We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Overly permissive Database privileges for “securedrop” user
The privileges given the MySQL user accessing the SecureDrop database
are overly permissive and allow an attacker after a successful SQL
injection attack to escalate privileges:

Example: https://github.com/freedomofpress/securedrop/search?q=
GRANT+ALL+PRIVILEGES&ref=cmdform

```
echo "Setting up MySQL database..."
mysql -u root -p"$mysql_root" -e "create database securedrop; GRANT ALL
PRIVILEGES ON securedrop.* TO 'securedrop'@'localhost' IDENTIFIED BY
'$mysql_securedrop';"
```

It should be made sure that the user is only applied with privileges
that are actually needed. In case an attacker manages to spot a SQL
injection vulnerability, the user with an unlimited set of permissions
would be capable of compromising the machine via FILE and other SQL
features (depending on the MySQL version). From what can be seen from
the application’s logic, the database user essentially needs read-write
access to one particular database - and not “GRANT ALL PRIVILEGES”.

Reported as part of the cure53 audit of 0.2 as: SD-01-003


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `install_files/source.config.py`
Content:
```
1 import os
2 
3 class BaseConfig(object):
4     DEBUG = False
5     TESTING = False
6     SECRET_KEY='SECRET_KEY_VALUE'
7 
8 class ProductionConfig(BaseConfig):
9     pass
10 
11 class DevelopmentConfig(BaseConfig):
12     DEBUG = True
13 
14 class TestingConfig(BaseConfig):
15     TESTING = True
16     # Tests are simpler if CSRF protection is disabled
17     WTF_CSRF_ENABLED = False
18 
19 # data directories - should be on secure media
20 STORE_DIR='/var/www/securedrop/store'
21 GPG_KEY_DIR='/var/www/securedrop/keys'
22 
23 # fingerprint of the GPG key to encrypt submissions to
24 JOURNALIST_KEY='APP_GPG_KEY_FINGERPRINT'
25 
26 SOURCE_TEMPLATES_DIR='/var/www/securedrop/source_templates'
27 JOURNALIST_TEMPLATES_DIR='/var/www/securedrop/journalist_templates'
28 WORD_LIST='/var/www/securedrop/wordlist'
29 
30 NOUNS='/var/www/securedrop/dictionaries/nouns.txt'
31 ADJECTIVES='/var/www/securedrop/dictionaries/adjectives.txt'
32 BCRYPT_ID_SALT='BCRYPT_ID_SALT_VALUE'
33 BCRYPT_GPG_SALT='BCRYPT_GPG_SALT_VALUE'
34 # Default to the production configuration
35 FlaskConfig = ProductionConfig
36 
37 if os.environ.get('SECUREDROP_ENV') == 'test':
38     FlaskConfig = TestingConfig
39     TEST_DIR='/tmp/securedrop_test'
40     STORE_DIR=os.path.join(TEST_DIR, 'store')
41     GPG_KEY_DIR=os.path.join(TEST_DIR, 'keys')
42     # test_journalist_key.pub
43     JOURNALIST_KEY='65A1B5FF195B56353CC63DFFCC40EF1228271441'
44 
45 # Database Configuration
46 
47 # Default to using a sqlite database file for development
48 #DATABASE_ENGINE = 'sqlite'
49 #DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
50 
51 # Uncomment to use mysql (or any other databaes backend supported by
52 # SQLAlchemy). Make sure you have the necessary dependencies installed, and run
53 # `python -c "import db; db.create_tables()"` to initialize the database
54 
55 DATABASE_ENGINE = 'mysql'
56 DATABASE_HOST = 'localhost'
57 DATABASE_NAME = 'securedrop'
58 DATABASE_USERNAME = 'securedrop'
59 DATABASE_PASSWORD = ''
60
```

Path: `install_files/document.config.py`
Content:
```
1 import os
2 
3 class BaseConfig(object):
4     DEBUG = False
5     TESTING = False
6     SECRET_KEY='SECRET_KEY_VALUE'
7 
8 class ProductionConfig(BaseConfig):
9     pass
10 
11 class DevelopmentConfig(BaseConfig):
12     DEBUG = True
13 
14 class TestingConfig(BaseConfig):
15     TESTING = True
16     # Tests are simpler if CSRF protection is disabled
17     WTF_CSRF_ENABLED = False
18 
19 # data directories - should be on secure media
20 STORE_DIR='/var/www/securedrop/store'
21 GPG_KEY_DIR='/var/www/securedrop/keys'
22 
23 # fingerprint of the GPG key to encrypt submissions to
24 JOURNALIST_KEY='APP_GPG_KEY_FINGERPRINT'
25 
26 SOURCE_TEMPLATES_DIR='/var/www/securedrop/source_templates'
27 JOURNALIST_TEMPLATES_DIR='/var/www/securedrop/journalist_templates'
28 WORD_LIST='/var/www/securedrop/wordlist'
29 NOUNS='/var/www/securedrop/dictionaries/nouns.txt'
30 ADJECTIVES='/var/www/securedrop/dictionaries/adjectives.txt'
31 BCRYPT_ID_SALT='BCRYPT_ID_SALT_VALUE'
32 BCRYPT_GPG_SALT='BCRYPT_GPG_SALT_VALUE'
33 
34 # Default to the production configuration
35 FlaskConfig = ProductionConfig
36 SECUREDROP_ROOT=os.path.abspath('/var/www/securedrop') 
37 
38 if os.environ.get('SECUREDROP_ENV') == 'test':
39     FlaskConfig = TestingConfig
40     TEST_DIR='/tmp/securedrop_test'
41     STORE_DIR=os.path.join(TEST_DIR, 'store')
42     GPG_KEY_DIR=os.path.join(TEST_DIR, 'keys')
43     # test_journalist_key.pub
44     JOURNALIST_KEY='65A1B5FF195B56353CC63DFFCC40EF1228271441'
45 
46 # Database Configuration
47 
48 # Default to using a sqlite database file for development
49 #DATABASE_ENGINE = 'sqlite'
50 #DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
51 
52 # Uncomment to use mysql (or any other databaes backend supported by
53 # SQLAlchemy). Make sure you have the necessary dependencies installed, and run
54 # `python -c "import db; db.create_tables()"` to initialize the database
55 
56 DATABASE_ENGINE = 'mysql'
57 DATABASE_HOST = 'localhost'
58 DATABASE_NAME = 'securedrop'
59 DATABASE_USERNAME = 'document_mysql'
60 DATABASE_PASSWORD = 'MYSQL_USER_PASS'
61
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/install_files/document.config.py b/install_files/document.config.py
--- a/install_files/document.config.py
+++ b/install_files/document.config.py
@@ -46,15 +46,15 @@
 # Database Configuration
 
 # Default to using a sqlite database file for development
-#DATABASE_ENGINE = 'sqlite'
-#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
+DATABASE_ENGINE = 'sqlite'
+DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
 
 # Uncomment to use mysql (or any other databaes backend supported by
 # SQLAlchemy). Make sure you have the necessary dependencies installed, and run
 # `python -c "import db; db.create_tables()"` to initialize the database
 
-DATABASE_ENGINE = 'mysql'
-DATABASE_HOST = 'localhost'
-DATABASE_NAME = 'securedrop'
-DATABASE_USERNAME = 'document_mysql'
-DATABASE_PASSWORD = 'MYSQL_USER_PASS'
+#DATABASE_ENGINE = 'mysql'
+#DATABASE_HOST = 'localhost'
+#DATABASE_NAME = 'securedrop'
+#DATABASE_USERNAME = 'document_mysql'
+#DATABASE_PASSWORD = 'MYSQL_USER_PASS'
diff --git a/install_files/source.config.py b/install_files/source.config.py
--- a/install_files/source.config.py
+++ b/install_files/source.config.py
@@ -45,15 +45,16 @@
 # Database Configuration
 
 # Default to using a sqlite database file for development
-#DATABASE_ENGINE = 'sqlite'
-#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
+DATABASE_ENGINE = 'sqlite'
+SECUREDROP_ROOT=os.path.abspath('/var/www/securedrop')
+DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')
 
 # Uncomment to use mysql (or any other databaes backend supported by
 # SQLAlchemy). Make sure you have the necessary dependencies installed, and run
 # `python -c "import db; db.create_tables()"` to initialize the database
 
-DATABASE_ENGINE = 'mysql'
-DATABASE_HOST = 'localhost'
-DATABASE_NAME = 'securedrop'
-DATABASE_USERNAME = 'securedrop'
-DATABASE_PASSWORD = ''
+#DATABASE_ENGINE = 'mysql'
+#DATABASE_HOST = 'localhost'
+#DATABASE_NAME = 'securedrop'
+#DATABASE_USERNAME = 'securedrop'
+#DATABASE_PASSWORD = ''

{"golden_diff": "diff --git a/install_files/document.config.py b/install_files/document.config.py\n--- a/install_files/document.config.py\n+++ b/install_files/document.config.py\n@@ -46,15 +46,15 @@\n # Database Configuration\n \n # Default to using a sqlite database file for development\n-#DATABASE_ENGINE = 'sqlite'\n-#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n+DATABASE_ENGINE = 'sqlite'\n+DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n \n # Uncomment to use mysql (or any other databaes backend supported by\n # SQLAlchemy). Make sure you have the necessary dependencies installed, and run\n # `python -c \"import db; db.create_tables()\"` to initialize the database\n \n-DATABASE_ENGINE = 'mysql'\n-DATABASE_HOST = 'localhost'\n-DATABASE_NAME = 'securedrop'\n-DATABASE_USERNAME = 'document_mysql'\n-DATABASE_PASSWORD = 'MYSQL_USER_PASS'\n+#DATABASE_ENGINE = 'mysql'\n+#DATABASE_HOST = 'localhost'\n+#DATABASE_NAME = 'securedrop'\n+#DATABASE_USERNAME = 'document_mysql'\n+#DATABASE_PASSWORD = 'MYSQL_USER_PASS'\ndiff --git a/install_files/source.config.py b/install_files/source.config.py\n--- a/install_files/source.config.py\n+++ b/install_files/source.config.py\n@@ -45,15 +45,16 @@\n # Database Configuration\n \n # Default to using a sqlite database file for development\n-#DATABASE_ENGINE = 'sqlite'\n-#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n+DATABASE_ENGINE = 'sqlite'\n+SECUREDROP_ROOT=os.path.abspath('/var/www/securedrop')\n+DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n \n # Uncomment to use mysql (or any other databaes backend supported by\n # SQLAlchemy). Make sure you have the necessary dependencies installed, and run\n # `python -c \"import db; db.create_tables()\"` to initialize the database\n \n-DATABASE_ENGINE = 'mysql'\n-DATABASE_HOST = 'localhost'\n-DATABASE_NAME = 'securedrop'\n-DATABASE_USERNAME = 'securedrop'\n-DATABASE_PASSWORD = ''\n+#DATABASE_ENGINE = 'mysql'\n+#DATABASE_HOST = 'localhost'\n+#DATABASE_NAME = 'securedrop'\n+#DATABASE_USERNAME = 'securedrop'\n+#DATABASE_PASSWORD = ''\n", "issue": "Overly permissive Database privileges for \u201csecuredrop\u201d user\nThe privileges given the MySQL user accessing the SecureDrop database\nare overly permissive and allow an attacker after a successful SQL\ninjection attack to escalate privileges:\n\nExample: https://github.com/freedomofpress/securedrop/search?q=\nGRANT+ALL+PRIVILEGES&ref=cmdform\n\n```\necho \"Setting up MySQL database...\"\nmysql -u root -p\"$mysql_root\" -e \"create database securedrop; GRANT ALL\nPRIVILEGES ON securedrop.* TO 'securedrop'@'localhost' IDENTIFIED BY\n'$mysql_securedrop';\"\n```\n\nIt should be made sure that the user is only applied with privileges\nthat are actually needed. In case an attacker manages to spot a SQL\ninjection vulnerability, the user with an unlimited set of permissions\nwould be capable of compromising the machine via FILE and other SQL\nfeatures (depending on the MySQL version). From what can be seen from\nthe application\u2019s logic, the database user essentially needs read-write\naccess to one particular database - and not \u201cGRANT ALL PRIVILEGES\u201d.\n\nReported as part of the cure53 audit of 0.2 as: SD-01-003\n\n", "before_files": [{"content": "import os\n\nclass BaseConfig(object):\n    DEBUG = False\n    TESTING = False\n    SECRET_KEY='SECRET_KEY_VALUE'\n\nclass ProductionConfig(BaseConfig):\n    pass\n\nclass DevelopmentConfig(BaseConfig):\n    DEBUG = True\n\nclass TestingConfig(BaseConfig):\n    TESTING = True\n    # Tests are simpler if CSRF protection is disabled\n    WTF_CSRF_ENABLED = False\n\n# data directories - should be on secure media\nSTORE_DIR='/var/www/securedrop/store'\nGPG_KEY_DIR='/var/www/securedrop/keys'\n\n# fingerprint of the GPG key to encrypt submissions to\nJOURNALIST_KEY='APP_GPG_KEY_FINGERPRINT'\n\nSOURCE_TEMPLATES_DIR='/var/www/securedrop/source_templates'\nJOURNALIST_TEMPLATES_DIR='/var/www/securedrop/journalist_templates'\nWORD_LIST='/var/www/securedrop/wordlist'\n\nNOUNS='/var/www/securedrop/dictionaries/nouns.txt'\nADJECTIVES='/var/www/securedrop/dictionaries/adjectives.txt'\nBCRYPT_ID_SALT='BCRYPT_ID_SALT_VALUE'\nBCRYPT_GPG_SALT='BCRYPT_GPG_SALT_VALUE'\n# Default to the production configuration\nFlaskConfig = ProductionConfig\n\nif os.environ.get('SECUREDROP_ENV') == 'test':\n    FlaskConfig = TestingConfig\n    TEST_DIR='/tmp/securedrop_test'\n    STORE_DIR=os.path.join(TEST_DIR, 'store')\n    GPG_KEY_DIR=os.path.join(TEST_DIR, 'keys')\n    # test_journalist_key.pub\n    JOURNALIST_KEY='65A1B5FF195B56353CC63DFFCC40EF1228271441'\n\n# Database Configuration\n\n# Default to using a sqlite database file for development\n#DATABASE_ENGINE = 'sqlite'\n#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n\n# Uncomment to use mysql (or any other databaes backend supported by\n# SQLAlchemy). Make sure you have the necessary dependencies installed, and run\n# `python -c \"import db; db.create_tables()\"` to initialize the database\n\nDATABASE_ENGINE = 'mysql'\nDATABASE_HOST = 'localhost'\nDATABASE_NAME = 'securedrop'\nDATABASE_USERNAME = 'securedrop'\nDATABASE_PASSWORD = ''\n", "path": "install_files/source.config.py"}, {"content": "import os\n\nclass BaseConfig(object):\n    DEBUG = False\n    TESTING = False\n    SECRET_KEY='SECRET_KEY_VALUE'\n\nclass ProductionConfig(BaseConfig):\n    pass\n\nclass DevelopmentConfig(BaseConfig):\n    DEBUG = True\n\nclass TestingConfig(BaseConfig):\n    TESTING = True\n    # Tests are simpler if CSRF protection is disabled\n    WTF_CSRF_ENABLED = False\n\n# data directories - should be on secure media\nSTORE_DIR='/var/www/securedrop/store'\nGPG_KEY_DIR='/var/www/securedrop/keys'\n\n# fingerprint of the GPG key to encrypt submissions to\nJOURNALIST_KEY='APP_GPG_KEY_FINGERPRINT'\n\nSOURCE_TEMPLATES_DIR='/var/www/securedrop/source_templates'\nJOURNALIST_TEMPLATES_DIR='/var/www/securedrop/journalist_templates'\nWORD_LIST='/var/www/securedrop/wordlist'\nNOUNS='/var/www/securedrop/dictionaries/nouns.txt'\nADJECTIVES='/var/www/securedrop/dictionaries/adjectives.txt'\nBCRYPT_ID_SALT='BCRYPT_ID_SALT_VALUE'\nBCRYPT_GPG_SALT='BCRYPT_GPG_SALT_VALUE'\n\n# Default to the production configuration\nFlaskConfig = ProductionConfig\nSECUREDROP_ROOT=os.path.abspath('/var/www/securedrop') \n\nif os.environ.get('SECUREDROP_ENV') == 'test':\n    FlaskConfig = TestingConfig\n    TEST_DIR='/tmp/securedrop_test'\n    STORE_DIR=os.path.join(TEST_DIR, 'store')\n    GPG_KEY_DIR=os.path.join(TEST_DIR, 'keys')\n    # test_journalist_key.pub\n    JOURNALIST_KEY='65A1B5FF195B56353CC63DFFCC40EF1228271441'\n\n# Database Configuration\n\n# Default to using a sqlite database file for development\n#DATABASE_ENGINE = 'sqlite'\n#DATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n\n# Uncomment to use mysql (or any other databaes backend supported by\n# SQLAlchemy). Make sure you have the necessary dependencies installed, and run\n# `python -c \"import db; db.create_tables()\"` to initialize the database\n\nDATABASE_ENGINE = 'mysql'\nDATABASE_HOST = 'localhost'\nDATABASE_NAME = 'securedrop'\nDATABASE_USERNAME = 'document_mysql'\nDATABASE_PASSWORD = 'MYSQL_USER_PASS'\n", "path": "install_files/document.config.py"}], "after_files": [{"content": "import os\n\nclass BaseConfig(object):\n    DEBUG = False\n    TESTING = False\n    SECRET_KEY='SECRET_KEY_VALUE'\n\nclass ProductionConfig(BaseConfig):\n    pass\n\nclass DevelopmentConfig(BaseConfig):\n    DEBUG = True\n\nclass TestingConfig(BaseConfig):\n    TESTING = True\n    # Tests are simpler if CSRF protection is disabled\n    WTF_CSRF_ENABLED = False\n\n# data directories - should be on secure media\nSTORE_DIR='/var/www/securedrop/store'\nGPG_KEY_DIR='/var/www/securedrop/keys'\n\n# fingerprint of the GPG key to encrypt submissions to\nJOURNALIST_KEY='APP_GPG_KEY_FINGERPRINT'\n\nSOURCE_TEMPLATES_DIR='/var/www/securedrop/source_templates'\nJOURNALIST_TEMPLATES_DIR='/var/www/securedrop/journalist_templates'\nWORD_LIST='/var/www/securedrop/wordlist'\n\nNOUNS='/var/www/securedrop/dictionaries/nouns.txt'\nADJECTIVES='/var/www/securedrop/dictionaries/adjectives.txt'\nBCRYPT_ID_SALT='BCRYPT_ID_SALT_VALUE'\nBCRYPT_GPG_SALT='BCRYPT_GPG_SALT_VALUE'\n# Default to the production configuration\nFlaskConfig = ProductionConfig\n\nif os.environ.get('SECUREDROP_ENV') == 'test':\n    FlaskConfig = TestingConfig\n    TEST_DIR='/tmp/securedrop_test'\n    STORE_DIR=os.path.join(TEST_DIR, 'store')\n    GPG_KEY_DIR=os.path.join(TEST_DIR, 'keys')\n    # test_journalist_key.pub\n    JOURNALIST_KEY='65A1B5FF195B56353CC63DFFCC40EF1228271441'\n\n# Database Configuration\n\n# Default to using a sqlite database file for development\nDATABASE_ENGINE = 'sqlite'\nSECUREDROP_ROOT=os.path.abspath('/var/www/securedrop')\nDATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n\n# Uncomment to use mysql (or any other databaes backend supported by\n# SQLAlchemy). Make sure you have the necessary dependencies installed, and run\n# `python -c \"import db; db.create_tables()\"` to initialize the database\n\n#DATABASE_ENGINE = 'mysql'\n#DATABASE_HOST = 'localhost'\n#DATABASE_NAME = 'securedrop'\n#DATABASE_USERNAME = 'securedrop'\n#DATABASE_PASSWORD = ''\n", "path": "install_files/source.config.py"}, {"content": "import os\n\nclass BaseConfig(object):\n    DEBUG = False\n    TESTING = False\n    SECRET_KEY='SECRET_KEY_VALUE'\n\nclass ProductionConfig(BaseConfig):\n    pass\n\nclass DevelopmentConfig(BaseConfig):\n    DEBUG = True\n\nclass TestingConfig(BaseConfig):\n    TESTING = True\n    # Tests are simpler if CSRF protection is disabled\n    WTF_CSRF_ENABLED = False\n\n# data directories - should be on secure media\nSTORE_DIR='/var/www/securedrop/store'\nGPG_KEY_DIR='/var/www/securedrop/keys'\n\n# fingerprint of the GPG key to encrypt submissions to\nJOURNALIST_KEY='APP_GPG_KEY_FINGERPRINT'\n\nSOURCE_TEMPLATES_DIR='/var/www/securedrop/source_templates'\nJOURNALIST_TEMPLATES_DIR='/var/www/securedrop/journalist_templates'\nWORD_LIST='/var/www/securedrop/wordlist'\nNOUNS='/var/www/securedrop/dictionaries/nouns.txt'\nADJECTIVES='/var/www/securedrop/dictionaries/adjectives.txt'\nBCRYPT_ID_SALT='BCRYPT_ID_SALT_VALUE'\nBCRYPT_GPG_SALT='BCRYPT_GPG_SALT_VALUE'\n\n# Default to the production configuration\nFlaskConfig = ProductionConfig\nSECUREDROP_ROOT=os.path.abspath('/var/www/securedrop') \n\nif os.environ.get('SECUREDROP_ENV') == 'test':\n    FlaskConfig = TestingConfig\n    TEST_DIR='/tmp/securedrop_test'\n    STORE_DIR=os.path.join(TEST_DIR, 'store')\n    GPG_KEY_DIR=os.path.join(TEST_DIR, 'keys')\n    # test_journalist_key.pub\n    JOURNALIST_KEY='65A1B5FF195B56353CC63DFFCC40EF1228271441'\n\n# Database Configuration\n\n# Default to using a sqlite database file for development\nDATABASE_ENGINE = 'sqlite'\nDATABASE_FILE=os.path.join(SECUREDROP_ROOT, 'db.sqlite')\n\n# Uncomment to use mysql (or any other databaes backend supported by\n# SQLAlchemy). Make sure you have the necessary dependencies installed, and run\n# `python -c \"import db; db.create_tables()\"` to initialize the database\n\n#DATABASE_ENGINE = 'mysql'\n#DATABASE_HOST = 'localhost'\n#DATABASE_NAME = 'securedrop'\n#DATABASE_USERNAME = 'document_mysql'\n#DATABASE_PASSWORD = 'MYSQL_USER_PASS'\n", "path": "install_files/document.config.py"}]}