# 1. SQL 注入防护 — 参数化查询
import sqlite3

# ❌ 危险：直接拼接 SQL
def unsafe_query(name):
    sql = f"SELECT * FROM users WHERE name='{name}'"
    cursor.execute(sql)

# ✅ 安全：参数化查询
def safe_query(name):
    sql = "SELECT * FROM users WHERE name=?"
    cursor.execute(sql, (name,))

# 2. 命令注入防护 — 避免 shell=True
import subprocess

# ❌ 危险
subprocess.run(f"ls {user_input}", shell=True)

# ✅ 安全：使用列表传递参数
subprocess.run(["ls", user_input], shell=False)

# 3. 路径遍历防护
import os

# ❌ 危险
path = os.path.join(base_dir, user_input)

# ✅ 安全：规范化路径并验证
safe_path = os.path.normpath(os.path.join(base_dir, user_input))
if not safe_path.startswith(os.path.normpath(base_dir)):
    raise ValueError("路径越界")

import re
from typing import Optional

class InputValidator:
    """输入验证工具类"""
    
    @staticmethod
    def validate_email(email: str) -> bool:
        """验证邮箱格式"""
        pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
        return bool(re.match(pattern, email))
    
    @staticmethod
    def validate_username(username: str) -> tuple[bool, str]:
        """验证用户名（3-20位字母数字下划线）"""
        if len(username) < 3:
            return False, "用户名至少3个字符"
        if len(username) > 20:
            return False, "用户名最多20个字符"
        if not re.match(r'^[a-zA-Z0-9_]+$', username):
            return False, "用户名只能包含字母、数字和下划线"
        return True, ""
    
    @staticmethod
    def sanitize_html(text: str) -> str:
        """HTML 转义（防 XSS）"""
        import html
        return html.escape(text)
    
    @staticmethod
    def validate_json(data: dict, required_fields: list) -> tuple[bool, str]:
        """验证 JSON 数据包含必要字段"""
        for field in required_fields:
            if field not in data:
                return False, f"缺少字段: {field}"
        return True, ""

import hashlib
import secrets
import base64

# ❌ 错误：明文存储密码
password = "my_secret_123"
store_to_db(password)  # 数据库泄露 = 所有密码泄露

# ❌ 错误：简单哈希（无盐）
hashed = hashlib.sha256(password.encode()).hexdigest()
# 彩虹表攻击可以反推

# ❌ 错误：自创哈希算法
hashed = my_custom_hash(password)

# ✅ 正确：使用专业密码哈希算法
import bcrypt

# 生成盐并哈希密码
password = "my_secret_123"
salt = bcrypt.gensalt(rounds=12)  # rounds 越高越安全，但越慢
hashed = bcrypt.hashpw(password.encode(), salt)
# 存储: hashed

# 验证密码
if bcrypt.checkpw(password.encode(), hashed):
    print("密码正确")
else:
    print("密码错误")

import hmac
import hashlib

# HMAC 用于验证消息完整性和真实性
# 需要密钥才能生成/验证

secret_key = b'my-secret-key'
message = b'important data'

# 生成 HMAC
hmac_signature = hmac.new(
    secret_key,
    message,
    hashlib.sha256
).hexdigest()

# 验证 HMAC
def verify_hmac(key, message, signature):
    expected = hmac.new(key, message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)  # 防时序攻击

# 常见用途：API 签名、Webhook 验证、JWT 签名

# 安装: pip install cryptography

# ========== AES-GCM 对称加密 ==========
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

# 加密
def encrypt_aes(key: bytes, plaintext: bytes) -> bytes:
    aesgcm = AESGCM(key)
    nonce = os.urandom(12)  # 12 字节随机 nonce
    ciphertext = aesgcm.encrypt(nonce, plaintext, None)
    return nonce + ciphertext

# 解密
def decrypt_aes(key: bytes, data: bytes) -> bytes:
    nonce = data[:12]
    ciphertext = data[12:]
    aesgcm = AESGCM(key)
    return aesgcm.decrypt(nonce, ciphertext, None)

# 生成密钥
key = AESGCM.generate_key(bit_length=256)

# 使用
encrypted = encrypt_aes(key, b"Hello, Security!")
decrypted = decrypt_aes(key, encrypted)
print(decrypted)  # b'Hello, Security!'

# ========== RSA 非对称加密 ==========
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes

# 生成密钥对
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)
public_key = private_key.public_key()

# 加密（用公钥）
ciphertext = public_key.encrypt(
    b"Secret message",
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None
    )
)

# 解密（用私钥）
plaintext = private_key.decrypt(
    ciphertext,
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None
    )
)
print(plaintext)  # b'Secret message'

import jwt
import datetime

SECRET_KEY = "your-secret-key-keep-it-safe"

def create_token(user_id: str, username: str) -> str:
    """创建 JWT Token"""
    payload = {
        "sub": user_id,
        "username": username,
        "iat": datetime.datetime.utcnow(),
        "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=24),
        "type": "access"
    }
    return jwt.encode(payload, SECRET_KEY, algorithm="HS256")

def verify_token(token: str) -> dict:
    """验证 JWT Token"""
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
        return {"valid": True, "payload": payload}
    except jwt.ExpiredSignatureError:
        return {"valid": False, "error": "Token 已过期"}
    except jwt.InvalidTokenError:
        return {"valid": False, "error": "无效 Token"}

# 使用
token = create_token("user_001", "张三")
result = verify_token(token)
print(result)  # {'valid': True, 'payload': {...}}