videohub's Introduction

VideoHub

A video sharing platform. A rough client-server architecture replica of YouTube with Flask and MySQL.

All CSS files are available offline.

Requirements

To install the requirements,

pip install -r requirements.txt

Starting server

To start server,

python3 ./Server/server.py

Starting client

To start client,

python3 ./Client/client.py

You're done!

Visit http://127.0.0.1:5000

Screenshots

Normal user

Homepage

Login / Signup Page

Video Search Page

Upload Page

Video Page

Video Page Full Screen

Dashboard

Administrator

Flagged Video List

Users List

videohub's People

Contributors

Stargazers

Watchers

videohub's Issues

Mutliple SQL Injection Security Vulnerabilities

Hello,

I noticed several SQL Injections in Server/database.py.

For example:

VideoHub/Server/database.py

Line 28 in dcc3308

 done1 = self.cur.execute("SELECT password FROM users WHERE username=\"{}\"".format(username)) 

The issue here is that the unsanitized username is used to build an SQL query, which then gets executed. This allows attackers to own the database (see the OWASP page above for a complete list of risks).

To fix the issue i would suggest using prepared statements.
For example,
done1 = self.cur.execute("SELECT password FROM users WHERE username=\"{}\"".format(username))

can be rewritten to:

done1 = self.cur.execute("SELECT password FROM users WHERE username='%s'", username)

(all the other similar lines should be changed accordingly).

I found the bug while testing DeepCode’s AI Code Review. The tool can help you automate the process of finding such (and many other types of) bugs. You can sign-up your repo (free for Open Source) to receive notifications whenever new bugs are detected. You can give it a try here.

Any feedback is more than welcome at [email protected].
Cheers, Victor.

SyntaxError - what's wrong?

Traceback (most recent call last):
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2213, in __call__
    return self.wsgi_app(environ, start_response)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2193, in wsgi_app
    response = self.handle_exception(e)
               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2190, in wsgi_app
    response = self.full_dispatch_request()
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1486, in full_dispatch_request
    rv = self.handle_user_exception(e)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
    rv = self.dispatch_request()
         ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/Client/nocache.py", line 8, in no_cache
    response = make_response(view(*args, **kwargs))
                             ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/./Client/client.py", line 54, in start
    most_viewed_video_IDs = ast.literal_eval(most_viewed_video_IDs)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/ast.py", line 64, in literal_eval
    node_or_string = parse(node_or_string.lstrip(" \t"), mode='eval')
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<unknown>", line 13
    	margin: 40px;
    	         ^
SyntaxError: invalid decimal literal
```Traceback (most recent call last):
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2213, in __call__
    return self.wsgi_app(environ, start_response)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2193, in wsgi_app
    response = self.handle_exception(e)
               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2190, in wsgi_app
    response = self.full_dispatch_request()
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1486, in full_dispatch_request
    rv = self.handle_user_exception(e)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
    rv = self.dispatch_request()
         ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/Client/nocache.py", line 8, in no_cache
    response = make_response(view(*args, **kwargs))
                             ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/./Client/client.py", line 54, in start
    most_viewed_video_IDs = ast.literal_eval(most_viewed_video_IDs)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/ast.py", line 64, in literal_eval
    node_or_string = parse(node_or_string.lstrip(" \t"), mode='eval')
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<unknown>", line 13
    	margin: 40px;
    	         ^
SyntaxError: invalid decimal literal

sharadbhat / videohub Goto Github PK