精选！我使用 ChatGPT 审计代码发现了 200 多个安全漏洞( GPT-4 与 GPT-3 对比报告)

from __future__ import unicode_literalsfrom flask import Flask, request, make_response, redirect, url_for, sessionfrom flask import render_template, flash, redirect, url_for, requestfrom werkzeug.security import safe_str_cmpfrom base64 import b64decode as b64dfrom base64 import b64encode as b64efrom hashlib import sha256from cStringIO import StringIOimport randomimport stringimport osimport sysimport subprocessimport commandsimport pickleimport cPickleimport marshalimport os.pathimport filecmpimport globimport linecacheimport shutilimport dircacheimport ioimport timeitimport popen2import codeimport codeopimport ptyimport posixfileSECRET_KEY = "you will never guess"if not os.path.exists(".secret"):with open(".secret", "w") as f:secret = "".join(random.choice(string.ascii_letters + string.digits)for x in range(4))f.write(secret)with open(".secret", "r") as f:cookie_secret = f.read().strip()app = Flask(__name__)app.config.from_object(__name__)black_type_list = [eval, execfile, compile, open, file, os.system, os.popen, os.popen2, os.popen3, os.popen4, os.fdopen, os.tmpfile, os.fchmod, os.fchown, os.open, os.openpty, os.read, os.pipe, os.chdir, os.fchdir, os.chroot, os.chmod, os.chown, os.link, os.lchown, os.listdir, os.lstat, os.mkfifo, os.mknod, os.access, os.mkdir, os.makedirs, os.readlink, os.remove, os.removedirs, os.rename, os.renames, os.rmdir, os.tempnam, os.tmpnam, os.unlink, os.walk, os.execl, os.execle, os.execlp, os.execv, os.execve, os.dup, os.dup2, os.execvp, os.execvpe, os.fork, os.forkpty, os.kill, os.spawnl, os.spawnle, os.spawnlp, os.spawnlpe,os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe, pickle.load, pickle.loads, cPickle.load, cPickle.loads, subprocess.call, subprocess.check_call, subprocess.check_output, subprocess.Popen, commands.getstatusoutput, commands.getoutput, commands.getstatus, glob.glob, linecache.getline, shutil.copyfileobj, shutil.copyfile, shutil.copy, shutil.copy2, shutil.move, shutil.make_archive, dircache.listdir, dircache.opendir, io.open, popen2.popen2, popen2.popen3, popen2.popen4, timeit.timeit, timeit.repeat, sys.call_tracing, code.interact, code.compile_command, codeop.compile_command, pty.spawn, posixfile.open, posixfile.fileopen]@app.before_requestdef count():session["cnt"] = 0@app.route("/")def home():remembered_str = "Hello, here\"s what we remember for you. And you can change, delete or extend it."new_str = "Hello fellow zombie, have you found a tasty brain and want to remember where? Go right here and enter it:"location = getlocation()if location == False:return redirect(url_for("clear"))return render_template("index.html", txt=remembered_str, location=location)@app.route("/clear")def clear():flash("Reminder cleared!")response = redirect(url_for("home"))response.set_cookie("location", max_age=0)return response@app.route("/reminder", methods=["POST", "GET"])def reminder():if request.method == "POST":location = request.form["reminder"]if location == "":flash("Message cleared, tell us when you have found more brains.")else:flash("We will remember where you find your brains.")location = b64e(pickle.dumps(location))cookie = make_cookie(location, cookie_secret)response = redirect(url_for("home"))response.set_cookie("location", cookie)return responselocation = getlocation()if location == False:return redirect(url_for("clear"))return render_template("reminder.html")class FilterException(Exception):def __init__(self, value):super(FilterException, self).__init__("The callable object {value} is not allowed".format(value=str(value)))class TimesException(Exception):def __init__(self):super(TimesException, self).__init__("Call func too many times!")def _hook_call(func):def wrapper(*args, **kwargs):session["cnt"] += 1print session["cnt"]print args[0].stackfor i in args[0].stack:if i in black_type_list:raise FilterException(args[0].stack[-2])if session["cnt"] >4:raise TimesException()return func(*args, **kwargs)return wrapperdef loads(strs):reload(pickle)files = StringIO(strs)unpkler = pickle.Unpickler(files)unpkler.dispatch[pickle.REDUCE] = _hook_call(unpkler.dispatch[pickle.REDUCE])return unpkler.load()def getlocation():cookie = request.cookies.get("location")if not cookie:return ""(digest, location) = cookie.split("!")if not safe_str_cmp(calc_digest(location, cookie_secret), digest):flash("Hey! This is not a valid cookie! Leave me alone.")return Falselocation = loads(b64d(location))return locationdef make_cookie(location, secret):return "%s!%s" % (calc_digest(location, secret), location)def calc_digest(location, secret):return sha256("%s%s" % (location, secret)).hexdigest()if __name__ == "__main__":app.run(host="0.0.0.0", port=5051)

$rootUname = $_GET["rootUname"];$array = array();/* check PHP Safe_Mode is off /if (ini_get("safe_mode")) {$array["phpSafeMode"] = "Fail - php safe mode is on - turn it off before you proceed with the installationbr/>";} else {$array["phpSafeMode"] = "Pass - php safe mode is off";}/ Test root account details */$rootTestCmd1 = "sudo -S -u " . $rootUname . " chmod 0777 /home 2>&1";exec($rootTestCmd1, $cmdOutput, $err);$homeDirPerms = substr(sprintf("%o", fileperms("/home")), -4);if ($homeDirPerms == "0777") {$array["rootDetails"] = "Pass - root account details are good ";} else {$array["rootDetails"] = "The root details provided have not passed: " . $cmdOutput[0] . "";}// reset /home dir permissions$rootTestCmd2 = "sudo -S -u " . $rootUname . " chmod 0755 /home 2>&1";exec($rootTestCmd2, $cmdOutput, $err);echo json_encode($array);

libxml_disable_entity_loader (false);$xmlfile = file_get_contents("php://input");$dom = new DOMDocument();$dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);$info = simplexml_import_dom($dom);$name = $info->name;$tel = $info->tel;$email = $info->email;$password = $info->password;echo "Sorry, $email is already registered!";?>

`#include ``int main(int argc, char **argv) {``printf(argv[1]);``return 0;``}`

`using Microsoft.AspNetCore.Http;``using Microsoft.AspNetCore.Mvc;``using Microsoft.Extensions.Logging;``using System;``using System.Collections.Generic;``using System.Linq;``using System.Threading.Tasks;``namespace WebFox.Controllers````[Route("api/[controller]")]``[ApiController]``public class LogInjection : ControllerBase``{``private readonly ILogger_logger;``public LogInjection(ILoggerlogger)``{``_logger = logger;``}``[HttpGet("{userInfo}")]``public void injectLog(string userInfo)``{``_logger.LogError("error!! " + userInfo);``}``}``}`

#include#include#includestruct Image{char header[4];int width;int height;char data[10];};int ProcessImage(char* filename){FILE *fp;char ch;struct Image img;fp = fopen(filename,"r"); if(fp == ){printf("
Can"t open file or file doesn"t exist.");exit(0);}printf("
	Header	width	height	data	\r
");while(fread(&img,sizeof(img),1,fp)>0){printf("
	%s	%d	%d	%s\r
",img.header,img.width,img.height,img.data);int size1 = img.width + img.height;char* buff1=(char*)malloc(size1);memcpy(buff1,img.data,sizeof(img.data));free(buff1);if (size1/2==0){free(buff1);}else{if(size1 == 123456){buff1[0]="a";}}int size2 = img.width - img.height+100;//printf("Size1:%d",size1);char* buff2=(char*)malloc(size2);memcpy(buff2,img.data,sizeof(img.data));int size3= img.width/img.height;//printf("Size2:%d",size3);char buff3[10];char* buff4 =(char*)malloc(size3);memcpy(buff4,img.data,sizeof(img.data));char OOBR_stack = buff3[size3+100];char OOBR_heap = buff4[100];buff3[size3+100]="c";buff4[100]="c";if(size3>10){buff4=0;}else{free(buff4);}free(buff2);}fclose(fp);}int main(int argc,char **argv){ProcessImage(argv[1]);}

class Utils{// Function to serialize an object and write it to a filepublic static void SerializeToFile(Object obj, String filename){try{FileOutputStream file = new FileOutputStream(filename);ObjectOutputStream out = new ObjectOutputStream(file);// Serialization of the object to fileSystem.out.println("Serializing " + obj.toString() + " to " + filename);out.writeObject(obj);out.close();file.close();}catch(Exception e){System.out.println("Exception: " + e.toString());}}// Function to deserialize an object from a filepublic static Object DeserializeFromFile(String filename){Object obj = new Object();try{FileInputStream file = new FileInputStream(filename);ObjectInputStream in = new ObjectInputStream(file);// Deserialization of the object to fileSystem.out.println("Deserializing from " + filename);obj = in.readObject();in.close();file.close();}catch(Exception e){System.out.println("Exception: " + e.toString());}return obj;}

var express = require("express");var cookieParser = require("cookie-parser");var escape = require("escape-html");var serialize = require("node-serialize");var app = express();app.use(cookieParser())app.get("/", function(req, res) {if (req.cookies.profile) {var str = new Buffer(req.cookies.profile, "base64").toString();var obj = serialize.unserialize(str);if (obj.username) {res.send("Hello " + escape(obj.username)); // <--- GPT-3 makes a mistake here}} else {res.cookie("profile", "eyJ1c2VybmFtZSI6ImFqaW4iLCJjb3VudHJ5IjoiaW5kaWEiLCJjaXR5IjoiYmFuZ2Fsb3JlIn0=", {maxAge: 900000,httpOnly: true});}res.send("Hello World");});app.listen(3000);