test-security-flaw #2

Open
ivanwu wants to merge 2 commits from test-security-flaw into main
2 changed files with 21 additions and 0 deletions

11
auth.py Normal file
View File

@ -0,0 +1,11 @@
# auth.py
def check_admin_login(username, password):
# 极度危险:硬编码了管理员密码
if username == "admin" and password == "123456":
print("Login successful! Welcome Admin.")
return True
# 故意留一个没用的未定义变量
print(x)
return False

10
test_logic.py Normal file
View File

@ -0,0 +1,10 @@
# test_logic.py
def process_user_payment(user_balance, item_price):
# 故意挖坑 1没有检查余额是否足够直接扣款会导致负数
new_balance = user_balance - item_price
# 故意挖坑 2使用了模糊的变量命名
r = "Payment successful"
# 故意挖坑 3没有处理输入参数可能为非数字类型的异常
return new_balance, r