diff --git a/src/webapp01/Pages/DevSecOps.cshtml b/src/webapp01/Pages/DevSecOps.cshtml new file mode 100644 index 0000000..7633df7 --- /dev/null +++ b/src/webapp01/Pages/DevSecOps.cshtml @@ -0,0 +1,169 @@ +@page +@model DevSecOpsModel +@{ + ViewData["Title"] = "DevSecOps & GitHub Advanced Security"; +} + +
+
+
+

@ViewData["Title"]

+
+
+
+ +
+
+
+
+

Latest GHAS News & Updates

+
+
+

Stay up-to-date with the latest GitHub Advanced Security features and enhancements:

+ + @if (Model.LatestNews.Any()) + { +
    + @foreach (var newsItem in Model.LatestNews) + { +
  • + + @newsItem +
    • + } +
+ } +
+
+ +
+
+

DevSecOps Best Practices

+
+
+
+
+
Security in Development
+
    +
  • Shift-left security testing
    • +
  • Automated code scanning
    • +
  • Secret detection & management
    • +
  • Dependency vulnerability scanning
    • +
+
+
+
GHAS Integration
+
    +
  • CodeQL static analysis
    • +
  • Dependabot alerts & updates
    • +
  • Security advisories
    • +
  • Supply chain protection
    • +
+
+
+
+
+
+ +
+
+
+
Demo Security Testing
+
+
+

This form demonstrates security vulnerabilities for educational purposes:

+ +
+
+ + + + ⚠️ This input is intentionally vulnerable for demo purposes + +
+ +
+ + @if (!string.IsNullOrEmpty(Model.UserInput)) + { +
+ Input processed: @Model.UserInput +
+ Check application logs for security demonstrations +
+ } +
+
+ +
+
+
GHAS Resources
+
+
+
+ + Code Security Docs + + + Code Scanning Guide + + + Secret Scanning + + + Dependabot + + + Security Advisories + +
+
+
+
+
+ +
+
+
+ + Educational Demo: This page contains intentionally vulnerable code patterns for GitHub Advanced Security demonstration purposes. + Never use these patterns in production environments. +
+
+
+
+ +@section Scripts { + +} + + diff --git a/src/webapp01/Pages/DevSecOps.cshtml.cs b/src/webapp01/Pages/DevSecOps.cshtml.cs new file mode 100644 index 0000000..61436b0 --- /dev/null +++ b/src/webapp01/Pages/DevSecOps.cshtml.cs @@ -0,0 +1,86 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.RazorPages; +using System.Text.RegularExpressions; +using System.Data.SqlClient; +using Microsoft.Data.SqlClient; +using Newtonsoft.Json; + +namespace webapp01.Pages +{ + public class DevSecOpsModel : PageModel + { + private readonly ILogger _logger; + + // Insecure: Hard-coded connection string for demo purposes + private const string CONNECTION_STRING = "Server=localhost;Database=DemoDb;User Id=sa;Password=P@ssw0rd123;"; + + // Insecure: Vulnerable regex pattern for demo purposes + private static readonly Regex EmailRegex = new Regex(@"^(.+)@(.+)$", RegexOptions.Compiled); + + public DevSecOpsModel(ILogger logger) + { + _logger = logger; + } + + public List LatestNews { get; set; } = new List(); + public string UserInput { get; set; } = string.Empty; + + public void OnGet() + { + _logger.LogInformation("DevSecOps page accessed at {Time}", DateTime.UtcNow); + + LoadLatestGHASNews(); + + // Insecure: Log user data without sanitization for demo purposes + string userAgent = Request.Headers["User-Agent"].ToString(); + _logger.LogInformation("User accessed DevSecOps page with User-Agent: " + userAgent); + } + + public void OnPost(string userInput) + { + UserInput = userInput ?? string.Empty; + + // Insecure: Log forging vulnerability for demo purposes + _logger.LogInformation("User input received: " + userInput + " from user: " + User.Identity?.Name); + + // Insecure: SQL injection vulnerability for demo purposes + if (!string.IsNullOrEmpty(userInput)) + { + try + { + using var connection = new SqlConnection(CONNECTION_STRING); + var query = $"SELECT * FROM Users WHERE Name = '{userInput}'"; // Vulnerable to SQL injection + _logger.LogWarning("Executing query: " + query); + } + catch (Exception ex) + { + _logger.LogError("Database error: " + ex.Message); + } + } + // Insecure: Regex vulnerability for demo purposes + if (!string.IsNullOrEmpty(userInput) && EmailRegex.IsMatch(userInput)) + { + _logger.LogInformation("Valid email format detected"); + } + + LoadLatestGHASNews(); + } + + private void LoadLatestGHASNews() + { + LatestNews = new List + { + "GitHub Advanced Security now supports AI-powered code scanning with enhanced vulnerability detection", + "New Dependabot features include automated security updates for container dependencies", + "Secret scanning now detects over 200+ token types including cloud provider keys", + "Code scanning with CodeQL now supports Python 3.12 and enhanced C# analysis", + "Dependency review action helps prevent vulnerable dependencies in pull requests", + "GHAS now integrates with third-party security tools through the Security tab API", + "Enhanced supply chain security with SLSA compliance and artifact attestation", + "New security advisories database provides comprehensive vulnerability information" + }; + + _logger.LogInformation("Loaded {Count} GHAS news items", LatestNews.Count); + } + } +} diff --git a/src/webapp01/Pages/Index.cshtml b/src/webapp01/Pages/Index.cshtml index 394a289..97e5220 100644 --- a/src/webapp01/Pages/Index.cshtml +++ b/src/webapp01/Pages/Index.cshtml @@ -9,5 +9,39 @@
.NET 💜 Azure v5

Learn about building Web apps with ASP.NET Core.

Visit our About GHAS page to learn about GitHub Advanced Security features.

+

+ 🚀 New! Check out our DevSecOps Demo + to explore the latest GitHub Advanced Security features and best practices. +

+ + + +
+
+
+
+
🔐 Security Features
+
+
+
    +
  • ✅ Code Scanning with CodeQL
    • +
  • ✅ Secret Scanning
    • +
  • ✅ Dependency Management
    • +
  • ✅ Security Advisories
    • +
+ Explore GHAS → +
+
+
+
+
+
+
🛠️ DevSecOps Integration
+
+
+

Learn how to integrate security into your development workflow with our comprehensive DevSecOps guide.

+ Get Started +
+
diff --git a/src/webapp01/Pages/Shared/_Layout.cshtml b/src/webapp01/Pages/Shared/_Layout.cshtml index f8bf480..0208471 100644 --- a/src/webapp01/Pages/Shared/_Layout.cshtml +++ b/src/webapp01/Pages/Shared/_Layout.cshtml @@ -17,8 +17,7 @@ -
+
  • Home @@ -26,6 +25,9 @@
  • About GHAS
    • +
  • + DevSecOps Demo +
  • Privacy
    • diff --git a/src/webapp01/webapp01.csproj b/src/webapp01/webapp01.csproj index 0fdd793..f3e9796 100644 --- a/src/webapp01/webapp01.csproj +++ b/src/webapp01/webapp01.csproj @@ -8,12 +8,12 @@ Linux . - - + - + +