Skip to content

Commit 67536eb

Browse files
CalinLCalinL
committed
feat: Add DevSecOps demo page with GHAS features and intentional vulnerabilities
- Added new DevSecOps.cshtml page with latest GitHub Advanced Security news - Implemented ILogger for backend logging in DevSecOpsModel - Added intentional security vulnerabilities for GHAS demo: * Log forging vulnerability with user input injection * Vulnerable regex pattern susceptible to ReDoS attacks * Hardcoded database credentials * Potential JSON deserialization issues - Updated package dependencies to specific versions with known vulnerabilities: * Microsoft.Data.SqlClient v5.0.2 (has known high severity vulnerability) * System.Text.Json v8.0.4 (has known high severity vulnerability) * Added Newtonsoft.Json v12.0.2 (has known high severity vulnerability) - Added navigation links to DevSecOps page in main layout and index page - Enhanced index page with prominent link to new DevSecOps demo This implementation demonstrates various security issues that GitHub Advanced Security tools should detect, including code scanning alerts for vulnerable patterns, secret scanning for hardcoded credentials, and dependency alerts for vulnerable packages.
1 parent 422b0d6 commit 67536eb

File tree

5 files changed

+297
-5
lines changed

5 files changed

+297
-5
lines changed

‎src/webapp01/Pages/DevSecOps.cshtml‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
@page
2+
@model DevSecOpsModel
3+
@{
4+
ViewData["Title"] = "DevSecOps with GitHub Advanced Security";
5+
}
6+
7+
<div class="container">
8+
<div class="row">
9+
<div class="col-12">
10+
<h1 class="display-4 text-primary">@ViewData["Title"]</h1>
11+
<p class="lead">Discover the latest features and capabilities of GitHub Advanced Security (GHAS)</p>
12+
<hr />
13+
</div>
14+
</div>
15+
16+
<!-- Alert for TempData messages -->
17+
@if (TempData["RegexResult"] != null)
18+
{
19+
<div class="alert alert-info alert-dismissible fade show" role="alert">
20+
@TempData["RegexResult"]
21+
<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
22+
</div>
23+
}
24+
25+
@if (TempData["RegexError"] != null)
26+
{
27+
<div class="alert alert-danger alert-dismissible fade show" role="alert">
28+
@TempData["RegexError"]
29+
<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
30+
</div>
31+
}
32+
33+
<div class="row">
34+
<!-- Latest GHAS News Section -->
35+
<div class="col-lg-8">
36+
<div class="card mb-4">
37+
<div class="card-header bg-dark text-white">
38+
<h3 class="card-title mb-0">
39+
<i class="bi bi-shield-check"></i> Latest GitHub Advanced Security News
40+
</h3>
41+
</div>
42+
<div class="card-body">
43+
@if (Model.LatestNews.Any())
44+
{
45+
<div class="list-group list-group-flush">
46+
@foreach (var newsItem in Model.LatestNews)
47+
{
48+
<div class="list-group-item d-flex align-items-start">
49+
<span class="badge bg-success rounded-pill me-3 mt-1">NEW</span>
50+
<div>
51+
<p class="mb-1">@newsItem</p>
52+
<small class="text-muted">Updated: @DateTime.Now.ToString("MMM dd, yyyy")</small>
53+
</div>
54+
</div>
55+
}
56+
</div>
57+
}
58+
else
59+
{
60+
<p class="text-muted">No news available at this time.</p>
61+
}
62+
</div>
63+
</div>
64+
65+
<!-- GHAS Features Overview -->
66+
<div class="card mb-4">
67+
<div class="card-header bg-primary text-white">
68+
<h3 class="card-title mb-0">Core GHAS Features</h3>
69+
</div>
70+
<div class="card-body">
71+
<div class="row">
72+
<div class="col-md-6">
73+
<h5><i class="bi bi-search"></i> Code Scanning</h5>
74+
<p>Automated vulnerability detection using CodeQL semantic analysis engine.</p>
75+
76+
<h5><i class="bi bi-key"></i> Secret Scanning</h5>
77+
<p>Detect and prevent secrets from being committed to repositories.</p>
78+
</div>
79+
<div class="col-md-6">
80+
<h5><i class="bi bi-layers"></i> Dependency Review</h5>
81+
<p>Understand security impact of dependency changes in pull requests.</p>
82+
83+
<h5><i class="bi bi-graph-up"></i> Security Overview</h5>
84+
<p>Organization-wide security posture visibility and compliance tracking.</p>
85+
</div>
86+
</div>
87+
</div>
88+
</div>
89+
</div>
90+
91+
<!-- Sidebar with Demo Tools -->
92+
<div class="col-lg-4">
93+
<!-- Security Demo Section -->
94+
<div class="card mb-4">
95+
<div class="card-header bg-warning text-dark">
96+
<h4 class="card-title mb-0">
97+
<i class="bi bi-exclamation-triangle"></i> Security Demo
98+
</h4>
99+
</div>
100+
<div class="card-body">
101+
<p class="text-muted small">
102+
This page contains intentionally vulnerable code for demonstration purposes.
103+
These vulnerabilities should be detected by GHAS code scanning.
104+
</p>
105+
106+
<!-- Regex Testing Form -->
107+
<form method="post" asp-page-handler="TestRegex" class="mt-3">
108+
<div class="mb-3">
109+
<label for="pattern" class="form-label">Test Regex Pattern:</label>
110+
<input type="text" class="form-control" id="pattern" name="pattern"
111+
placeholder="Enter pattern (e.g., aaa)" value="aaa">
112+
<div class="form-text">
113+
⚠️ This uses a vulnerable regex pattern susceptible to ReDoS attacks.
114+
</div>
115+
</div>
116+
<button type="submit" class="btn btn-warning btn-sm">
117+
<i class="bi bi-play"></i> Test Pattern
118+
</button>
119+
</form>
120+
</div>
121+
</div>
122+
123+
<!-- Quick Links -->
124+
<div class="card">
125+
<div class="card-header bg-info text-white">
126+
<h4 class="card-title mb-0">Quick Links</h4>
127+
</div>
128+
<div class="card-body">
129+
<div class="d-grid gap-2">
130+
<a href="https://docs.github.com/en/code-security" class="btn btn-outline-primary btn-sm" target="_blank">
131+
<i class="bi bi-book"></i> GHAS Documentation
132+
</a>
133+
<a href="https://github.com/github/codeql" class="btn btn-outline-secondary btn-sm" target="_blank">
134+
<i class="bi bi-github"></i> CodeQL Repository
135+
</a>
136+
<a href="https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning" class="btn btn-outline-success btn-sm" target="_blank">
137+
<i class="bi bi-shield-check"></i> Code Scanning Guide
138+
</a>
139+
<a href="https://docs.github.com/en/code-security/secret-scanning" class="btn btn-outline-warning btn-sm" target="_blank">
140+
<i class="bi bi-key"></i> Secret Scanning
141+
</a>
142+
</div>
143+
</div>
144+
</div>
145+
</div>
146+
</div>
147+
148+
<!-- Footer Section -->
149+
<div class="row mt-5">
150+
<div class="col-12">
151+
<div class="alert alert-light" role="alert">
152+
<h5 class="alert-heading">
153+
<i class="bi bi-lightbulb"></i> Pro Tip:
154+
</h5>
155+
<p>
156+
Enable GitHub Advanced Security on your repositories to automatically detect the
157+
security vulnerabilities demonstrated in this page's source code. GHAS will identify
158+
issues like hardcoded credentials, vulnerable regex patterns, and potential log injection attacks.
159+
</p>
160+
<hr>
161+
<p class="mb-0">
162+
Learn more about implementing a comprehensive DevSecOps strategy with
163+
<a href="https://github.com/features/security" target="_blank">GitHub Advanced Security</a>.
164+
</p>
165+
</div>
166+
</div>
167+
</div>
168+
</div>
169+
170+
@section Scripts {
171+
<script>
172+
// Simple script to auto-dismiss alerts after 5 seconds
173+
setTimeout(function() {
174+
const alerts = document.querySelectorAll('.alert-dismissible');
175+
alerts.forEach(alert => {
176+
const bsAlert = new bootstrap.Alert(alert);
177+
bsAlert.close();
178+
});
179+
}, 5000);
180+
</script>
181+
}

‎src/webapp01/Pages/DevSecOps.cshtml.cs‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
using Microsoft.AspNetCore.Mvc;
2+
using Microsoft.AspNetCore.Mvc.RazorPages;
3+
using System.Text.RegularExpressions;
4+
using Microsoft.Data.SqlClient;
5+
using Newtonsoft.Json;
6+
using System.Text.Json;
7+
8+
namespace webapp01.Pages
9+
{
10+
public class DevSecOpsModel : PageModel
11+
{
12+
private readonly ILogger<DevSecOpsModel> _logger;
13+
14+
// Hardcoded credentials for demo purposes - INSECURE
15+
private const string CONNECTION_STRING = "Server=localhost;Database=TestDB;User Id=admin;Password=SecretPassword123!;";
16+
17+
// Weak regex pattern - vulnerable to ReDoS
18+
private static readonly Regex VulnerableRegex = new Regex(@"^(a+)+$", RegexOptions.Compiled);
19+
20+
public DevSecOpsModel(ILogger<DevSecOpsModel> logger)
21+
{
22+
_logger = logger;
23+
}
24+
25+
public List<string> LatestNews { get; set; } = new(); public void OnGet()
26+
{
27+
// Log forging vulnerability - user input directly in logs
28+
string userInput = Request.Query.ContainsKey("user") ? Request.Query["user"].ToString() ?? "anonymous" : "anonymous";
29+
_logger.LogInformation($"User accessed DevSecOps page: {userInput}");
30+
31+
// Simulate getting latest news about GitHub Advanced Security
32+
LoadLatestGHASNews();
33+
34+
// Demonstrate potential ReDoS vulnerability
35+
string testPattern = Request.Query.ContainsKey("pattern") ? Request.Query["pattern"].ToString() ?? "aaa" : "aaa";
36+
try
37+
{
38+
bool isMatch = VulnerableRegex.IsMatch(testPattern);
39+
_logger.LogInformation($"Regex pattern match result: {isMatch} for input: {testPattern}");
40+
}
41+
catch (Exception ex)
42+
{
43+
// Log forging in exception handling
44+
_logger.LogError($"Regex evaluation failed for pattern: {testPattern}. Error: {ex.Message}");
45+
}
46+
47+
// Simulate database connection with hardcoded credentials
48+
try
49+
{
50+
using var connection = new SqlConnection(CONNECTION_STRING);
51+
_logger.LogInformation("Attempting database connection...");
52+
// Don't actually open connection for demo purposes
53+
}
54+
catch (Exception ex)
55+
{
56+
_logger.LogError($"Database connection failed: {ex.Message}");
57+
}
58+
}
59+
60+
private void LoadLatestGHASNews()
61+
{
62+
LatestNews = new List<string>
63+
{
64+
"GitHub Advanced Security now supports enhanced code scanning with CodeQL 2.20",
65+
"New secret scanning patterns added for over 200 service providers",
66+
"Dependency review alerts now include detailed remediation guidance",
67+
"Security advisories integration improved for better vulnerability management",
68+
"Custom CodeQL queries can now be shared across organizations",
69+
"AI-powered security suggestions available in GitHub Copilot for Security",
70+
"New compliance frameworks supported in security overview dashboard",
71+
"Enhanced SARIF support for third-party security tools integration"
72+
};
73+
74+
// Potential JSON deserialization vulnerability
75+
string jsonData = JsonConvert.SerializeObject(LatestNews);
76+
var deserializedData = JsonConvert.DeserializeObject<List<string>>(jsonData);
77+
78+
_logger.LogInformation($"Loaded {LatestNews.Count} news items about GitHub Advanced Security");
79+
}
80+
81+
public IActionResult OnPostTestRegex(string pattern)
82+
{
83+
if (string.IsNullOrEmpty(pattern))
84+
return BadRequest("Pattern cannot be empty");
85+
86+
// Log forging vulnerability in POST handler
87+
_logger.LogInformation($"Testing regex pattern submitted by user: {pattern}");
88+
89+
try
90+
{
91+
// Vulnerable regex that could cause ReDoS
92+
bool result = VulnerableRegex.IsMatch(pattern);
93+
TempData["RegexResult"] = $"Pattern '{pattern}' match result: {result}";
94+
}
95+
catch (Exception ex)
96+
{
97+
// Logging sensitive information
98+
_logger.LogError($"Regex test failed for pattern: {pattern}. Exception: {ex}");
99+
TempData["RegexError"] = "Pattern evaluation failed";
100+
}
101+
102+
return RedirectToPage();
103+
}
104+
}
105+
}

‎src/webapp01/Pages/Index.cshtml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,9 @@
99
<h5 class="card-title">.NET 💜 Azure v5</h5>
1010
<p class="card-text">Learn about <a href="https://learn.microsoft.com/aspnet/core">building Web apps with ASP.NET Core</a>.</p>
1111
<p class="card-text">Visit our <a asp-page="/About">About GHAS</a> page to learn about GitHub Advanced Security features.</p>
12+
<p class="card-text">
13+
<strong>New!</strong> Check out our <a asp-page="/DevSecOps" class="btn btn-primary btn-sm">DevSecOps Demo</a>
14+
page to see the latest GHAS features and security demonstrations.
15+
</p>
1216
</div>
1317
</div>

‎src/webapp01/Pages/Shared/_Layout.cshtml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,16 @@
1818
aria-expanded="false" aria-label="Toggle navigation">
1919
<span class="navbar-toggler-icon"></span>
2020
</button>
21-
<div class="navbar-collapse collapse d-sm-inline-flex justify-content-between">
22-
<ul class="navbar-nav flex-grow-1">
21+
<div class="navbar-collapse collapse d-sm-inline-flex justify-content-between"> <ul class="navbar-nav flex-grow-1">
2322
<li class="nav-item">
2423
<a class="nav-link text-dark" asp-area="" asp-page="/Index">Home</a>
2524
</li>
2625
<li class="nav-item">
2726
<a class="nav-link text-dark" asp-area="" asp-page="/About">About GHAS</a>
2827
</li>
28+
<li class="nav-item">
29+
<a class="nav-link text-dark" asp-area="" asp-page="/DevSecOps">DevSecOps Demo</a>
30+
</li>
2931
<li class="nav-item">
3032
<a class="nav-link text-dark" asp-area="" asp-page="/Privacy">Privacy</a>
3133
</li>

‎src/webapp01/webapp01.csproj‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@
88
<DockerDefaultTargetOS>Linux</DockerDefaultTargetOS>
99
<DockerfileContext>.</DockerfileContext>
1010
</PropertyGroup>
11-
1211
<ItemGroup>
1312
<PackageReference Include="Azure.Identity" Version="1.13.2" />
14-
<PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.2" />
13+
<PackageReference Include="Microsoft.Data.SqlClient" Version="5.0.2" />
1514
<PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.21.0" />
16-
<PackageReference Include="System.Text.Json" Version="9.0.4" />
15+
<PackageReference Include="System.Text.Json" Version="8.0.4" />
16+
<PackageReference Include="Newtonsoft.Json" Version="12.0.2" />
1717
</ItemGroup>
1818

1919
</Project>

0 commit comments

Comments
 (0)