STRLCPY/wrongsecrets

■ ■ ■ ■ ■ ■

.github/workflows/dast-zap-test.yml

		skipped 19 lines
20	20		java-version: "19"
21	21		distribution: "temurin"
22	22		- name: Clean install
23		-	run: ./mvnw clean install
	23	+	run: ./mvnw clean install -DskipTests -Ddependency-check.skip -Dcyclonedx.skip=true
24	24		- name: Start wrongsecrets
25	25		run: nohup ./mvnw spring-boot:run -Dspring-boot.run.profiles=without-vault &
26	26		- name: ZAP Scan
		skipped 2 lines
29	29		allow_issue_writing: false
30	30		docker_name: "owasp/zap2docker-stable"
31	31		target: "http://localhost:8080"
32		-	rules_file_name: .zap/rule-config.tsv
	32	+	rules_file_name: config/zap/rule-config.tsv
33	33		fail_action: true
34	34

■ ■ ■ ■ ■ ■

.github/workflows/java_swagger_doc.yml

1	+	name: Javadoc and Swaggerdoc generator
2	+
3	+	on:
4	+	repository_dispatch:
5	+	workflow_dispatch:
6	+	push:
7	+	branches: [ master ]
8	+	pull_request:
9	+	branches: [ master ]
10	+	permissions:
11	+	contents: read
12	+	jobs:
13	+	javaDocGenerator:
14	+	runs-on: ubuntu-latest
15	+	steps:
16	+	- uses: actions/checkout@v3
17	+	- name: Set up JDK 19
18	+	uses: actions/setup-java@v3
19	+	with:
20	+	java-version: "19"
21	+	distribution: "temurin"
22	+	- name: Clean install
23	+	run: ./mvnw clean install -DskipTests -Ddependency-check.skip -Dcyclonedx.skip=true
24	+	- name: Compile javadoc
25	+	run: ./mvnw compile javadoc:javadoc
26	+	- name: Start wrongsecrets
27	+	run: nohup ./mvnw spring-boot:run -Dspring-boot.run.profiles=without-vault &
28	+	- name: Compile javadocs
29	+	run: ./mvnw compile javadoc:javadoc
30	+	- name: Generate swaggerdoc
31	+	run: ./mvnw springdoc-openapi:generate
32	+	- name: Upload swagger api doc
33	+	uses: actions/upload-artifact@v3
34	+	with:
35	+	name: apidocs
36	+	path: target/openapi.json
37	+	- name: Upload javadoc
38	+	uses: actions/upload-artifact@v3
39	+	with:
40	+	name: javadoc
41	+	path: target/site
42	+

■ ■ ■ ■ ■ ■

.github/workflows/link_checker.yml

1		-	# This is a basic workflow to help you get started with Actions
2	1
3	2		name: Dead Link Checker
4	3
		skipped 30 lines

■ ■ ■ ■ ■ ■

Dockerfile

		skipped 7 lines
8	8		ENV APP_VERSION=$argBasedVersion
9	9		ENV DOCKER_ENV_PASSWORD="This is it"
10	10		ENV AZURE_KEY_VAULT_ENABLED=false
	11	+	ENV springdoc_swagger-ui_enabled=false
	12	+	ENV springdoc_api-docs_enabled=false
11	13
12	14		RUN echo "2vars"
13	15		RUN echo "$ARG_BASED_PASSWORD"
		skipped 12 lines

■ ■ ■ ■ ■ ■

README.md

		skipped 1 lines
2	2
3	3		# OWASP WrongSecrets [![Tweet](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/intent/tweet?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this&url=https://github.com/OWASP/wrongsecrets&hashtags=secretsmanagement,secrets,hunting,p0wnableapp,OWASP,WrongSecrets)[<img src="https://raw.githubusercontent.com/mastodon/mastodon/main/app/javascript/images/app-icon.svg" width=16>](https://tootpick.org/#text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement,%20%23secrets,%20%23hunting,%20%23p0wnableapp,%20%23OWASP,%20%23WrongSecrets)
4	4
5		-	[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![Test minikube script (k8s)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml) [![Test minikube script (k8s&vault)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml) [![Docker container test](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml)
	5	+	[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) ![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)[![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![Test minikube script (k8s)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml) [![Test minikube script (k8s&vault)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml) [![Docker container test](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml)
6	6		[![OWASP Lab Project](https://img.shields.io/badge/OWASP-lab%20project-48A646.svg)](https://owasp.org/projects/)
7	7		[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/7024/badge)](https://bestpractices.coreinfrastructure.org/projects/7024)
8	8		[![Discussions](https://img.shields.io/github/discussions/OWASP/wrongsecrets)](https://github.com/OWASP/wrongsecrets/discussions)
		skipped 12 lines
21	21		- [Support](#support)
22	22		- [Basic docker exercises](#basic-docker-exercises)
23	23		- [Running these on Heroku](#running-these-on-heroku)
24		-	- [Deploying the app under your own heroku account](#deploying-the-app-under-your-own-heroku-account)
25	24		- [Running on Fly.io](#running-on-flyio)
26	25		- [Basic K8s exercise](#basic-k8s-exercise)
27	26		- [Minikube based](#minikube-based)
		skipped 81 lines
109	108		You can test them out at [https://wrongsecrets.herokuapp.com/](https://wrongsecrets.herokuapp.com/) as well! But please
110	109		understand that we have NO guarantees that this works. Given we run in Heroku free-tier, please do not fuzz and/or try
111	110		to bring it down: you would be spoiling it for others that want to testdrive it.
112		-
113		-	### Deploying the app under your own heroku account
114		-
115		-	1. [Sign up to Heroku](https://signup.heroku.com/) and [log in to your account](https://id.heroku.com/login)
116		-	2. Click the button below and follow the instructions
117		-
118		-	[![Deploy](https://www.herokucdn.com/deploy/button.svg)](https://heroku.com/deploy)
119	111
120	112		### Running on Fly.io
121	113
		skipped 361 lines

■ ■ ■ ■ ■ ■

.zap/rule-config.tsv config/zap/rule-config.tsv

		skipped 8 lines
9	9		10109 IGNORE (Modern Web Application)
10	10		10110 IGNORE (Dangerous JS Functions)
11	11		90033 IGNORE (Loosely Scoped Cookie)
	12	+	10096 IGNORE (Timestamp Disclosure - Unix)
12	13

■ ■ ■ ■ ■ ■

fly.toml

		skipped 10 lines
11	11		[build.args]
12	12		argBasedVersion="1.6.1"
13	13		spring_profile="without-vault"
	14	+	springdoc_api-docs_enabled="false"
	15	+	springdoc_swagger-ui_enabled="false"
14	16
15	17		[env]
16	18		K8S_ENV="Fly(Docker)"
		skipped 32 lines

■ ■ ■ ■ ■ ■

pom.xml

		skipped 5 lines
6	6		<groupId>org.springframework.boot</groupId>
7	7		<artifactId>spring-boot-starter-parent</artifactId>
8	8		<version>3.0.4</version>
9		-	<relativePath /> <!-- lookup parent from repository -->
	9	+	<relativePath/> <!-- lookup parent from repository -->
10	10		</parent>
11	11		<groupId>org.owasp</groupId>
12	12		<artifactId>wrongsecrets</artifactId>
13		-	<version>jre18test2-SNAPSHOT</version>
	13	+	<version>1.6.1-SNAPSHOT</version>
14	14		<name>OWASP WrongSecrets</name>
15	15		<description>Examples with how to not use secrets</description>
16	16		<url>https://owasp.org/www-project-wrongsecrets/</url>
		skipped 6 lines
23	23		</issueManagement>
24	24		<licenses>
25	25		<license>
26		-	<name>MIT License</name>
27		-	<url>https://opensource.org/licenses/MIT</url>
	26	+	<name>AGPLv3 License</name>
	27	+	<url>https://opensource.org/license/agpl-v3/</url>
28	28		<distribution>repo</distribution>
29	29		</license>
30	30		</licenses>
		skipped 149 lines
180	180		<groupId>com.google.cloud</groupId>
181	181		<artifactId>google-cloud-secretmanager</artifactId>
182	182		</dependency>
183		-
	183	+	<dependency>
	184	+	<groupId>org.springdoc</groupId>
	185	+	<artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
	186	+	<version>2.0.4</version>
	187	+	</dependency>
184	188		<dependency>
185	189		<groupId>com.azure.spring</groupId>
186	190		<artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
		skipped 30 lines
217	221		<version>4.6.0</version>
218	222		</dependency>
219	223		<!-- <dependency>-->
220		-	<!-- <groupId>com.h2database</groupId>-->
221		-	<!-- <artifactId>h2</artifactId>-->
222		-	<!-- <version>2.1.214</version>-->
223		-	<!-- </dependency>-->
	224	+	<!-- <groupId>com.h2database</groupId>-->
	225	+	<!-- <artifactId>h2</artifactId>-->
	226	+	<!-- <version>2.1.214</version>-->
	227	+	<!-- </dependency>-->
224	228		</dependencies>
225	229
226	230		<dependencyManagement>
		skipped 215 lines
442	446		</configuration>
443	447		</execution>
444	448		</executions>
	449	+	</plugin>
	450	+	<plugin>
	451	+	<groupId>org.springdoc</groupId>
	452	+	<artifactId>springdoc-openapi-maven-plugin</artifactId>
	453	+	<version>1.4</version>
445	454		</plugin>
446	455		<plugin>
447	456		<groupId>org.codehaus.mojo</groupId>
		skipped 34 lines

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/AboutController.java

1	1		package org.owasp.wrongsecrets;
2	2
	3	+	import io.swagger.v3.oas.annotations.Operation;
3	4		import org.owasp.wrongsecrets.canaries.CanaryCounter;
4	5		import org.springframework.beans.factory.annotation.Autowired;
5	6		import org.springframework.beans.factory.annotation.Value;
		skipped 5 lines
11	12		public class AboutController {
12	13
13	14
	15	+
14	16		@GetMapping("/about")
	17	+	@Operation(description = "Endpoint to get dynamic data on about")
15	18		public String getStats(Model model) {
16	19		return "about";
17	20		}
		skipped 2 lines

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/IndexController.java

1	1		package org.owasp.wrongsecrets;
2	2
	3	+	import io.swagger.v3.oas.annotations.Operation;
3	4		import lombok.extern.slf4j.Slf4j;
4	5		import org.springframework.stereotype.Controller;
5	6		import org.springframework.web.bind.annotation.GetMapping;
		skipped 3 lines
9	10		public class IndexController {
10	11
11	12		@GetMapping("/")
	13	+	@Operation(description = "Returns all dynamic data for the welcome screen")
12	14		public String index() {
13	15		return "welcome";
14	16		}
		skipped 2 lines

■ ■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/StatsController.java

1	1		package org.owasp.wrongsecrets;
2	2
	3	+	import io.swagger.v3.oas.annotations.Operation;
3	4		import org.owasp.wrongsecrets.canaries.CanaryCounter;
4	5		import org.springframework.beans.factory.annotation.Autowired;
5	6		import org.springframework.beans.factory.annotation.Value;
		skipped 16 lines
22	23		@Value("${ctf_enabled}")
23	24		private boolean ctfModeEnabled;
24	25
	26	+	@Value("${springdoc.swagger-ui.enabled}")
	27	+	private boolean swaggerUIEnabled;
	28	+
	29	+	@Value("${springdoc.api-docs.enabled}")
	30	+	private boolean springdockenabled;
	31	+
25	32		@Value("${canarytokenURLs}")
26	33		private String[] canaryTokenURLs;
27	34
	35	+	@Value("${springdoc.swagger-ui.path}")
	36	+	private String swaggerURI;
	37	+
28	38		@GetMapping("/stats")
	39	+	@Operation(description = "Returns all dynamic data for the stats screen")
29	40		public String getStats(Model model) {
30	41		model.addAttribute("canaryCounter", canaryCounter.getTotalCount());
31	42		model.addAttribute("sessioncounter", sessionConfiguration.getCounter());
		skipped 1 lines
33	44		model.addAttribute("canarytokenURLs", canaryTokenURLs);
34	45		model.addAttribute("hintsEnabled", hintsEnabled);
35	46		model.addAttribute("reasonEnabled", reasonEnabled);
36		-	model.addAttribute("ctfModeEnabled",ctfModeEnabled);
	47	+	model.addAttribute("ctfModeEnabled", ctfModeEnabled);
	48	+	model.addAttribute("swaggerUIEnabled", swaggerUIEnabled);
	49	+	model.addAttribute("springdockenabled", springdockenabled);
	50	+	model.addAttribute("swaggerURI", swaggerURI);
37	51		return "stats";
38	52		}
39	53		}
		skipped 1 lines

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/WrongSecretsApplication.java

1	1		package org.owasp.wrongsecrets;
2	2
	3	+	import org.owasp.wrongsecrets.challenges.ChallengesController;
3	4		import org.owasp.wrongsecrets.challenges.kubernetes.Vaultpassword;
	5	+	import org.owasp.wrongsecrets.oauth.TokenController;
	6	+	import org.springdoc.core.utils.SpringDocUtils;
4	7		import org.springframework.boot.SpringApplication;
5	8		import org.springframework.boot.autoconfigure.SpringBootApplication;
6	9		import org.springframework.boot.context.properties.EnableConfigurationProperties;
		skipped 15 lines
22	25		return new InMemoryScoreCard(28);
23	26		}
24	27
25		-
	28	+	static {
	29	+	SpringDocUtils.getConfig().addRestControllers(AboutController.class, ChallengesController.class, IndexController.class, StatsController.class, TokenController.class);
	30	+	}
26	31
27	32		}
28	33

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/asciidoc/AsciiDocGenerator.java

		skipped 10 lines
11	11
12	12		import static org.asciidoctor.Asciidoctor.Factory.create;
13	13
	14	+	/**
	15	+	* Used for generating HTML out of asciidoc. Used for all Challenges' challenge texts, tips, and explanations.
	16	+	*/
14	17		public class AsciiDocGenerator implements TemplateGenerator {
15	18
16	19		private static final Asciidoctor asciidoctor = create();
		skipped 12 lines

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/challenges/ChallengesController.java

1	1		package org.owasp.wrongsecrets.challenges;
2	2
3	3		import com.google.common.base.Strings;
	4	+	import io.swagger.v3.oas.annotations.Hidden;
	5	+	import io.swagger.v3.oas.annotations.Operation;
4	6		import org.owasp.wrongsecrets.RuntimeEnvironment;
5	7		import org.owasp.wrongsecrets.ScoreCard;
6	8		import org.owasp.wrongsecrets.challenges.docker.Challenge0;
		skipped 57 lines
64	66		}
65	67
66	68		@GetMapping
	69	+	@Operation(description = "Returns the given expalantion text for a challenge")
67	70		public String explanation(@PathVariable Integer id) {
68	71		return challenges.get(id).getExplanation();
69	72		}
70	73
71	74		@GetMapping("/spoil-{id}")
	75	+	@Hidden
72	76		public String spoiler(Model model, @PathVariable Integer id) {
73	77		if (!ctfModeEnabled) {
74	78		var challenge = challenges.get(id).getChallenge();
		skipped 5 lines
80	84		}
81	85
82	86		@GetMapping("/challenge/{id}")
	87	+	@Operation(description = "Returns the data for a given challenge's form interaction")
83	88		public String challenge(Model model, @PathVariable Integer id) {
84	89		if (!checkId(id)) {
85	90		throw new ResponseStatusException(
		skipped 26 lines
112	117		}
113	118
114	119		@PostMapping(value = "/challenge/{id}", params = "action=reset")
	120	+	@Operation(description = "Resets the state of a given challenge")
115	121		public String reset(@ModelAttribute ChallengeForm challengeForm, @PathVariable Integer id, Model model) {
116	122		if (!checkId(id)) {
117	123		throw new ResponseStatusException(
		skipped 11 lines
129	135		}
130	136
131	137		@PostMapping(value = "/challenge/{id}", params = "action=submit")
	138	+	@Operation(description = "Post your answer to the challenge for a given challenge ID")
132	139		public String postController(@ModelAttribute ChallengeForm challengeForm, Model model, @PathVariable Integer id) {
133	140		if (!checkId(id)) {
134	141		throw new ResponseStatusException(
		skipped 92 lines

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/oauth/TokenController.java

		skipped 1 lines
2	2
3	3		import com.fasterxml.jackson.annotation.JsonProperty;
4	4		import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
	5	+	import io.swagger.v3.oas.annotations.OpenAPIDefinition;
	6	+	import io.swagger.v3.oas.annotations.Operation;
5	7		import lombok.extern.slf4j.Slf4j;
	8	+	import org.springdoc.core.annotations.RouterOperation;
6	9		import org.springframework.beans.factory.annotation.Value;
7	10		import org.springframework.http.HttpStatus;
8	11		import org.springframework.http.MediaType;
		skipped 15 lines
24	27		this.dockerMountPath = dockerMountPath;
25	28		}
26	29
	30	+
	31	+	@Operation(summary = "Endpoint for interaction at challenge 16")
27	32		@PostMapping(path = "/token", consumes = {MediaType.APPLICATION_FORM_URLENCODED_VALUE})
28	33		public ResponseEntity<?> clientCredentialToken(TokenRequest tokenRequest) {
29	34		if ("client_credentials".equals(tokenRequest.grant_type())
		skipped 7 lines
37	42		.build();
38	43		}
39	44
	45	+	/**
	46	+	* Tokenrequest
	47	+	*
	48	+	* @param grant_type ew
	49	+	* @param client_id we
	50	+	* @param client_secret we
	51	+	*/
40	52		public record TokenRequest(String grant_type,
41	53		String client_id,
42	54		String client_secret) {
		skipped 19 lines

■ ■ ■ ■ ■ ■

src/main/resources/application.properties

		skipped 16 lines
17	17		AWS_WEB_IDENTITY_TOKEN_FILE=if_you_see_this_please_use_AWS_Setup
18	18		FILENAME_CHALLENGE9=wrongsecret
19	19		FILENAME_CHALLENGE10=wrongsecret-2
20		-
	20	+	springdoc.swagger-ui.path=/swagger-ui.html
	21	+	springdoc.swagger-ui.enabled=true
	22	+	springdoc.api-docs.enabled=true
	23	+	springdoc.swagger-ui.csrf.enabled=true
	24	+	springdoc.show-actuator=true
	25	+	springdoc.model-and-view-allowed=true
21	26		spring.cloud.azure.keyvault.secret.property-source-enabled=false
22	27		spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://default.placeholder.overriddenink8s.vars.localhost
23	28		spring.cloud.azure.keyvault.secret.property-sources[0].name=wrongsecret-3
		skipped 80 lines

■ ■ ■ ■ ■ ■

src/main/resources/templates/stats.html

		skipped 12 lines
13	13		<p>
14	14		Number of active sessions: <span th:text="${sessioncounter}"></span><br/>
15	15		Number of canary callbacks since boot: <span th:text="${canaryCounter}"></span><br/>
16		-	Active sessions are currently active visitors to challenges.
	16	+	Active sessions are currently active visitors to challenges.<br/>
	17	+	<span class="d-none d-lg-block" th:if="${swaggerEnabled==true}" ><br/><br/><br/></span>
17	18		</p>
18	19
19	20		</div>
		skipped 4 lines
24	25		<p>
25	26		Hints enabled: <span th:text="${hintsEnabled}"></span> <br/>
26	27		Reason enabled: <span th:text="${reasonEnabled}"></span><br/>
27		-	CTF-mode enabled: <span th:text="${ctfModeEnabled}"></span>
	28	+	CTF-mode enabled: <span th:text="${ctfModeEnabled}"></span><br/>
	29	+	Springdoc enabled: <span th:text="${springdockenabled}"></span><br/>
	30	+	Swagger enabled: <span th:text="${swaggerEnabled}"></span>
	31	+	<span th:if="${swaggerEnabled==true}" ><br/>Swagger uri: <a th:href="${swaggerURI}" target="_blank" th:text="${swaggerURI}"></a></span>
28	32		</p>
29	33		</div>
30	34		</div>
		skipped 23 lines

■ ■ ■ ■ ■ ■

src/main/resources/templates/welcome.html

		skipped 115 lines
116	116		</ul>
117	117		</div>
118	118		<div class="border border-dark thank-you text-center">
119		-	Developing our solution in 3 clouds cost money. Want to help us to cover our cloud bills?
	119	+	Developing our solution in 3 clouds costs money. Want to help us to cover our cloud bills?
120	120		<a href="https://owasp.org/donate/?reponame=www-project-wrongsecrets&title=OWASP+wrongsecrets" target="_blank">Donate</a>.
121	121		</div>
122	122		</div>
		skipped 50 lines

Merge remote-tracking branch 'origin/fix/issue673' into fix/issue673