Add ping and user endpoints

[eduardoconviso]

New Flask endpoints for host ping and user lookup.

Note: intentionally vulnerable (command + SQL injection) for AST PR-scan testing.

[conviso-platform-appsec-staging]

🛡️ Conviso Application Security Scan Results

Summary: 0 Critical | 7 High | 2 Medium | 1 Low

---

🔴 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Severity: High | File: app.py:12

Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.

host = request.args.get("host")
    # command injection: unsanitized user input into shell
    os.system("ping -c 1 " + host)

---

🔴 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Severity: High | File: app.py:14

User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.

os.system("ping -c 1 " + host)

---

🔴 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Severity: High | File: app.py:20

User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use Entry.objects.filter(date=2006).

uid = request.args.get("id")
    conn = sqlite3.connect("app.db")
    # SQL injection: string-formatted query
    query = "SELECT * FROM users WHERE id = '%s'" % uid
    return str(conn.execute(query).fetchall())

---

🔴 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Severity: High | File: app.py:24

Detected possible formatted SQL query. Use parameterized queries instead.

return str(conn.execute(query).fetchall())

---

🟠 Incorrect Type Conversion or Cast

Severity: Medium | File: app.py:23

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.

query = "SELECT * FROM users WHERE id = '%s'" % uid

---

...and 1 more issues.
See the full report in the Conviso Platform.