Dự án Khách hàng của Bạn Đang Bị Xâm Phạm

1// ✅ Secure client isolation
2class SecureProjectManager {
3    constructor(clientId) {
4        this.clientId = clientId;
5        this.db = new Database(`client_${clientId}_db`);
6    }
7    
8    getClientData(projectId, requestingUser) {
9        // Verify user can access this client's data
10        if (!this.verifyClientAccess(requestingUser, this.clientId)) {
11            throw new Error('Unauthorized cross-client access attempt');
12        }
13        
14        // Client-specific database
15        return this.db.query('SELECT * FROM projects WHERE id = ? AND client_id = ?', 
16                           [projectId, this.clientId]);
17    }
18}

1// ❌ Vulnerable client data handling
2class ProjectManager {
3    constructor() {
4        // Shared database connection for all clients
5        this.db = new Database('shared_agency_db');
6    }
7    
8    getClientData(projectId) {
9        // No client isolation check
10        return this.db.query(`SELECT * FROM projects WHERE id = ${projectId}`);
11    }
12    
13    // Client A data mixed with Client B
14    deployProject(clientA_data, clientB_config) {
15        const merged = {...clientA_data, ...clientB_config};
16        return this.deploy(merged);
17    }
18}

1# ✅ Secure client-isolated deployment
2def deploy_client_project(client_id, project_name, environment_vars):
3    # Client-specific staging environment
4    staging_server = connect_to_server(f'staging-{client_id}.agency.com')
5    
6    # Verify client ownership
7    if not verify_project_ownership(client_id, project_name):
8        raise UnauthorizedError("Project doesn't belong to client")
9    
10    # Client-specific encryption keys
11    encrypted_vars = encrypt_with_client_key(client_id, environment_vars)
12    
13    # Isolated deployment
14    staging_server.deploy(project_name, encrypted_vars)

1# ❌ Vulnerable shared development
2def deploy_to_staging(project_name, environment_vars):
3    # Shared staging environment for all clients
4    staging_server = connect_to_server('shared-staging.agency.com')
5    
6    # Environment variables from all clients mixed
7    all_vars = {**environment_vars, **global_config}
8    
9    # Client secrets potentially exposed to other clients
10    staging_server.deploy(project_name, all_vars)