Ken Johnson
9f157012b0
This commit adds comprehensive coverage of OWASP Top 10 2025 categories, implementing both ReDoS (A05:2025) and Software Supply Chain (A03:2025) vulnerabilities for educational purposes. ## New Vulnerabilities Added ### A05:2025 - Injection (ReDoS) - Implemented three ReDoS endpoints in TutorialsController: - POST /tutorials/redos_email - Vulnerable email regex with nested quantifiers - POST /tutorials/redos_username - Classic (a+)+ pattern - POST /tutorials/redos_email_safe - Secure version using URI::MailTo::EMAIL_REGEXP - Added Regexp.timeout = 1.0 configuration (Rails 8 protection) - All endpoints include timing and error handling demonstrations ### A03:2025 - Software Supply Chain Failures - Demonstrated missing SRI on CDN assets in application.html.erb - Added educational endpoints: - GET /tutorials/supply_chain - Comprehensive supply chain vulnerabilities overview - GET /tutorials/check_dependencies - Dependency scanning simulation - Covers: Missing SRI, outdated dependencies, no SBOM, insecure gem sources ## Files Changed ### New Files - config/initializers/regexp_timeout.rb: Enables Rails 8 ReDoS protection - spec/controllers/tutorials_controller_spec.rb: 23 passing tests for all endpoints ### Modified Files - app/controllers/tutorials_controller.rb: Added 5 new educational endpoints - app/views/layouts/application.html.erb: Added CDN assets WITHOUT SRI (intentional vuln) - config/routes.rb: Added routes for ReDoS and supply chain endpoints ## Test Coverage - 23 RSpec tests covering both ReDoS and A03 vulnerabilities - Tests validate vulnerability behavior, error handling, and educational content - All tests passing ## Educational Value - Demonstrates OWASP 2025 categories A03 and A05 - Shows both vulnerable and secure implementations - Includes real-world CVE examples (British Airways, Magecart) - Provides mitigation guidance and tool recommendations This completes 100% coverage of OWASP Top 10 2025 categories in RailsGoat Rails 8. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
81 lines
1.6 KiB
Ruby
81 lines
1.6 KiB
Ruby
# frozen_string_literal: true
|
|
Railsgoat::Application.routes.draw do
|
|
|
|
get "login" => "sessions#new"
|
|
get "signup" => "users#new"
|
|
get "logout" => "sessions#destroy"
|
|
|
|
get "forgot_password" => "password_resets#forgot_password"
|
|
post "forgot_password" => "password_resets#send_forgot_password"
|
|
get "password_resets" => "password_resets#confirm_token"
|
|
post "password_resets" => "password_resets#reset_password"
|
|
|
|
get "dashboard/doc" => "dashboard#doc"
|
|
|
|
resources :sessions
|
|
|
|
resources :users do
|
|
get "account_settings"
|
|
|
|
resources :retirement
|
|
resources :paid_time_off
|
|
resources :work_info
|
|
resources :performance
|
|
resources :benefit_forms
|
|
resources :messages
|
|
|
|
resources :pay do
|
|
collection do
|
|
post "update_dd_info"
|
|
post "decrypted_bank_acct_num"
|
|
end
|
|
end
|
|
|
|
end
|
|
|
|
get "download" => "benefit_forms#download"
|
|
post "upload" => "benefit_forms#upload"
|
|
|
|
resources :tutorials do
|
|
collection do
|
|
get "credentials"
|
|
post "redos_email"
|
|
post "redos_username"
|
|
post "redos_email_safe"
|
|
get "supply_chain"
|
|
get "check_dependencies"
|
|
end
|
|
end
|
|
|
|
resources :schedule do
|
|
collection do
|
|
get "get_pto_schedule"
|
|
end
|
|
end
|
|
|
|
resources :admin do
|
|
get "dashboard"
|
|
get "get_user"
|
|
post "delete_user"
|
|
patch "update_user"
|
|
get "get_all_users"
|
|
get "analytics"
|
|
end
|
|
|
|
resources :dashboard do
|
|
collection do
|
|
get "home"
|
|
get "change_graph"
|
|
end
|
|
end
|
|
|
|
namespace :api, defaults: {format: "json"} do
|
|
namespace :v1 do
|
|
resources :users
|
|
resources :mobile
|
|
end
|
|
end
|
|
|
|
root to: "sessions#new"
|
|
end
|