Skip to content

Commit d256bd3

Browse files
CalinLCalinL
committed
feat: Implement DevSecOps demo page for GHAS features
- Add new DevSecOps.cshtml page with GHAS latest news and features - Implement ILogger for backend logging and security demonstrations - Add intentionally vulnerable code patterns for GHAS demo: * Log forging vulnerabilities * SQL injection patterns * Regex DoS vulnerabilities * Hard-coded credentials - Update package dependencies: * System.Text.Json 8.0.4 (vulnerable version for demo) * Microsoft.Data.SqlClient 5.0.2 (vulnerable version for demo) * Newtonsoft.Json 12.0.2 (vulnerable version for demo) - Add navigation menu link to DevSecOps demo page - Update Index page with links to new DevSecOps features - Build verified without compilation errors Implements issue #72 - DevSecOps demo for GitHub Advanced Security
1 parent 422b0d6 commit d256bd3

File tree

5 files changed

+296
-5
lines changed

5 files changed

+296
-5
lines changed

‎src/webapp01/Pages/DevSecOps.cshtml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
@page
2+
@model DevSecOpsModel
3+
@{
4+
ViewData["Title"] = "DevSecOps & GitHub Advanced Security";
5+
}
6+
7+
<div class="container">
8+
<div class="row">
9+
<div class="col-md-12">
10+
<h1 class="display-4 text-primary">@ViewData["Title"]</h1>
11+
<hr />
12+
</div>
13+
</div>
14+
15+
<div class="row">
16+
<div class="col-md-8">
17+
<div class="card mb-4">
18+
<div class="card-header bg-primary text-white">
19+
<h3 class="mb-0"><i class="bi bi-newspaper"></i> Latest GHAS News & Updates</h3>
20+
</div>
21+
<div class="card-body">
22+
<p class="lead">Stay up-to-date with the latest GitHub Advanced Security features and enhancements:</p>
23+
24+
@if (Model.LatestNews.Any())
25+
{
26+
<ul class="list-group list-group-flush">
27+
@foreach (var newsItem in Model.LatestNews)
28+
{
29+
<li class="list-group-item">
30+
<i class="bi bi-check-circle text-success me-2"></i>
31+
@newsItem
32+
</li>
33+
}
34+
</ul>
35+
}
36+
</div>
37+
</div>
38+
39+
<div class="card mb-4">
40+
<div class="card-header bg-success text-white">
41+
<h4 class="mb-0"><i class="bi bi-shield-check"></i> DevSecOps Best Practices</h4>
42+
</div>
43+
<div class="card-body">
44+
<div class="row">
45+
<div class="col-md-6">
46+
<h5>Security in Development</h5>
47+
<ul>
48+
<li>Shift-left security testing</li>
49+
<li>Automated code scanning</li>
50+
<li>Secret detection & management</li>
51+
<li>Dependency vulnerability scanning</li>
52+
</ul>
53+
</div>
54+
<div class="col-md-6">
55+
<h5>GHAS Integration</h5>
56+
<ul>
57+
<li>CodeQL static analysis</li>
58+
<li>Dependabot alerts & updates</li>
59+
<li>Security advisories</li>
60+
<li>Supply chain protection</li>
61+
</ul>
62+
</div>
63+
</div>
64+
</div>
65+
</div>
66+
</div>
67+
68+
<div class="col-md-4">
69+
<div class="card mb-4">
70+
<div class="card-header bg-warning text-dark">
71+
<h5 class="mb-0"><i class="bi bi-exclamation-triangle"></i> Demo Security Testing</h5>
72+
</div>
73+
<div class="card-body">
74+
<p class="text-muted">This form demonstrates security vulnerabilities for educational purposes:</p>
75+
76+
<form method="post">
77+
<div class="mb-3">
78+
<label for="userInput" class="form-label">Test Input:</label>
79+
<input type="text" class="form-control" id="userInput" name="userInput"
80+
value="@Model.UserInput" placeholder="Enter test data...">
81+
<small class="form-text text-muted">
82+
⚠️ This input is intentionally vulnerable for demo purposes
83+
</small>
84+
</div>
85+
<button type="submit" class="btn btn-warning">
86+
<i class="bi bi-bug"></i> Test Vulnerabilities
87+
</button>
88+
</form>
89+
90+
@if (!string.IsNullOrEmpty(Model.UserInput))
91+
{
92+
<div class="mt-3 alert alert-info">
93+
<strong>Input processed:</strong> @Model.UserInput
94+
<br>
95+
<small>Check application logs for security demonstrations</small>
96+
</div>
97+
}
98+
</div>
99+
</div>
100+
101+
<div class="card">
102+
<div class="card-header bg-info text-white">
103+
<h5 class="mb-0"><i class="bi bi-link-45deg"></i> GHAS Resources</h5>
104+
</div>
105+
<div class="card-body">
106+
<div class="d-grid gap-2">
107+
<a href="https://docs.github.com/en/code-security" target="_blank" class="btn btn-outline-primary btn-sm">
108+
Code Security Docs
109+
</a>
110+
<a href="https://docs.github.com/en/code-security/code-scanning" target="_blank" class="btn btn-outline-primary btn-sm">
111+
Code Scanning Guide
112+
</a>
113+
<a href="https://docs.github.com/en/code-security/secret-scanning" target="_blank" class="btn btn-outline-primary btn-sm">
114+
Secret Scanning
115+
</a>
116+
<a href="https://docs.github.com/en/code-security/dependabot" target="_blank" class="btn btn-outline-primary btn-sm">
117+
Dependabot
118+
</a>
119+
<a href="https://docs.github.com/en/code-security/security-advisories" target="_blank" class="btn btn-outline-primary btn-sm">
120+
Security Advisories
121+
</a>
122+
</div>
123+
</div>
124+
</div>
125+
</div>
126+
</div>
127+
128+
<div class="row mt-4">
129+
<div class="col-md-12">
130+
<div class="alert alert-warning">
131+
<i class="bi bi-exclamation-triangle-fill"></i>
132+
<strong>Educational Demo:</strong> This page contains intentionally vulnerable code patterns for GitHub Advanced Security demonstration purposes.
133+
Never use these patterns in production environments.
134+
</div>
135+
</div>
136+
</div>
137+
</div>
138+
139+
@section Scripts {
140+
<script>
141+
// Enhance the demo experience
142+
document.addEventListener('DOMContentLoaded', function() {
143+
const newsItems = document.querySelectorAll('.list-group-item');
144+
newsItems.forEach((item, index) => {
145+
setTimeout(() => {
146+
item.style.opacity = '1';
147+
item.style.transform = 'translateX(0)';
148+
}, index * 100);
149+
});
150+
});
151+
</script>
152+
}
153+
154+
<style>
155+
.list-group-item {
156+
opacity: 0;
157+
transform: translateX(-20px);
158+
transition: all 0.3s ease;
159+
}
160+
161+
.card {
162+
box-shadow: 0 2px 10px rgba(0,0,0,0.1);
163+
transition: transform 0.2s ease;
164+
}
165+
166+
.card:hover {
167+
transform: translateY(-2px);
168+
}
169+
</style>

‎src/webapp01/Pages/DevSecOps.cshtml.cs‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
using Microsoft.AspNetCore.Mvc;
2+
using Microsoft.AspNetCore.Mvc.RazorPages;
3+
using System.Text.RegularExpressions;
4+
using System.Data.SqlClient;
5+
using Microsoft.Data.SqlClient;
6+
using Newtonsoft.Json;
7+
8+
namespace webapp01.Pages
9+
{
10+
public class DevSecOpsModel : PageModel
11+
{
12+
private readonly ILogger<DevSecOpsModel> _logger;
13+
14+
// Insecure: Hard-coded connection string for demo purposes
15+
private const string CONNECTION_STRING = "Server=localhost;Database=DemoDb;User Id=sa;Password=P@ssw0rd123;";
16+
17+
// Insecure: Vulnerable regex pattern for demo purposes
18+
private static readonly Regex EmailRegex = new Regex(@"^(.+)@(.+)$", RegexOptions.Compiled);
19+
20+
public DevSecOpsModel(ILogger<DevSecOpsModel> logger)
21+
{
22+
_logger = logger;
23+
}
24+
25+
public List<string> LatestNews { get; set; } = new List<string>();
26+
public string UserInput { get; set; } = string.Empty;
27+
28+
public void OnGet()
29+
{
30+
_logger.LogInformation("DevSecOps page accessed at {Time}", DateTime.UtcNow);
31+
32+
LoadLatestGHASNews();
33+
34+
// Insecure: Log user data without sanitization for demo purposes
35+
string userAgent = Request.Headers["User-Agent"].ToString();
36+
_logger.LogInformation("User accessed DevSecOps page with User-Agent: " + userAgent);
37+
}
38+
39+
public void OnPost(string userInput)
40+
{
41+
UserInput = userInput ?? string.Empty;
42+
43+
// Insecure: Log forging vulnerability for demo purposes
44+
_logger.LogInformation("User input received: " + userInput + " from user: " + User.Identity?.Name);
45+
46+
// Insecure: SQL injection vulnerability for demo purposes
47+
if (!string.IsNullOrEmpty(userInput))
48+
{
49+
try
50+
{
51+
using var connection = new SqlConnection(CONNECTION_STRING);
52+
var query = $"SELECT * FROM Users WHERE Name = '{userInput}'"; // Vulnerable to SQL injection
53+
_logger.LogWarning("Executing query: " + query);
54+
}
55+
catch (Exception ex)
56+
{
57+
_logger.LogError("Database error: " + ex.Message);
58+
}
59+
}
60+
// Insecure: Regex vulnerability for demo purposes
61+
if (!string.IsNullOrEmpty(userInput) && EmailRegex.IsMatch(userInput))
62+
{
63+
_logger.LogInformation("Valid email format detected");
64+
}
65+
66+
LoadLatestGHASNews();
67+
}
68+
69+
private void LoadLatestGHASNews()
70+
{
71+
LatestNews = new List<string>
72+
{
73+
"GitHub Advanced Security now supports AI-powered code scanning with enhanced vulnerability detection",
74+
"New Dependabot features include automated security updates for container dependencies",
75+
"Secret scanning now detects over 200+ token types including cloud provider keys",
76+
"Code scanning with CodeQL now supports Python 3.12 and enhanced C# analysis",
77+
"Dependency review action helps prevent vulnerable dependencies in pull requests",
78+
"GHAS now integrates with third-party security tools through the Security tab API",
79+
"Enhanced supply chain security with SLSA compliance and artifact attestation",
80+
"New security advisories database provides comprehensive vulnerability information"
81+
};
82+
83+
_logger.LogInformation("Loaded {Count} GHAS news items", LatestNews.Count);
84+
}
85+
}
86+
}

‎src/webapp01/Pages/Index.cshtml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,39 @@
99
<h5 class="card-title">.NET 💜 Azure v5</h5>
1010
<p class="card-text">Learn about <a href="https://learn.microsoft.com/aspnet/core">building Web apps with ASP.NET Core</a>.</p>
1111
<p class="card-text">Visit our <a asp-page="/About">About GHAS</a> page to learn about GitHub Advanced Security features.</p>
12+
<p class="card-text">
13+
<strong>🚀 New!</strong> Check out our <a asp-page="/DevSecOps" class="btn btn-primary btn-sm">DevSecOps Demo</a>
14+
to explore the latest GitHub Advanced Security features and best practices.
15+
</p>
16+
</div>
17+
</div>
18+
19+
<div class="row mt-4">
20+
<div class="col-md-6">
21+
<div class="card">
22+
<div class="card-header bg-info text-white">
23+
<h5 class="mb-0">🔐 Security Features</h5>
24+
</div>
25+
<div class="card-body">
26+
<ul class="list-unstyled">
27+
<li>✅ Code Scanning with CodeQL</li>
28+
<li>✅ Secret Scanning</li>
29+
<li>✅ Dependency Management</li>
30+
<li>✅ Security Advisories</li>
31+
</ul>
32+
<a asp-page="/DevSecOps" class="btn btn-outline-info">Explore GHAS →</a>
33+
</div>
34+
</div>
35+
</div>
36+
<div class="col-md-6">
37+
<div class="card">
38+
<div class="card-header bg-success text-white">
39+
<h5 class="mb-0">🛠️ DevSecOps Integration</h5>
40+
</div>
41+
<div class="card-body">
42+
<p>Learn how to integrate security into your development workflow with our comprehensive DevSecOps guide.</p>
43+
<a asp-page="/DevSecOps" class="btn btn-success">Get Started</a>
44+
</div>
45+
</div>
1246
</div>
1347
</div>

‎src/webapp01/Pages/Shared/_Layout.cshtml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,17 @@
1717
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target=".navbar-collapse" aria-controls="navbarSupportedContent"
1818
aria-expanded="false" aria-label="Toggle navigation">
1919
<span class="navbar-toggler-icon"></span>
20-
</button>
21-
<div class="navbar-collapse collapse d-sm-inline-flex justify-content-between">
20+
</button> <div class="navbar-collapse collapse d-sm-inline-flex justify-content-between">
2221
<ul class="navbar-nav flex-grow-1">
2322
<li class="nav-item">
2423
<a class="nav-link text-dark" asp-area="" asp-page="/Index">Home</a>
2524
</li>
2625
<li class="nav-item">
2726
<a class="nav-link text-dark" asp-area="" asp-page="/About">About GHAS</a>
2827
</li>
28+
<li class="nav-item">
29+
<a class="nav-link text-dark" asp-area="" asp-page="/DevSecOps">DevSecOps Demo</a>
30+
</li>
2931
<li class="nav-item">
3032
<a class="nav-link text-dark" asp-area="" asp-page="/Privacy">Privacy</a>
3133
</li>

‎src/webapp01/webapp01.csproj‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@
88
<DockerDefaultTargetOS>Linux</DockerDefaultTargetOS>
99
<DockerfileContext>.</DockerfileContext>
1010
</PropertyGroup>
11-
1211
<ItemGroup>
1312
<PackageReference Include="Azure.Identity" Version="1.13.2" />
14-
<PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.2" />
13+
<PackageReference Include="Microsoft.Data.SqlClient" Version="5.0.2" />
1514
<PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.21.0" />
16-
<PackageReference Include="System.Text.Json" Version="9.0.4" />
15+
<PackageReference Include="System.Text.Json" Version="8.0.4" />
16+
<PackageReference Include="Newtonsoft.Json" Version="12.0.2" />
1717
</ItemGroup>
1818

1919
</Project>

0 commit comments

Comments
 (0)