Injection 注入攻擊

// 危險！SQL Injection 漏洞
public async Task<User?> GetUserUnsafe(string email)
{
    // 永遠不要這樣做 — 字串拼接 SQL
    var sql = $"SELECT * FROM Users WHERE Email = '{email}'";
    // 攻擊者輸入: ' OR 1=1 --
    // 變成: SELECT * FROM Users WHERE Email = '' OR 1=1 --'
    // 結果: 回傳所有使用者
    return await _db.Users.FromSqlRaw(sql).FirstOrDefaultAsync();
}
 
// 正確！參數化查詢
public async Task<User?> GetUserSafe(string email)
{
    // 方法 1: EF Core LINQ（天然安全）
    return await _db.Users.FirstOrDefaultAsync(u => u.Email == email);
 
    // 方法 2: 參數化原生 SQL
    return await _db.Users
        .FromSqlInterpolated($"SELECT * FROM Users WHERE Email = {email}")
        .FirstOrDefaultAsync();
 
    // 方法 3: 明確的參數
    return await _db.Users
        .FromSqlRaw("SELECT * FROM Users WHERE Email = @email",
            new SqlParameter("@email", email))
        .FirstOrDefaultAsync();
}
 
// 輸入驗證 — 伺服器端
public class CreateUserDto
{
    [Required]
    [EmailAddress]
    [MaxLength(256)]
    public string Email { get; set; } = "";
 
    [Required]
    [MinLength(2)]
    [MaxLength(100)]
    [RegularExpression(@"^[\p{L}\s'-]+$")] // 只允許字母、空格、連字號
    public string Name { get; set; } = "";
}

// 危險！SQL Injection
app.get("/users", async (req, res) => {
  // 永遠不要這樣做
  const query = `SELECT * FROM users WHERE email = '${req.query.email}'`;
  const result = await db.query(query); // 危險！
});
 
// 正確！參數化查詢
app.get("/users", async (req, res) => {
  // PostgreSQL — $1 佔位符
  const result = await db.query(
    "SELECT * FROM users WHERE email = $1",
    [req.query.email]
  );
  res.json(result.rows);
});
 
// Prisma ORM（天然安全）
app.get("/users", async (req, res) => {
  const user = await prisma.user.findUnique({
    where: { email: req.query.email as string },
  });
  res.json(user);
});
 
// NoSQL Injection 防禦 — MongoDB
app.post("/login", async (req, res) => {
  // 危險！攻擊者可以傳 { "email": {"$gt": ""}, "password": {"$gt": ""} }
  // const user = await User.findOne(req.body);
 
  // 正確！確保輸入是字串
  const email = String(req.body.email);
  const password = String(req.body.password);
  const user = await User.findOne({ email });
  if (!user || !await bcrypt.compare(password, user.passwordHash)) {
    return res.status(401).json({ error: "Invalid credentials" });
  }
});
 
// 輸入驗證 — Zod
import { z } from "zod";
 
const CreateUserSchema = z.object({
  email: z.string().email().max(256),
  name: z.string().min(2).max(100).regex(/^[\p{L}\s'-]+$/u),
});
 
app.post("/users", async (req, res) => {
  const parsed = CreateUserSchema.safeParse(req.body);
  if (!parsed.success) return res.status(400).json({ errors: parsed.error.issues });
  // parsed.data 已經驗證過，安全使用
});

# 危險！SQL Injection
@app.get("/users")
async def get_user_unsafe(email: str):
    # 永遠不要這樣做
    query = f"SELECT * FROM users WHERE email = '{email}'"
    return await db.execute(query)
 
# 正確！參數化查詢
@app.get("/users")
async def get_user_safe(email: str):
    query = "SELECT * FROM users WHERE email = :email"
    return await db.execute(query, {"email": email})
 
# SQLAlchemy ORM（天然安全）
@app.get("/users")
async def get_user_orm(email: str):
    return await db.query(User).filter(User.email == email).first()
 
# Command Injection 防禦
import subprocess
import shlex
 
# 危險！
# os.system(f"convert {filename} output.png")  # 攻擊者可注入命令
 
# 正確！用 list 傳參數，不經過 shell
def convert_image(filename: str):
    # 先驗證檔名
    if not filename.replace(".", "").replace("-", "").replace("_", "").isalnum():
        raise ValueError("Invalid filename")
 
    subprocess.run(
        ["convert", filename, "output.png"],
        check=True,
        shell=False,  # 關鍵：不用 shell
    )
 
# 輸入驗證 — Pydantic
from pydantic import BaseModel, EmailStr, constr
 
class CreateUserDto(BaseModel):
    email: EmailStr
    name: constr(min_length=2, max_length=100, pattern=r"^[\w\s'-]+$")