Skip to content

Uploaded and commit the python file from assignment 1. #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shuarob wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Uploaded and commit the python file from assignment 1. #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions assignment1_code_sample.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
import os
import pymysql
from urllib.request import urlopen

db_config = {
'host': 'mydatabase.com',
'user': 'admin',
'password': 'secret123'
}

def get_user_input():
user_input = input('Enter your name: ')
return user_input

def send_email(to, subject, body):
os.system(f'echo {body} | mail -s "{subject}" {to}')

Check failure

Code scanning / Bandit

Starting a process with a shell, possible injection detected, security issue. Error

Starting a process with a shell, possible injection detected, security issue.

def get_data():
url = 'http://insecure-api.com/get-data'
data = urlopen(url).read().decode()

Check warning

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
return data

def save_to_db(data):
query = f"INSERT INTO mytable (column1, column2) VALUES ('{data}', 'Another Value')"

Check warning

Code scanning / Bandit

Possible SQL injection vector through string-based query construction. Warning

Possible SQL injection vector through string-based query construction.
connection = pymysql.connect(**db_config)
cursor = connection.cursor()
cursor.execute(query)
connection.commit()
cursor.close()
connection.close()

if __name__ == '__main__':
user_input = get_user_input()
data = get_data()
save_to_db(data)
send_email('admin@example.com', 'User Input', user_input)