diff --git a/CWE-707/CWE-838/compliant01.py b/CWE-707/CWE-838/compliant01.py new file mode 100644 index 0000000..92809c9 --- /dev/null +++ b/CWE-707/CWE-838/compliant01.py @@ -0,0 +1,25 @@ +"""Compliant Code Example""" + +import base64 + + +def report_record_attack(stream: bytearray): + try: + decoded_text = stream.decode("utf-8") + except UnicodeDecodeError as e: + # Encode the stream using Base64 if there is an exception + encoded_payload = base64.b64encode(stream).decode("utf-8") + # Logging encoded payload for forensic analysis + print("Base64 Encoded Payload for Forensic Analysis:", encoded_payload) + print("Error decoding payload:", e) + else: + print("Important text:", decoded_text) + + +##################### +# attempting to exploit above code example +##################### +payload = bytearray("user: 毛泽东先生 attempted a directory traversal".encode("utf-8")) +# Introducing an error in the encoded text, a byte +payload[3] = 128 +report_record_attack(payload) \ No newline at end of file diff --git a/CWE-707/CWE-838/noncompliant01.py b/CWE-707/CWE-838/noncompliant01.py new file mode 100644 index 0000000..31143e6 --- /dev/null +++ b/CWE-707/CWE-838/noncompliant01.py @@ -0,0 +1,12 @@ +""" Non-compliant Code Example """ + +def report_record_attack(stream: bytearray): + print("important text:", stream.decode("utf-8")) + +##################### +# attempting to exploit above code example +##################### +payload = bytearray("user: 毛泽东先生 attempted a directory traversal".encode("utf-8")) +# Introducing an error in the encoded text, a byte +payload[3] = 128 +report_record_attack(payload) \ No newline at end of file