Feature/v2 enhancements #1

raffertyuy · 2025-01-11T15:27:37Z

New Feature:

.env.example: Added AZURE_OPENAI_KEY environment variable to store the OpenAI key.

Enhancements:

.github/workflows/python-lint.yml: Introduced a Python Lint Workflow that runs on push, pull requests to the main branch, and on a scheduled cron job. This workflow uses multiple linters for improved code quality.

New Flask Application:

flask_app.py: Created a simple Flask application with HTTP basic authentication, SQLite database initialization, and several endpoints to query user information.

Code Readability:

streamlit_app.py: Improved readability by splitting long comments into multiple lines and replacing st.markdown with st.write for displaying user messages and assistant responses. [1] [2]

…/contoso-chat-streamlit into feature/v2-enhancements

streamlit_app.py

flask_app.py

+
+"""Simple Flask application."""
+
+from flask import Flask


flask_app.py

+"""Simple Flask application."""
+
+from flask import Flask
+from flask_httpauth import HTTPBasicAuth


flask_app.py

+
+from flask import Flask
+from flask_httpauth import HTTPBasicAuth
+import sqlite3


flask_app.py

+from flask import Flask
+from flask_httpauth import HTTPBasicAuth
+import sqlite3
+import logging


flask_app.py

+    ''')
+
+    # Insert two users
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 1', '[email protected]', 'user1secret'))


flask_app.py

+
+    # Insert two users
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 1', '[email protected]', 'user1secret'))
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 2', '[email protected]', 'thisisverysecret'))


flask_app.py

+        return str(user)
+
+    @app.route('/query-by-foo/<foo>')
+    def query_foo(foo: str):


flask_app.py

+
+
+if __name__ == '__main__':
+    main()


flask_app.py

+
+LOG = logging.getLogger(__name__)
+
+def init():


flask_app.py

+    ''')
+
+    # Insert two users
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 1', '[email protected]', 'user1secret'))


flask_app.py

+
+    # Insert two users
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 1', '[email protected]', 'user1secret'))
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 2', '[email protected]', 'thisisverysecret'))


flask_app.py

+        return user[3] == password
+
+
+    @app.route('/')


flask_app.py

+        return "Hello, World!"
+
+
+    @auth.login_required


flask_app.py

+        return str(user)
+
+
+    @app.route('/query-by-email/<email>')


flask_app.py

+
+
+if __name__ == '__main__':
+    main()


flask_app.py

+
+"""Simple Flask application."""
+
+from flask import Flask


flask_app.py

+"""Simple Flask application."""
+
+from flask import Flask
+from flask_httpauth import HTTPBasicAuth


flask_app.py

+        user = c.fetchone()
+        conn.close()
+        if user is None:
+            LOG.debug('User not found: %s, with password: %s', name, password)


To fix the problem, we should avoid logging sensitive information such as passwords. Instead, we can log a generic message indicating that the user was not found or the password was incorrect without including the actual password in the log. This way, we maintain the functionality of logging failed login attempts without exposing sensitive information.

Replace the logging statement on line 52 to exclude the password.

Update the logging message to provide useful information without compromising security.

flask_app.py

+
+        conn = sqlite3.connect('users.db')
+        c = conn.cursor()
+        c.execute('SELECT * FROM users WHERE name = ' + name)


To fix the SQL injection vulnerability, we should use parameterized queries instead of directly concatenating user input into the SQL query. This approach ensures that user input is properly escaped and treated as data rather than executable code.

In the specific case of the query_name function, we will modify the SQL query to use a parameterized query. This involves replacing the string concatenation with a placeholder (?) and passing the user-provided value as a parameter to the execute method.

flask_app.py

+        """Get info for an user by dob."""
+        conn = sqlite3.connect('users.db')
+        c = conn.cursor()
+        c.execute('SELECT * FROM users WHERE dob = ' + dob)


To fix the SQL injection vulnerability, we should use parameterized queries instead of directly concatenating user input into the SQL query string. Parameterized queries ensure that user input is properly escaped and treated as data rather than executable code.

Steps to fix:

Modify the query_dob function to use a parameterized query.

Replace the direct concatenation of dob with a placeholder (?) and pass dob as a parameter to the execute method.

flask_app.py

+        return str(user)
+
+    init()
+    app.run(debug=True)


To fix the problem, we need to ensure that the Flask application does not run in debug mode when deployed in a production environment. This can be achieved by using an environment variable to control the debug mode. We will modify the code to check the environment variable and set the debug mode accordingly.

Import the os module to access environment variables.

Modify the app.run call to set the debug mode based on an environment variable.

Copilot

Copilot reviewed 4 out of 5 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

.env.example: Language not supported

Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more

Copilot · 2025-01-13T09:00:07Z

flask_app.py

+            id INTEGER PRIMARY KEY,
+            name TEXT NOT NULL,
+            email TEXT NOT NULL UNIQUE
+            secret TEXT NOT NULL,


Syntax error in the SQL CREATE TABLE statement. Remove the extra comma after the 'secret' column.

Suggested change

secret TEXT NOT NULL,

secret TEXT NOT NULL

Copilot · 2025-01-13T09:00:08Z

flask_app.py

+    ''')
+
+    # Insert two users
+    c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 1', '[email protected]', 'user1secret'))


The INSERT INTO users statement is missing a third value for the 'password' column.

Suggested change

c.execute("INSERT INTO users (name, email, password) VALUES (?, ?)", ('User 1', '[email protected]', 'user1secret'))

c.execute("INSERT INTO users (name, email, password) VALUES (?, ?, ?)", ('User 1', '[email protected]', 'user1secret'))

Copilot · 2025-01-13T09:00:08Z

flask_app.py

+
+        conn = sqlite3.connect('users.db')
+        c = conn.cursor()
+        c.execute('SELECT * FROM users WHERE name = ' + name)


SQL query constructed using string concatenation, which can lead to SQL injection vulnerabilities. Use parameterized queries instead.

Suggested change

c.execute('SELECT * FROM users WHERE name = ' + name)

c.execute('SELECT * FROM users WHERE name = ?', (name,))

Copilot · 2025-01-13T09:00:09Z

flask_app.py

+        """Get info for an user by dob."""
+        conn = sqlite3.connect('users.db')
+        c = conn.cursor()
+        c.execute('SELECT * FROM users WHERE dob = ' + dob)


SQL query constructed using string concatenation, which can lead to SQL injection vulnerabilities. Use parameterized queries instead.

Suggested change

c.execute('SELECT * FROM users WHERE dob = ' + dob)

c.execute('SELECT * FROM users WHERE dob = ?', [dob])

Copilot · 2025-01-13T09:00:09Z

flask_app.py

+        conn.close()
+        return str(user)
+
+    @app.route('/query-by-foo/<foo>')


The 'foo' column does not exist in the 'users' table. This will cause a runtime error.

Suggested change

@app.route('/query-by-foo/<foo>')

Copilot · 2025-01-13T09:00:09Z

flask_app.py

+        conn.close()
+        return str(user)
+
+    @app.route('/query-by-dob/<dob>')


The 'dob' column does not exist in the 'users' table. This will cause a runtime error.

Suggested change

@app.route('/query-by-dob/<dob>')

raffertyuy added 6 commits January 11, 2025 14:59

add fake key

17eb712

feat: add deliberate XSS vulnerability for demo purposes

ea3536d

add aoai key

43371b3

Merge branch 'raffertyuy:main' into feature/v2-enhancements

0bd92d7

minor updates

a6a9fc9

Merge branch 'feature/v2-enhancements' of https://github.com/octodemo…

442e91b

…/contoso-chat-streamlit into feature/v2-enhancements