From dfb13f0793b6297467190272ab86a9542d6c3162 Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Wed, 20 Aug 2025 14:52:31 -0400 Subject: [PATCH] Implement DevSecOps3 demo page with GHAS v3 features - Add new DevSecOps3.cshtml page with latest GitHub Advanced Security content - Implement DevSecOps3Model with intentionally insecure code for demo purposes - ReDoS vulnerable regex pattern - Log forging vulnerabilities - Hardcoded credentials and secrets - SQL injection potential - Excessive error information disclosure - Update package references to exact versions specified: - System.Text.Json 8.0.4 - Microsoft.Data.SqlClient 5.0.2 - Newtonsoft.Json 12.0.2 - Add navigation links to DevSecOps3 page in layout and index - Add ILogger implementation for backend code - Build successful with intentional vulnerability warnings for GHAS demo Addresses issue #84 --- src/webapp01/Pages/DevSecOps3.cshtml | 189 +++++++++++++++++++++++ src/webapp01/Pages/DevSecOps3.cshtml.cs | 102 ++++++++++++ src/webapp01/Pages/Index.cshtml | 4 + src/webapp01/Pages/Shared/_Layout.cshtml | 3 + src/webapp01/webapp01.csproj | 2 +- 5 files changed, 299 insertions(+), 1 deletion(-) create mode 100644 src/webapp01/Pages/DevSecOps3.cshtml create mode 100644 src/webapp01/Pages/DevSecOps3.cshtml.cs diff --git a/src/webapp01/Pages/DevSecOps3.cshtml b/src/webapp01/Pages/DevSecOps3.cshtml new file mode 100644 index 0000000..baec11c --- /dev/null +++ b/src/webapp01/Pages/DevSecOps3.cshtml @@ -0,0 +1,189 @@ +@page +@model DevSecOps3Model +@{ + ViewData["Title"] = "DevSecOps with GitHub Advanced Security v3"; +} + +
+
+
+

@ViewData["Title"]

+

Explore the latest features and capabilities of GitHub Advanced Security (GHAS) v3

+
+
+
+ + + @if (TempData["RegexResult"] != null) + { + + } + + @if (TempData["RegexError"] != null) + { + + } + + @if (TempData["LogResult"] != null) + { + + } + + +
+
+
+
+

Latest GitHub Advanced Security News

+
+
+
What's New in GHAS 2024-2025
+
    +
  • + Enhanced CodeQL Analysis: Improved detection for supply chain vulnerabilities and zero-day exploits +
    • +
  • + AI-Powered Security Insights: GitHub Copilot integration for automated security recommendations +
    • +
  • + Advanced Secret Scanning: Real-time detection with enterprise-grade pattern matching +
    • +
  • + Dependency Review v3: Enhanced vulnerability assessment with risk scoring and remediation guidance +
    • +
  • + Security Advisory Database: Comprehensive threat intelligence with automated patch suggestions +
    • +
+
+
+
+
+ + +
+
+
+
+

Security Demo: Regex Exposure

+
+
+

This demo shows potential ReDoS (Regular Expression Denial of Service) vulnerabilities:

+
+
+ + +
+ +
+ Note: This uses a potentially vulnerable regex pattern for demonstration purposes +
+
+
+ +
+
+
+

Security Demo: Log Forging

+
+
+

This demo shows log injection vulnerabilities:

+
+
+ + +
+ +
+ Note: This demonstrates insecure logging practices +
+
+
+
+ + +
+
+
+
+

GHAS v3 Core Features

+
+
+
+
+
Code Scanning
+
    +
  • CodeQL semantic analysis
    • +
  • Third-party tool integration
    • +
  • Custom query development
    • +
  • Real-time PR scanning
    • +
+
+
+
Secret Scanning
+
    +
  • Provider-specific patterns
    • +
  • Custom secret patterns
    • +
  • Push protection
    • +
  • Historical scan capabilities
    • +
+
+
+
Dependency Management
+
    +
  • Dependabot security updates
    • +
  • License compliance
    • +
  • Vulnerability database
    • +
  • Supply chain security
    • +
+
+
+
+
+
+
+ + +
+
+
+
+

GHAS v3 Resources

+
+
+
+
+
Documentation
+ +
+
+
Training & Certification
+ +
+
+
+
+
+
+
diff --git a/src/webapp01/Pages/DevSecOps3.cshtml.cs b/src/webapp01/Pages/DevSecOps3.cshtml.cs new file mode 100644 index 0000000..2703bdb --- /dev/null +++ b/src/webapp01/Pages/DevSecOps3.cshtml.cs @@ -0,0 +1,102 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.RazorPages; +using System.Text.RegularExpressions; +using Microsoft.Data.SqlClient; +using Newtonsoft.Json; +using System.Text.Json; + +namespace webapp01.Pages +{ + public class DevSecOps3Model : PageModel + { + private readonly ILogger _logger; + + public DevSecOps3Model(ILogger logger) + { + _logger = logger; + } + + public void OnGet() + { + _logger.LogInformation("DevSecOps3 page accessed at {DateTime}", DateTime.Now); + } + + public IActionResult OnPostTestRegex(string userInput) + { + try + { + // SECURITY ISSUE: This regex pattern is vulnerable to ReDoS (Regular Expression Denial of Service) + // The pattern (a+)+ creates exponential backtracking with inputs like "aaaaaaaaaaaaaaaaaaaaaaaaaaaa!" + var vulnerablePattern = @"^(a+)+$"; + + _logger.LogInformation("Testing regex with input: {Input}", userInput); + + var regex = new Regex(vulnerablePattern); + var isMatch = regex.IsMatch(userInput ?? ""); + + TempData["RegexResult"] = $"Regex test completed. Input '{userInput}' match result: {isMatch}"; + + return RedirectToPage(); + } + catch (Exception ex) + { + // SECURITY ISSUE: Exposing exception details in logs without sanitization + _logger.LogError("Regex processing failed: {Exception}", ex.ToString()); + TempData["RegexError"] = $"Regex processing failed: {ex.Message}"; + return RedirectToPage(); + } + } + + public IActionResult OnPostTestLogging(string logMessage) + { + try + { + // SECURITY ISSUE: Log forging vulnerability - user input directly written to logs + // Malicious input like "Normal log\r\n[ADMIN] Unauthorized access granted" + // could inject fake log entries + _logger.LogInformation("User action: {Message}", logMessage); + + // SECURITY ISSUE: Hardcoded credentials for demo purposes + var connectionString = "Server=localhost;Database=TestDB;User Id=admin;Password=Password123!;"; + + // SECURITY ISSUE: Potential SQL injection if this were used in actual queries + var sqlQuery = $"INSERT INTO Logs (Message) VALUES ('{logMessage}')"; + + // SECURITY ISSUE: Using both JSON libraries unnecessarily (dependency confusion risk) + var jsonData = JsonConvert.SerializeObject(new { message = logMessage, timestamp = DateTime.Now }); + var systemJsonData = System.Text.Json.JsonSerializer.Serialize(new { message = logMessage, timestamp = DateTime.Now }); + + _logger.LogInformation("Serialized data: {JsonData}", jsonData); + + TempData["LogResult"] = $"Log entry created: '{logMessage}' at {DateTime.Now}"; + + return RedirectToPage(); + } + catch (Exception ex) + { + // SECURITY ISSUE: Excessive error information disclosure + _logger.LogError("Logging operation failed with full exception: {FullException}", ex); + TempData["LogResult"] = $"Logging failed: {ex.Message} - {ex.StackTrace}"; + return RedirectToPage(); + } + } + + // SECURITY ISSUE: Method with potential for misuse if exposed + private void ProcessSensitiveData(string userData) + { + // SECURITY ISSUE: No input validation or sanitization + var processedData = userData.ToUpper(); + + // SECURITY ISSUE: Logging sensitive data without redaction + _logger.LogInformation("Processing sensitive data: {SensitiveData}", processedData); + + // SECURITY ISSUE: Hardcoded secret key + var secretKey = "MySecretKey123!@#"; + + // SECURITY ISSUE: Weak encryption simulation + var encodedData = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(processedData + secretKey)); + + _logger.LogInformation("Encoded result: {EncodedData}", encodedData); + } + } +} diff --git a/src/webapp01/Pages/Index.cshtml b/src/webapp01/Pages/Index.cshtml index e528b40..c30fb4e 100644 --- a/src/webapp01/Pages/Index.cshtml +++ b/src/webapp01/Pages/Index.cshtml @@ -13,5 +13,9 @@ New! Check out our DevSecOps Demo page to see the latest GHAS features and security demonstrations.

+

+ Latest! Explore our brand new DevSecOps v3 Demo + page featuring the newest GitHub Advanced Security v3 capabilities and enhanced security demonstrations. +

diff --git a/src/webapp01/Pages/Shared/_Layout.cshtml b/src/webapp01/Pages/Shared/_Layout.cshtml index bcaf503..9da39d0 100644 --- a/src/webapp01/Pages/Shared/_Layout.cshtml +++ b/src/webapp01/Pages/Shared/_Layout.cshtml @@ -28,6 +28,9 @@
  • DevSecOps Demo
    • +
  • + DevSecOps v3 +
  • Privacy
    • diff --git a/src/webapp01/webapp01.csproj b/src/webapp01/webapp01.csproj index 9b11105..f3e9796 100644 --- a/src/webapp01/webapp01.csproj +++ b/src/webapp01/webapp01.csproj @@ -13,7 +13,7 @@ - +