sharadbhat / videohub Goto Github PK
View Code? Open in Web Editor NEWA rough replica of YouTube with Flask and MySQL
License: MIT License
A rough replica of YouTube with Flask and MySQL
License: MIT License
YouTube autoplay next video
Hello,
I noticed several SQL Injections in Server/database.py.
For example:
Line 28 in dcc3308
The issue here is that the unsanitized username is used to build an SQL query, which then gets executed. This allows attackers to own the database (see the OWASP page above for a complete list of risks).
To fix the issue i would suggest using prepared statements.
For example,
done1 = self.cur.execute("SELECT password FROM users WHERE username=\"{}\"".format(username))
can be rewritten to:
done1 = self.cur.execute("SELECT password FROM users WHERE username='%s'", username)
(all the other similar lines should be changed accordingly).
I found the bug while testing DeepCode’s AI Code Review. The tool can help you automate the process of finding such (and many other types of) bugs. You can sign-up your repo (free for Open Source) to receive notifications whenever new bugs are detected. You can give it a try here.
Any feedback is more than welcome at [email protected].
Cheers, Victor.
Traceback (most recent call last):
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2213, in __call__
return self.wsgi_app(environ, start_response)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2193, in wsgi_app
response = self.handle_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2190, in wsgi_app
response = self.full_dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1486, in full_dispatch_request
rv = self.handle_user_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/Client/nocache.py", line 8, in no_cache
response = make_response(view(*args, **kwargs))
^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/./Client/client.py", line 54, in start
most_viewed_video_IDs = ast.literal_eval(most_viewed_video_IDs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/ast.py", line 64, in literal_eval
node_or_string = parse(node_or_string.lstrip(" \t"), mode='eval')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/ast.py", line 50, in parse
return compile(source, filename, mode, flags,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<unknown>", line 13
margin: 40px;
^
SyntaxError: invalid decimal literal
```Traceback (most recent call last):
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2213, in __call__
return self.wsgi_app(environ, start_response)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2193, in wsgi_app
response = self.handle_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 2190, in wsgi_app
response = self.full_dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1486, in full_dispatch_request
rv = self.handle_user_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/vhost/lib64/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/Client/nocache.py", line 8, in no_cache
response = make_response(view(*args, **kwargs))
^^^^^^^^^^^^^^^^^^^^^^
File "/home/keitaro/chroot-distro/debian11/mnt/shared/videohubserver/videohub/./Client/client.py", line 54, in start
most_viewed_video_IDs = ast.literal_eval(most_viewed_video_IDs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/ast.py", line 64, in literal_eval
node_or_string = parse(node_or_string.lstrip(" \t"), mode='eval')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/ast.py", line 50, in parse
return compile(source, filename, mode, flags,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<unknown>", line 13
margin: 40px;
^
SyntaxError: invalid decimal literal
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.