-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- add hardening rule for script timeout - change hardening level - re-make hardening python code - hardening report (text) - auto-delete process for real time output - MANIFEST.in exclude audit files - Fix: request multiline - Fix: request first output - Fix: csv databases (NUL characters) - Fix: Windows config files
- Loading branch information
1 parent
20d66e7
commit 3bf4082
Showing
12 changed files
with
160 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,7 +27,9 @@ | |
|
|
||
| from typing import Tuple, Dict, List, TypeVar | ||
| from email.message import EmailMessage | ||
| from collections.abc import Iterator | ||
| from smtplib import SMTP, SMTP_SSL | ||
| from collections import namedtuple | ||
| from os import _Environ, path | ||
| from threading import Thread | ||
| from string import Template | ||
|
|
@@ -40,6 +42,21 @@ | |
| ServerConfiguration = TypeVar("ServerConfiguration") | ||
| User = TypeVar("User") | ||
|
|
||
| _Request = namedtuple( | ||
| "_Request", | ||
| [ | ||
| "ID", | ||
| "Time", | ||
| "UserName", | ||
| "ErrorCode", | ||
| "Page", | ||
| "UserAgent", | ||
| "Subject", | ||
| "Reason", | ||
| "Name", | ||
| ], | ||
| ) | ||
|
|
||
| __version__ = "0.0.4" | ||
| __author__ = "Maurice Lambert" | ||
| __author_email__ = "[email protected]" | ||
|
|
@@ -198,7 +215,8 @@ | |
| </div> | ||
| <div id="submit_row" class="row"> | ||
| <input type="hidden" id="code" name="code" value="${code}"> | ||
| <input type="hidden" id="error" name="error" \ | ||
| value="${code}"> | ||
| <input type="hidden" name="csrf_token" id="csrf_token" \ | ||
| value="{csrf}"> | ||
| <div class="submit_position"> | ||
|
|
@@ -426,7 +444,7 @@ | |
| }, | ||
| { | ||
| "input": false, | ||
| "name": "code" | ||
| "name": "error" | ||
| } | ||
| ] | ||
| }; | ||
|
|
@@ -541,7 +559,9 @@ def send_mail( | |
| configuration: ServerConfiguration, notification: str | ||
| ) -> None: | ||
|
|
||
| """This function send a notification mail.""" | ||
| """ | ||
| This function send a notification mail. | ||
| """ | ||
|
|
||
| server_name = getattr(configuration, "smtp_server", None) | ||
| starttls = getattr(configuration, "smtp_starttls", None) | ||
|
|
@@ -588,19 +608,35 @@ def save( | |
| reason: str, | ||
| ) -> None: | ||
|
|
||
| """This function save the report/request to a CSV file.""" | ||
| """ | ||
| This function save the report/request to a CSV file. | ||
| """ | ||
|
|
||
| filename = path.join( | ||
| path.dirname(__file__), "..", "data", "requests.csv" | ||
| ) | ||
|
|
||
| with open(filename) as file: | ||
| id_ = 0 | ||
| line = file.readline() # First line is columns | ||
| line = file.readline() | ||
| while line: | ||
| id_ = int(line.split(",")[0][1:-1]) + 1 | ||
| line = file.readline() | ||
| def get_requests() -> Iterator[_Request]: | ||
|
|
||
| """ | ||
| This function build Request from database. | ||
| """ | ||
|
|
||
| yield from map( | ||
| _Request._make, | ||
| csv.reader( | ||
| open(filename, "r", newline=""), | ||
| quoting=csv.QUOTE_ALL, | ||
| ), | ||
| ) | ||
|
|
||
| id_ = 0 | ||
| first = True | ||
| for request in get_requests(): | ||
| if first: # columns | ||
| first = False | ||
| continue | ||
| id_ = int(request.ID) + 1 | ||
|
|
||
| with open(filename, "a", newline="") as file: | ||
| csvfile = csv.writer(file, quoting=csv.QUOTE_ALL) | ||
|
|
@@ -628,7 +664,9 @@ def send( | |
| csrf_token: str = None, | ||
| ) -> Tuple[str, Dict[str, str], str]: | ||
|
|
||
| """This function save and send request or report.""" | ||
| """ | ||
| This function save and send request or report. | ||
| """ | ||
|
|
||
| referer = escape(environ.get("HTTP_REFERER")) | ||
| user_agent = escape(environ.get("HTTP_USER_AGENT")) | ||
|
|
@@ -638,8 +676,19 @@ def send( | |
| code = escape(code) | ||
| user.name = escape(user.name) | ||
|
|
||
| while len(arguments) < 4: | ||
| arguments.append(None) | ||
| for string in ( | ||
| referer, | ||
| user_agent, | ||
| code, | ||
| user.name, | ||
| subject, | ||
| name, | ||
| reason, | ||
| ): | ||
| if not string.isprintable(): | ||
| raise ValueError( | ||
| f"Strings must be printable: '{string}' is not." | ||
| ) | ||
|
|
||
| notification = ( | ||
| f'The user named: "{user.name}" get a HTTP error ' | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,7 +23,7 @@ | |
| This file implement some functions to manage WebScript default databases.""" | ||
|
|
||
| __version__ = "1.1.1" | ||
| __version__ = "1.2.0" | ||
| __author__ = "Maurice Lambert" | ||
| __author_email__ = "[email protected]" | ||
| __maintainer__ = "Maurice Lambert" | ||
|
|
@@ -272,6 +272,10 @@ def add_user( | |
| ) | ||
| ) | ||
|
|
||
| for string in user: | ||
| if not string.isprintable(): | ||
| raise ValueError(f"Strings must be printable: '{string}' is not.") | ||
|
|
||
| with open(path.join(DIRECTORY, FILES[0]), "a", newline="") as csvfile: | ||
| csv_writer = csv.writer(csvfile, quoting=csv.QUOTE_ALL) | ||
| csv_writer.writerow(user) | ||
|
|
@@ -345,6 +349,10 @@ def add_group(name: str, id_: int) -> Group: | |
|
|
||
| group = anti_XSS(Group(id_, name)) | ||
|
|
||
| for string in group: | ||
| if not string.isprintable(): | ||
| raise ValueError(f"Strings must be printable: '{string}' is not.") | ||
|
|
||
| with open(path.join(DIRECTORY, FILES[1]), "a", newline="") as csvfile: | ||
| csv_writer = csv.writer(csvfile, quoting=csv.QUOTE_ALL) | ||
| csv_writer.writerow(group) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,7 +23,7 @@ | |
| This file can share a password securely.""" | ||
|
|
||
| __version__ = "0.0.4" | ||
| __version__ = "0.1.0" | ||
| __author__ = "Maurice Lambert" | ||
| __author_email__ = "[email protected]" | ||
| __maintainer__ = "Maurice Lambert" | ||
|
|
@@ -190,7 +190,13 @@ def main() -> None: | |
| password, hash_, iteration, key = encrypt(password) | ||
| password, key = get_printable(password, key) | ||
|
|
||
| passwords.append([timestamp, password, views, hash_, iteration, id_]) | ||
| password = [timestamp, password, views, hash_, iteration, id_] | ||
|
|
||
| for string in passwords: | ||
| if isinstance(string, str) and not string.isprintable(): | ||
| raise ValueError(f"Strings must be printable: '{string}' is not.") | ||
|
|
||
| passwords.append() | ||
| save(passwords, id_) | ||
|
|
||
| print( | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.