Commit Graph

120 Commits

Author SHA1 Message Date
robbiepaul b79bdf1976 Use Puma
CI / test (3.4.1) (push) Has been cancelled
2026-04-27 19:56:56 +01:00
robbiepaul de00187ec1 Use Puma
CI / test (3.4.1) (push) Has been cancelled
2026-04-27 19:38:07 +01:00
robbiepaul 5b6337a868 Use Puma
CI / test (3.4.1) (push) Has been cancelled
2026-04-27 19:28:10 +01:00
robbiepaul 8cd29793be Fix activestorage config error
CI / test (3.4.1) (push) Has been cancelled
2026-04-27 17:26:13 +01:00
Your Name d920cd1494 add storage
CI / test (3.4.1) (push) Has been cancelled
2026-04-26 23:29:32 +01:00
Shiva Chethan Reddy 39bc3ed974 Add bonus documentation for Rails encrypted secrets 2026-01-11 13:06:41 +05:30
Ken Johnson 7712f5867f Fix test failures on Ubuntu and other platforms (issue #486)
Fixes test suite to run cleanly across different platforms (macOS, Linux, Windows)
after the Rails 5→8 upgrade and UI/UX overhaul.

## Issues Fixed

1. **Firefox/Selenium driver errors**: Removed deprecated Poltergeist/PhantomJS
   configuration and properly configured Selenium with headless Chrome. This
   works across all platforms without requiring Firefox.

2. **CSS selector errors** ('Unable to find css ".signup"'): The UI/UX overhaul
   removed the .signup CSS class. Updated the login helper to work with the
   new login form structure.

3. **Ambiguous Login button**: The new UI has both a Login button and Login link.
   Changed from `click_on "Login"` to `click_button "Login"` to be specific.

4. **Deprecation warning**: Opted into Rails 8.1 behavior for to_time timezone
   preservation to eliminate deprecation warnings.

## Changes

- spec/support/capybara_shared.rb:
  * Removed deprecated Poltergeist/PhantomJS configuration
  * Configured Selenium with headless Chrome
  * Updated login helper to work with new UI (removed .signup/.actions selectors)
  * Changed click_on to click_button for specificity

- spec/spec_helper.rb:
  * Removed conflicting Capybara.javascript_driver override that was forcing
    selenium_headless (which tried to use Firefox)

- config/application.rb:
  * Added config.active_support.to_time_preserves_timezone = :zone to opt into
    Rails 8.1 behavior and eliminate deprecation warning

## Test Results

Before: 43 failures (driver errors, CSS selector errors)
After: 46 examples, 0 failures, 14 pending 

The 14 pending specs are expected - they verify vulnerabilities still exist.

## Platform Requirements

JavaScript tests now require Chrome/Chromium to be installed:
- macOS: Chrome is usually installed
- Ubuntu: `sudo apt-get install chromium-browser chromium-chromedriver`
- Windows: Chrome is usually installed

Fixes #486

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-04 11:09:14 -05:00
Ken Johnson bcf1aabd35 Add redirect for GET requests to /upload endpoint
Added a redirect handler for users who try to access /upload via GET
request instead of using the form POST. This prevents errors and guides
users to the proper upload form.

Changes:
- Added GET route for /upload that redirects to benefit forms page
- Added redirect_to_benefit_forms action in controller
- Shows info flash message directing users to the upload form

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-11 13:25:50 +00:00
Ken Johnson 9f157012b0 Add Rails 8 vulnerabilities aligned with OWASP Top 10 2025
This commit adds comprehensive coverage of OWASP Top 10 2025 categories,
implementing both ReDoS (A05:2025) and Software Supply Chain (A03:2025)
vulnerabilities for educational purposes.

## New Vulnerabilities Added

### A05:2025 - Injection (ReDoS)
- Implemented three ReDoS endpoints in TutorialsController:
  - POST /tutorials/redos_email - Vulnerable email regex with nested quantifiers
  - POST /tutorials/redos_username - Classic (a+)+ pattern
  - POST /tutorials/redos_email_safe - Secure version using URI::MailTo::EMAIL_REGEXP
- Added Regexp.timeout = 1.0 configuration (Rails 8 protection)
- All endpoints include timing and error handling demonstrations

### A03:2025 - Software Supply Chain Failures
- Demonstrated missing SRI on CDN assets in application.html.erb
- Added educational endpoints:
  - GET /tutorials/supply_chain - Comprehensive supply chain vulnerabilities overview
  - GET /tutorials/check_dependencies - Dependency scanning simulation
- Covers: Missing SRI, outdated dependencies, no SBOM, insecure gem sources

## Files Changed

### New Files
- config/initializers/regexp_timeout.rb: Enables Rails 8 ReDoS protection
- spec/controllers/tutorials_controller_spec.rb: 23 passing tests for all endpoints

### Modified Files
- app/controllers/tutorials_controller.rb: Added 5 new educational endpoints
- app/views/layouts/application.html.erb: Added CDN assets WITHOUT SRI (intentional vuln)
- config/routes.rb: Added routes for ReDoS and supply chain endpoints

## Test Coverage
- 23 RSpec tests covering both ReDoS and A03 vulnerabilities
- Tests validate vulnerability behavior, error handling, and educational content
- All tests passing

## Educational Value
- Demonstrates OWASP 2025 categories A03 and A05
- Shows both vulnerable and secure implementations
- Includes real-world CVE examples (British Airways, Magecart)
- Provides mitigation guidance and tool recommendations

This completes 100% coverage of OWASP Top 10 2025 categories in RailsGoat Rails 8.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-06 15:11:54 -05:00
Ken Toler 11819bf14c Squashing changes associated with pg 2020-04-17 15:38:24 -04:00
Ken Toler ad311cdda1 added openshift configs 2020-03-01 13:57:00 -05:00
Ken Toler e5a03e4da6 pg update and config.hosts 2020-02-29 18:52:33 -05:00
Ken Toler 8c4e4283cd update database.yml to support openshift posgresql db 2020-02-28 21:49:12 -05:00
Al Snow 23d145129d Upgraded Ruby to 2.7.0-preview1 and Rails to 6.0.0 - fixed 1 spec 2019-09-09 15:13:29 -04:00
Al Snow 213bb0cfa4 Fixed i18n.fallbacks warning msg 2018-12-26 10:50:00 -05:00
Joseph Mastey c4f0b91534 use more idiomatic syntax for routes 2017-12-12 15:07:42 -06:00
Joseph Mastey 9902345291 chore(rubocop): giganto rubocop commit.
muahahahah
2017-12-05 18:46:21 -06:00
Joseph Mastey 284cd8811c feat(rubocop): use rubocop-github 2017-12-05 18:38:32 -06:00
Ken Johnson 3b16f04edd Merge pull request #278 from jmmastey/updated-minified-js
@jmmastey LGTM 👍 

Good call on removing the stock photos that shipped with this as well as updating libs and removing cruft. Thank you as always 🙇
2017-11-16 09:47:08 -05:00
mccabe615 ba7e9a7845 fixing rubocop config to remove github references 2017-11-14 11:11:43 -05:00
mccabe615 26b24a1ca5 removing github rubocop gem and adding the config into the project directly. 2017-11-14 10:44:05 -05:00
Joseph Mastey 0ac072e7e8 update fullcalendar js library, plus styles etc 2017-10-23 21:10:22 -05:00
Joseph Mastey f5a8e0c6a8 upgrade jQuery dataTable library, with minified version 2017-10-23 20:53:55 -05:00
Joseph Mastey 97e8b82e0c bug(password): fixes URL for password reset 2017-10-06 19:52:37 -05:00
Joseph Mastey ba684f95ec restore mysql environment to working 2017-01-19 16:10:47 -06:00
Joseph Mastey 54b8c291ea upgrade(rails 5): no longer use rake to invoke rake tasks, use rails
though I left the case alone where the command would previously been
just `bundle exec rake`, as doing the same doesn't work for rails.
2017-01-19 13:59:40 -06:00
Claudio Benvenuti 79b306fcae Fix METHOD for forgot_password route 2016-06-01 17:59:48 +02:00
Al Snow 8ddcd96917 Fixed PTO error page 2016-01-07 13:36:36 -05:00
Al Snow edf9a6d560 Upgraded ruby to 2.2.4 and gems: sprockets-rails and bundler 2015-12-18 10:51:26 -05:00
Al Snow 0604fa3c4e Fixed config.serve_static_assets DEPRECATION WARNING 2015-08-21 11:34:57 -04:00
cktricky 5c62c1b021 the setting was incorrect and did not match what we show in the tutorial 2015-08-18 12:27:20 -04:00
Al Snow 10014e1378 Fixed configs found during running 'rails server' 2015-04-09 15:23:40 -04:00
Al Snow 890b77bdaf Upgraded 5 gems by rebuilding Gemfile.lock file 2015-03-28 10:46:52 -04:00
Ken Johnson a6e5ba63cc Merge pull request #197 from OWASP/tuts
This removes tutorials from the local copy of railsgoat in favor of the wiki
2015-03-27 15:04:05 -07:00
cktricky efe81fb6a6 okay, a lot of changes but this basically gets us out of tutorials being hosted locally 2015-03-25 19:32:12 -04:00
Al Snow 9838cf2bad Resynced with parent repo 2015-03-23 13:11:40 -04:00
Mike McCabe 7e3e35e3d3 disabling livereload and updating mailcatcher settings 2015-03-21 13:44:28 -04:00
cktricky f8c771a84b Merge branch 'master' of github.com:OWASP/railsgoat into tuts 2015-03-20 18:46:51 -04:00
Al Snow 9e7eb02cde Merge branch 'master' of https://github.com/OWASP/railsgoat
Conflicts:
	Gemfile.lock
2015-02-26 09:13:15 -05:00
Mike McCabe b2c8e6cf8d Merge branch 'master' of github.com:OWASP/railsgoat 2015-02-23 21:30:37 -05:00
Mike McCabe 1eee953f62 adding render vuln 2015-02-23 20:36:53 -05:00
Al Snow ca0526ccc9 Upgraded to Rails 4.0.13; Rebuilt Gemfile.lock file 2015-01-10 09:45:51 -05:00
cktricky 907045488d this change allows the app to get the csrf fixes working when running rake training 2015-01-09 11:40:37 -05:00
cktricky 09ba2b3270 going to dynamically load the tutorial page depending on the route folks decide to take 2015-01-06 19:43:23 -05:00
Al Snow 80e1ede02b Added Fred's Strong Parameter work 2014-12-28 17:20:39 -05:00
Fred Nixon ea8e9901f4 On branch strong-params
Your branch is behind 'origin/strong-params' by 1 commit, and can be fast-forwarded.

I'll pull to catch up after this commit
Change code to whitelist params
Remove attr_accessible lines
Add strong_params to Gemfile, since this branch is still on Rails 3
Mixin to ActiveRecord::Base ActiveModel::ForbiddenAttributesProtection
Use an initializer for the mixin
2014-12-05 15:04:01 -05:00
Al Snow 0957033457 Upgraded to Ruby 2.1.3; Changed timeout value 2014-09-19 19:00:40 -04:00
Al Snow 74d047507a Changed timeout to 25000 for all envs 2014-09-19 11:12:32 -04:00
Al Snow 1ea0c2ddbb More Rails 4.0 upgrade changes
1. Compared existing branch with empty Rails 4.0 project and
    made changes as needed.
 2. Fix find/first warning.
 3. Fix sqlite timeout issue.
    -- config/database.yml
    -- spec/vulnerabilities/insecure_dor_spec.rb
2014-09-13 13:44:07 -04:00
Al Snow 23513cf8d2 Initial Rails 4.0.x upgrade 2014-09-07 13:00:54 -04:00