added vuln

[altearjen]

No description provided.

[semgrep-code-atearjen]

It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use hashlib.scrypt.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>vulns/sql_injection/sql_injection_login.py</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L109 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 109] hashlib.md5</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L109 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 109] md5_pass</a>"]

            v3["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L81 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 81] _hash_password</a>"]
        end
            v2 --> v3
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L81 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 81] _hash_password(password)</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

_{Ignore this finding from md5-used-as-password.}

[altearjen]

/semgrep ignore not relevant

[semgrep-code-atearjen]

Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.

_{Ignore this finding from render-template-string.}

[semgrep-code-atearjen]

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>vulns/sql_injection/sql_injection_login.py</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L77 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 77] request.form</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L77 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 77] form</a>"]

            v3["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L79 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 79] username</a>"]
        end
            v2 --> v3
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/atearjen/bad-python-app/blob/c06419049f5f898135eeba1c65309a15071249a7/vulns/sql_injection/sql_injection_login.py#L83 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 83] f&quot;SELECT * FROM users WHERE username=&apos;{username}&apos; AND password=&apos;{password_hash}&apos;&quot;</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

_{Ignore this finding from tainted-sql-string.}