From 7100d8567e2e24a03d9739e1a6ebb69638f52eea Mon Sep 17 00:00:00 2001 From: Fahad Date: Wed, 20 Aug 2025 15:19:11 +0400 Subject: [PATCH] Removed test files --- test_simulation_files/api_endpoints.py | 54 ----------------------- test_simulation_files/auth_manager.py | 61 -------------------------- test_simulation_files/config.json | 16 ------- test_simulation_files/test_module.py | 35 --------------- 4 files changed, 166 deletions(-) delete mode 100644 test_simulation_files/api_endpoints.py delete mode 100644 test_simulation_files/auth_manager.py delete mode 100644 test_simulation_files/config.json delete mode 100644 test_simulation_files/test_module.py diff --git a/test_simulation_files/api_endpoints.py b/test_simulation_files/api_endpoints.py deleted file mode 100644 index 519a941..0000000 --- a/test_simulation_files/api_endpoints.py +++ /dev/null @@ -1,54 +0,0 @@ -#!/usr/bin/env python3 -from flask import Flask, request, jsonify -import sqlite3 -import os - -app = Flask(__name__) - - -@app.route("/api/user/", methods=["GET"]) -def get_user(user_id): - """Get user information by ID""" - # Potential SQL injection vulnerability - conn = sqlite3.connect("users.db") - cursor = conn.cursor() - - # BUG: Direct string interpolation creates SQL injection risk - query = f"SELECT * FROM users WHERE id = {user_id}" - cursor.execute(query) - - result = cursor.fetchone() - conn.close() - - if result: - return jsonify( - { - "id": result[0], - "username": result[1], - "email": result[2], - "password_hash": result[3], # Security issue: exposing password hash - } - ) - else: - return jsonify({"error": "User not found"}), 404 - - -@app.route("/api/admin/users", methods=["GET"]) -def list_all_users(): - """Admin endpoint to list all users""" - # Missing authentication check - conn = sqlite3.connect("users.db") - cursor = conn.cursor() - cursor.execute("SELECT id, username, email FROM users") - - users = [] - for row in cursor.fetchall(): - users.append({"id": row[0], "username": row[1], "email": row[2]}) - - conn.close() - return jsonify(users) - - -if __name__ == "__main__": - # Debug mode in production is a security risk - app.run(debug=True, host="0.0.0.0") diff --git a/test_simulation_files/auth_manager.py b/test_simulation_files/auth_manager.py deleted file mode 100644 index 756a8da..0000000 --- a/test_simulation_files/auth_manager.py +++ /dev/null @@ -1,61 +0,0 @@ -#!/usr/bin/env python3 -import hashlib -import pickle -import sqlite3 - - -class AuthenticationManager: - def __init__(self, db_path="users.db"): - # A01: Broken Access Control - No proper session management - self.db_path = db_path - self.sessions = {} # In-memory session storage - - def login(self, username, password): - """User login with various security vulnerabilities""" - # A03: Injection - SQL injection vulnerability - conn = sqlite3.connect(self.db_path) - cursor = conn.cursor() - - # Direct string interpolation in SQL query - query = f"SELECT id, password_hash FROM users WHERE username = '{username}'" - cursor.execute(query) - - user = cursor.fetchone() - if not user: - return {"status": "failed", "message": "User not found"} - - # A02: Cryptographic Failures - Weak hashing algorithm - password_hash = hashlib.md5(password.encode()).hexdigest() - - if user[1] == password_hash: - # A07: Identification and Authentication Failures - Weak session generation - session_id = hashlib.md5(f"{username}{password}".encode()).hexdigest() - self.sessions[session_id] = {"user_id": user[0], "username": username} - - return {"status": "success", "session_id": session_id} - else: - return {"status": "failed", "message": "Invalid password"} - - def reset_password(self, email): - """Password reset with security issues""" - # A04: Insecure Design - No rate limiting or validation - reset_token = hashlib.md5(email.encode()).hexdigest() - - # A09: Security Logging and Monitoring Failures - No security event logging - # Simply returns token without any verification or logging - return {"reset_token": reset_token, "url": f"/reset?token={reset_token}"} - - def deserialize_user_data(self, data): - """Unsafe deserialization""" - # A08: Software and Data Integrity Failures - Insecure deserialization - return pickle.loads(data) - - def get_user_profile(self, user_id): - """Get user profile with authorization issues""" - # A01: Broken Access Control - No authorization check - conn = sqlite3.connect(self.db_path) - cursor = conn.cursor() - - # Fetches any user profile without checking permissions - cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,)) - return cursor.fetchone() diff --git a/test_simulation_files/config.json b/test_simulation_files/config.json deleted file mode 100644 index c066b27..0000000 --- a/test_simulation_files/config.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "database": { - "host": "localhost", - "port": 5432, - "name": "testdb", - "ssl": true - }, - "cache": { - "redis_url": "redis://localhost:6379", - "ttl": 3600 - }, - "logging": { - "level": "INFO", - "format": "%(asctime)s - %(name)s - %(levelname)s - %(message)s" - } -} \ No newline at end of file diff --git a/test_simulation_files/test_module.py b/test_simulation_files/test_module.py deleted file mode 100644 index b6397dc..0000000 --- a/test_simulation_files/test_module.py +++ /dev/null @@ -1,35 +0,0 @@ -""" -Sample Python module for testing MCP conversation continuity -""" - - -def fibonacci(n): - """Calculate fibonacci number recursively""" - if n <= 1: - return n - return fibonacci(n - 1) + fibonacci(n - 2) - - -def factorial(n): - """Calculate factorial iteratively""" - result = 1 - for i in range(1, n + 1): - result *= i - return result - - -class Calculator: - """Simple calculator class""" - - def __init__(self): - self.history = [] - - def add(self, a, b): - result = a + b - self.history.append(f"{a} + {b} = {result}") - return result - - def multiply(self, a, b): - result = a * b - self.history.append(f"{a} * {b} = {result}") - return result