From 67536eb38191a0dbaf6690758e178e6b2276effd Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Thu, 29 May 2025 10:03:08 -0400 Subject: [PATCH] feat: Add DevSecOps demo page with GHAS features and intentional vulnerabilities - Added new DevSecOps.cshtml page with latest GitHub Advanced Security news - Implemented ILogger for backend logging in DevSecOpsModel - Added intentional security vulnerabilities for GHAS demo: * Log forging vulnerability with user input injection * Vulnerable regex pattern susceptible to ReDoS attacks * Hardcoded database credentials * Potential JSON deserialization issues - Updated package dependencies to specific versions with known vulnerabilities: * Microsoft.Data.SqlClient v5.0.2 (has known high severity vulnerability) * System.Text.Json v8.0.4 (has known high severity vulnerability) * Added Newtonsoft.Json v12.0.2 (has known high severity vulnerability) - Added navigation links to DevSecOps page in main layout and index page - Enhanced index page with prominent link to new DevSecOps demo This implementation demonstrates various security issues that GitHub Advanced Security tools should detect, including code scanning alerts for vulnerable patterns, secret scanning for hardcoded credentials, and dependency alerts for vulnerable packages. --- src/webapp01/Pages/DevSecOps.cshtml | 181 +++++++++++++++++++++++ src/webapp01/Pages/DevSecOps.cshtml.cs | 105 +++++++++++++ src/webapp01/Pages/Index.cshtml | 4 + src/webapp01/Pages/Shared/_Layout.cshtml | 6 +- src/webapp01/webapp01.csproj | 6 +- 5 files changed, 297 insertions(+), 5 deletions(-) create mode 100644 src/webapp01/Pages/DevSecOps.cshtml create mode 100644 src/webapp01/Pages/DevSecOps.cshtml.cs diff --git a/src/webapp01/Pages/DevSecOps.cshtml b/src/webapp01/Pages/DevSecOps.cshtml new file mode 100644 index 0000000..19f5d71 --- /dev/null +++ b/src/webapp01/Pages/DevSecOps.cshtml @@ -0,0 +1,181 @@ +@page +@model DevSecOpsModel +@{ + ViewData["Title"] = "DevSecOps with GitHub Advanced Security"; +} + +
+
+
+

@ViewData["Title"]

+

Discover the latest features and capabilities of GitHub Advanced Security (GHAS)

+
+
+
+ + + @if (TempData["RegexResult"] != null) + { + + } + + @if (TempData["RegexError"] != null) + { + + } + +
+ +
+
+
+

+ Latest GitHub Advanced Security News +

+
+
+ @if (Model.LatestNews.Any()) + { +
+ @foreach (var newsItem in Model.LatestNews) + { +
+ NEW +
+

@newsItem

+ Updated: @DateTime.Now.ToString("MMM dd, yyyy") +
+
+ } +
+ } + else + { +

No news available at this time.

+ } +
+
+ + +
+
+

Core GHAS Features

+
+
+
+
+
Code Scanning
+

Automated vulnerability detection using CodeQL semantic analysis engine.

+ +
Secret Scanning
+

Detect and prevent secrets from being committed to repositories.

+
+
+
Dependency Review
+

Understand security impact of dependency changes in pull requests.

+ +
Security Overview
+

Organization-wide security posture visibility and compliance tracking.

+
+
+
+
+
+ + +
+ +
+
+

+ Security Demo +

+
+
+

+ This page contains intentionally vulnerable code for demonstration purposes. + These vulnerabilities should be detected by GHAS code scanning. +

+ + +
+
+ + +
+ ⚠️ This uses a vulnerable regex pattern susceptible to ReDoS attacks. +
+
+ +
+
+
+ + +
+
+

Quick Links

+
+
+
+ + GHAS Documentation + + + CodeQL Repository + + + Code Scanning Guide + + + Secret Scanning + +
+
+
+
+
+ + +
+
+ +
+
+
+ +@section Scripts { + +} diff --git a/src/webapp01/Pages/DevSecOps.cshtml.cs b/src/webapp01/Pages/DevSecOps.cshtml.cs new file mode 100644 index 0000000..acff4fc --- /dev/null +++ b/src/webapp01/Pages/DevSecOps.cshtml.cs @@ -0,0 +1,105 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.RazorPages; +using System.Text.RegularExpressions; +using Microsoft.Data.SqlClient; +using Newtonsoft.Json; +using System.Text.Json; + +namespace webapp01.Pages +{ + public class DevSecOpsModel : PageModel + { + private readonly ILogger _logger; + + // Hardcoded credentials for demo purposes - INSECURE + private const string CONNECTION_STRING = "Server=localhost;Database=TestDB;User Id=admin;Password=SecretPassword123!;"; + + // Weak regex pattern - vulnerable to ReDoS + private static readonly Regex VulnerableRegex = new Regex(@"^(a+)+$", RegexOptions.Compiled); + + public DevSecOpsModel(ILogger logger) + { + _logger = logger; + } + + public List LatestNews { get; set; } = new(); public void OnGet() + { + // Log forging vulnerability - user input directly in logs + string userInput = Request.Query.ContainsKey("user") ? Request.Query["user"].ToString() ?? "anonymous" : "anonymous"; + _logger.LogInformation($"User accessed DevSecOps page: {userInput}"); + + // Simulate getting latest news about GitHub Advanced Security + LoadLatestGHASNews(); + + // Demonstrate potential ReDoS vulnerability + string testPattern = Request.Query.ContainsKey("pattern") ? Request.Query["pattern"].ToString() ?? "aaa" : "aaa"; + try + { + bool isMatch = VulnerableRegex.IsMatch(testPattern); + _logger.LogInformation($"Regex pattern match result: {isMatch} for input: {testPattern}"); + } + catch (Exception ex) + { + // Log forging in exception handling + _logger.LogError($"Regex evaluation failed for pattern: {testPattern}. Error: {ex.Message}"); + } + + // Simulate database connection with hardcoded credentials + try + { + using var connection = new SqlConnection(CONNECTION_STRING); + _logger.LogInformation("Attempting database connection..."); + // Don't actually open connection for demo purposes + } + catch (Exception ex) + { + _logger.LogError($"Database connection failed: {ex.Message}"); + } + } + + private void LoadLatestGHASNews() + { + LatestNews = new List + { + "GitHub Advanced Security now supports enhanced code scanning with CodeQL 2.20", + "New secret scanning patterns added for over 200 service providers", + "Dependency review alerts now include detailed remediation guidance", + "Security advisories integration improved for better vulnerability management", + "Custom CodeQL queries can now be shared across organizations", + "AI-powered security suggestions available in GitHub Copilot for Security", + "New compliance frameworks supported in security overview dashboard", + "Enhanced SARIF support for third-party security tools integration" + }; + + // Potential JSON deserialization vulnerability + string jsonData = JsonConvert.SerializeObject(LatestNews); + var deserializedData = JsonConvert.DeserializeObject>(jsonData); + + _logger.LogInformation($"Loaded {LatestNews.Count} news items about GitHub Advanced Security"); + } + + public IActionResult OnPostTestRegex(string pattern) + { + if (string.IsNullOrEmpty(pattern)) + return BadRequest("Pattern cannot be empty"); + + // Log forging vulnerability in POST handler + _logger.LogInformation($"Testing regex pattern submitted by user: {pattern}"); + + try + { + // Vulnerable regex that could cause ReDoS + bool result = VulnerableRegex.IsMatch(pattern); + TempData["RegexResult"] = $"Pattern '{pattern}' match result: {result}"; + } + catch (Exception ex) + { + // Logging sensitive information + _logger.LogError($"Regex test failed for pattern: {pattern}. Exception: {ex}"); + TempData["RegexError"] = "Pattern evaluation failed"; + } + + return RedirectToPage(); + } + } +} diff --git a/src/webapp01/Pages/Index.cshtml b/src/webapp01/Pages/Index.cshtml index 394a289..e0db7f6 100644 --- a/src/webapp01/Pages/Index.cshtml +++ b/src/webapp01/Pages/Index.cshtml @@ -9,5 +9,9 @@
.NET 💜 Azure v5

Learn about building Web apps with ASP.NET Core.

Visit our About GHAS page to learn about GitHub Advanced Security features.

+

+ New! Check out our DevSecOps Demo + page to see the latest GHAS features and security demonstrations. +

diff --git a/src/webapp01/Pages/Shared/_Layout.cshtml b/src/webapp01/Pages/Shared/_Layout.cshtml index f8bf480..bcaf503 100644 --- a/src/webapp01/Pages/Shared/_Layout.cshtml +++ b/src/webapp01/Pages/Shared/_Layout.cshtml @@ -18,14 +18,16 @@ aria-expanded="false" aria-label="Toggle navigation"> -
-
    +
    • Home
    • About GHAS
      • +
    • + DevSecOps Demo +
    • Privacy
      • diff --git a/src/webapp01/webapp01.csproj b/src/webapp01/webapp01.csproj index 0fdd793..f3e9796 100644 --- a/src/webapp01/webapp01.csproj +++ b/src/webapp01/webapp01.csproj @@ -8,12 +8,12 @@ Linux . - - + - + +