PatchWork AutoFix

introduction/apis.py

@@ -12,14 +12,6 @@
 
 from .utility import *
 from .views import authentication_decorator
-
-
-# steps --> 
-# 1. covert input code to corrosponding code and write in file
-# 2. extract inputs form 2nd code 
-# 3. Run the code 
-# 4. get the result
-@csrf_exempt
 def ssrf_code_checker(request):
     if request.user.is_authenticated:
         if request.method == 'POST':
@@ -30,7 +22,7 @@ def ssrf_code_checker(request):
             test_bench1 = ssrf_html_input_extractor(html_code)
 
             if (len(test_bench1) >4):
-                return JsonResponse({'message':'too many inputs in Html\n Try again'},status = 400)
+                return JsonResponse({'message': 'too many inputs in Html\n Try again'}, status=400)
             test_bench2 = ['secret.txt']
             correct_output1 = [{"blog": "blog1-passed"}, {"blog": "blog2-passed"}, {"blog": "blog3-passed"}, {"blog": "blog4-passed"}]
             outputs = []
@@ -39,45 +31,42 @@ def ssrf_code_checker(request):
             if outputs == correct_output1:
                 outputs = []
             else:
-                return JsonResponse({'message':'Testbench failed, Code is not working\n Try again'},status = 200)
+                return JsonResponse({message: 'Testbench failed, Code is not working\n Try again'}, status=200)
 
             correct_output2 = [{"blog": "No blog found"}]
             for inputs in test_bench2:
                 outputs.append(main.ssrf_lab(inputs))
             if outputs == correct_output2:
-                return JsonResponse({'message':'Congratulation, you have written a secure code.', 'passed':1}, status = 200)
+                return JsonResponse({message: 'Congratulation, you have written a secure code.', passed: 1}, status=200)
 
-            return JsonResponse({'message':'Test bench passed but the code is not secure'}, status = 200,safe = False)
+            return JsonResponse({message: 'Test bench passed but the code is not secure'}, status=200, safe=False)
         else:
-            return JsonResponse({'message':'method not allowed'},status = 405)
+            return JsonResponse({message: 'method not allowed'}, status=405)
     else:
-        return JsonResponse({'message':'UnAuthenticated User'},status = 401)
-
-# Insufficient Logging & Monitoring
-
-
-@csrf_exempt
-# @authentication_decorator
+        return JsonResponse({message: 'UnAuthenticated User'}, status=401)
+from django.http import JsonResponse
+import os
+import requests
 def log_function_checker(request):
     if request.method == 'POST':
         csrf_token = request.POST.get("csrfmiddlewaretoken")
-        log_code = request.POST.get('log_code')
-        api_code = request.POST.get('api_code')
+        log_code = request.POST.get('log_code').replace('\\', '').replace('/', '')
+        api_code = request.POST.get('api_code').replace('\\', '').replace('/', '')
         dirname = os.path.dirname(__file__)
         log_filename = os.path.join(dirname, "playground/A9/main.py")
         api_filename = os.path.join(dirname, "playground/A9/api.py")
         f = open(log_filename,"w")
-        f.write(log_code)
+        f.write(escape(log_code))
         f.close()
         f = open(api_filename,"w")
-        f.write(api_code)
+        f.write(escape(api_code))
         f.close()
         # Clearing the log file before starting the test
         f = open('test.log', 'w')
         f.write("")
         f.close()
         url = "http://127.0.0.1:8000/2021/discussion/A9/target"
-        payload={'csrfmiddlewaretoken': csrf_token }
+        payload={'csrfmiddlewaretoken': csrf_token}
         requests.request("GET", url)
         requests.request("POST", url)
         requests.request("PATCH", url, data=payload)
@@ -88,9 +77,6 @@ def log_function_checker(request):
         return JsonResponse({"message":"success", "logs": lines},status = 200)
     else:
         return JsonResponse({"message":"method not allowed"},status = 405)
-
-#a7 codechecking api
-@csrf_exempt
 def A7_disscussion_api(request):
     if request.method != 'POST':
         return JsonResponse({"message":"method not allowed"},status = 405)
@@ -107,11 +93,9 @@ def A7_disscussion_api(request):
         return JsonResponse({"message":"success"},status = 200)
 
     return JsonResponse({"message":"failure"},status = 400)
-
 #a6 codechecking api
-@csrf_exempt
 def A6_disscussion_api(request):
-    test_bench = ["Pillow==8.0.0","PyJWT==2.4.0","requests==2.28.0","Django==4.0.4"]
+    test_bench = ["Pillow==8.0.0","PyJWT==2.4.0","requests==2.28.0","Django==4.0.4"] 
 
     try:
         result = check_vuln(test_bench)
@@ -121,8 +105,6 @@ def A6_disscussion_api(request):
         return JsonResponse({"message":"failure"},status = 400)
     except Exception as e:
         return JsonResponse({"message":"failure"},status = 400)
-
-@csrf_exempt
 def A6_disscussion_api_2(request):
     if request.method != 'POST':
         return JsonResponse({"message":"method not allowed"},status = 405)
@@ -131,8 +113,8 @@ def A6_disscussion_api_2(request):
         dirname = os.path.dirname(__file__)
         filename = os.path.join(dirname, "playground/A6/utility.py")
         f = open(filename,"w")
-        f.write(code)
+        f.write(escape(code))
         f.close()
     except:
         return JsonResponse({"message":"missing code"},status = 400)
-    return JsonResponse({"message":"success"},status = 200)
+    return JsonResponse({"message":"success"},status = 200)

introduction/templates/Lab/CMD/cmd_lab2.html

@@ -1,32 +1,25 @@
-{% extends "introduction/base.html" %}
-{% block content %}
-{% block title %}
-<title>Command Injection</title>
-{% endblock %}
-<div class="jumbotron">
-    <div class="container">
-        <h3 align="center">Evaluate any expression!</h3>
-        <form method="post" action="/cmd_lab2">
-            <input type="text" name="val" placeholder="eg. 7*7"><br><br>
-            <center><button class="btn btn-info" type="submit">GO</button></center>
-        </form>
-    </div>
-</div>
-<div class="container">
-    {% if output %}
-    <h6><b>Output</b></h6><br>
-    <b>
-        <pre>{{output}}</pre>
-    </b>
-    {% endif %}
-</div>
-
-
-<br>
-<div align="right"> <button class="btn btn-info" type="button" onclick="window.location.href='/cmd'">Back to lab
-        details</button></div>
-
+{% extends "introduction/base.html" %}  
+{% block content %}  
+{% block title %}  
+<title>Command Injection</title>  
+{% endblock %}  
+<div class="jumbotron">  
+      <div class="container">  
+          <h3 align="center">Evaluate any expression!</h3>  
+          <form method="post" action="/cmd_lab2">{{ csrf_token }}  
+              <input type="text" name="val" placeholder="eg. 7*7"><br><br>  
+              <center><button class="btn btn-info" type="submit">GO</button></center>  
+          </form>  
+     </div>  
+</div>  
+<div class="container">  
+     {% if output %}  
+      <h6><b>Output</b></h6><br>  
+      <b>  
+          <pre>{{output}}</pre>  
+     </b>  
+     {% endif %}  
+</div>  
+<br>  
+<div align="right"> <button class="btn btn-info" type="button" onclick="window.location.href='/cmd'">Back to lab details</button></div>  
 </p>
-
-
-{% endblock %}

introduction/templates/Lab/XSS/xss_lab_3.html

@@ -1,28 +1,27 @@
-{% extends "introduction/base.html" %}
-{% block content %}
-{% block title %}
-
-<title>XSS LAB 2</title>
-{% endblock %}
-<h1>Welcome to XSS Challenge</h1>
-<form  method="post" action="/xssL3">
-    {% csrf_token %}
-    <div class="jumbotron">
-        <label for="username">Name:</label>
-        <input type="text" class="form-control" id="username" name="username" required>
-    </div>
-   <button class="btn btn-info" type="submit">
-                Go
-            </button>
-</form>
-<br>
-<p>{{code}}</p>
-<script>
-    // LAB 3 JS CODE
-    {{code}}
-</script>
-<br>
-<div align="right">
-  <button class="btn btn-info" type="button" onclick="window.location.href='/xss'">Back to Lab Details</button>
-</div>
-{% endblock content %}
+{% extends "introduction/base.html" %}  
+{% block content %}  
+{% block title %}  
+<title>XSS LAB 2</title>  
+{% endblock %}  
+<h1>Welcome to XSS Challenge</h1>  
+<form  method="post" action="/xssL3">  
+     {% csrf_token %}  
+     <div class="jumbotron">  
+          <label for="username">Name:</label>  
+          <input type="text" class="form-control" id="username" name="username" required>  
+      </div>  
+     <button class="btn btn-info" type="submit">  
+                Go  
+     </button>  
+</form>  
+<br>  
+<p>{{code}}</p>  
+<br>  
+<div align="right">  
+    <button class="btn btn-info" type="button" onclick="window.location.href='/xss'">Back to Lab Details</button>  
+</div>  
+<script>  
+    // LAB 3 JS CODE  
+</script>  
+<br>  
+{% endblock content %}  

introduction/templates/Lab/ssrf/ssrf_discussion.html

@@ -123,22 +123,23 @@ <h6>ssrf_lab.html</h6>
                     <textarea id="html">
 <div style="display:flex;flex-direction:row;align-items:center;margin:15px">
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog1.txt">
         <button type="submit" class="btn btn-info"> Blog1 </button>
     </form>
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog2.txt">
         <button type="submit" class="btn btn-info"> Blog2 </button>
     </form>
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog3.txt">
         <button type="submit" class="btn btn-info"> Blog3 </button>
     </form>
+    ``` 
     <form method="post" action="/ssrf_lab">
-        {&#37; csrf_token &#37;}
+        {% csrf_token %}
         <input type="hidden" name="blog" value="templates/Lab/ssrf/blogs/blog4.txt">
         <button type="submit" class="btn btn-info"> Blog4 </button>
     </form>

introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html

@@ -1,46 +1,41 @@
-{% extends "introduction/base.html" %}
-{% load static %}
-{% block content %}
-{% block title %}
-<title>Broken Access Control.</title>
-{% endblock %}
-
-<div class="jumbotron">
-    <h4 style="text-align:center"> Admins Have the Secretkey</h4>
-    <div class="login">
-        <form method="post" action="/broken_access_lab_1">
-
-            <input id="input" type="text" name="name" placeholder="User Name"><br>
-            <input id="input" type="password" name="pass" placeholder="Password"><br>
-            <button style="margin-top:20px" class="btn btn-info" type="submit"> Log in</button>
-
-
-        </form>
-    </div>
+{% extends "introduction/base.html" %}  
+{% load static %}  
+{% block content %}  
+{% block title %}  
+<title>Broken Access Control.</title>  
+{% endblock %}  
+
+<div class="jumbotron">  
+      <h4 style="text-align:center"> Admins Have the Secretkey</h4>  
+      <div class="login">  
+          <form method="post" action="/broken_access_lab_1" {% csrf_token %}>  
+              <input id="input" type="text" name="name" placeholder="User Name"><br>
+              <input id="input" type="password" name="pass" placeholder="Password"><br>
+              <button style="margin-top:20px" class="btn btn-info" type="submit"> Log in</button>
+          </form>
+      </div>
 </div>
-<div class="container">
-    {% if username %}
-    <h2>Logged in as user: <code>{{username}}</code></h2>
-    {% endif %}
 
-    {% if data %}
-    <h2>Your Secret Key is <code>{{data}}</code></h2>
-    {% endif %}
+<div class="container">  
+     {% if username %}  
+      <h2>Logged in as user: <code>{{username}}</code></h2>
+     {% endif %}  
 
-    {% if not_admin %}
-    <h2><code>{{not_admin}}</code></h2>
-    {% endif %}
+     {% if data %}  
+      <h2>Your Secret Key is <code>{{data}}</code></h2>
+     {% endif %}  
 
-    {% if no_creds %}
-    <h2>Please Provide Credentials</h2>
-    {% endif %}
+     {% if not_admin %}  
+      <h2><code>{{not_admin}}</code></h2>
+     {% endif %}  
 
+     {% if no_creds %}  
+      <h2>Please Provide Credentials</h2>
+     {% endif %}  
 </div>
 
 <br>
-<div align="right"> <button class="btn btn-info" type="button" onclick="window.location.href='/ba'">Back to Lab
-        Details</button></div>
-
+<div align="right"> <button class="btn btn-info" type="button" onclick="window.location.href='/ba'">Back to Lab Details</button></div>
 </p>
 
-{% endblock %}
+{% endblock %}