Secure Software Development Code Injection and XSS practices

This project is with aiming to help developers understand and mitigate code injection and cross-site scripting (XSS) vulnerabilities in their applications. It provides best practices, examples, and tools to enhance the security of software development.

Project Structure

.
├── backend
│   └── src
│       ├── api
│       │   ├── controller
│       │   │   ├── controller.js
│       │   │   └── secureController.js
│       │   └── network
│       │       ├── network.js
│       │       └── secureNetwork.js
│       ├── config
│       │   └── config.js
│       ├── index.js
│       ├── query
│       │   ├── database.js
│       │   └── secureDatabase.js
│       └── routes
│           └── routes.js
├── frontend
│   ├── index.html
│   ├── src
│   │   ├── api
│   │   │   ├── auth.ts
│   │   │   └── playground.ts
│   │   ├── App.tsx
│   │   ├── assets
│   │   │   └── logo.png
│   │   ├── components
│   │   │   ├── atoms
│   │   │   │   ├── InputField.tsx
│   │   │   │   ├── PasswordField.tsx
│   │   │   │   └── SubmitButton.tsx
│   │   │   ├── molecules
│   │   │   │   ├── EvalPlayground.tsx
│   │   │   │   └── LoginFormFields.tsx
│   │   │   ├── organisms
│   │   │   │   └── LoginForm.tsx
│   │   │   └── pages
│   │   │       ├── CodePlayground.tsx
│   │   │       ├── Header.tsx
│   │   │       └── Login.tsx
│   │   ├── constants
│   │   │   └── app.ts
│   │   ├── interfaces
│   │   │   ├── auth.ts
│   │   │   └── playground.ts
│   │   ├── main.tsx
│   │   ├── styles
│   │   │   ├── App.module.scss
│   │   │   ├── Header.module.scss
│   │   │   └── Login.module.scss
└── └── └── vite-env.d.ts

Endpoints

The backend exposes the following endpoints:

Method	Endpoint	Description
GET	/	Home endpoint
POST	/api/login	SQL Injection vulnerable login endpoint
POST	/api/secure/login	Secure login endpoint preventing SQL Injection
POST	/api/execute	eval() vulnerable code execution endpoint
POST	/api/secure/execute	Secure code execution endpoint preventing code injection

Getting Started

Prerequisites

• Node.js
• npm or yarn
• A database (PostgreSQL)

Installation

1. Clone the repository:

   git clone https://github.com/CarGDev/CodeInjectionAssigment
    cd CodeInjectionAssigment
   

2. Install backend dependencies:

   cd backend
   npm install
   

3. Install frontend dependencies:

   cd ../frontend
   npm install
   

Running the Application

1. Start the backend server:

   cd backend
   npm run dev
   

2. Start the frontend development server:

    cd ../frontend
    npm run dev
   

3. Open your browser and navigate to http://localhost:5173 to access the application.

Security Practices

The project implements the following security practices to mitigate code injection and XSS vulnerabilities:

• Parameterized Queries: All database queries use parameterized statements to prevent SQL injection attacks.
• Input Validation and Sanitization: User inputs are validated and sanitized to ensure they do not contain malicious code.
• Avoiding eval(): The playground feature is sanitized to prevent the execution of arbitrary code.