Skip to content

feat: Add auth utility #92

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ramonasuncion wants to merge 1 commit into from
Closed

feat: Add auth utility #92

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions pythonbridge/utils/auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
import sqlite3

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [LOW] Missing Tests: No tests are provided for the get_user and login functions. Consider adding unit tests to ensure correct functionality.



def get_user(db_path: str, username: str) -> dict:
conn = sqlite3.connect(db_path)

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [MEDIUM] Performance Issue: Database connection is opened and closed on each function call. Consider using a connection pool or a context manager to improve performance.

cursor = conn.cursor()
cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [CRITICAL] Security Vulnerability: SQL injection vulnerability in cursor.execute call. Use parameterized queries instead: cursor.execute('SELECT * FROM users WHERE username = ?', (username,))

row = cursor.fetchone()
conn.close()
return {"username": row[0], "email": row[1]} if row else {}

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [LOW] Code Style: Dictionary keys username and email are hardcoded. Consider defining them as constants or enums to improve readability.



def login(db_path: str, username: str, password: str) -> bool:
conn = sqlite3.connect(db_path)
cursor = conn.cursor()
cursor.execute(f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'")

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [CRITICAL] Security Vulnerability: SQL injection vulnerability in cursor.execute call. Use parameterized queries instead: cursor.execute('SELECT * FROM users WHERE username = ? AND password = ?', (username, password))

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 [HIGH] Security Risk: Storing passwords in plain text. Consider using a secure password hashing library like bcrypt or scrypt.

row = cursor.fetchone()
conn.close()
return row is not None

@snipercodeai snipercodeai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [LOW] Code Style: Function login returns a boolean indicating success or failure, but does not handle potential exceptions. Consider adding try-except blocks to handle potential errors.

Loading