アクセスコントロールの修正
flask-app プロジェクト内の pages/a5.py を開きます：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
from flask import (
Blueprint,
request,
redirect,
make_response,
render_template
)
from models import (
get_user,
get_user_by_password
)
from utils import (
generate_session,
parse_session
)
bp = Blueprint(
"a5", __name__,
template_folder='templates',
static_folder='static'
)
@bp.route("/A5")
def a5():
return render_template("a5.html")
@bp.route("/A5/auth", methods=['POST'])
def a5_auth():
username = request.form.get("username")
password = request.form.get("password")
user = get_user_by_password(username, password)
if not user:
return render_template("error.html", message="Invalid Credentials")
# Generate SessionID
session_id = generate_session(username)
response = make_response(redirect("/owasp/A5/profile/{}".format(username)))
response.set_cookie("sessionId", session_id)
return response
@bp.route("/A5/profile/<username>")
def a5_profile(username):
if not request.cookies.get("sessionId"):
return ("<h1>Not Authorized!</h1>")
session = parse_session(request.cookies.get("sessionId"))
user = get_user(username)
if not user:
return render_template("404.html")
return render_template("profile.html", user=user)
|
/A5/profile/<username> URLに応答する関数は、sessionId による現在のユーザーが、URL にアクセスしようとしているユーザーと同じかどうかもチェックしないことに気付くでしょう。開発者がチェックを実装するのを忘れたか、要件に関する誤解があったかもしれません。
チェックを追加するだけで、すぐにパッチを適用できます。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
from flask import (
Blueprint,
request,
redirect,
make_response,
render_template
)
from models import (
get_user,
get_user_by_password
)
from utils import (
generate_session,
parse_session
)
bp = Blueprint(
"a5", __name__,
template_folder='templates',
static_folder='static'
)
@bp.route("/A5")
def a5():
return render_template("a5.html")
@bp.route("/A5/auth", methods=['POST'])
def a5_auth():
username = request.form.get("username")
password = request.form.get("password")
user = get_user_by_password(username, password)
if not user:
return render_template("error.html", message="Invalid Credentials")
# Generate SessionID
session_id = generate_session(username)
response = make_response(redirect("/owasp/A5/profile/{}".format(username)))
response.set_cookie("sessionId", session_id)
return response
@bp.route("/A5/profile/<username>")
def a5_profile(username):
if not request.cookies.get("sessionId"):
return ("<h1>Not Authorized!</h1>")
session = parse_session(request.cookies.get("sessionId"))
if session['username'] != username:
return ("<h1>Not Authorized!</h1>")
user = get_user(username)
if not user:
return render_template("404.html")
return render_template("profile.html", user=user)
|