Skip to content

Fix critical security vulnerabilities and resource leaks#1

Open
Sunil56224972 wants to merge 2 commits into
MinhasKamal:masterfrom
Sunil56224972:master
Open

Fix critical security vulnerabilities and resource leaks#1
Sunil56224972 wants to merge 2 commits into
MinhasKamal:masterfrom
Sunil56224972:master

Conversation

@Sunil56224972

Copy link
Copy Markdown

Hello! 👋
I was reviewing the project and found a few critical bugs and vulnerabilities. I've gone ahead and fixed them in this PR.

Summary of Fixes:

  1. Directory Traversal / Arbitrary File Write (Exploit): Fixed an issue in patientRecord.py and movement.py where a user could input a crafted name (e.g., ../../../filename) to overwrite arbitrary files on the system. Filenames are now safely sanitized using regex.
  2. JSON Injection (Exploit): The __str__ methods were manually concatenating JSON strings, making the system vulnerable to JSON injection if a name contained a double quote ("). This has been refactored to safely use Python's built-in json.dumps().
  3. Missing Directory Crash (Bug): If the res/ directory did not exist, the application would hard crash with a FileNotFoundError. Added os.makedirs(..., exist_ok=True) before file operations to ensure the directory structure exists.
  4. Zombie Camera Process (Resource Leak): When the application exited or crashed abruptly, the cv2.VideoCapture was not released, leaving the webcam light on and the device locked. Wrapped the ui.mainloop() inside main.py with a try...finally block to safely .release() the camera upon exit.

Let me know if you need any changes made!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant