init: deliberately vulnerable demo (CWE-798/327/89/78/319)

README.md

@@ -0,0 +1,3 @@
+# cra-vuln-demo
+Deliberately vulnerable Python app for testing CRA control-tagging.
+Hardcoded creds, weak crypto, SQLi, command injection, cleartext HTTP.

auth.py

@@ -0,0 +1,6 @@
+# Deliberately vulnerable: hardcoded credentials (CWE-798)
+API_KEY = "sk_live_51HxYzABCDEFghijklmnopqrstuvwxyz0123456789"
+ADMIN_PASSWORD = "admin123"
+
+def login(user, pw):
+    return pw == ADMIN_PASSWORD

crypto.py

@@ -0,0 +1,9 @@
+import hashlib
+from Crypto.Cipher import DES
+
+def weak_hash(data):
+    return hashlib.md5(data.encode()).hexdigest()   # weak hash (CWE-327/328)
+
+def encrypt(data, key):
+    cipher = DES.new(key, DES.MODE_ECB)              # weak cipher (CWE-327)
+    return cipher.encrypt(data)

db.py

@@ -0,0 +1,9 @@
+import os
+
+def get_user(conn, user_id):
+    cur = conn.cursor()
+    cur.execute("SELECT * FROM users WHERE id = " + user_id)   # SQL injection (CWE-89)
+    return cur.fetchall()
+
+def ping(host):
+    os.system("ping -c 1 " + host)                              # command injection (CWE-78)

net.py

@@ -0,0 +1,4 @@
+import requests
+
+def fetch(path):
+    return requests.get("http://api.internal.example/" + path)  # cleartext transport (CWE-319)