Fix XSS by applying context-aware encoding

passman-dev/Caddyfile

@@ -1,19 +0,0 @@
-# HTTP site: redirect everything to HTTPS
-http://localhost {
-    redir https://{host}{uri} permanent
-}
-
-# HTTPS site
-https://localhost {
-    reverse_proxy web:80
-    tls internal
-
-    # Optional: security headers (defense-in-depth)
-    header {
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "DENY"
-        Referrer-Policy "no-referrer"
-    }
-}
-
-

passman-dev/db/init/01-create-pwd_mgr-db-withData.sql

@@ -22,12 +22,6 @@ CREATE TABLE IF NOT EXISTS `dummy` (
   `id` int(11) DEFAULT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
--- Create a dedicated DB user for the web application (least privilege).
--- Grant only the required privileges on the application database.
-CREATE USER IF NOT EXISTS 'passman_app'@'%' IDENTIFIED BY 'passman_app_pw';
-GRANT SELECT, INSERT, UPDATE, DELETE ON pwd_mgr.* TO 'passman_app'@'%';
-FLUSH PRIVILEGES;
-
 CREATE TABLE IF NOT EXISTS `login_users` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `username` varchar(20) NOT NULL,
@@ -37,7 +31,7 @@ CREATE TABLE IF NOT EXISTS `login_users` (
 ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 INSERT INTO `login_users` (`id`, `username`, `password`) VALUES
-	(1, 'u1', '$2y$10$L18u5/PyVkDgsce/DsUOQu0sKhTzh854Euhog3cVb1W4YAfgRzY8W'); -- php -r 'echo password_hash("p1", PASSWORD_DEFAULT), PHP_EOL;'
+	(1, 'u1', 'p1');
 
 CREATE TABLE IF NOT EXISTS `notes` (
   `notesid` int(11) NOT NULL AUTO_INCREMENT,

passman-dev/docker-compose.yml

@@ -2,30 +2,18 @@
 services:
   web:
     build: .
-    # ports:
-    #   - "80:80"
+    ports:
+      - "80:80"
     volumes:
       - ./php:/var/www/html
     environment:
       DB_HOST: db
+      DB_USER: root
+      DB_PASS: rootpass
       DB_NAME: pwd_mgr
-      DB_USER: passman_app
-      DB_PASS: passman_app_pw
     depends_on:
       - db
 
-  proxy:
-    image: caddy:2
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - caddy_data:/data
-      - caddy_config:/config
-    depends_on:
-      - web
-
   db:
     image: mariadb:11
     container_name: passman_db
@@ -42,6 +30,4 @@ services:
 
 volumes:
   dbdata:
-  caddy_data:
-  caddy_config:
 

passman-dev/php/passman/config.php

@@ -3,8 +3,8 @@
 // NOTE: In Docker, the DB host is the service name (e.g., "db"), not "localhost".
 
 $DB_HOST = getenv('DB_HOST') ?: 'db';
-$DB_USER = getenv('DB_USER') ?: 'passman_app';
-$DB_PASS = getenv('DB_PASS') ?: 'passman_app_pw';
+$DB_USER = getenv('DB_USER') ?: 'root';
+$DB_PASS = getenv('DB_PASS') ?: 'rootpass';
 $DB_NAME = getenv('DB_NAME') ?: 'pwd_mgr';
 
 // Create a DB connection.

passman-dev/php/passman/dashboard.php

@@ -26,23 +26,12 @@ if(isset($_POST['new_website'], $_POST['new_username'], $_POST['new_password'])
 	$new_username = trim($_POST["new_username"]);
 	$new_password = trim($_POST["new_password"]);
 
-	// Insert new web site using a prepared statement to prevent SQL injection.
-	$sql_query = "INSERT INTO websites (login_user_id, web_url, web_username, web_password) VALUES " .
-				"((SELECT id FROM login_users WHERE username = ?), ?, ?, ?)";
-
-	$stmt = $conn->prepare($sql_query);
-	if ($stmt === false) {
-		$conn->close();
-		die("Prepare failed.");
-	}
-
-	$stmt->bind_param("ssss", $username, $new_website, $new_username, $new_password);
+	// Insert new web site
+	$sql_query = "INSERT INTO websites (login_user_id,web_url,web_username,web_password) VALUES " .
+				"((SELECT id FROM login_users WHERE username='{$username}'),'{$new_website}','{$new_username}','{$new_password}');";
 	//echo $sql_query;
-
-	$result = $stmt->execute();
-	$stmt->close();
-	$conn->close();
-
+	$result = $conn->query($sql_query);
+	$conn -> close();
 
 	// After processing, redirect to the same page to clear the form
 	unset($_POST['new_website']);
@@ -56,25 +45,11 @@ if(isset($_POST['new_website'], $_POST['new_username'], $_POST['new_password'])
 if(isset($_POST['delete_website']) && trim($_POST["websiteid"] != '')) {
 	$webid = trim($_POST["websiteid"]);
 
-	// Cast to int to avoid unexpected input and use a prepared statement to prevent SQL injection.
-	$webid = (int)trim($_POST["websiteid"]);
-
 	// Delete selected web site
-	$sql_query = "DELETE FROM websites WHERE webid = ?";
-
-	$stmt = $conn->prepare($sql_query);
-	if ($stmt === false) {
-		$conn->close();
-		die("Prepare failed.");
-	}
-
-	$stmt->bind_param("i", $webid);
+	$sql_query = "DELETE FROM websites WHERE webid='{$webid}';";
 	//echo $sql_query;
-
-	$result = $stmt->execute();
-	$stmt->close();
-	$conn->close();
-
+	$result = $conn->query($sql_query);
+	$conn -> close();
 
 	// After processing, redirect to the same page to clear the form
 	unset($_POST['websiteid']);
@@ -82,40 +57,22 @@ if(isset($_POST['delete_website']) && trim($_POST["websiteid"] != '')) {
 	exit();
 }
 
-// Display list of user's web sites using a prepared statement to prevent SQL injection.
-$sql_query = "SELECT * FROM websites INNER JOIN login_users ON websites.login_user_id=login_users.id WHERE login_users.username = ?";
+// Display list of user's web sites
+$sql_query = "SELECT * FROM websites INNER JOIN login_users ON websites.login_user_id=login_users.id WHERE login_users.username='{$username}';";
 //echo $sql_query;
-
-$stmt = $conn->prepare($sql_query);
-if ($stmt === false) {
-    $conn->close();
-    die("Prepare failed.");
-}
-
-$stmt->bind_param("s", $username);
-$stmt->execute();
-$result = $stmt->get_result();
-$stmt->close();
-
+$result = $conn->query($sql_query);
 
 //echo htmlspecialchars($username);
-$safe_username = htmlspecialchars($username, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
-echo "<h3>Entries of " . $safe_username . "</h3>";
+echo "<h3>Entries of " . $username . "</h3>";
 
 if (!empty($result) && $result->num_rows >= 1) {
 	while ($row = $result -> fetch_assoc()) {
-		// Escape output to prevent stored XSS (DB content must be treated as untrusted).
-		$safe_url  = htmlspecialchars($row["web_url"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
-		$safe_user = htmlspecialchars($row["web_username"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
-		$safe_pass = htmlspecialchars($row["web_password"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
-		$webid_safe = (int)$row["webid"];
-
 		echo "<table border=0>";
-		echo	"<tr style='background-color: #f4f4f4;'><td colspan=2>" . $safe_url . "</td></tr>" . 
-				"<tr><td>Username: " . $safe_user . "</td><td>Password: " . $safe_pass  . "</td></tr>";
+		echo	"<tr style='background-color: #f4f4f4;'><td colspan=2>" . $row["web_url"] . "</td></tr>" . 
+				"<tr><td>Username: " . $row["web_username"] . "</td><td>Password: " . $row["web_password"] . "</td></tr>";
 
 		echo	"<tr><td><form method='POST' style='height: 3px'>" . 
-				"<input type='hidden' name='websiteid' value='" . $webid_safe . "'>" .
+				"<input type='hidden' name='websiteid' value='" . $row["webid"] . "'>" .
 				"<button type='submit' name='delete_website'>Delete</button></form></td></tr>";
 
 		echo	"<tr><td colspan=2 style=height: 20px;></td></tr>";

passman-dev/php/passman/index.html

@@ -15,23 +15,23 @@
 	<br />
 	<ul>
 		<li>
-			<a href="/passman/register.php">Registration Form</a>
+			<a href="http://localhost/passman/register.php">Registration Form</a>
 		</li>
 		<br />
 		<li>
-			<a href="/passman/login.php">Login Page</a>
+			<a href="http://localhost/passman/login.php">Login Page</a>
 		</li>
 		<br />
 		<li>
-			<a href="/passman/logout.php">Logout Page</a>
+			<a href="http://localhost/passman/logout.php">Logout Page</a>
 		</li>
 		<br />
 		<li>
-			<a href="/passman/dashboard.php">Dashboard</a> (display passwords for websites)
+			<a href="http://localhost/passman/dashboard.php">Dashboard</a> (display passwords for websites)
 		</li>
 		<br />
 		<li>
-			<a href="/passman/notes.php">Notes</a> (notes/comments/announcements)
+			<a href="http://localhost/passman/notes.php">Notes</a> (notes/comments/announcements)
 		</li>
 		<br />
 	</ul>
@@ -41,18 +41,18 @@
 	<br />
 	<ul>
 		<li>
-			Test <a href="/passman/test_hash.php">hashing</a> functions in PHP (server side)
+			Test <a href="http://localhost/passman/test_hash.php">hashing</a> functions in PHP (server side)
 		</li>
 		<br />
 		<li>
-			Test <a href="/passman/test_encrypt.php">encrypting/decrypting</a> functions in PHP (server side)
+			Test <a href="http://localhost/passman/test_encrypt.php">encrypting/decrypting</a> functions in PHP (server side)
 		</li>
 		<br />
 	</ul>
 
 	<br />
 	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Hacker's side (for using stealing cookies using XSS):
-	<a href="/passman/xss">passman/xss</a>
+	<a href="http://localhost/passman/xss">http://localhost/passman/xss</a>
 	<br />
 
 </body>

passman-dev/php/passman/login.php

@@ -26,51 +26,46 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
 		// }
 		require_once __DIR__ . "/config.php";
 
-		// Authentication with hashed passwords:
-		// 1) Fetch the stored hash by username
-		// 		SQL injection mitigation: use a prepared statement with bound parameters.
-		// 		User input is treated strictly as data, not as part of the SQL syntax.
-		// 2) Verify the submitted password with password_verify()
-		$stmt = $conn->prepare("SELECT id, password FROM login_users WHERE username = ?");
+		// SQL injection mitigation: use a prepared statement with bound parameters.
+		// User input is treated strictly as data, not as part of the SQL syntax.
+		$stmt = $conn->prepare("SELECT id FROM login_users WHERE username = ? AND password = ?");
+
 		if ($stmt === false) {
 			// Fail closed (do not leak details in production).
 			die("Prepare failed.");
 		}
 
-		$stmt->bind_param("s", $username);
+		$stmt->bind_param("ss", $username, $password);
 		$stmt->execute();
-
-		$result = $stmt->get_result();  // Requires mysqlnd (usually enabled)
+		$stmt->store_result();   // Needed to use $stmt->num_rows
 		unset($_POST['username']);
 		unset($_POST['password']);
 
-		if ($result && $result->num_rows === 1) {
-			$row = $result->fetch_assoc();
-			$stored_hash = $row["password"];
+		if ($stmt->num_rows >= 1) {
+			// Regenerate session ID to prevent session fixation!
+			//session_regenerate_id(true);
 
-			// Verify password against the stored hash.
-			if (password_verify($password, $stored_hash)) {
-				// Regenerate session ID to prevent session fixation!
-				//session_regenerate_id(true);
+			// Successfully logged in
+			$_SESSION['username'] = $username;
+			$_SESSION['loggedin'] = true;
 
-				// Successfully logged in
-				$_SESSION['username'] = $username;
-				$_SESSION['loggedin'] = true;
+			//while ($row = $result -> fetch_assoc()) {
+			//	print_r($row);
+			//	$_SESSION['user_id'] = $row['id'];
+			//}
 
-				$stmt->close();
-				$conn->close();
+			// Close
+			$stmt->close();
+			$conn -> close();
 
-				header("Location: dashboard.php");
-				exit;
-			} else {
-				$login_message = "Invalid username or password";
-			}
+			// Redirect to a dashboard page
+			header("Location: dashboard.php");
+			exit;
 		} else {
 			$login_message = "Invalid username or password";
 		}
-
 		$stmt->close();
-		$conn->close();
+		$conn -> close();
 	}
 }
 ?>

passman-dev/php/passman/notes.php

@@ -50,24 +50,13 @@ if(isset($_POST['new_note']) && trim($_POST['new_note']) !='') {
 	//$sql_query = "INSERT INTO notes (login_user_id,note) VALUES " .
 	//			 "((SELECT id FROM login_users WHERE username='{$username}'),('{$new_note}'));";
 
-    // Insert new note using a prepared statement to prevent SQL injection.
-    $sql_query = "INSERT INTO notes (login_user_id, note) ".
-                "VALUES ((SELECT id FROM login_users WHERE username = ?), ?)";
+	$sql_query = "INSERT INTO notes (login_user_id, note) ".
+				 "VALUES ((SELECT id FROM login_users WHERE username='{$username}'), '{$new_note}')";
 
-    $stmt = $conn->prepare($sql_query);
-    if ($stmt === false) {
-        // Fail closed (do not leak DB details).
-        $conn->close();
-        die("Prepare failed.");
-    }
-
-    $stmt->bind_param("ss", $username, $new_note);
-    //echo $sql_query;
-
-    $result = $stmt->execute();
-    $stmt->close();
-    $conn->close();
+	//echo $sql_query;
 	
+	$result = $conn->query($sql_query);
+	$conn -> close();
 
 	// After processing, redirect to the same page to clear the form
 	unset($_POST['new_note']);

passman-dev/php/passman/register.php

@@ -29,28 +29,11 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
 		//}
 		require_once __DIR__ . "/config.php";
 
-		// Insert a new user using a prepared statement to prevent SQL injection.
-		$sql_query = "INSERT INTO login_users (username, password) VALUES (?, ?)";
-
-		$stmt = $conn->prepare($sql_query);
-		if ($stmt === false) {
-			$login_message = "Database error (prepare failed).";
-			$result = false;
-		} else {
-			// Hash the password before storing it.
-			// Never store login passwords in plaintext.
-			$password_hash = password_hash($new_password, PASSWORD_DEFAULT);
-			if ($password_hash === false) {
-				$login_message = "Password hashing failed.";
-				$result = false;
-			} else {
-				// Store the hash (not the plaintext password).
-				$stmt->bind_param("ss", $new_username, $password_hash);
-				$result = $stmt->execute();
-			}
-			$stmt->close();
-		}
+		// Insert a new user
+		$sql_query = "INSERT INTO login_users (username,password) VALUES ('{$new_username}','{$new_password}');";
+		//echo $sql_query;
 
+		$result = $conn->query($sql_query);
 
 		unset($_POST['new_username']);
 		unset($_POST['new_password']);