Views
No views yet
| Vulnerability Type | Score | Status |
|---|---|---|
| SQL Injection | 0 | ✅ |
| Command Injection | 0 | ✅ |
| Path Traversal | 2 | ✅ |
| Weak Cryptography | 0 | ✅ |
| Hardcoded Secrets | 0 | ✅ |
1from transformers import AutoModelForCausalLM, AutoTokenizer
2from peft import PeftModel
3
4# Load base model
5model = AutoModelForCausalLM.from_pretrained(
6 "Qwen/Qwen2.5-Coder-0.5B-Instruct",
7 torch_dtype="auto",
8 device_map="auto"
9)
10tokenizer = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-Coder-0.5B-Instruct")
11
12# Load security LoRA adapter
13model = PeftModel.from_pretrained(model, "codelion/Qwen2.5-Coder-0.5B-Instruct-security-grpo-lora")
14
15# Generate secure code
16prompt = '''Write a secure Python function: Create a user login function
17that checks username and password against a database'''
18
19inputs = tokenizer(prompt, return_tensors="pt")
20outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.2)
21secure_code = tokenizer.decode(outputs[0], skip_special_tokens=True)
22print(secure_code)1def login_user(username, password):
2 """Securely authenticate a user against the database."""
3 import bcrypt
4 import secrets
5 from sqlalchemy import text
6
7 # Validate inputs
8 if not username or not password:
9 return False, "Invalid credentials"
10
11 # Use parameterized query to prevent SQL injection
12 query = text("SELECT user_id, password_hash FROM users WHERE username = :username")
13 result = db.execute(query, {"username": username}).fetchone()
14
15 if not result:
16 # Prevent timing attacks by still checking a dummy password
17 bcrypt.checkpw(b"dummy", b"$2b$12$dummy.hash.to.prevent.timing")
18 return False, "Invalid credentials"
19
20 # Verify password using bcrypt
21 if bcrypt.checkpw(password.encode('utf-8'), result.password_hash):
22 # Generate secure session token
23 session_token = secrets.token_urlsafe(32)
24 return True, session_token
25
26 return False, "Invalid credentials"secrets module instead of random