 Ken Johnson
|
9f157012b0
|
Add Rails 8 vulnerabilities aligned with OWASP Top 10 2025
This commit adds comprehensive coverage of OWASP Top 10 2025 categories,
implementing both ReDoS (A05:2025) and Software Supply Chain (A03:2025)
vulnerabilities for educational purposes.
## New Vulnerabilities Added
### A05:2025 - Injection (ReDoS)
- Implemented three ReDoS endpoints in TutorialsController:
- POST /tutorials/redos_email - Vulnerable email regex with nested quantifiers
- POST /tutorials/redos_username - Classic (a+)+ pattern
- POST /tutorials/redos_email_safe - Secure version using URI::MailTo::EMAIL_REGEXP
- Added Regexp.timeout = 1.0 configuration (Rails 8 protection)
- All endpoints include timing and error handling demonstrations
### A03:2025 - Software Supply Chain Failures
- Demonstrated missing SRI on CDN assets in application.html.erb
- Added educational endpoints:
- GET /tutorials/supply_chain - Comprehensive supply chain vulnerabilities overview
- GET /tutorials/check_dependencies - Dependency scanning simulation
- Covers: Missing SRI, outdated dependencies, no SBOM, insecure gem sources
## Files Changed
### New Files
- config/initializers/regexp_timeout.rb: Enables Rails 8 ReDoS protection
- spec/controllers/tutorials_controller_spec.rb: 23 passing tests for all endpoints
### Modified Files
- app/controllers/tutorials_controller.rb: Added 5 new educational endpoints
- app/views/layouts/application.html.erb: Added CDN assets WITHOUT SRI (intentional vuln)
- config/routes.rb: Added routes for ReDoS and supply chain endpoints
## Test Coverage
- 23 RSpec tests covering both ReDoS and A03 vulnerabilities
- Tests validate vulnerability behavior, error handling, and educational content
- All tests passing
## Educational Value
- Demonstrates OWASP 2025 categories A03 and A05
- Shows both vulnerable and secure implementations
- Includes real-world CVE examples (British Airways, Magecart)
- Provides mitigation guidance and tool recommendations
This completes 100% coverage of OWASP Top 10 2025 categories in RailsGoat Rails 8.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-12-06 15:11:54 -05:00 |
|
|
Joseph Mastey
|
9902345291
|
chore(rubocop): giganto rubocop commit.
muahahahah
|
2017-12-05 18:46:21 -06:00 |
|
|
cktricky
|
a06788ff58
|
commented out currently unused spec tests for the pay controller and model
|
2014-03-14 20:30:57 -04:00 |
|
|
cktricky
|
2c8781ebc1
|
added a pay controller and model
|
2014-03-14 20:29:14 -04:00 |
|
|
cktricky
|
caaa3ba96d
|
commented out unused spec tests as well as removed unnecessary require statement
|
2014-03-14 16:57:55 -04:00 |
|
|
cktricky
|
932d2304f9
|
okay first run at making an API for railsgoat
|
2014-03-12 12:38:41 -04:00 |
|
|
James Espinosa
|
bfa3467107
|
Remove default RSpec tests to fix build
|
2013-12-10 23:08:46 -06:00 |
|
|
James Espinosa
|
da1845e8f9
|
Implement working mailer and controller
|
2013-12-04 00:57:32 -06:00 |
|
|
Mike McCabe
|
4c6dc24200
|
removing empty tests
|
2013-11-12 15:07:21 -05:00 |
|
|
Mike McCabe
|
8686f6b9d3
|
adding messages mvc to allow users to send messages.
|
2013-10-11 16:03:37 -04:00 |
|