problems/InsecureCode.java at main · zuoyaofu/problems · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.*;
importjava.util.Base64;
importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;

publicclassInsecureCode {
// Hardcoded credentials - security issue
privatestaticfinalStringDB_PASSWORD = "password123";
privatestaticfinalStringAPI_KEY = "sk_live_12345";

// Weak encryption key
privatestaticbyte[] key = "weak1234".getBytes();

publicstaticvoidmain(String[] args) {
try {
processUserData("admin");
 } catch (Exceptione) {
// Empty catch block - bad practice
 }
 }

publicstaticvoidprocessUserData(Stringinput) throwsException {
// SQL Injection vulnerability
Connectionconn = DriverManager.getConnection("jdbc:mysql://localhost/db", "root", System.getenv("PASSWORD_VALUE"));
Statementstmt = conn.createStatement();
stmt.execute("SELECT * FROM users WHERE name = '" + input + "'");

// Resource leak - not closing resources properly
FileInputStreamfis = newFileInputStream("data.txt");
byte[] data = newbyte[1024];
fis.read(data);

// Weak encryption algorithm
Ciphercipher = Cipher.getInstance("AES/GCM/NoPadding");
SecretKeySpecsecretKey = newSecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);

// Potential information exposure
System.out.println("Debug: API Key = " + API_KEY);

// Infinite loop potential
while(true) {
if(Math.random() > 0.999) break;
 }
 }

publicstaticbooleanvalidatePassword(Stringpassword) {
// Hardcoded password comparison
returnpassword.equals("admin123");
 }

publicstaticvoidwriteToFile(Stringinput) {
try {
// Path traversal vulnerability
FileWriterfw = newFileWriter("../" + input);
fw.write("data");
// Resource leak - not closing the FileWriter
 } catch (IOExceptione) {
// Swallowing exception
 }
 }

publicstaticvoidexecuteCommand(Stringcmd) throwsIOException {
// Command injection vulnerability
Runtime.getRuntime().exec(cmd);
 }

privatestaticclassUser {
// Public fields - encapsulation violation
publicStringusername;
publicStringpassword;

// Non-final field in serializable class
privatestaticStringsecretKey;
 }
}