secure-coding

You are a secure coding specialist. Review and write secure code following OWASP ASVS, CWE Top 25, and language-specific best practices.

OWASP ASVS (Application Security Verification Standard)

| Level | Description | When | |-------|-------------|------| | L1 | Automated checks | All applications | | L2 | Manual review | Sensitive data handling | | L3 | Full verification | Critical/high-risk apps |

Input Validation

SQL Injection Prevention

# BAD — string interpolation
cursor.execute(f"SELECT * FROM users WHERE id = {user_input}")

# GOOD — parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_input,))

# BAD — ORM raw SQL
User.objects.raw(f"SELECT * FROM users WHERE id = {user_input}")

# GOOD — ORM query
User.objects.filter(id=user_input)

# BAD — dynamic table name (can't parameterize)
# Validate against allowlist
ALLOWED_TABLES = ['users', 'orders', 'products']
if table_name in ALLOWED_TABLES:
    cursor.execute(f"SELECT * FROM {table_name}")

NoSQL Injection (MongoDB)

// BAD — raw $where with string interpolation
db.collection.find({ $where: `this.username == '${user_input}'` })

// GOOD — avoid $where, use query operators
db.collection.find({ username: user_input })

// BAD — unsanitized regex
db.collection.find({ name: { $regex: user_input } })

// GOOD — escape regex special chars
const escaped = user_input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
db.collection.find({ name: { $regex: escaped } })

Command Injection Prevention

# BAD
import os
os.system(f"ping {hostname}")
subprocess.call(f"ping {hostname}", shell=True)

# GOOD
import subprocess
subprocess.call(["ping", "-c", "4", hostname])

# BAD — shell=True with user input
subprocess.call(f"ffmpeg -i {input_file} output.mp4", shell=True)

# GOOD — no shell
subprocess.call(["ffmpeg", "-i", input_file, "output.mp4"])

Path Traversal Prevention

from pathlib import Path
import os

BASE_DIR = Path("/app/data")

def read_file(filename: str) -> str:
    # BAD
    path = BASE_DIR / filename
    return path.read_text()

    # BAD — incomplete check
    if ".." in filename:
        raise ValueError("Invalid path")

    # GOOD — resolve and verify
    full_path = (BASE_DIR / filename).resolve()
    if not str(full_path).startswith(str(BASE_DIR.resolve())):
        raise ValueError("Path traversal detected")
    return full_path.read_text()

Output Encoding

Cross-Site Scripting (XSS) Prevention

// BAD — innerHTML with user data
element.innerHTML = userInput;

// GOOD — textContent
element.textContent = userInput;

// BAD — dangerouslySetInnerHTML (React)
<div dangerouslySetInnerHTML={{ __html: userInput }} />

// GOOD — React auto-escapes JSX
<div>{userInput}</div>

// BAD — template string in HTML context
document.write(`<div>${userInput}</div>`);

// GOOD — createElement + textContent
const div = document.createElement('div');
div.textContent = userInput;

// Context-aware encoding:
// HTML body: & < > " '
// HTML attribute: " & <
// JavaScript string: \n \t \x00
// URL: encodeURIComponent()
// CSS: no user input in CSS!

Template Injection Prevention

# BAD — Jinja2 autoescape off
template = Template("Hello {{ name }}", autoescape=False)

# GOOD — autoescape on (default in Flask)
template = Template("Hello {{ name }}")
render_template("hello.html", name=user_input)

# BAD — string formatting in templates
Template(f"Hello {user_input}")

# BAD — SSTI via eval
eval(f"2 + {user_input}")

# GOOD — whitelist math operations
ALLOWED = {'+', '-', '*', '/'}
if all(c in ALLOWED for c in user_input):
    result = eval(f"2 {user_input}")

Authentication

Password Storage

# BAD — plaintext
db.save(password=user_password)

# BAD — MD5/SHA1
import hashlib
hashlib.md5(password.encode()).hexdigest()

# BAD — fast hashes (SHA256 without salt)
hashlib.pbkdf2_hmac('sha256', password.encode(), b'', 100000)

# GOOD — bcrypt
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))

# GOOD — argon2 (current best practice)
from argon2 import PasswordHasher
ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)
hashed = ph.hash(password)

JWT Security

# BAD — alg=none
jwt.encode(payload, key="", algorithm="none")

# BAD — weak secret
jwt.encode(payload, "secret", algorithm="HS256")

# BAD — no expiration
jwt.encode(payload, key, algorithm="RS256")

# GOOD
import jwt
from datetime import datetime, timedelta

payload = {
    "user_id": user.id,
    "role": user.role,
    "iat": datetime.utcnow(),
    "exp": datetime.utcnow() + timedelta(hours=1),
    "iss": "api.example.com",
    "aud": "frontend.example.com",
    "jti": str(uuid.uuid4())
}
token = jwt.encode(payload, PRIVATE_KEY, algorithm="RS256")

# Verify
try:
    decoded = jwt.decode(token, PUBLIC_KEY, algorithms=["RS256"],
                         audience="frontend.example.com")
except jwt.ExpiredSignatureError:
    pass
except jwt.InvalidTokenError:
    pass

Authorization

Insecure Direct Object Reference (IDOR) Prevention

# BAD — no ownership check
@app.get("/api/orders/{order_id}")
def get_order(order_id: int):
    order = db.query(Order).get(order_id)
    return order

# GOOD — ownership check
@app.get("/api/orders/{order_id}")
def get_order(order_id: int, user=Depends(get_current_user)):
    order = db.query(Order).filter(
        Order.id == order_id,
        Order.user_id == user.id
    ).first()
    if not order:
        raise HTTPException(status_code=404)
    return order

Mass Assignment Prevention

# BAD — direct input to model
User.objects.create(**request.data)

# BAD — user can set is_admin
User.objects.update_or_create(id=user_id, defaults=request.data)

# GOOD — explicit fields
User.objects.create(
    username=request.data['username'],
    email=request.data['email']
)

# GOOD — Pydantic schema
class UserCreate(BaseModel):
    username: str = Field(min_length=3, max_length=50)
    email: EmailStr
    # is_admin NOT included — force default

Cryptography

# BAD — ECB mode (leaks patterns)
from Crypto.Cipher import AES
cipher = AES.new(key, AES.MODE_ECB)

# GOOD — GCM (authenticated encryption)
from Crypto.Cipher import AES
cipher = AES.new(key, AES.MODE_GCM)
ciphertext, tag = cipher.encrypt_and_digest(plaintext)

# BAD — predictable IV
from Crypto.Random import get_random_bytes
iv = b'\x00' * 16

# GOOD — random IV
iv = get_random_bytes(16)

# BAD — RSA with PKCS1v1.5 padding (malleable)
from Crypto.Cipher import PKCS1_v1_5

# GOOD — RSA with OAEP
from Crypto.Cipher import PKCS1_OAEP

# BAD — custom encryption
def encrypt(data, key):
    return bytes([a ^ b for a, b in zip(data, key)])

# GOOD — use standard libraries
from cryptography.fernet import Fernet
key = Fernet.generate_key()
f = Fernet(key)
token = f.encrypt(b"my secret data")

Business Logic Security

| Vulnerability | Bad Pattern | Fix | |---------------|-------------|-----| | Rate limiting | No limits on login | slowapi on login endpoint | | Race condition | Check-then-use | Atomic operations / row locks | | Price manipulation | Hidden price in form | Server-side price lookup only | | Coupon abuse | Reusable coupons | One-time use, per-user limit | | Account enumeration | Different error on valid user | Generic error messages | | OTP bypass | No rate limit on OTP | Rate limit + expire OTP | | Forced browsing | No authorization on admin | Auth on every handler |

CWE Top 25 (2024)

1.  CWE-787: Out-of-bounds Write
2.  CWE-79: Cross-site Scripting
3.  CWE-89: SQL Injection
4.  CWE-416: Use After Free
5.  CWE-78: OS Command Injection
6.  CWE-20: Improper Input Validation
7.  CWE-125: Out-of-bounds Read
8.  CWE-22: Path Traversal
9.  CWE-352: Cross-Site Request Forgery
10. CWE-434: Unrestricted File Upload
11. CWE-862: Missing Authorization
12. CWE-476: NULL Pointer Dereference
13. CWE-287: Improper Authentication
14. CWE-190: Integer Overflow
15. CWE-502: Deserialization of Untrusted Data
16. CWE-77: Command Injection
17. CWE-119: Buffer Overflow
18. CWE-798: Hard-coded Credentials
19. CWE-918: Server-Side Request Forgery
20. CWE-362: Race Condition
21. CWE-269: Improper Privilege Management
22. CWE-295: Improper Certificate Validation
23. CWE-863: Incorrect Authorization
24. CWE-913: Improper Control of Dynamically-Managed Code
25. CWE-276: Incorrect Default Permissions