|
| 1 | +using Microsoft.AspNetCore.Mvc; |
| 2 | +using Microsoft.AspNetCore.Mvc.RazorPages; |
| 3 | +using System.Text.RegularExpressions; |
| 4 | +using Microsoft.Data.SqlClient; |
| 5 | +using Newtonsoft.Json; |
| 6 | +using System.Text.Json; |
| 7 | + |
| 8 | +namespace webapp01.Pages |
| 9 | +{ |
| 10 | + /// <summary> |
| 11 | + /// DevSecOps Demo Page Model - Contains intentional security vulnerabilities for GHAS demonstration |
| 12 | + /// WARNING: This code is intentionally insecure for educational purposes only |
| 13 | + /// </summary> |
| 14 | + public class DevSecOps4837Model : PageModel |
| 15 | + { |
| 16 | + private readonly ILogger<DevSecOps4837Model> _logger; |
| 17 | + |
| 18 | + // SECURITY ISSUE: Hardcoded database credentials - will be detected by GHAS Secret Scanning |
| 19 | + private const string DB_CONNECTION_STRING = "Server=demo-sql.database.windows.net;Database=GHASDemo;User Id=demoadmin;Password=P@ssw0rd123!;"; |
| 20 | + |
| 21 | + // SECURITY ISSUE: Vulnerable regex pattern susceptible to ReDoS (Regular Expression Denial of Service) |
| 22 | + // This pattern has nested quantifiers which can cause exponential backtracking |
| 23 | + private static readonly Regex VulnerableEmailRegex = new Regex(@"^([a-zA-Z0-9]+)*@([a-zA-Z0-9]+)*\.com$", RegexOptions.Compiled); |
| 24 | + |
| 25 | + public DevSecOps4837Model(ILogger<DevSecOps4837Model> logger) |
| 26 | + { |
| 27 | + _logger = logger; |
| 28 | + _logger.LogInformation("DevSecOps4837Model initialized"); |
| 29 | + } |
| 30 | + |
| 31 | + public List<GHASNewsItem> GHASNews { get; set; } = new List<GHASNewsItem>(); |
| 32 | + |
| 33 | + public void OnGet() |
| 34 | + { |
| 35 | + // SECURITY ISSUE: Log Forging - Unsanitized user input directly in log statements |
| 36 | + string userName = Request.Query.ContainsKey("user") ? Request.Query["user"].ToString() ?? "anonymous" : "anonymous"; |
| 37 | + _logger.LogInformation($"User {userName} accessed DevSecOps-4837 page"); |
| 38 | + |
| 39 | + // SECURITY ISSUE: Another log forging example with query parameter |
| 40 | + string action = Request.Query.ContainsKey("action") ? Request.Query["action"].ToString() ?? "view" : "view"; |
| 41 | + _logger.LogInformation($"Action performed: {action} by user {userName}"); |
| 42 | + |
| 43 | + // Load GHAS news with intentional vulnerabilities |
| 44 | + LoadGHASNews(); |
| 45 | + |
| 46 | + // Demonstrate regex vulnerability |
| 47 | + DemonstrateRegexVulnerability(); |
| 48 | + |
| 49 | + // Demonstrate SQL injection risk |
| 50 | + DemonstrateSQLRisk(); |
| 51 | + } |
| 52 | + |
| 53 | + private void LoadGHASNews() |
| 54 | + { |
| 55 | + _logger.LogInformation("Loading latest GitHub Advanced Security news"); |
| 56 | + |
| 57 | + GHASNews = new List<GHASNewsItem> |
| 58 | + { |
| 59 | + new GHASNewsItem |
| 60 | + { |
| 61 | + Title = "CodeQL 2.20 Released with Enhanced Security Analysis", |
| 62 | + Description = "New CodeQL version includes improved support for C#, Java, and JavaScript with 50+ new security queries for OWASP Top 10 vulnerabilities.", |
| 63 | + Date = DateTime.Now.AddDays(-2) |
| 64 | + }, |
| 65 | + new GHASNewsItem |
| 66 | + { |
| 67 | + Title = "Secret Scanning Push Protection Now GA", |
| 68 | + Description = "Push protection prevents developers from accidentally committing secrets to repositories, with support for 200+ token patterns.", |
| 69 | + Date = DateTime.Now.AddDays(-5) |
| 70 | + }, |
| 71 | + new GHASNewsItem |
| 72 | + { |
| 73 | + Title = "Dependabot Security Updates Enhanced", |
| 74 | + Description = "Automated dependency updates now include intelligent PR grouping and compatibility scoring to reduce alert fatigue.", |
| 75 | + Date = DateTime.Now.AddDays(-7) |
| 76 | + }, |
| 77 | + new GHASNewsItem |
| 78 | + { |
| 79 | + Title = "AI-Powered Security Fix Suggestions", |
| 80 | + Description = "GitHub Copilot for Security now provides context-aware fix suggestions for code scanning alerts with one-click remediation.", |
| 81 | + Date = DateTime.Now.AddDays(-10) |
| 82 | + }, |
| 83 | + new GHASNewsItem |
| 84 | + { |
| 85 | + Title = "Custom CodeQL Query Suites", |
| 86 | + Description = "Organizations can now create and share custom CodeQL query suites across repositories for industry-specific compliance requirements.", |
| 87 | + Date = DateTime.Now.AddDays(-14) |
| 88 | + }, |
| 89 | + new GHASNewsItem |
| 90 | + { |
| 91 | + Title = "Security Overview Dashboard Updates", |
| 92 | + Description = "New metrics and visualizations for tracking security posture across enterprise organizations with improved filtering and export capabilities.", |
| 93 | + Date = DateTime.Now.AddDays(-18) |
| 94 | + } |
| 95 | + }; |
| 96 | + |
| 97 | + // SECURITY ISSUE: Unnecessary JSON serialization/deserialization that could introduce vulnerabilities |
| 98 | + string jsonData = JsonConvert.SerializeObject(GHASNews); |
| 99 | + var tempData = JsonConvert.DeserializeObject<List<GHASNewsItem>>(jsonData); |
| 100 | + |
| 101 | + _logger.LogInformation($"Loaded {GHASNews.Count} GHAS news items"); |
| 102 | + } |
| 103 | + |
| 104 | + private void DemonstrateRegexVulnerability() |
| 105 | + { |
| 106 | + // SECURITY ISSUE: Testing vulnerable regex pattern that could cause ReDoS |
| 107 | + string testEmail = Request.Query.ContainsKey("email") ? Request.Query["email"].ToString() ?? "test@example.com" : "test@example.com"; |
| 108 | + |
| 109 | + try |
| 110 | + { |
| 111 | + // This vulnerable regex can cause exponential backtracking with inputs like "aaaaaaaaaaaaaaaaaaaaaaaaa@aaaaaaaaaaaaaaa" |
| 112 | + bool isValidEmail = VulnerableEmailRegex.IsMatch(testEmail); |
| 113 | + _logger.LogInformation($"Email validation result for {testEmail}: {isValidEmail}"); |
| 114 | + } |
| 115 | + catch (Exception ex) |
| 116 | + { |
| 117 | + // SECURITY ISSUE: Logging full exception details which might contain sensitive information |
| 118 | + _logger.LogError($"Regex validation failed for email: {testEmail}. Exception: {ex}"); |
| 119 | + } |
| 120 | + } |
| 121 | + |
| 122 | + private void DemonstrateSQLRisk() |
| 123 | + { |
| 124 | + // SECURITY ISSUE: Using hardcoded connection string |
| 125 | + try |
| 126 | + { |
| 127 | + using var connection = new SqlConnection(DB_CONNECTION_STRING); |
| 128 | + _logger.LogInformation("Database connection configured with demo credentials"); |
| 129 | + |
| 130 | + // SECURITY ISSUE: Potential SQL injection if this were to accept user input |
| 131 | + string userId = Request.Query.ContainsKey("userId") ? Request.Query["userId"].ToString() ?? "1" : "1"; |
| 132 | + string unsafeQuery = $"SELECT * FROM Users WHERE UserId = {userId}"; // SQL INJECTION RISK |
| 133 | + |
| 134 | + // Log the unsafe query (for demonstration - not actually executing) |
| 135 | + _logger.LogWarning($"Unsafe SQL query constructed: {unsafeQuery}"); |
| 136 | + } |
| 137 | + catch (Exception ex) |
| 138 | + { |
| 139 | + _logger.LogError($"Database operation failed: {ex.Message}"); |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | + public IActionResult OnPostProcessInput(string userInput) |
| 144 | + { |
| 145 | + if (string.IsNullOrEmpty(userInput)) |
| 146 | + { |
| 147 | + _logger.LogWarning("Empty input received in ProcessInput handler"); |
| 148 | + return Page(); |
| 149 | + } |
| 150 | + |
| 151 | + // SECURITY ISSUE: Log Forging - User input directly in logs without sanitization |
| 152 | + _logger.LogInformation($"Processing user input: {userInput}"); |
| 153 | + |
| 154 | + // SECURITY ISSUE: User input could contain newlines or control characters |
| 155 | + _logger.LogInformation($"Input length: {userInput.Length}, Content: {userInput}"); |
| 156 | + |
| 157 | + // Demonstrate potential command injection risk (not actually executing) |
| 158 | + if (userInput.Contains(";") || userInput.Contains("|")) |
| 159 | + { |
| 160 | + _logger.LogWarning($"Suspicious input detected with special characters: {userInput}"); |
| 161 | + } |
| 162 | + |
| 163 | + TempData["Message"] = $"Input processed: {userInput}"; |
| 164 | + return RedirectToPage(); |
| 165 | + } |
| 166 | + } |
| 167 | + |
| 168 | + /// <summary> |
| 169 | + /// Model for GHAS news items |
| 170 | + /// </summary> |
| 171 | + public class GHASNewsItem |
| 172 | + { |
| 173 | + public string Title { get; set; } = string.Empty; |
| 174 | + public string Description { get; set; } = string.Empty; |
| 175 | + public DateTime Date { get; set; } |
| 176 | + } |
| 177 | +} |
0 commit comments