Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add sending output format strings and templates lab #503

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

add sending output format strings and templates lab #503

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
125 changes: 125 additions & 0 deletions docs/labs/sending_output.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,125 @@
<!DOCTYPE html>
<html><script src="template_files/page-script.js" id="bw-fido2-page-script"></script><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="template_files/style.css">
<link rel="stylesheet" href="template_files/checker.css">
<script src="template_files/js-yaml.min.js"></script>
<script src="template_files/checker.js"></script>
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">

<!-- See create_labs.md for how to create your own lab! -->

<!-- Sample expected answer -->
<script id="expected0" type="plain/text">
private final List<String> allowedHosts = new String[]{"127.0.0.1"}
</script>
<!--
-->
<script id="expected1" type="plain/text">
private final List<String> allowedHosts = new String[]{"localhost"}
</script>

<!-- Full pattern of correct answer -->
<script id="correct0" type="plain/text">
private final List<String> allowedHosts = new String\[]{"(127\.0\.0\.1|localhost)"}
</script>

<script id="correct1" type="plain/text">
private final List<String> allowedHosts = new String\[]{"127\.0\.0\.1",(\s)*"localhost"}
</script>

<script id="correct2" type="plain/text">
private final List<String> allowedHosts = new String\[]{"locahost",(\s)*"127\.0\.0\.1"}
</script>

<script id="info" type="application/yaml">
---
hints:
- present: "new String[]{}"
text: Add allowed hosts the string array enclosed in curly brackets.
- present: "private final List<String> allowedHosts ="
text: Make sure that the allowedHosts constant is an Java inline string array.
# debug: true
</script>
</head>
<body>
<!-- For GitHub Pages formatting: -->
<div class="container-lg px-3 my-5 markdown-body">
<h1>Format Strings and Templates Lab</h1>
<p>
This is a lab exercise on developing secure software.
For more information, see the <a href="https://best.openssf.org/labs/introduction.html" target="_blank">introduction to
the labs</a>.

</p><p>
</p><h2>Task</h2>
<p>
<b>Restrict the JNDI hostnames from which variables can be loaded.</b>

</p><p>
</p><h2>Background</h2>
<p>
In this exercise, we'll assume that out output template allows a user to specify a JNDI hostname
Copy link
Author

@jasinner jasinner Jul 17, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@david-a-wheeler What If we updated the Background section by adding:

"Allowing a user to load variables is still a security risk, even from the same host. However the program requirements might dictate it's necessary. We're going to assume that in this exercise it's required to load variables from a JNDI server on the same host, and disabling such functionality is not an option."

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense to me!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However, it's not really dealing with the underlying issue I raised earlier.

from which to load variables from. As is the case in the Log4j logging framework.

</p><p>
</p><h2>Task Information</h2>
<p>

</p><p>
Please change the code below so that it restricts the JNDI hostnames from which variables can be
loaded to only the local network interface (127.0.0.1). Use IPv4 addresses only.


</p><p>
</p><h2>Interactive Lab (<span id="grade">to be completed</span>)</h2>
<p>
</p><form id="lab">
<pre><code>
public class JndiManager extends AbstractManager {
<input id="attempt0" type="text" size="60" spellcheck="false"
value="private final List<String> allowedHosts = new String[]{}" style="background-color: yellow;">

/**
* Looks up a named object through this JNDI context.
*
* @param name name of the object to look up.
* @param <T> the type of the object.
* @return the named object if it could be located.
* @throws NamingException if a naming exception is encountered
*/
@SuppressWarnings("unchecked")
public <T> T lookup(final String name) throws NamingException {
URI uri = new URI(name);
if (!allowedHosts.contains(uri.getHost())) {
LOGGER.warn("Attempt to access ldap server not in allowed list");
return null;
}
return (T) this.context.lookup(name);
}
}
</code></pre>
<button type="button" class="hintButton" title="Provide a hint given current attempt.">Hint</button>
<button type="button" class="resetButton" title="Reset initial state (throwing away current attempt).">Reset</button>
<button type="button" class="giveUpButton" title="Give up and show an answer.">Give up</button>
<br><br>
<p>
<i>This lab was developed by Jason Shepherd at
<a href="https://access.redhat.com/security/">Red Hat Product Security</a>.</i>
<br><br>
</p><p id="correctStamp" class="small">
<textarea id="debugData" class="displayNone" rows="20" cols="65" readonly="readonly"></textarea>
</p></form>
<br><br>
<p>
<summary>
Source: This example is a modified version of the patch for CVE-2021-44228 in
<a href="https://github.com/apache/logging-log4j2/pull/608/files">apache/logging-log4j2</a>
</summary>
</p>
</div><!-- End GitHub pages formatting -->


</body></html>