Ken Johnson
9f157012b0
This commit adds comprehensive coverage of OWASP Top 10 2025 categories, implementing both ReDoS (A05:2025) and Software Supply Chain (A03:2025) vulnerabilities for educational purposes. ## New Vulnerabilities Added ### A05:2025 - Injection (ReDoS) - Implemented three ReDoS endpoints in TutorialsController: - POST /tutorials/redos_email - Vulnerable email regex with nested quantifiers - POST /tutorials/redos_username - Classic (a+)+ pattern - POST /tutorials/redos_email_safe - Secure version using URI::MailTo::EMAIL_REGEXP - Added Regexp.timeout = 1.0 configuration (Rails 8 protection) - All endpoints include timing and error handling demonstrations ### A03:2025 - Software Supply Chain Failures - Demonstrated missing SRI on CDN assets in application.html.erb - Added educational endpoints: - GET /tutorials/supply_chain - Comprehensive supply chain vulnerabilities overview - GET /tutorials/check_dependencies - Dependency scanning simulation - Covers: Missing SRI, outdated dependencies, no SBOM, insecure gem sources ## Files Changed ### New Files - config/initializers/regexp_timeout.rb: Enables Rails 8 ReDoS protection - spec/controllers/tutorials_controller_spec.rb: 23 passing tests for all endpoints ### Modified Files - app/controllers/tutorials_controller.rb: Added 5 new educational endpoints - app/views/layouts/application.html.erb: Added CDN assets WITHOUT SRI (intentional vuln) - config/routes.rb: Added routes for ReDoS and supply chain endpoints ## Test Coverage - 23 RSpec tests covering both ReDoS and A03 vulnerabilities - Tests validate vulnerability behavior, error handling, and educational content - All tests passing ## Educational Value - Demonstrates OWASP 2025 categories A03 and A05 - Shows both vulnerable and secure implementations - Includes real-world CVE examples (British Airways, Magecart) - Provides mitigation guidance and tool recommendations This completes 100% coverage of OWASP Top 10 2025 categories in RailsGoat Rails 8. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
55 lines
1.5 KiB
Plaintext
Executable File
55 lines
1.5 KiB
Plaintext
Executable File
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>RailsGoat</title>
|
|
<%= stylesheet_link_tag "application", media: "all", "data-turbolinks-track" => true %>
|
|
<%= javascript_include_tag "application", "data-turbolinks-track" => true %>
|
|
<%#= csrf_meta_tags %> <!-- <~ What is this for? I hear it helps w/ JS and Sea-surfing.....whatevz -->
|
|
|
|
<!-- VULNERABILITY A03:2025 - Software Supply Chain Failures
|
|
Missing Subresource Integrity (SRI) checks on CDN assets
|
|
If the CDN is compromised, malicious code can be injected without detection
|
|
|
|
SECURE: Should include integrity="sha384-..." crossorigin="anonymous"
|
|
See: /tutorials/supply_chain for exploitation details
|
|
-->
|
|
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
|
|
<script src="https://cdn.jsdelivr.net/npm/jquery@3.6.0/dist/jquery.min.js"></script>
|
|
|
|
<!-- bootstrap css -->
|
|
<%
|
|
if cookies[:font]
|
|
%>
|
|
<style>body { font-size:<%= raw cookies[:font] %> !important;}</style>
|
|
<%
|
|
end
|
|
%>
|
|
|
|
</head>
|
|
<body>
|
|
<%= render "layouts/shared/header" %>
|
|
<%= render "layouts/shared/sidebar" %>
|
|
<div class="container-fluid">
|
|
<% if current_user %>
|
|
<div class="dashboard-wrapper">
|
|
<%= render "layouts/shared/messages" %>
|
|
<%= yield %>
|
|
</div>
|
|
<% else %>
|
|
<div class="login-wrapper">
|
|
<%= render "layouts/shared/messages" %>
|
|
<%= yield %>
|
|
</div>
|
|
<% end %>
|
|
</div>
|
|
<%= render "layouts/shared/footer" %>
|
|
|
|
<script type="text/javascript">
|
|
|
|
//Dropdown
|
|
$('.dropdown-toggle').dropdown();
|
|
</script>
|
|
|
|
</body>
|
|
</html>
|