Skip to content

Add DevSecOps page with security news and examples; update project dependencies #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add DevSecOps page with security news and examples; update project dependencies #67

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c577d5f
Add DevSecOps page with security news and examples; update project de…
CalinL May 12, 2025
e2f2e71
Refactor PrivacyModel to improve logging and clarify TODOs for produc…
CalinL May 12, 2025
a93d0af
Add new sample files
CalinL May 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions src/webapp01/Pages/DevSecOps.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
@page
@model webapp01.Pages.DevSecOpsModel
@{
ViewData["Title"] = "DevSecOps";
}

<h2>DevSecOps & GitHub Advanced Security News</h2>
<div>
<ul>
<li><strong>May 2025:</strong> GitHub Advanced Security now supports secret scanning for custom patterns.</li>
<li><strong>April 2025:</strong> Code scanning with CodeQL adds new C# queries for insecure deserialization.</li>
<li><strong>March 2025:</strong> Push protection for credentials is now enabled by default for all repos.</li>
</ul>
</div>
<p>Below is a demonstration of insecure C# code for educational purposes only.</p>
<pre>
@Model.InsecureLogExample
@Model.InsecureRegexExample
</pre>
36 changes: 36 additions & 0 deletions src/webapp01/Pages/DevSecOps.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
using Microsoft.AspNetCore.Mvc.RazorPages;
using Microsoft.Extensions.Logging;
using System.Text.RegularExpressions;

namespace webapp01.Pages
{
public class DevSecOpsModel : PageModel
{
private readonly ILogger<DevSecOpsModel> _logger;
public string InsecureLogExample { get; private set; }
public string InsecureRegexExample { get; private set; }

public DevSecOpsModel(ILogger<DevSecOpsModel> logger)

Check warning on line 13 in src/webapp01/Pages/DevSecOps.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Non-nullable property 'InsecureLogExample' must contain a non-null value when exiting constructor. Consider adding the 'required' modifier or declaring the property as nullable.

Check warning on line 13 in src/webapp01/Pages/DevSecOps.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Non-nullable property 'InsecureRegexExample' must contain a non-null value when exiting constructor. Consider adding the 'required' modifier or declaring the property as nullable.

Check warning on line 13 in src/webapp01/Pages/DevSecOps.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Non-nullable property 'InsecureLogExample' must contain a non-null value when exiting constructor. Consider adding the 'required' modifier or declaring the property as nullable.

Check warning on line 13 in src/webapp01/Pages/DevSecOps.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Non-nullable property 'InsecureRegexExample' must contain a non-null value when exiting constructor. Consider adding the 'required' modifier or declaring the property as nullable.
{
_logger = logger;
}

public void OnGet()
{
// Insecure log forging example
string userInput = "attacker\nInjectedLogEntry";
_logger.LogInformation("User input: {UserInput}", userInput);
InsecureLogExample = $"_logger.LogInformation(\"User input: {{UserInput}}\", \"{userInput}\");";

// Insecure regex example (ReDoS)
string evilInput = new string('a', 10000) + "!";
string pattern = "(a+)+!";
try
{
Regex.Match(evilInput, pattern);
InsecureRegexExample = $"Regex.Match(evilInput, \"{pattern}\"); // Potential ReDoS";
}
catch { }

Check notice

Code scanning / CodeQL

Poor error handling: empty catch block Note

Poor error handling: empty catch block.

Copilot Autofix

AI 17 days ago

To fix the issue, the empty catch block should be replaced with proper exception handling. At a minimum, the exception should be logged to provide visibility into what went wrong. Depending on the application's requirements, additional actions (e.g., notifying the user, retrying the operation) may also be necessary.

In this case, we will log the exception using the _logger instance, which is already available in the class. This ensures that any issues with the Regex.Match operation are recorded for debugging and monitoring purposes.

Suggested changeset 1
src/webapp01/Pages/DevSecOps.cshtml.cs

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/webapp01/Pages/DevSecOps.cshtml.cs b/src/webapp01/Pages/DevSecOps.cshtml.cs
--- a/src/webapp01/Pages/DevSecOps.cshtml.cs
+++ b/src/webapp01/Pages/DevSecOps.cshtml.cs
@@ -32,3 +32,6 @@
             }
-            catch { }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "An error occurred while matching the regex pattern.");
+            }
         }
EOF
@@ -32,3 +32,6 @@
}
catch { }
catch (Exception ex)
{
_logger.LogError(ex, "An error occurred while matching the regex pattern.");
}
}
Copilot is powered by AI and may make mistakes. Always verify output.

Check notice

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Copilot Autofix

AI 17 days ago

To fix the issue, we will replace the generic catch { } block with specific exception handling for exceptions that can be thrown by the Regex.Match method. The most relevant exception to handle here is RegexMatchTimeoutException, which occurs when a match operation exceeds its time-out interval. Additionally, we will log the exception details to aid in debugging and ensure that the program behaves predictably.

Suggested changeset 1
src/webapp01/Pages/DevSecOps.cshtml.cs

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/webapp01/Pages/DevSecOps.cshtml.cs b/src/webapp01/Pages/DevSecOps.cshtml.cs
--- a/src/webapp01/Pages/DevSecOps.cshtml.cs
+++ b/src/webapp01/Pages/DevSecOps.cshtml.cs
@@ -32,3 +32,6 @@
             }
-            catch { }
+            catch (RegexMatchTimeoutException ex)
+            {
+                _logger.LogError(ex, "Regex match timed out for pattern: {Pattern}", pattern);
+            }
         }
EOF
@@ -32,3 +32,6 @@
}
catch { }
catch (RegexMatchTimeoutException ex)
{
_logger.LogError(ex, "Regex match timed out for pattern: {Pattern}", pattern);
}
}
Copilot is powered by AI and may make mistakes. Always verify output.
}
}
}
1 change: 1 addition & 0 deletions src/webapp01/Pages/Index.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,6 @@
<h5 class="card-title">.NET 💜 Azure v4</h5>
<p class="card-text">Learn about <a href="https://learn.microsoft.com/aspnet/core">building Web apps with ASP.NET Core</a>.</p>
<p class="card-text">Visit our <a asp-page="/About">About GHAS</a> page to learn about GitHub Advanced Security features.</p>
<p class="card-text">Check out the <a asp-page="/DevSecOps">DevSecOps</a> page for the latest security news and a demo.</p>
</div>
</div>
5 changes: 3 additions & 2 deletions src/webapp01/webapp01.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,10 @@

<ItemGroup>
<PackageReference Include="Azure.Identity" Version="1.13.2" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.2" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="5.0.2" />
<PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.21.0" />
<PackageReference Include="System.Text.Json" Version="9.0.4" />
<PackageReference Include="Newtonsoft.Json" Version="12.0.2" />
<PackageReference Include="System.Text.Json" Version="8.0.4" />
</ItemGroup>

</Project>
Loading