diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 0000000..be6486d --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,21 @@ +name: Checkmarx One Scan +on: + push: + branches: + - master +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v2 + - name: Checkmarx One CLI Action + uses: checkmarx/ast-github-action@main #Github Action version + with: + project_name: ${{ github.repository }} + cx_tenant: bradesco-poc + base_uri: https://deu.ast.checkmarx.net/ + cx_client_id: ${{ secrets.CANARY_OATH }} + cx_client_secret: ${{ secrets.CANARY_SECRET }} + ## additional_params: --apikey ${{ secrets.API_KEY }} + additional_params: --async diff --git a/.vs/Damm-Vulnerable-CSharp-API/FileContentIndex/1559651a-00f7-452c-8125-6a411b8d749e.vsidx b/.vs/Damm-Vulnerable-CSharp-API/FileContentIndex/1559651a-00f7-452c-8125-6a411b8d749e.vsidx new file mode 100644 index 0000000..b07a0a6 Binary files /dev/null and b/.vs/Damm-Vulnerable-CSharp-API/FileContentIndex/1559651a-00f7-452c-8125-6a411b8d749e.vsidx differ diff --git a/.vs/Damm-Vulnerable-CSharp-API/FileContentIndex/read.lock b/.vs/Damm-Vulnerable-CSharp-API/FileContentIndex/read.lock new file mode 100644 index 0000000..e69de29 diff --git a/.vs/Damm-Vulnerable-CSharp-API/v17/.wsuo b/.vs/Damm-Vulnerable-CSharp-API/v17/.wsuo new file mode 100644 index 0000000..2a5a435 Binary files /dev/null and b/.vs/Damm-Vulnerable-CSharp-API/v17/.wsuo differ diff --git a/.vs/ProjectSettings.json b/.vs/ProjectSettings.json new file mode 100644 index 0000000..f8b4888 --- /dev/null +++ b/.vs/ProjectSettings.json @@ -0,0 +1,3 @@ +{ + "CurrentProjectSetting": null +} \ No newline at end of file diff --git a/.vs/VSWorkspaceState.json b/.vs/VSWorkspaceState.json new file mode 100644 index 0000000..972924d --- /dev/null +++ b/.vs/VSWorkspaceState.json @@ -0,0 +1,8 @@ +{ + "ExpandedNodes": [ + "", + "\\Controllers" + ], + "SelectedNode": "\\Controllers\\UsersController.cs", + "PreviewInSolutionExplorer": false +} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..6c2ff60 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,5 @@ +{ + "githubPullRequests.ignoredPullRequestBranches": [ + "master" + ] +} \ No newline at end of file diff --git a/Controllers/AuthorizationsController.cs b/Controllers/AuthorizationsController.cs index 566a4e9..2716c08 100644 --- a/Controllers/AuthorizationsController.cs +++ b/Controllers/AuthorizationsController.cs @@ -40,7 +40,8 @@ public IActionResult Post([FromBody] AuthorizationRequest authorizationRequest) [HttpGet("GetTokenSSO")] public IActionResult GetTokenSSO() { - var ssoCookieData = HttpContext.Request.Cookies["sso_ctx"]; + //var ssoCookieData = HttpContext.Request.Cookies["sso_ctx"]; + HttpCookie ssoCookieData = new HttpCookie(HttpContext.Request.Cookies["sso_ctx"]); if(String.IsNullOrEmpty(ssoCookieData)) { return Unauthorized(); diff --git a/Controllers/UsersController.cs b/Controllers/UsersController.cs index d751bcf..230cfe8 100644 --- a/Controllers/UsersController.cs +++ b/Controllers/UsersController.cs @@ -36,7 +36,8 @@ public IActionResult Put(int id, [FromBody] Models.UserUpdateRequest user) return BadRequest(ModelState); } - var existingUser = _context.Users.SingleOrDefault(m => m.ID == id); + //var existingUser = _context.Users.SingleOrDefault(m => m.ID == id); + var existingUser = _context.Users.GetById(id); if(existingUser == null) { return NotFound(); } diff --git a/Damm-Vulnerable-CSharp-API.sln b/Damm-Vulnerable-CSharp-API.sln new file mode 100644 index 0000000..4a9789c --- /dev/null +++ b/Damm-Vulnerable-CSharp-API.sln @@ -0,0 +1,25 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.5.002.0 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "dvcsharp-core-api", "dvcsharp-core-api.csproj", "{86757448-E853-40A0-8BBD-13E8B77ACB38}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {86757448-E853-40A0-8BBD-13E8B77ACB38}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {86757448-E853-40A0-8BBD-13E8B77ACB38}.Debug|Any CPU.Build.0 = Debug|Any CPU + {86757448-E853-40A0-8BBD-13E8B77ACB38}.Release|Any CPU.ActiveCfg = Release|Any CPU + {86757448-E853-40A0-8BBD-13E8B77ACB38}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {8305D38D-03A2-4466-B287-430247E98B83} + EndGlobalSection +EndGlobal diff --git a/azure-pipelines.yml b/azure-pipelines.yml new file mode 100644 index 0000000..c77037c --- /dev/null +++ b/azure-pipelines.yml @@ -0,0 +1,28 @@ +# Starter pipeline + +# Start with a minimal pipeline that you can customize to build and deploy your code. +# Add steps that build, run tests, deploy, and more: +# https://aka.ms/yaml + +trigger: +- master +- main + +pool: + vmImage: ubuntu-latest + +steps: +- script: echo Hello, world! + displayName: 'Run a one-line script' + +- script: | + echo Add other tasks to build, test, and deploy your project. + echo See https://aka.ms/yaml + displayName: 'Run a multi-line script' + +- task: Checkmarx AST@2 + inputs: + CheckmarxService: 'AST-admin' + projectName: '$(Build.Repository.Name)' + branchName: '$(Build.SourceBranchName)' + tenantName: 'beta_nova8' diff --git a/docker-compose.yml b/docker-compose.yml index 6f5bcf5..1d34bb2 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,4 +7,4 @@ services: - .:/app ports: - "5000:5000" - + host: "0.0.0.0" \ No newline at end of file diff --git a/dvcsharp-core-api.csproj b/dvcsharp-core-api.csproj index fd4be0f..55d73c6 100644 --- a/dvcsharp-core-api.csproj +++ b/dvcsharp-core-api.csproj @@ -1,14 +1,12 @@ - netcoreapp2.0 - - + @@ -16,15 +14,13 @@ + - - - - + \ No newline at end of file