From caa16764e58d8e030d4203e1a3198f89d7bb3a62 Mon Sep 17 00:00:00 2001 From: Al Snow Date: Tue, 14 Oct 2014 14:23:25 -0400 Subject: [PATCH 01/17] Upgraded 3 gems by rebuilding Gemfile.lock file --- Gemfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index c225e1b..cea4db8 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -41,7 +41,7 @@ GEM rack (>= 0.9.0) binding_of_caller (0.7.2) debug_inspector (>= 0.0.1) - brakeman (2.6.2) + brakeman (2.6.3) erubis (~> 2.6) fastercsv (~> 1.5) haml (>= 3.0, < 5.0) @@ -56,7 +56,7 @@ GEM bundler-audit (0.3.1) bundler (~> 1.2) thor (~> 0.18) - capybara (2.4.3) + capybara (2.4.4) mime-types (>= 1.16) nokogiri (>= 1.3.3) rack (>= 1.0.0) @@ -96,7 +96,7 @@ GEM eventmachine (1.0.3) execjs (2.2.1) fastercsv (1.5.5) - ffi (1.9.5) + ffi (1.9.6) foreman (0.75.0) dotenv (~> 0.11.1) thor (~> 0.19.1) From 10b532d4d64f0f95daaedf56541a1f543b7f3a44 Mon Sep 17 00:00:00 2001 From: jackMannino Date: Tue, 14 Oct 2014 16:20:22 -0400 Subject: [PATCH 02/17] this should resolve issue #162 --- .gitignore | 1 + .vagrant/machines/default/virtualbox/action_provision | 1 - .vagrant/machines/default/virtualbox/action_set_name | 1 - .vagrant/machines/default/virtualbox/id | 1 - .vagrant/machines/default/virtualbox/index_uuid | 1 - .vagrant/machines/default/virtualbox/synced_folders | 1 - 6 files changed, 1 insertion(+), 5 deletions(-) delete mode 100644 .vagrant/machines/default/virtualbox/action_provision delete mode 100644 .vagrant/machines/default/virtualbox/action_set_name delete mode 100644 .vagrant/machines/default/virtualbox/id delete mode 100644 .vagrant/machines/default/virtualbox/index_uuid delete mode 100644 .vagrant/machines/default/virtualbox/synced_folders diff --git a/.gitignore b/.gitignore index d990b41..faea331 100755 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ *.png coverage .tags +/.vagrant diff --git a/.vagrant/machines/default/virtualbox/action_provision b/.vagrant/machines/default/virtualbox/action_provision deleted file mode 100644 index 77c6cb5..0000000 --- a/.vagrant/machines/default/virtualbox/action_provision +++ /dev/null @@ -1 +0,0 @@ -1.5:0310ed2b-180b-4362-8938-bb3e625f7d83 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/action_set_name b/.vagrant/machines/default/virtualbox/action_set_name deleted file mode 100644 index b935995..0000000 --- a/.vagrant/machines/default/virtualbox/action_set_name +++ /dev/null @@ -1 +0,0 @@ -1411168755 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/id b/.vagrant/machines/default/virtualbox/id deleted file mode 100644 index f59565f..0000000 --- a/.vagrant/machines/default/virtualbox/id +++ /dev/null @@ -1 +0,0 @@ -0310ed2b-180b-4362-8938-bb3e625f7d83 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/index_uuid b/.vagrant/machines/default/virtualbox/index_uuid deleted file mode 100644 index 5843c30..0000000 --- a/.vagrant/machines/default/virtualbox/index_uuid +++ /dev/null @@ -1 +0,0 @@ -78e19905ec554042b35b3ff48edea617 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/synced_folders b/.vagrant/machines/default/virtualbox/synced_folders deleted file mode 100644 index d2e7a75..0000000 --- a/.vagrant/machines/default/virtualbox/synced_folders +++ /dev/null @@ -1 +0,0 @@ -{"virtualbox":{"/vagrant":{"guestpath":"/vagrant","hostpath":"/Users/cktricky/tmp/railsgoat","disabled":false},"b2e07a9244":{"guestpath":"/var/lib/docker/docker_1411168823_77433","hostpath":"/Users/cktricky/tmp/railsgoat","disabled":false,"docker_guestpath":"/vagrant","docker_sfid":"b2e07ac2be7a6c1713ca3e8253dc1dc0","docker_host_sfid":"8cd68cef-7fe9-4719-a3ba-f0245b20edd3","id":"b2e07a9244","virtualbox__transient":true,"transient":true},"b2e07a1381":{"guestpath":"/var/lib/docker/docker_1411171335_76822","hostpath":"/Users/cktricky/tmp/railsgoat","disabled":false,"docker_guestpath":"/vagrant","docker_sfid":"b2e07ac2be7a6c1713ca3e8253dc1dc0","docker_host_sfid":"03541d0f-aa3f-485f-8c9f-3381de8e6fd4","id":"b2e07a1381","virtualbox__transient":true,"transient":true}}} \ No newline at end of file From 9eb2d9dd9134b7000a958701e3f7106bc61a7123 Mon Sep 17 00:00:00 2001 From: jackMannino Date: Tue, 14 Oct 2014 16:20:22 -0400 Subject: [PATCH 03/17] added vagrant files to gitignore --- .gitignore | 1 + .vagrant/machines/default/virtualbox/action_provision | 1 - .vagrant/machines/default/virtualbox/action_set_name | 1 - .vagrant/machines/default/virtualbox/id | 1 - .vagrant/machines/default/virtualbox/index_uuid | 1 - .vagrant/machines/default/virtualbox/synced_folders | 1 - 6 files changed, 1 insertion(+), 5 deletions(-) delete mode 100644 .vagrant/machines/default/virtualbox/action_provision delete mode 100644 .vagrant/machines/default/virtualbox/action_set_name delete mode 100644 .vagrant/machines/default/virtualbox/id delete mode 100644 .vagrant/machines/default/virtualbox/index_uuid delete mode 100644 .vagrant/machines/default/virtualbox/synced_folders diff --git a/.gitignore b/.gitignore index d990b41..faea331 100755 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ *.png coverage .tags +/.vagrant diff --git a/.vagrant/machines/default/virtualbox/action_provision b/.vagrant/machines/default/virtualbox/action_provision deleted file mode 100644 index 77c6cb5..0000000 --- a/.vagrant/machines/default/virtualbox/action_provision +++ /dev/null @@ -1 +0,0 @@ -1.5:0310ed2b-180b-4362-8938-bb3e625f7d83 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/action_set_name b/.vagrant/machines/default/virtualbox/action_set_name deleted file mode 100644 index b935995..0000000 --- a/.vagrant/machines/default/virtualbox/action_set_name +++ /dev/null @@ -1 +0,0 @@ -1411168755 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/id b/.vagrant/machines/default/virtualbox/id deleted file mode 100644 index f59565f..0000000 --- a/.vagrant/machines/default/virtualbox/id +++ /dev/null @@ -1 +0,0 @@ -0310ed2b-180b-4362-8938-bb3e625f7d83 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/index_uuid b/.vagrant/machines/default/virtualbox/index_uuid deleted file mode 100644 index 5843c30..0000000 --- a/.vagrant/machines/default/virtualbox/index_uuid +++ /dev/null @@ -1 +0,0 @@ -78e19905ec554042b35b3ff48edea617 \ No newline at end of file diff --git a/.vagrant/machines/default/virtualbox/synced_folders b/.vagrant/machines/default/virtualbox/synced_folders deleted file mode 100644 index d2e7a75..0000000 --- a/.vagrant/machines/default/virtualbox/synced_folders +++ /dev/null @@ -1 +0,0 @@ -{"virtualbox":{"/vagrant":{"guestpath":"/vagrant","hostpath":"/Users/cktricky/tmp/railsgoat","disabled":false},"b2e07a9244":{"guestpath":"/var/lib/docker/docker_1411168823_77433","hostpath":"/Users/cktricky/tmp/railsgoat","disabled":false,"docker_guestpath":"/vagrant","docker_sfid":"b2e07ac2be7a6c1713ca3e8253dc1dc0","docker_host_sfid":"8cd68cef-7fe9-4719-a3ba-f0245b20edd3","id":"b2e07a9244","virtualbox__transient":true,"transient":true},"b2e07a1381":{"guestpath":"/var/lib/docker/docker_1411171335_76822","hostpath":"/Users/cktricky/tmp/railsgoat","disabled":false,"docker_guestpath":"/vagrant","docker_sfid":"b2e07ac2be7a6c1713ca3e8253dc1dc0","docker_host_sfid":"03541d0f-aa3f-485f-8c9f-3381de8e6fd4","id":"b2e07a1381","virtualbox__transient":true,"transient":true}}} \ No newline at end of file From e2d4c0574c32ee8dff64b8f39f0921b58c16d0be Mon Sep 17 00:00:00 2001 From: Al Snow Date: Sun, 19 Oct 2014 11:37:38 -0400 Subject: [PATCH 04/17] Upgraded 4 gems by rebuilding Gemfile.lock file --- Gemfile.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index cea4db8..1a1c286 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -94,7 +94,7 @@ GEM http_parser.rb (~> 0.6.0) erubis (2.7.0) eventmachine (1.0.3) - execjs (2.2.1) + execjs (2.2.2) fastercsv (1.5.5) ffi (1.9.6) foreman (0.75.0) @@ -237,7 +237,7 @@ GEM sexp_processor (~> 4.0) ruby_parser (3.5.0) sexp_processor (~> 4.1) - sass (3.4.5) + sass (3.4.6) sass-rails (3.2.6) railties (~> 3.2.0) sass (>= 3.1.10) @@ -255,8 +255,8 @@ GEM skinny (0.2.3) eventmachine (~> 1.0.0) thin (~> 1.5.0) - slim (2.0.3) - temple (~> 0.6.6) + slim (2.1.0) + temple (~> 0.6.9) tilt (>= 1.3.3, < 2.1) slop (3.6.0) sprockets (2.2.2) @@ -265,7 +265,7 @@ GEM rack (~> 1.0) tilt (~> 1.1, != 1.3.0) sqlite3 (1.3.9) - temple (0.6.8) + temple (0.6.9) terminal-table (1.4.5) therubyracer (0.12.1) libv8 (~> 3.16.14.0) From d6f5d38f779d0df54a2657aea6ea0f1ed62e4257 Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 23 Oct 2014 16:41:54 -0500 Subject: [PATCH 05/17] removing the send tutorial for now --- app/views/tutorials/metaprogramming.html.erb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/views/tutorials/metaprogramming.html.erb b/app/views/tutorials/metaprogramming.html.erb index fc58bd6..565534b 100644 --- a/app/views/tutorials/metaprogramming.html.erb +++ b/app/views/tutorials/metaprogramming.html.erb @@ -7,7 +7,7 @@
- <%= render :partial => ("layouts/tutorial/metaprogramming/send")%> + <%#= render :partial => ("layouts/tutorial/metaprogramming/send")%>
From adc8290df8c350724be619cdc6244958f80dc71e Mon Sep 17 00:00:00 2001 From: Al Snow Date: Fri, 24 Oct 2014 10:57:11 -0400 Subject: [PATCH 06/17] Upgraded 3 gems by rebuilding Gemfile.lock file --- Gemfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 1a1c286..5ad895c 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -34,7 +34,7 @@ GEM childprocess (>= 0.3.6) cucumber (>= 1.1.1) rspec-expectations (>= 2.7.0) - bcrypt (3.1.7) + bcrypt (3.1.9) better_errors (2.0.0) coderay (>= 1.0.0) erubis (>= 2.6.6) @@ -176,7 +176,7 @@ GEM multi_json (~> 1.0) websocket-driver (>= 0.2.0) polyglot (0.3.5) - powder (0.2.1) + powder (0.2.2) thor (>= 0.11.5) pry (0.10.1) coderay (~> 1.1.0) @@ -284,7 +284,7 @@ GEM polyglot polyglot (>= 0.3.1) trollop (2.0) - tzinfo (0.3.41) + tzinfo (0.3.42) uglifier (2.5.3) execjs (>= 0.3.0) json (>= 1.8.0) From 87fed3a305171772078eaa25b4d02bcc83b0cda1 Mon Sep 17 00:00:00 2001 From: Al Snow Date: Tue, 28 Oct 2014 13:45:12 -0400 Subject: [PATCH 07/17] Rebuilt Gemfile.lock file; Fixed Time.now issue --- Gemfile.lock | 119 +++++++++++++++++- app/models/benefits.rb | 4 +- .../injection/_injection_command.html.erb | 6 +- report.html | 6 +- 4 files changed, 125 insertions(+), 10 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 5ad895c..351feaf 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -108,7 +108,7 @@ GEM trollop (~> 2.0) gherkin (2.12.2) multi_json (~> 1.3) - guard (2.6.1) + guard (2.7.0) formatador (>= 0.2.4) listen (~> 2.7) lumberjack (~> 1.0) @@ -265,7 +265,7 @@ GEM rack (~> 1.0) tilt (~> 1.1, != 1.3.0) sqlite3 (1.3.9) - temple (0.6.9) + temple (0.6.10) terminal-table (1.4.5) therubyracer (0.12.1) libv8 (~> 3.16.14.0) @@ -282,6 +282,121 @@ GEM json treetop (1.4.15) polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) + polyglot (>= 0.3.1) polyglot (>= 0.3.1) trollop (2.0) tzinfo (0.3.42) diff --git a/app/models/benefits.rb b/app/models/benefits.rb index 4a1cb9d..144a2f4 100644 --- a/app/models/benefits.rb +++ b/app/models/benefits.rb @@ -12,13 +12,13 @@ class Benefits < ActiveRecord::Base def self.make_backup(file, data_path, full_file_name) if File.exists?(full_file_name) - silence_streams(STDERR) { system("cp #{full_file_name} #{data_path}/bak#{Time.now.to_i}_#{file.original_filename}") } + silence_streams(STDERR) { system("cp #{full_file_name} #{data_path}/bak#{Time.zone.now.to_i}_#{file.original_filename}") } end end =begin def self.make_backup(file, data_path, full_file_name) - FileUtils.cp "#{full_file_name}", "#{data_path}/bak#{Time.now.to_i}_#{file.original_filename}" + FileUtils.cp "#{full_file_name}", "#{data_path}/bak#{Time.zone.now.to_i}_#{file.original_filename}" end =end diff --git a/app/views/layouts/tutorial/injection/_injection_command.html.erb b/app/views/layouts/tutorial/injection/_injection_command.html.erb index 59debec..f0c871f 100644 --- a/app/views/layouts/tutorial/injection/_injection_command.html.erb +++ b/app/views/layouts/tutorial/injection/_injection_command.html.erb @@ -67,7 +67,7 @@ end def self.make_backup(file, data_path, full_file_name) - system("cp #{full_file_name} #{data_path}/bak#{Time.now.to_i}_#{file.original_filename}") + system("cp #{full_file_name} #{data_path}/bak#{Time.zone.now.to_i}_#{file.original_filename}") end end @@ -131,7 +131,7 @@ 

           def self.make_backup(file, data_path, full_file_name)
-             FileUtils.cp "#{full_file_name}", "#{data_path}/bak#{Time.now.to_i}_#{file.original_filename}"
+             FileUtils.cp "#{full_file_name}", "#{data_path}/bak#{Time.zone.now.to_i}_#{file.original_filename}"
            end
@@ -153,4 +153,4 @@ - \ No newline at end of file + diff --git a/report.html b/report.html index d0b0aeb..c8c5512 100644 --- a/report.html +++ b/report.html @@ -807,7 +807,7 @@ p { Benefits Benefits.make_backup Command Injection -
Possible command injection near line 15: system("cp #{(local full_file_name)} #{(local data_path)}/ba... +