1. SQL Injection via Unsanitized String Concatenation / Interpolation

@RestController
public class SqlInjectionLesson5a {
    @PostMapping("/SqlInjection/attack5a")
    public String injectableQuery(@RequestParam String account, Connection connection) throws Exception {
        String query = "SELECT * FROM user_data WHERE first_name = 'John' AND last_name = '" + account + "'";
        Statement statement = connection.createStatement();
        ResultSet results = statement.executeQuery(query);
        return results.toString();
    }
}

// ❌ VULNERABLE (Lines 10–12)
String query = "SELECT * FROM user_data WHERE first_name = 'John' AND last_name = '" + account + "'";
Statement statement = connection.createStatement();
ResultSet results = statement.executeQuery(query);

// ✅ FIXED — Parameterized PreparedStatement (Binds 'account' as literal value)
String query = "SELECT * FROM user_data WHERE first_name = 'John' AND last_name = ?";
PreparedStatement statement = connection.prepareStatement(query);
statement.setString(1, account);
ResultSet results = statement.executeQuery();

2. Insecure Deserialization of Untrusted Data

// ❌ VULNERABLE
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();

// ✅ FIXED — Use ObjectInputFilter (Java 17+)
ObjectInputStream ois = new ObjectInputStream(inputStream);
ois.setObjectInputFilter(info -> {
    if (info.serialClass() == AllowedClass.class) return ObjectInputFilter.Status.ALLOWED;
    return ObjectInputFilter.Status.REJECTED;
});

3. IDOR — Broken Object Level Authorization

// ❌ VULNERABLE
Account acct = accountRepository.findById(accountId);
return acct;

// ✅ FIXED
String userId = SecurityContextHolder.getContext()
    .getAuthentication().getName();
Account acct = accountRepository.findByIdAndUserId(accountId, userId);
if (acct == null) throw new AccessDeniedException("Forbidden");
return acct;

4. Server-Side Request Forgery (SSRF)

// ❌ VULNERABLE
const response = await axios.get(req.body.callbackUrl);

// ✅ FIXED
const ALLOWED_DOMAINS = ['api.trusted.com', 'hooks.partner.com'];
const url = new URL(req.body.callbackUrl);

if (!ALLOWED_DOMAINS.includes(url.hostname)) {
  return res.status(400).json({ error: 'URL not permitted' });
}

// Block private/internal IP ranges
const ipRanges = ['10.', '172.', '192.168.', '127.', '169.254.'];
if (ipRanges.some(range => url.hostname.startsWith(range))) {
  return res.status(400).json({ error: 'Internal URLs not permitted' });
}

const response = await axios.get(url.toString(), { timeout: 5000 });

5. XML External Entity (XXE) Injection

// ❌ VULNERABLE
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();

// ✅ FIXED
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);
DocumentBuilder db = dbf.newDocumentBuilder();

6. Authentication Bypass via JWT Algorithm Confusion

// ❌ VULNERABLE
const payload = jwt.verify(token, publicKey);

// ✅ FIXED
const payload = jwt.verify(token, publicKey, {
  algorithms: ['RS256'],  // Explicitly allowlist algorithms
});

7. Hardcoded AWS Secret Key in Source Code

# ❌ VULNERABLE
client = boto3.client('s3',
    aws_access_key_id='AKIAIOSFODNN7EXAMPLE',
    aws_secret_access_key='wJalrXUtnFEMI/...')

# ✅ FIXED — Use environment variables
import os
client = boto3.client('s3',
    aws_access_key_id=os.environ['AWS_ACCESS_KEY_ID'],
    aws_secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'])

# ✅ BEST — Use IAM instance role (no credentials in code at all)
client = boto3.client('s3')  # Credentials from instance profile

8. Cross-Site Request Forgery (CSRF) — State-Changing Endpoint

// ✅ Enable Spring Security CSRF (default in Spring Security)
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().csrfTokenRepository(
            CookieCsrfTokenRepository.withHttpOnlyFalse()
        );
    }
}

9. Path Traversal — Arbitrary File Read

import os

BASE_DIR = '/app/files'

# ❌ VULNERABLE
filepath = os.path.join(BASE_DIR, filename)
with open(filepath) as f: return f.read()

# ✅ FIXED
real_path = os.path.realpath(os.path.join(BASE_DIR, filename))
if not real_path.startswith(os.path.realpath(BASE_DIR) + os.sep):
    abort(403, "Path traversal detected")
with open(real_path) as f: return f.read()

10. Weak Cryptographic Algorithm (MD5 for Password Hashing)

// ❌ VULNERABLE
MessageDigest md = MessageDigest.getInstance("MD5");
byte[] hash = md.digest(password.getBytes());

// ✅ FIXED — Use BCrypt
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(12); // work factor 12
String hashedPassword = encoder.encode(password);

// Verify:
boolean matches = encoder.matches(rawPassword, storedHash);

11. Open Redirect via Unvalidated returnUrl Parameter

// ❌ VULNERABLE
res.redirect(req.query.returnUrl);

// ✅ FIXED — Only allow relative paths on same domain
const returnUrl = req.query.returnUrl as string;
const url = new URL(returnUrl, `https://${req.hostname}`);

if (url.hostname !== req.hostname) {
  return res.redirect('/dashboard'); // Default safe redirect
}
res.redirect(url.pathname + url.search);

12. Missing Security Response Headers

// ✅ FIXED — Use Helmet.js
import helmet from 'helmet';

app.use(helmet({
  hsts: { maxAge: 31536000, includeSubDomains: true },
  frameguard: { action: 'deny' },
  contentSecurityPolicy: true,
  noSniff: true,
  referrerPolicy: { policy: 'same-origin' },
}));

13. Verbose Error Messages Exposing Stack Traces

// Remediate per finding-specific guidance

14. Insecure Cookie — Missing HttpOnly Flag

// Remediate per finding-specific guidance

15. Insecure Cookie — Missing Secure Flag

// Remediate per finding-specific guidance

16. Logging of Sensitive Data (Password in Log)

// Remediate per finding-specific guidance

17. Insecure Randomness — Math.random() for Token

// Remediate per finding-specific guidance

18. Missing Rate Limiting on Login Endpoint

// Remediate per finding-specific guidance

19. Outdated Dependency — Apache Commons Text 1.9

// Remediate per finding-specific guidance

20. Debug Endpoint Exposed in Production

// Remediate per finding-specific guidance

21. Server Version Disclosed in Response Headers

// Remediate per finding-specific guidance

22. Commented-Out Code Contains Credentials

// Remediate per finding-specific guidance

23. Missing Input Length Validation

// Remediate per finding-specific guidance

24. Unsafe innerHTML Assignment

// Remediate per finding-specific guidance

25. Missing CORS Allowlist — Wildcard Origin

// Remediate per finding-specific guidance

26. Race Condition in Balance Update Transaction

// Remediate per finding-specific guidance

27. Unused Elevated Permission in IAM Role Binding

// Remediate per finding-specific guidance