diff --git a/src/webapp01/Pages/DevSecOps7.cshtml b/src/webapp01/Pages/DevSecOps7.cshtml new file mode 100644 index 0000000..01b6dba --- /dev/null +++ b/src/webapp01/Pages/DevSecOps7.cshtml @@ -0,0 +1,181 @@ +@page +@model DevSecOps7Model +@{ + ViewData["Title"] = "DevSecOps 7 - GitHub Advanced Security"; +} + +
+
+
+

@ViewData["Title"]

+

Explore the cutting-edge features and capabilities of GitHub Advanced Security (GHAS)

+
+
+
+ + + @if (TempData["RegexResult"] != null) + { + + } + + @if (TempData["RegexError"] != null) + { + + } + +
+ +
+
+
+

+ Latest GitHub Advanced Security News +

+
+
+ @if (Model.LatestNews.Any()) + { +
+ @foreach (var newsItem in Model.LatestNews) + { +
+ NEW +
+

@newsItem

+ Updated: @DateTime.Now.ToString("MMM dd, yyyy") +
+
+ } +
+ } + else + { +

No news available at this time.

+ } +
+
+ + +
+
+

Core GHAS Features

+
+
+
+
+
Code Scanning
+

Automated vulnerability detection using CodeQL semantic analysis engine.

+ +
Secret Scanning
+

Detect and prevent secrets from being committed to repositories.

+
+
+
Dependency Review
+

Understand security impact of dependency changes in pull requests.

+ +
Security Overview
+

Organization-wide security posture visibility and compliance tracking.

+
+
+
+
+
+ + +
+ +
+
+

+ Security Demo +

+
+
+

+ This page contains intentionally vulnerable code for demonstration purposes. + These vulnerabilities should be detected by GHAS code scanning. +

+ + +
+
+ + +
+ ⚠️ This uses a vulnerable regex pattern susceptible to ReDoS attacks. +
+
+ +
+
+
+ + +
+
+

Quick Links

+
+
+
+ + GHAS Documentation + + + CodeQL Repository + + + Code Scanning Guide + + + Secret Scanning + +
+
+
+
+
+ + +
+
+ +
+
+
+ +@section Scripts { + +} diff --git a/src/webapp01/Pages/DevSecOps7.cshtml.cs b/src/webapp01/Pages/DevSecOps7.cshtml.cs new file mode 100644 index 0000000..f4cb99d --- /dev/null +++ b/src/webapp01/Pages/DevSecOps7.cshtml.cs @@ -0,0 +1,107 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.RazorPages; +using System.Text.RegularExpressions; +using Microsoft.Data.SqlClient; +using Newtonsoft.Json; +using System.Text.Json; + +namespace webapp01.Pages +{ + public class DevSecOps7Model : PageModel + { + private readonly ILogger _logger; + + // Hardcoded credentials for demo purposes - INSECURE + private const string CONNECTION_STRING = "Server=localhost;Database=TestDB;User Id=admin;Password=SecretPassword123!;"; + + // Weak regex pattern - vulnerable to ReDoS + private static readonly Regex VulnerableRegex = new Regex(@"^(a+)+$", RegexOptions.Compiled); + + public DevSecOps7Model(ILogger logger) + { + _logger = logger; + } + + public List LatestNews { get; set; } = new(); + + public void OnGet() + { + // Log forging vulnerability - user input directly in logs + string userInput = Request.Query.ContainsKey("user") ? Request.Query["user"].ToString() ?? "anonymous" : "anonymous"; + _logger.LogInformation($"User accessed DevSecOps7 page: {userInput}"); + + // Simulate getting latest news about GitHub Advanced Security + LoadLatestGHASNews(); + + // Demonstrate potential ReDoS vulnerability + string testPattern = Request.Query.ContainsKey("pattern") ? Request.Query["pattern"].ToString() ?? "aaa" : "aaa"; + try + { + bool isMatch = VulnerableRegex.IsMatch(testPattern); + _logger.LogInformation($"Regex pattern match result: {isMatch} for input: {testPattern}"); + } + catch (Exception ex) + { + // Log forging in exception handling + _logger.LogError($"Regex evaluation failed for pattern: {testPattern}. Error: {ex.Message}"); + } + + // Simulate database connection with hardcoded credentials + try + { + using var connection = new SqlConnection(CONNECTION_STRING); + _logger.LogInformation("Attempting database connection..."); + // Don't actually open connection for demo purposes + } + catch (Exception ex) + { + _logger.LogError($"Database connection failed: {ex.Message}"); + } + } + + private void LoadLatestGHASNews() + { + LatestNews = new List + { + "GitHub Advanced Security now supports enhanced code scanning with CodeQL 2.20", + "New secret scanning patterns added for over 200 service providers", + "Dependency review alerts now include detailed remediation guidance", + "Security advisories integration improved for better vulnerability management", + "Custom CodeQL queries can now be shared across organizations", + "AI-powered security suggestions available in GitHub Copilot for Security", + "New compliance frameworks supported in security overview dashboard", + "Enhanced SARIF support for third-party security tools integration" + }; + + // Potential JSON deserialization vulnerability + string jsonData = JsonConvert.SerializeObject(LatestNews); + var deserializedData = JsonConvert.DeserializeObject>(jsonData); + + _logger.LogInformation($"Loaded {LatestNews.Count} news items about GitHub Advanced Security"); + } + + public IActionResult OnPostTestRegex(string pattern) + { + if (string.IsNullOrEmpty(pattern)) + return BadRequest("Pattern cannot be empty"); + + // Log forging vulnerability in POST handler + _logger.LogInformation($"Testing regex pattern submitted by user: {pattern}"); + + try + { + // Vulnerable regex that could cause ReDoS + bool result = VulnerableRegex.IsMatch(pattern); + TempData["RegexResult"] = $"Pattern '{pattern}' match result: {result}"; + } + catch (Exception ex) + { + // Logging sensitive information + _logger.LogError($"Regex test failed for pattern: {pattern}. Exception: {ex}"); + TempData["RegexError"] = "Pattern evaluation failed"; + } + + return RedirectToPage(); + } + } +} diff --git a/src/webapp01/Pages/Index.cshtml b/src/webapp01/Pages/Index.cshtml index 636b186..789e829 100644 --- a/src/webapp01/Pages/Index.cshtml +++ b/src/webapp01/Pages/Index.cshtml @@ -10,7 +10,7 @@

Learn about building Web apps with ASP.NET Core.

Visit our About GHAS page to learn about GitHub Advanced Security features.

- New! Check out our DevSecOps Demo + New! Check out our DevSecOps7 Demo page to see the latest GHAS features and security demonstrations.

diff --git a/src/webapp01/webapp01.csproj b/src/webapp01/webapp01.csproj index 9b11105..f3e9796 100644 --- a/src/webapp01/webapp01.csproj +++ b/src/webapp01/webapp01.csproj @@ -13,7 +13,7 @@ - +