**Course Title:** Security Best Practices in Software Development **Section Title:** Secure Coding Practices **Topic:** Refactor code to implement secure coding practices.(Lab topic) **Objective:** By the end of this lab exercise, students will be able to refactor code to implement secure coding practices, identify and mitigate security vulnerabilities, and apply best practices for secure software development. **Lab Overview:** In this lab exercise, students will work with a given codebase that contains security vulnerabilities. They will refactor the code to implement secure coding practices, apply input validation and sanitization techniques, and handle errors securely. The lab will cover the following topics: 1. Code Review and Identification of Security Vulnerabilities 2. Refactoring Code to Implement Secure Coding Practices 3. Input Validation and Sanitization Technqiues 4. Secure Error Handling **Lab Environment:** * Operating System: Ubuntu 20.04 LTS * Programming Language: Python 3.9 * IDE: PyCharm Community Edition * Database: MySQL 8.0 **Lab Exercise:** The given codebase is a simple web application written in Python using the Flask framework. The application allows users to register, login, and view their profile information. However, the codebase contains several security vulnerabilities, including: * Insecure password storage * Lack of input validation and sanitization * Insecure error handling Students will refactor the code to implement secure coding practices, including: * Secure password storage using bcrypt * Input validation and sanitization using Flask-WTF * Secure error handling using try-except blocks **Step 1: Review the Existing Codebase** Review the existing codebase and identify the security vulnerabilities. * Identify insecure password storage in `models.py` and `authentication.py`. * Identify lack of input validation and sanitization in `forms.py` and `views.py`. * Identify insecure error handling in `views.py`. **Step 2: Refactor the Code to Implement Secure Coding Practices** Refactor the code to implement secure coding practices. * Implement secure password storage using bcrypt in `models.py` and `authentication.py`. * Implement input validation and sanitization using Flask-WTF in `forms.py` and `views.py`. * Implement secure error handling using try-except blocks in `views.py`. **Example Code:** Before (Insecure Password Storage): ```python from werkzeug.security import generate_password_hash class User(db.Model): # ... def set_password(self, password): self.password = generate_password_hash(password) ``` After (Secure Password Storage): ```python from flask_bcrypt import Bcrypt bcrypt = Bcrypt(app) class User(db.Model): # ... def set_password(self, password): self.password = bcrypt.generate_password_hash(password).decode('utf-8') ``` Before (Lack of Input Validation and Sanitization): ```python from flask import request, jsonify class ProfileForm(FlaskForm): name = StringField('Name') email = StringField('Email') # ... @app.route('/profile', methods=['POST']) def update_profile(): form = ProfileForm() if form.validate_on_submit(): # ... return jsonify({'message': 'Profile updated successfully'}) return jsonify({'message': 'Invalid form data'}), 400 ``` After (Input Validation and Sanitization): ```python from flask_wtf import FlaskForm from wtforms import StringField, EmailField, validators class ProfileForm(FlaskForm): name = StringField('Name', [validators.DataRequired(), validators.Length(min=2, max=50)]) email = EmailField('Email', [validators.DataRequired(), validators.Email()]) # ... @app.route('/profile', methods=['POST']) def update_profile(): form = ProfileForm() if form.validate_on_submit(): # ... return jsonify({'message': 'Profile updated successfully'}) return jsonify({'message': 'Invalid form data'}), 400 ``` Before (Insecure Error Handling): ```python try: # ... except Exception as e: return jsonify({'message': str(e)}), 500 ``` After (Secure Error Handling): ```python try: # ... except Exception as e: app.logger.error(e) return jsonify({'message': 'Internal server error'}), 500 ``` **Conclusion:** In this lab exercise, students refactored a given codebase to implement secure coding practices, including secure password storage, input validation and sanitization, and secure error handling. By applying these best practices, students can develop secure software applications that protect user data and prevent security breaches. **Additional Resources:** * OWASP Secure Coding Practices: <https://owasp.org/www-project-secure-coding-practices/> * Flask Security: <https://flask.palletsprojects.com/en/2.0.x/security/> * PyJWT (JSON Web Tokens): <https://pyjwt.readthedocs.io/en/stable/> **Please ask for help if you need it.**