VSinerva/csb-project-1
Archived
1
0
Fork 0
Code Activity

Add flaw 1: Broken Access Control

Browse source
This commit is contained in:
Vili Sinervä 2024-11-25 16:33:17 +02:00
parent 9e55b0a1ed
commit 05fec8a837
No known key found for this signature in database
GPG key ID: DF8FEAF54EFAC996
2 changed files with 18 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -16,21 +16,33 @@ LINK: https://github.com/VSinerva/csb-project-1
I am using the basic Django template, so no instructions are included.
FLAW 1:
> ADD EXACT SOURCE LINK
Broken Access Control (Can delete another user's notes)
(Broken Access Control) Right now, the notes are identified and deleted with a simple sequential ID.
This makes it trivial for a logged in user to delete notes from other users.
The malicious user simply needs to edit the client-side URL of their POST request.
The issue can easily be fixed by adding the commented out ownership check before deleting a note.
The check compares the logged in user to the owner of the note, and only deletes the note if they match.
This should never cause a problem for a normal user, but it makes sure that the note being deleted
belongs to the logged in user.
FLAW 2:
> ADD EXACT SOURCE LINK
Cryptographic Failure (Weak/No password hashing)
FLAW 3:
> ADD EXACT SOURCE LINK
SQL Injection (Unsanitized SQL query for search)
FLAW 4:
> ADD EXACT SOURCE LINK
Identification and Authentication Failure (No password strength checks)
FLAW 5:
> ADD EXACT SOURCE LINK
CSRF (No CSRF token for Delete)

6
notes/views.py
View file

@ -36,9 +36,11 @@ def add(request):
@login_required()
def remove(request, note_id):
if request.method == 'POST':
user = request.user
note = Note.objects.get(pk=note_id)
if user == note.owner:
# FLAW 1:
# Adding an ownership check would fix the problem
# user = request.user
# if user == note.owner:
note.delete()
return HttpResponseRedirect(request.META.get('HTTP_REFERER', 'index'))