Sebastian
Riveros

Basic Vulnerable Code Examples

PHP (Basic Example):

// UNSAFE - Basic vulnerability
    if (isset($_FILES['file'])) {
      $filename = $_FILES['file']['name'];
      move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $filename);
    }

Python (Flask Example):

# UNSAFE - Basic vulnerability
    @app.route('/upload', methods=['POST'])
    def upload():
        file = request.files['file']
        file.save(os.path.join('uploads', file.filename))

Basic Secure Solutions

PHP (Basic Protection):

$allowed = ['jpg', 'png', 'gif'];
    $ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
    
    if (!in_array($ext, $allowed)) {
        die("Invalid file type");
    }
    
    $filename = uniqid().'.'.$ext;
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/'.$filename);

Python (Basic Protection):

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg'}
    
    def allowed_file(filename):
        return '.' in filename and \
               filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
    
    file = request.files['file']
    if file and allowed_file(file.filename):
        filename = secure_filename(file.filename)
        file.save(os.path.join('uploads', filename))

Advanced Vulnerable Code

PHP (Incomplete Validation):

// UNSAFE - Advanced bypass possible
    $allowed = ['image/jpeg', 'image/png'];
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
    
    if (in_array($mime, $allowed)) {
        move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/'.$_FILES['file']['name']);
    }

Node.js (Express Example):

// UNSAFE - Advanced bypass possible
    app.post('/upload', (req, res) => {
      const file = req.files.file;
      if (['image/jpeg', 'image/png'].includes(file.mimetype)) {
        file.mv('uploads/{file.name}');
      }
    });

Advanced Secure Solutions

PHP (Advanced Protection):

$allowed = ['jpg' => 'image/jpeg', 'png' => 'image/png'];
    $ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
    
    if (!array_key_exists($ext, $allowed) || 
        $allowed[$ext] !== $mime ||
        !getimagesize($_FILES['file']['tmp_name']) ||
        exif_imagetype($_FILES['file']['tmp_name']) === false) {
        die("Invalid file");
    }
    
    $filename = bin2hex(random_bytes(16)).'.'.$ext;
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/'.$filename);

Node.js (Advanced Protection):

const fileType = require('file-type');
    const { execSync } = require('child_process');
    
    app.post('/upload', async (req, res) => {
      const file = req.files.file;
      const allowed = { jpg: 'image/jpeg', png: 'image/png' };
      const ext = path.extname(file.name).slice(1).toLowerCase();
      
      // Verify with multiple methods
      const type = await fileType.fromBuffer(file.data);
      const identify = execSync('identify -format "%m" {file.tempFilePath}');
      
      if (!allowed[ext] || 
          allowed[ext] !== type.mime || 
          !allowed[ext].includes(identify.toString())) {
        return res.status(400).send('Invalid file');
      }
      
      const filename = crypto.randomBytes(16).toString('hex') + '.' + ext;
      await file.mv('uploads/{filename}');
    });

Vulnerable Code Example

 // UNSAFE - Direct deserialization
    public User deserialize(byte[] data) {
        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data))) {
            return (User) ois.readObject(); // Dangerous!
        }
    }

Secure Code Solution

 // SAFE - Using look-ahead deserialization
    public User safeDeserialize(byte[] data) {
        ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
            'maxdepth=10;maxarray=1000;!org.apache.commons.collections.*'
        );
        
        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data))) {
            ois.setObjectInputFilter(filter);
            return (User) ois.readObject();
        }
    }

Vulnerable Code Example

// UNSAFE - Direct DOM injection
    document.getElementById('output').innerHTML = userInput;

Common Attack Payloads:

<script>alert(1)</script>
    <img src=x onerror=alert(1)>
    <svg onload=alert(1)>

Secure Code Solutions

// SAFE - TextContent instead of innerHTML
    document.getElementById('output').textContent = userInput;
    
    // SAFE - Using DOMPurify
    const clean = DOMPurify.sanitize(userInput);
    element.innerHTML = clean;

Context-Specific Encoding:

// HTML Entity Encoding
    function escapeHtml(unsafe) {
      return unsafe.replace(/[&<>"']/g, m => ({
        '&': '&', '<': '<', '>': '>',
        '"': '"', "'": '''
      }[m]));
    }

Vulnerable Code Examples

PHP (Basic Example):

// UNSAFE - Concatenated query
    $query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'";
    $result = mysqli_query($conn, $query);

Node.js (Basic Example):

// UNSAFE - String concatenation
    const query = "SELECT * FROM users WHERE username = '{req.body.username}'";
    db.query(query, (err, result) => { ... });

Secure Code Solutions

PHP (Patched):

// SAFE - Prepared statement
    $stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
    $stmt->bind_param("s", $_POST['username']);
    $stmt->execute();
    $result = $stmt->get_result();

Node.js (Patched):

// SAFE - Parameterized query
    const query = 'SELECT * FROM users WHERE username = ?';
    db.query(query, [req.body.username], (err, result) => { ... });

Vulnerable Handshake

A vulnerable server might not validate the 'Origin' header, allowing connections from any domain.

// UNSAFE - No Origin check
    const wss = new WebSocket.Server({ port: 8080 });
    
    wss.on('connection', ws => {
      // Connection accepted from anywhere!
      ws.on('message', message => {
        console.log('received: %s', message);
      });
    });

Secure Handshake

A secure server strictly validates the 'Origin' header against a whitelist.

// SAFE - Strict Origin check
    const server = http.createServer();
    const wss = new WebSocket.Server({ noServer: true });
    const allowedOrigins = ['https://yourapp.com'];
    
    server.on('upgrade', (req, socket, head) => {
      const origin = req.headers.origin;
      if (!allowedOrigins.includes(origin)) {
        socket.destroy();
        return;
      }
      
      wss.handleUpgrade(req, socket, head, ws => {
        wss.emit('connection', ws, req);
      });
    });