From 366edc3b09ab27055271c96939d634f6561e6ec9 Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 17 Apr 2014 11:33:18 -0400 Subject: [PATCH 01/16] not sure if this is working --- app/views/sessions/new.html.erb | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb index dbeea1f..2d1d450 100755 --- a/app/views/sessions/new.html.erb +++ b/app/views/sessions/new.html.erb @@ -1,3 +1,22 @@ +<<<<<<< HEAD +======= +
+ + +
+>>>>>>> ab536af... removing select but keeping DOM XSS

MetaCorp

A GoatGroup Company

@@ -38,4 +57,4 @@
- \ No newline at end of file + From 8cb6ff36ac6d44070ed570a1530c69002e0761ea Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 17 Apr 2014 11:37:02 -0400 Subject: [PATCH 02/16] removed needless diff stuff --- app/views/sessions/new.html.erb | 3 --- 1 file changed, 3 deletions(-) diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb index 2d1d450..eb80c99 100755 --- a/app/views/sessions/new.html.erb +++ b/app/views/sessions/new.html.erb @@ -1,5 +1,3 @@ -<<<<<<< HEAD -=======
->>>>>>> ab536af... removing select but keeping DOM XSS

MetaCorp

A GoatGroup Company

From 8e4e084dc9a90d40f5ae395e3d269ae60896258d Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 17 Apr 2014 12:51:02 -0400 Subject: [PATCH 03/16] Fixes #99. We have added the hogan method for escaping user input and added a tutorial --- app/assets/javascripts/application.js | 28 ++++ .../layouts/tutorial/xss/_dom_xss.html.erb | 125 ++++++++++++++++++ app/views/tutorials/xss.html.erb | 5 + 3 files changed, 158 insertions(+) create mode 100644 app/views/layouts/tutorial/xss/_dom_xss.html.erb diff --git a/app/assets/javascripts/application.js b/app/assets/javascripts/application.js index 653be27..283ba09 100755 --- a/app/assets/javascripts/application.js +++ b/app/assets/javascripts/application.js @@ -40,8 +40,36 @@ $("pre.ruby").snippet("ruby",{style:"rand01",transparent:true,showNum:true}); // with a transparent background // without showing line numbers. + + +$("pre.javascript").snippet("javascript",{style:"rand01",transparent:true,showNum:true}); + // Finds 
 elements with the class "js"
+    // and snippet highlights the JAVASCRIPT code within
+    // using a random style from the selection of 39
+    // with a transparent background
+    // without showing line numbers.
+
 };
 
+var rAmp = /&/g,
+     rLt = //g,
+     rApos = /\'/g,
+     rQuot = /\"/g,
+     hChars = /[&<>\"\']/;
+
+function hoganEscape(str) {
+    str = coerceToString(str);
+    return hChars.test(str) ?
+      str
+        .replace(rAmp, '&')
+        .replace(rLt, '<')
+        .replace(rGt, '>')
+        .replace(rApos, ''')
+        .replace(rQuot, '"') :
+      str;
+  }
+
 $(document).ready(function(){
 	rubyCodeFormat()
 });
diff --git a/app/views/layouts/tutorial/xss/_dom_xss.html.erb b/app/views/layouts/tutorial/xss/_dom_xss.html.erb
new file mode 100644
index 0000000..f0d18de
--- /dev/null
+++ b/app/views/layouts/tutorial/xss/_dom_xss.html.erb
@@ -0,0 +1,125 @@
+

+    

+      

+         A3 - Cross-Site Scripting ("XSS") - DOM Based
+      

+    

+    

+      

+        

+          

+            
+              
+              
+				Description
+            
+          

+          

+            

+             

+             DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.	
+             

+            

+          

+        

+        

+          

+            
+              
+              
+              Bug
+            
+          

+          

+            

+              

+			    The following code was taken from app/views/sessions/new.html.erb:
+			  

+			  
+				 <%= 
+				%{ 
+	  
+				} 
+				%>
+			  

+			  

+				The code (above) takes user input (params), and renders it back on the page without any output encoding or escaping.
+			  
	
+            

+          

+        

+        

+          

+            
+              
+              
+              Solution
+            
+          

+          

+            

+             
 Stored Cross-Site Scripting ATTACK:

+			 
 
+				Ensure you are signed out of the application first. Make sure you are using something like Firefox as Safari/Chrome won't work for this exercise. Then, use the following link (substitute hostname for your actual hostname) to execute an alert box:
+			 

+			 
+				<%= %{http://127.0.0.1:3000/#test=} %>
+			 
	
+			 
 Stored Cross-Site Scripting SOLUTION:

+			 
 
+			   Leverage the Hogan function for escaping (found in the application.js file) to escape user input:
+			 

+			 
+				<%= %{
+	 
+	 
+				}	
+				
+				%>
+			 
	
+            

+          

+        

+      	

+          

+            
+              
+              
+              Hint
+            
+          

+          

+            

+              

+			    You should view the source of the login page, might be something interesting there.
+			  

+            

+          

+        

+	

+    

+  

\ No newline at end of file
diff --git a/app/views/tutorials/xss.html.erb b/app/views/tutorials/xss.html.erb
index f8eff5c..d03193a 100755
--- a/app/views/tutorials/xss.html.erb
+++ b/app/views/tutorials/xss.html.erb
@@ -5,6 +5,11 @@
 		       <%= render :partial => "layouts/tutorial/xss/xss_first"%>
+
+
+ <%= render :partial => "layouts/tutorial/xss/dom_xss"%> +
+
From 8bc20e8f916c3e291938f4982e1f6c83150fb70c Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Wed, 9 Apr 2014 11:25:18 -0400 Subject: [PATCH 04/16] fixing name in messages --- app/models/message.rb | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/app/models/message.rb b/app/models/message.rb index 7894ae9..12aaaba 100644 --- a/app/models/message.rb +++ b/app/models/message.rb @@ -4,7 +4,10 @@ class Message < ActiveRecord::Base validates_presence_of :creator_id, :receiver_id, :message def creator_name - creator = User.where(:id => self.creator_id).first - creator.full_name + if creator = User.where(:user_id => self.creator_id).first + creator.full_name + else + "Name unavailable".html_safe + end end -end \ No newline at end of file +end From 833cdaeff94a612423f1f83e494bc9bc07005750 Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Mon, 7 Apr 2014 23:09:10 -0400 Subject: [PATCH 05/16] adding .tags to gitignore --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index c58b054..d990b41 100755 --- a/.gitignore +++ b/.gitignore @@ -7,4 +7,5 @@ .DS_Store /public/data *.png -coverage \ No newline at end of file +coverage +.tags From 9fd91a8224180dbef50b1278c8b14f642edc1290 Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Mon, 7 Apr 2014 23:09:48 -0400 Subject: [PATCH 06/16] initial commit of mobile controller --- app/controllers/api/v1/mobile_controller.rb | 32 +++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 app/controllers/api/v1/mobile_controller.rb diff --git a/app/controllers/api/v1/mobile_controller.rb b/app/controllers/api/v1/mobile_controller.rb new file mode 100644 index 0000000..dd07496 --- /dev/null +++ b/app/controllers/api/v1/mobile_controller.rb @@ -0,0 +1,32 @@ +class Api::V1::MobileController < ApplicationController + + skip_before_filter :authenticated + before_filter :mobile_request? + + respond_to :json + + def show + if params[:class] + model = params[:class].classify.constantize + respond_with model.find(params[:id]).to_json + end + end + + def index + if params[:class] + model = params[:class].classify.constantize + respond_with model.all.to_json + end + end + + private + + def mobile_request? + if session[:mobile_param] + session[:mobile_param] == "1" + else + request.user_agent =~ /ios|android/i + end + end + +end From e760fc00875c733781a787099a3cba525d8a1bff Mon Sep 17 00:00:00 2001 From: John Poulin Date: Tue, 8 Apr 2014 12:49:31 -0400 Subject: [PATCH 07/16] merging --- app/controllers/dashboard_controller.rb | 5 +++++ app/views/layouts/application.html.erb | 14 +++++++------- app/views/layouts/shared/_header.html.erb | 8 +++++--- 3 files changed, 17 insertions(+), 10 deletions(-) diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb index 593abe4..41d4236 100755 --- a/app/controllers/dashboard_controller.rb +++ b/app/controllers/dashboard_controller.rb @@ -4,6 +4,11 @@ class DashboardController < ApplicationController def home @user = current_user + + # See if the user has a font preference + if params[:font] + cookies[:font] = params[:font] + end end end diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index 4720e04..01d0022 100755 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -6,13 +6,13 @@ <%= javascript_include_tag "application" %> <%= csrf_meta_tags %> - - - - +<% +if cookies[:font] +%> + +<% +end +%> diff --git a/app/views/layouts/shared/_header.html.erb b/app/views/layouts/shared/_header.html.erb index 7c4d310..95f1b31 100755 --- a/app/views/layouts/shared/_header.html.erb +++ b/app/views/layouts/shared/_header.html.erb @@ -1,8 +1,10 @@
- + + Font Size: + A + A +