安全编码实践：打造健壮、抵御攻击的软件系统

import sqlite3

def search_products(term):
    conn = sqlite3.connect('products.db')
    cursor = conn.cursor()

    # 使用参数化查询防止SQL注入
    cursor.execute("SELECT * FROM products WHERE name LIKE ?", ('%' + term + '%',))
    results = cursor.fetchall()

    conn.close()
    return results

from flask import Flask, escape, render_template_string
import bleach

app = Flask(__name__)

# 设置允许的HTML标签与属性
ALLOWED_TAGS = ['strong', 'em', 'a']
ALLOWED_ATTRIBUTES = {'a': ['href']}

@app.route('/')
def index():
    user_comment = request.args.get('comment', '')

    # 使用bleach库清理用户评论中的恶意HTML
    cleaned_comment = bleach.clean(user_comment, tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES)

    return render_template_string(
        """
        <div class="comment">
            {{ escaped_comment }}
        </div>
        """,
        escaped_comment=escape(cleaned_comment)
    )

from flask import Flask, jsonify, request
from flask_jwt_extended import JWTManager, jwt_required, create_access_token

app = Flask(__name__)
app.config['JWT_SECRET_KEY'] = 'your-secret-key-here'
jwt = JWTManager(app)

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username')
    password = request.json.get('password')

    # 这里假设已完成用户验证逻辑
    if valid_user_credentials(username, password):
        access_token = create_access_token(identity=username)
        return jsonify(access_token=access_token)
    else:
        return jsonify(error='Invalid credentials'), 401

@app.route('/protected', methods=['GET'])
@jwt_required()
def protected_resource():
    current_user = get_jwt_identity()  # 获取已验证用户的标识
    return jsonify(message=f'Hello, {current_user}! This is a protected resource.')

if __name__ == '__main__':
    app.run(debug=True)