nxvl/secure-coding-with-python

Secure Coding in python

Secure Coding with Python.

Description

Welcome to the Secure coding with python course. In this repository you will find a series of branches for each step of the development of a sample marketplace application. In such a development, we will be making security mistakes and introducing vulnerabilities, we will add tests for them and finally fixing them.

The branches will have the following naming scheme for easier navigation: {Chapter number}-{Chapter Name}/{code|test|fix}. I encourage you to follow the chapters in order, but you can also skip to the specific one you wish to review.

For this course we will be using Python3, Flask and PostgreSQL.

Preparing the environment

In order to run the code we will set up a virtual environment using pyenv and pyenv-virtualenv. Please refer to each repo for installation instructions.

We create our environment with:

> pyenv virtualenv 3.7.4 sec-coding-marketplace

and we enable it with:

> pyenv shell sec-coding-marketplace

Proceed to next section

Index

1. Vulnerable Components

• 1-vulnerable-components/code
• 1-vulnerable-components/test
• 1-vulnerable-components/fix

2. SQL Injection

• 2.1-sql-injection/code
• 2.1-sql-injection/test
• 2.1-sql-injection/fix
• 2.2-sql-injection/test
• 2.2-sql-injection/fix
• 2.3-sql-injection/fix

3. Weak password storage

• 3.1-weak-password-storage/code
• 3.1-weak-password-storage/fix
• 3.2-weak-password-storage/test
• 3.2-weak-password-storage/fix

4. Broken Authentication

• 4-broken-authentication/code
• 4-broken-authentication/fix

5. Broken Deauthentication

• 5.1-broken-deauthentication/code
• 5.1-broken-deauthentication/test
• 5.1-broken-deauthentication/fix
• 5.2-broken-deauthentication/code
• 5.2-broken-deauthentication/test
• 5.2-broken-deauthentication/fix

6. Cross-Site Request Forgery (csrf)

• 6-csrf/code
• 6-csrf/test
• 6-csrf/fix

7. Cross-Site Scripting (xss)

• 7-xss/code
• 7-xss/test
• 7-xss/fix

8. Broken Access Control

• 8-broken-access-control/code
• 8-broken-access-control/test
• 8-broken-access-control/fix

9. Sensitive Data Exposure

• 9-sensitive-data-exposure/code
• 9-sensitive-data-exposure/test
• 9-sensitive-data-exposure/fix