQUIRED
context.check_hostname = True

# VULNERABLE: Directory listing enabled
# Nginx
autoindex on;

# Apache
Options +Indexes

# Python
python -m http.server  # Lists directories by default

# SAFE: Directory listing disabled
# Nginx
autoindex off;

# Apache
Options -Indexes

# VULNERABLE: Detailed errors in response
@app.errorhandler(Exception)
def handle_error(e):
    return jsonify({
        'error': str(e),
        'traceback': traceback.format_exc(),
        'query': last_executed_query,
        'config': app.config
    }), 500

# VULNERABLE: Stack traces exposed
app.config['PROPAGATE_EXCEPTIONS'] = True

# SAFE: Generic error messages
@app.errorhandler(Exception)
def handle_error(e):
    app.logger.error(f"Error: {e}", exc_info=True)  # Log details server-side
    return jsonify({'error': 'An unexpected error occurred'}), 500

# VULNERABLE: Insecure cookie settings
response.set_cookie('session', value)  # Missing flags

# VULNERABLE: Explicit insecure flags
response.set_cookie('session', value, secure=False, httponly=False, samesite='None')

# SAFE: Secure cookie settings
response.set_cookie(
    'session',
    value,
    secure=True,       # HTTPS only
    httponly=True,     # No JavaScript access
    samesite='Lax',    # CSRF protection
    max_age=3600,      # Reasonable expiration
    path='/',
    domain='.example.com'
)

# Flask session configuration
app.config['SESSION_COOKIE_SECURE'] = True
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'

# VULNERABLE: World-readable sensitive files
os.chmod(config_file, 0o777)
os.chmod(private_key, 0o644)

# VULNERABLE: Overly permissive umask
os.umask(0o000)

# SAFE: Restrictive permissions
os.chmod(config_file, 0o600)  # Owner read/write only
os.chmod(private_key, 0o400)  # Owner read only
os.chmod(script, 0o700)       # Owner execute only

# VULNERABLE: All methods allowed
@app.route('/api/data', methods=['GET', 'POST', 'PUT', 'DELETE', 'TRACE', 'OPTIONS'])

# VULNERABLE: TRACE method enabled (XST attacks)
# VULNERABLE: Unnecessary methods on sensitive endpoints

# SAFE: Explicit method restrictions
@app.route('/api/data', methods=['GET'])
def get_data():
    pass

@app.route('/api/data', methods=['POST'])
@require_auth
def create_data():
    pass

# Debug mode
grep -rn "debug.*=.*[Tt]rue\|DEBUG.*=.*[Tt]rue" --include="*.py" --include="*.js" --include="*.json"

# CORS wildcards
grep -rn "Access-Control-Allow-Origin.*\*\|origins.*\*\|origin.*\*" --include="*.py" --include="*.js"

# SSL verification disabled
grep -rn "verify.*=.*[Ff]alse\|rejectUnauthorized.*false\|NODE_TLS_REJECT_UNAUTHORIZED" --include="*.py" --include="*.js"

# Default credentials
grep -rn "password.*=.*['\"]admin\|password.*=.*['\"]root\|password.*=.*['\"]123456" --include="*.py" --include="*.yaml" --include="*.yml"

# Missing security headers (check for absence)
grep -rn "after_request\|middleware" --include="*.py" | grep -v "X-Content-Type-Options\|X-Frame-Options"

# Exposed endpoints
grep -rn "@app.route.*debug\|@app.route.*admin\|@app.route.*config\|/actuator" --include="*.py" --include="*.java"