AI 生成漏洞之 CWE 對映

# AI 生成：易受 SQL 注入
def get_user(username):
    query = f"SELECT * FROM users WHERE username = '{username}'"
    cursor.execute(query)
    return cursor.fetchone()
 
# 模型應建議之安全替代方案
def get_user(username):
    query = "SELECT * FROM users WHERE username = %s"
    cursor.execute(query, (username,))
    return cursor.fetchone()

// AI 生成:易受 SQL 注入
app.get('/users/:id', async (req, res) => {
  const result = await db.query(
    `SELECT * FROM users WHERE id = ${req.params.id}`
  );
  res.json(result.rows);
});
 
// 安全替代方案
app.get('/users/:id', async (req, res) => {
  const result = await db.query(
    'SELECT * FROM users WHERE id = $1',
    [req.params.id]
  );
  res.json(result.rows);
});

# AI 生成：反射型 XSS
@app.route('/search')
def search():
    query = request.args.get('q', '')
    results = search_engine.search(query)
    return f"<h1>Results for: {query}</h1>" + render_results(results)
 
# 安全替代方案
from markupsafe import escape
 
@app.route('/search')
def search():
    query = request.args.get('q', '')
    results = search_engine.search(query)
    return f"<h1>Results for: {escape(query)}</h1>" + render_results(results)

// AI 生成：以 DOM 為本之 XSS
function displayMessage(message) {
  document.getElementById('output').innerHTML = message;
}
 
// 安全替代方案
function displayMessage(message) {
  document.getElementById('output').textContent = message;
}

# AI 生成：路徑穿越
@app.route('/files/<filename>')
def serve_file(filename):
    return send_file(os.path.join(UPLOAD_DIR, filename))
 
# 安全替代方案
@app.route('/files/<filename>')
def serve_file(filename):
    filename = secure_filename(filename)
    file_path = os.path.join(UPLOAD_DIR, filename)
    if not os.path.abspath(file_path).startswith(os.path.abspath(UPLOAD_DIR)):
        abort(403)
    return send_file(file_path)

// AI 生成：Node.js 中之路徑穿越
app.get('/download', (req, res) => {
  const filePath = path.join(__dirname, 'uploads', req.query.file);
  res.sendFile(filePath);
});
 
// 安全替代方案
app.get('/download', (req, res) => {
  const fileName = path.basename(req.query.file);  // 剝除路徑元件
  const filePath = path.join(__dirname, 'uploads', fileName);
  const resolved = path.resolve(filePath);
  if (!resolved.startsWith(path.resolve(path.join(__dirname, 'uploads')))) {
    return res.status(403).send('Forbidden');
  }
  res.sendFile(resolved);
});

# AI 生成：命令注入
def convert_image(input_path, output_format):
    os.system(f"convert {input_path} output.{output_format}")
 
# 安全替代方案
def convert_image(input_path, output_format):
    allowed_formats = {'png', 'jpg', 'gif', 'webp'}
    if output_format not in allowed_formats:
        raise ValueError(f"Unsupported format: {output_format}")
    subprocess.run(
        ['convert', input_path, f'output.{output_format}'],
        check=True,
        capture_output=True
    )

// AI 生成：Go 中之命令注入
func runDiagnostic(host string) (string, error) {
    cmd := exec.Command("sh", "-c", "ping -c 4 " + host)
    output, err := cmd.Output()
    return string(output), err
}
 
// 安全替代方案
func runDiagnostic(host string) (string, error) {
    cmd := exec.Command("ping", "-c", "4", host)
    output, err := cmd.Output()
    return string(output), err
}

# AI 生成：硬編碼憑證
import boto3
 
client = boto3.client(
    's3',
    aws_access_key_id='AKIAIOSFODNN7EXAMPLE',
    aws_secret_access_key='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
    region_name='us-east-1'
)
 
# 安全替代方案
import boto3
 
client = boto3.client('s3')  # 使用預設憑證鏈

// AI 生成：硬編碼資料庫憑證
const pool = new Pool({
  host: 'localhost',
  port: 5432,
  user: 'admin',
  password: 'password123',
  database: 'myapp'
});
 
// 安全替代方案
const pool = new Pool({
  connectionString: process.env.DATABASE_URL
});