Patched code sample

# SECURE CODE - Comprehensive Security Implementation
import os
import json
import sqlite3
import html
import re
import hashlib
import time
from pathlib import Path
from typing import Dict, Any, Optional, List, Union
from flask import Flask, request, jsonify, escape
from werkzeug.utils import secure_filename
import logging

app = Flask(__name__)
app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY', 'secure-random-key-change-in-production')

# Configure secure logging
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class SecureDataProcessor:
    """
    SECURE IMPLEMENTATION: Comprehensive protection against all vulnerability classes
    - SQL Injection prevention via parameterized queries
    - Command Injection prevention via safe file operations
    - XSS prevention via proper output encoding
    - Deserialization protection via JSON validation
    - Path Traversal prevention via secure path handling
    """
    
    def __init__(self):
        self.max_input_length = 1000
        self.max_query_length = 500
        self.max_file_size = 10000  # 10KB limit
        self.allowed_file_extensions = {'.txt', '.log', '.csv', '.json'}
        self.secure_upload_dir = Path('/secure/uploads')
        self.secure_upload_dir.mkdir(parents=True, exist_ok=True)
        
        # Comprehensive security patterns for detection
        self.dangerous_patterns = [
            # SQL injection patterns
            r'(DROP|DELETE|INSERT|UPDATE|UNION|ALTER)\s+(TABLE|DATABASE|FROM|INTO|SET)',
            r'['"];', r'--\s', r'/\*.*?\*/', r'OR\s+1\s*=\s*1',
            
            # XSS patterns
            r'<script[^>]*>', r'javascript:', r'vbscript:', r'data:',
            r'on\w+\s*=', r'<iframe', r'<object', r'<embed',
            
            # Command injection patterns
            r'[;&|`$]', r'\.\./', r'/etc/', r'/bin/', r'rm\s+-rf',
            r'wget\s+', r'curl\s+', r'nc\s+', r'netcat\s+',
            
            # Code execution patterns
            r'__import__', r'eval\s*\(', r'exec\s*\(', r'compile\s*\(',
        ]
    
    def process_user_data_securely(self, user_input: str, file_path: str, 
                                 query_data: str, json_data: str) -> Dict[str, Any]:
        """
        SECURE FUNCTION: Comprehensive protection against all attack vectors
        """
        
        try:
            # SECURITY 1: Input validation and sanitization
            safe_user_input = self._validate_and_sanitize_input(user_input, 'user_input')
            safe_query_data = self._validate_and_sanitize_input(query_data, 'query_data')
            safe_file_path = self._validate_file_path(file_path)
            safe_json_data = self._validate_json_data(json_data)
            
            # SECURITY 2: Secure database operations with parameterized queries
            db_results = self._execute_secure_database_query(safe_user_input, safe_query_data)
            
            # SECURITY 3: Secure file operations without command injection
            file_content = self._process_file_securely(safe_file_path) if safe_file_path else None
            
            # SECURITY 4: Secure data processing without deserialization risks
            processed_data = self._process_json_data_securely(safe_json_data) if safe_json_data else None
            
            # SECURITY 5: Secure HTML generation with XSS protection
            secure_html = self._generate_secure_html_output(
                safe_user_input, db_results, file_content, processed_data
            )
            
            return {
                'success': True,
                'html': secure_html,
                'results_count': len(db_results) if db_results else 0,
                'file_processed': file_content is not None,
                'data_processed': processed_data is not None,
                'status': 'processed_securely',
                'timestamp': time.time()
            }
            
        except SecurityException as e:
            logger.warning(f"Security violation detected: {e}")
            return {
                'success': False,
                'error': 'Security validation failed',
                'status': 'rejected_for_security',
                'timestamp': time.time()
            }
        except Exception as e:
            logger.error(f"Processing error: {e}")
            return {
                'success': False,
                'error': 'Processing failed',
                'status': 'processing_error',
                'timestamp': time.time()
            }
    
    def _validate_and_sanitize_input(self, input_value: str, field_name: str) -> str:
        """Comprehensive input validation and sanitization."""
        
        if not isinstance(input_value, str):
            raise SecurityException(f"{field_name} must be a string")
        
        # Length validation
        max_length = self.max_query_length if 'query' in field_name else self.max_input_length
        if len(input_value) > max_length:
            raise SecurityException(f"{field_name} exceeds maximum length")
        
        # Dangerous pattern detection
        if self._contains_dangerous_patterns(input_value):
            raise SecurityException(f"{field_name} contains dangerous patterns")
        
        # HTML escape for XSS prevention
        sanitized = html.escape(input_value, quote=True)
        
        # Additional sanitization
        sanitized = self._deep_sanitize(sanitized)
        
        return sanitized
    
    def _validate_file_path(self, file_path: str) -> Optional[str]:
        """Secure file path validation preventing path traversal."""
        
        if not file_path or not isinstance(file_path, str):
            return None
        
        # Prevent path traversal
        if '..' in file_path or file_path.startswith('/'):
            raise SecurityException("Path traversal attempt detected")
        
        # Sanitize filename
        safe_filename = secure_filename(file_path)
        if not safe_filename:
            raise SecurityException("Invalid filename")
        
        # Validate file extension
        file_ext = Path(safe_filename).suffix.lower()
        if file_ext not in self.allowed_file_extensions:
            raise SecurityException(f"File extension not allowed: {file_ext}")
        
        return safe_filename
    
    def _validate_json_data(self, json_data: str) -> Optional[Dict[str, Any]]:
        """Secure JSON validation replacing pickle deserialization."""
        
        if not json_data or not isinstance(json_data, str):
            return None
        
        try:
            # Use JSON instead of pickle for safe deserialization
            data = json.loads(json_data)
            
            # Validate JSON structure
            if not isinstance(data, dict):
                raise SecurityException("JSON data must be an object")
            
            # Validate data size
            if len(str(data)) > self.max_file_size:
                raise SecurityException("JSON data too large")
            
            return data
            
        except json.JSONDecodeError:
            raise SecurityException("Invalid JSON format")
    
    def _execute_secure_database_query(self, user_input: str, query_data: str) -> List[tuple]:
        """Execute database queries securely with parameterized statements."""
        
        try:
            # Use parameterized queries to prevent SQL injection
            connection = sqlite3.connect(':memory:')  # In-memory for demo
            cursor = connection.cursor()
            
            # Create demo table
            cursor.execute("""
                CREATE TABLE users (
                    id INTEGER PRIMARY KEY,
                    username TEXT NOT NULL,
                    email TEXT NOT NULL,
                    status TEXT DEFAULT 'active'
                )
            """)
            
            # Insert demo data
            cursor.execute("INSERT INTO users VALUES (1, 'admin', 'admin@example.com', 'active')")
            cursor.execute("INSERT INTO users VALUES (2, 'user', 'user@example.com', 'active')")
            cursor.execute("INSERT INTO users VALUES (3, 'guest', 'guest@example.com', 'inactive')")
            
            # SECURE: Parameterized query prevents SQL injection
            secure_query = """
                SELECT id, username, email, status 
                FROM users 
                WHERE username LIKE ? AND status LIKE ?
                LIMIT 10
            """
            cursor.execute(secure_query, (f"%{user_input}%", f"%{query_data}%"))
            
            results = cursor.fetchall()
            connection.close()
            
            return results
            
        except Exception as e:
            logger.error(f"Database query error: {e}")
            return []
    
    def _process_file_securely(self, file_path: str) -> Optional[str]:
        """Process files securely using Python file operations."""
        
        try:
            # Use secure file path within upload directory
            full_path = self.secure_upload_dir / file_path
            
            # Verify file exists and is within allowed directory
            if not full_path.exists() or not full_path.is_file():
                return None
            
            # Verify file is within secure directory (prevent symlink attacks)
            if not str(full_path.resolve()).startswith(str(self.secure_upload_dir.resolve())):
                raise SecurityException("File access outside secure directory")
            
            # Read file safely with size limit
            with open(full_path, 'r', encoding='utf-8', errors='ignore') as f:
                content = f.read(self.max_file_size)
            
            # Sanitize file content
            safe_content = self._sanitize_file_content(content)
            
            return safe_content
            
        except Exception as e:
            logger.error(f"File processing error: {e}")
            return None
    
    def _process_json_data_securely(self, json_data: Dict[str, Any]) -> Dict[str, Any]:
        """Process JSON data securely with validation."""
        
        # Extract and validate specific fields
        processed = {}
        
        if 'name' in json_data:
            processed['name'] = self._validate_and_sanitize_input(str(json_data['name']), 'json_name')
        
        if 'value' in json_data:
            processed['value'] = self._validate_and_sanitize_input(str(json_data['value']), 'json_value')
        
        if 'timestamp' in json_data:
            # Validate timestamp
            try:
                timestamp = float(json_data['timestamp'])
                if 0 < timestamp < time.time() + 86400:  # Within reasonable range
                    processed['timestamp'] = timestamp
            except (ValueError, TypeError):
                pass
        
        return processed
    
    def _generate_secure_html_output(self, user_input: str, db_results: List[tuple], 
                                   file_content: Optional[str], processed_data: Optional[Dict]) -> str:
        """Generate secure HTML output with comprehensive XSS protection."""
        
        # Double-escape all user content
        safe_user_input = html.escape(user_input, quote=True)
        
        # Build secure HTML structure
        html_parts = [
            "<html>",
            "<head><title>Secure Processing Results</title></head>",
            "<body>",
            f"  <h1>Secure Processing Results</h1>",
            f"  <div class='user-section'>",
            f"    <strong>User Input:</strong> <span class='user-input'>{safe_user_input}</span>",
            f"  </div>"
        ]
        
        # Add database results securely
        if db_results:
            html_parts.append(f"  <div class='db-section'>")
            html_parts.append(f"    <strong>Database Results:</strong>")
            html_parts.append(f"    <ul>")
            for result in db_results[:5]:  # Limit results
                safe_result = html.escape(str(result), quote=True)
                html_parts.append(f"      <li>{safe_result}</li>")
            html_parts.append(f"    </ul>")
            html_parts.append(f"  </div>")
        
        # Add file content securely
        if file_content:
            safe_file_content = html.escape(file_content[:200], quote=True)  # Limit and escape
            html_parts.append(f"  <div class='file-section'>")
            html_parts.append(f"    <strong>File Content Preview:</strong>")
            html_parts.append(f"    <pre>{safe_file_content}</pre>")
            html_parts.append(f"  </div>")
        
        # Add processed data securely
        if processed_data:
            safe_data = html.escape(str(processed_data), quote=True)
            html_parts.append(f"  <div class='data-section'>")
            html_parts.append(f"    <strong>Processed Data:</strong>")
            html_parts.append(f"    <code>{safe_data}</code>")
            html_parts.append(f"  </div>")
        
        html_parts.extend(["</body>", "</html>"])
        
        return "
".join(html_parts)
    
    def _contains_dangerous_patterns(self, content: str) -> bool:
        """Check for dangerous patterns using comprehensive regex."""
        
        content_lower = content.lower()
        
        for pattern in self.dangerous_patterns:
            if re.search(pattern, content_lower, re.IGNORECASE):
                return True
        
        return False
    
    def _deep_sanitize(self, content: str) -> str:
        """Deep sanitization removing dangerous content."""
        
        # Remove script tags and event handlers
        sanitized = re.sub(r'<script[^>]*>.*?</script>', '', content, flags=re.IGNORECASE | re.DOTALL)
        sanitized = re.sub(r'on\w+\s*=\s*["'][^"']*["']', '', sanitized, flags=re.IGNORECASE)
        
        # Remove dangerous protocols and SQL patterns
        sanitized = re.sub(r'(javascript|vbscript|data):', '', sanitized, flags=re.IGNORECASE)
        sanitized = re.sub(r'(DROP|DELETE|INSERT|UPDATE|UNION)\s+(TABLE|FROM|INTO|SET|SELECT)', 
                          '', sanitized, flags=re.IGNORECASE)
        
        return sanitized.strip()
    
    def _sanitize_file_content(self, content: str) -> str:
        """Sanitize file content for safe display."""
        
        # Remove potential script content
        sanitized = re.sub(r'<script[^>]*>.*?</script>', '[SCRIPT_REMOVED]', 
                          content, flags=re.IGNORECASE | re.DOTALL)
        
        # Limit line length and content
        lines = sanitized.split('
')[:20]  # Max 20 lines
        sanitized_lines = [line[:100] for line in lines]  # Max 100 chars per line
        
        return '
'.join(sanitized_lines)

class SecurityException(Exception):
    """Custom exception for security violations."""
    pass

# Secure Flask endpoint implementation
processor = SecureDataProcessor()

@app.route('/process', methods=['POST'])
def secure_endpoint():
    """SECURE endpoint with comprehensive protection."""
    
    try:
        # Extract and validate inputs
        user_input = request.form.get('input', '')
        file_path = request.form.get('file', '')
        query_data = request.form.get('query', '')
        json_data = request.form.get('data', '')
        
        # Process securely
        result = processor.process_user_data_securely(
            user_input, file_path, query_data, json_data
        )
        
        if result['success']:
            return result['html']
        else:
            return jsonify({'error': result['error'], 'status': result['status']}), 400
            
    except Exception as e:
        logger.error(f"Endpoint error: {e}")
        return jsonify({'error': 'Processing failed', 'status': 'error'}), 500

# Example of secure usage:
# POST /process with properly validated and sanitized inputs
# All dangerous patterns are detected and blocked
# All outputs are properly escaped and secured