diff --git a/src/webapp01/Pages/DevSecOps.cshtml b/src/webapp01/Pages/DevSecOps.cshtml new file mode 100644 index 0000000..cd7d092 --- /dev/null +++ b/src/webapp01/Pages/DevSecOps.cshtml @@ -0,0 +1,55 @@ +@page +@model webapp01.Pages.DevSecOpsModel +@{ + ViewData["Title"] = "DevSecOps Demonstration"; +} + +
+

@ViewData["Title"]

+
+ +
+

GitHub Advanced Security (GHAS)

+

+ GitHub Advanced Security provides a suite of tools to help you secure your software development lifecycle directly within your GitHub workflow. + It helps you find and fix vulnerabilities earlier, automate security processes, and maintain compliance. +

+

Key features include:

+ + +

Demonstrating Insecure Code Patterns

+

This page's backend includes examples of insecure code patterns for educational purposes. These are things GHAS can help identify.

+ +

Log Forging Example

+

Try adding ?userInput=test%0AINFO: Fake log entry to the URL to see a log forging attempt.

+
+
+ + +
+ +
+ @if (!string.IsNullOrEmpty(Model.LogForgingTestResult)) + { +
@Model.LogForgingTestResult
+ } + +

Regex Exposure (ReDoS) Example

+

The backend has a regex pattern (a+)+$ which is vulnerable to ReDoS. Test with inputs like "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!" (many 'a's followed by an exclamation mark).

+
+
+ + +
+ +
+ @if (!string.IsNullOrEmpty(Model.RegexTestResult)) + { +
@Model.RegexTestResult
+ } + +
diff --git a/src/webapp01/Pages/DevSecOps.cshtml.cs b/src/webapp01/Pages/DevSecOps.cshtml.cs new file mode 100644 index 0000000..eea006c --- /dev/null +++ b/src/webapp01/Pages/DevSecOps.cshtml.cs @@ -0,0 +1,84 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.RazorPages; +using Microsoft.Extensions.Logging; +using System; +using System.Text.RegularExpressions; + +namespace webapp01.Pages +{ + public class DevSecOpsModel : PageModel + { + private readonly ILogger _logger; + + [BindProperty(SupportsGet = true)] + public string? UserInput { get; set; } + + [BindProperty] + public string? RegexInput { get; set; } + + public string? LogForgingTestResult { get; private set; } + public string? RegexTestResult { get; private set; } + + public DevSecOpsModel(ILogger logger) + { + _logger = logger; + } + + public void OnGet() + { + _logger.LogInformation("DevSecOps page visited at {Time}", DateTime.UtcNow); + + if (!string.IsNullOrEmpty(UserInput)) + { + // Insecure Log Forging: UserInput is directly logged. + // A malicious user could inject newline characters and fake log entries. + // Example: userInput = "test%0AINFO:+User+logged+out" + _logger.LogInformation("User input from query: " + UserInput); + LogForgingTestResult = $"Logged: 'User input from query: {UserInput}'. Check the application logs."; + } + } + + public IActionResult OnPostCheckRegex() + { + _logger.LogInformation("Checking regex pattern for input: {Input}", RegexInput); + RegexTestResult = PerformRegexCheck(RegexInput ?? string.Empty); + return Page(); + } + + private string PerformRegexCheck(string input) + { + // Insecure Regex (Potential ReDoS - Regular Expression Denial of Service) + // The pattern (a+)+$ is an example of an "evil regex". + // With inputs like "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!" (many 'a's followed by '!') + // it can cause catastrophic backtracking, leading to high CPU usage and denial of service. + // GHAS Code Scanning can often detect such vulnerable regex patterns. + string pattern = @"(a+)+$"; + string result; + try + { + // It's good practice to set a timeout for regex operations. + if (Regex.IsMatch(input, pattern, RegexOptions.None, TimeSpan.FromSeconds(2))) + { + result = "Regex pattern matched."; + _logger.LogInformation(result); + } + else + { + result = "Regex pattern did not match."; + _logger.LogInformation(result); + } + } + catch (RegexMatchTimeoutException ex) + { + result = $"Regex operation timed out for input: '{input}'. This indicates a potential ReDoS vulnerability. Exception: {ex.Message}"; + _logger.LogWarning(result); + } + catch (Exception ex) + { + result = $"An error occurred during regex matching: {ex.Message}"; + _logger.LogError(ex, result); + } + return result; + } + } +} diff --git a/src/webapp01/Pages/Index.cshtml b/src/webapp01/Pages/Index.cshtml index f6c6665..b4c4754 100644 --- a/src/webapp01/Pages/Index.cshtml +++ b/src/webapp01/Pages/Index.cshtml @@ -9,5 +9,6 @@
.NET 💜 Azure v4

Learn about building Web apps with ASP.NET Core.

Visit our About GHAS page to learn about GitHub Advanced Security features.

+

Explore our DevSecOps Demo page.

diff --git a/src/webapp01/webapp01.csproj b/src/webapp01/webapp01.csproj index 0fdd793..9c86888 100644 --- a/src/webapp01/webapp01.csproj +++ b/src/webapp01/webapp01.csproj @@ -13,6 +13,7 @@ +