Skip to content

Commit 1d62582

Browse files
grendel513grendel513
authored
Merge pull request #161 from jpbowie/master
Added Import Options
2 parents cd18071 + e0e8fa8 commit 1d62582

17 files changed

+2387
-1
lines changed

‎docker/sample_data/scans/SampleGenericImport.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Date,Title,CweId,Url,Severity,Description,Mitigation,Impact,References,Active,Verified,FalsePositive,Duplicate
2+
11/7/16,Potential XSS Vulnerability,79,,High,"FileName: default.aspx.csDescription: Potential XSS VulnerabilityLine:18Code Line: Response.Write(output);",None,,,TRUE,FALSE,FALSE,FALSE
3+
11/7/16,Potential SQL Injection,112,,High,"FileName: UserData.csDescription: Potential SQL Injection VulnerabilityLine:42Code Line: strSQL=""SELECT * FROM users WHERE user_id="" + request_user_id",None,,Test Reference,TRUE,FALSE,TRUE,FALSE
4+
11/7/16,Weak Cryptography,327,https://myserver.mycompany.com/Login.aspx,Low,"Url:https://myserver.mycompany.com/Login.aspxDescription: Using weak crypto algorithm",None,Potential impact,,TRUE,FALSE,FALSE,TRUE

‎docker/sample_data/scans/VCG-WebGoatNet-Results.csv‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Core\Cart.cs,16,"TODO: Refactor this. Use LINQ with aggregation to get SUM.",False,"LawnGreen"
2+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Core\Cart.cs,41,"TODO: Add ability to delete an orderDetail and to change quantities.",False,"LawnGreen"
3+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Core\Order.cs,27,"TODO: Shipments and Payments should be singular. Like customer.",False,"LawnGreen"
4+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\BlogEntryRepository.cs,18,"TODO: should put this in a try/catch",False,"LawnGreen"
5+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\BlogResponseRepository.cs,18,"TODO: should put this in a try/catch",False,"LawnGreen"
6+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\CustomerRepository.cs,41,"TODO: Add try/catch logic",False,"LawnGreen"
7+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\ShipperRepository.cs,37,"/ TODO: Use the check digit algorithms to make it realistic.",False,"LawnGreen"
8+
4,Standard,"URL Request Gets Path from Variable","The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.",C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs,25," Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));",False,"LawnGreen"
9+
4,Standard,"URL Request Gets Path from Variable","The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.",C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs,72," Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));",False,"LawnGreen"
10+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs,58,"TODO: Put this in try/catch as well",False,"LawnGreen"
11+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs,59,"TODO: Feels like this is too much business logic. Should be moved to OrderDetail constructor?",False,"LawnGreen"
12+
3,Medium,".NET Debugging Enabled","The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.",C:\Projects\WebGoat.Net\WebSite\Web.config,25,"",False,"LawnGreen"
13+
4,Standard,"URL Request Gets Path from Variable","The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.",C:\Projects\WebGoat.Net\WebSite\Account\Register.aspx.cs,35," Response.Redirect(continueUrl);",False,"LawnGreen"
14+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Account\ViewAccountInfo.aspx.cs,22,"ContactName is being repurposed as the foreign key to the user table. Kludgey, I know.",False,"LawnGreen"
15+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs,102,"TODO: Throws an error if we don't set the date. Try to set it to null or something.",False,"LawnGreen"
16+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs,145,"TODO: Uncommenting this line causes EF to throw exception when creating the order.",False,"LawnGreen"
17+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\XtremelyEvilWebApp\StealCookies.aspx.cs,19,"TODO: Mail the cookie in real time.",False,"LawnGreen"
18+
3,Medium,".NET Debugging Enabled","The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.",C:\Projects\WebGoat.Net\XtremelyEvilWebApp\Web.config,6,"",False,"LawnGreen"

‎docker/sample_data/scans/VCG-WebGoatNet-Results.xml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!--XML Export of VCG Results for directory: C:\Projects\WebGoat.Net. Scanned for C# security issues.-->
3+
<CodeIssueCollection>
4+
<CodeIssue>
5+
<Priority>6</Priority>
6+
<Severity>Suspicious Comment</Severity>
7+
<Title>Comment Indicates Potentially Unfinished Code</Title>
8+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
9+
<FileName>C:\Projects\WebGoat.Net\Core\Cart.cs</FileName>
10+
<Line>16</Line>
11+
<CodeLine>TODO: Refactor this. Use LINQ with aggregation to get SUM.</CodeLine>
12+
<Checked>False</Checked>
13+
<CheckColour>LawnGreen</CheckColour>
14+
</CodeIssue>
15+
<CodeIssue>
16+
<Priority>6</Priority>
17+
<Severity>Suspicious Comment</Severity>
18+
<Title>Comment Indicates Potentially Unfinished Code</Title>
19+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
20+
<FileName>C:\Projects\WebGoat.Net\Core\Cart.cs</FileName>
21+
<Line>41</Line>
22+
<CodeLine>TODO: Add ability to delete an orderDetail and to change quantities.</CodeLine>
23+
<Checked>False</Checked>
24+
<CheckColour>LawnGreen</CheckColour>
25+
</CodeIssue>
26+
<CodeIssue>
27+
<Priority>6</Priority>
28+
<Severity>Suspicious Comment</Severity>
29+
<Title>Comment Indicates Potentially Unfinished Code</Title>
30+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
31+
<FileName>C:\Projects\WebGoat.Net\Core\Order.cs</FileName>
32+
<Line>27</Line>
33+
<CodeLine>TODO: Shipments and Payments should be singular. Like customer.</CodeLine>
34+
<Checked>False</Checked>
35+
<CheckColour>LawnGreen</CheckColour>
36+
</CodeIssue>
37+
<CodeIssue>
38+
<Priority>6</Priority>
39+
<Severity>Suspicious Comment</Severity>
40+
<Title>Comment Indicates Potentially Unfinished Code</Title>
41+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
42+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\BlogEntryRepository.cs</FileName>
43+
<Line>18</Line>
44+
<CodeLine>TODO: should put this in a try/catch</CodeLine>
45+
<Checked>False</Checked>
46+
<CheckColour>LawnGreen</CheckColour>
47+
</CodeIssue>
48+
<CodeIssue>
49+
<Priority>6</Priority>
50+
<Severity>Suspicious Comment</Severity>
51+
<Title>Comment Indicates Potentially Unfinished Code</Title>
52+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
53+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\BlogResponseRepository.cs</FileName>
54+
<Line>18</Line>
55+
<CodeLine>TODO: should put this in a try/catch</CodeLine>
56+
<Checked>False</Checked>
57+
<CheckColour>LawnGreen</CheckColour>
58+
</CodeIssue>
59+
<CodeIssue>
60+
<Priority>6</Priority>
61+
<Severity>Suspicious Comment</Severity>
62+
<Title>Comment Indicates Potentially Unfinished Code</Title>
63+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
64+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\CustomerRepository.cs</FileName>
65+
<Line>41</Line>
66+
<CodeLine>TODO: Add try/catch logic</CodeLine>
67+
<Checked>False</Checked>
68+
<CheckColour>LawnGreen</CheckColour>
69+
</CodeIssue>
70+
<CodeIssue>
71+
<Priority>6</Priority>
72+
<Severity>Suspicious Comment</Severity>
73+
<Title>Comment Indicates Potentially Unfinished Code</Title>
74+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
75+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\ShipperRepository.cs</FileName>
76+
<Line>37</Line>
77+
<CodeLine>/ TODO: Use the check digit algorithms to make it realistic.</CodeLine>
78+
<Checked>False</Checked>
79+
<CheckColour>LawnGreen</CheckColour>
80+
</CodeIssue>
81+
<CodeIssue>
82+
<Priority>4</Priority>
83+
<Severity>Standard</Severity>
84+
<Title>URL Request Gets Path from Variable</Title>
85+
<Description>The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.</Description>
86+
<FileName>C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs</FileName>
87+
<Line>25</Line>
88+
<CodeLine> Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));</CodeLine>
89+
<Checked>False</Checked>
90+
<CheckColour>LawnGreen</CheckColour>
91+
</CodeIssue>
92+
<CodeIssue>
93+
<Priority>4</Priority>
94+
<Severity>Standard</Severity>
95+
<Title>URL Request Gets Path from Variable</Title>
96+
<Description>The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.</Description>
97+
<FileName>C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs</FileName>
98+
<Line>72</Line>
99+
<CodeLine> Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));</CodeLine>
100+
<Checked>False</Checked>
101+
<CheckColour>LawnGreen</CheckColour>
102+
</CodeIssue>
103+
<CodeIssue>
104+
<Priority>6</Priority>
105+
<Severity>Suspicious Comment</Severity>
106+
<Title>Comment Indicates Potentially Unfinished Code</Title>
107+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
108+
<FileName>C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs</FileName>
109+
<Line>58</Line>
110+
<CodeLine>TODO: Put this in try/catch as well</CodeLine>
111+
<Checked>False</Checked>
112+
<CheckColour>LawnGreen</CheckColour>
113+
</CodeIssue>
114+
<CodeIssue>
115+
<Priority>6</Priority>
116+
<Severity>Suspicious Comment</Severity>
117+
<Title>Comment Indicates Potentially Unfinished Code</Title>
118+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
119+
<FileName>C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs</FileName>
120+
<Line>59</Line>
121+
<CodeLine>TODO: Feels like this is too much business logic. Should be moved to OrderDetail constructor?</CodeLine>
122+
<Checked>False</Checked>
123+
<CheckColour>LawnGreen</CheckColour>
124+
</CodeIssue>
125+
<CodeIssue>
126+
<Priority>3</Priority>
127+
<Severity>Medium</Severity>
128+
<Title>.NET Debugging Enabled</Title>
129+
<Description>The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.</Description>
130+
<FileName>C:\Projects\WebGoat.Net\WebSite\Web.config</FileName>
131+
<Line>25</Line>
132+
<CodeLine/>
133+
<Checked>False</Checked>
134+
<CheckColour>LawnGreen</CheckColour>
135+
</CodeIssue>
136+
<CodeIssue>
137+
<Priority>4</Priority>
138+
<Severity>Standard</Severity>
139+
<Title>URL Request Gets Path from Variable</Title>
140+
<Description>The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.</Description>
141+
<FileName>C:\Projects\WebGoat.Net\WebSite\Account\Register.aspx.cs</FileName>
142+
<Line>35</Line>
143+
<CodeLine> Response.Redirect(continueUrl);</CodeLine>
144+
<Checked>False</Checked>
145+
<CheckColour>LawnGreen</CheckColour>
146+
</CodeIssue>
147+
<CodeIssue>
148+
<Priority>6</Priority>
149+
<Severity>Suspicious Comment</Severity>
150+
<Title>Comment Indicates Potentially Unfinished Code</Title>
151+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
152+
<FileName>C:\Projects\WebGoat.Net\WebSite\Account\ViewAccountInfo.aspx.cs</FileName>
153+
<Line>22</Line>
154+
<CodeLine>ContactName is being repurposed as the foreign key to the user table. Kludgey, I know.</CodeLine>
155+
<Checked>False</Checked>
156+
<CheckColour>LawnGreen</CheckColour>
157+
</CodeIssue>
158+
<CodeIssue>
159+
<Priority>6</Priority>
160+
<Severity>Suspicious Comment</Severity>
161+
<Title>Comment Indicates Potentially Unfinished Code</Title>
162+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
163+
<FileName>C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs</FileName>
164+
<Line>102</Line>
165+
<CodeLine>TODO: Throws an error if we don't set the date. Try to set it to null or something.</CodeLine>
166+
<Checked>False</Checked>
167+
<CheckColour>LawnGreen</CheckColour>
168+
</CodeIssue>
169+
<CodeIssue>
170+
<Priority>6</Priority>
171+
<Severity>Suspicious Comment</Severity>
172+
<Title>Comment Indicates Potentially Unfinished Code</Title>
173+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
174+
<FileName>C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs</FileName>
175+
<Line>145</Line>
176+
<CodeLine>TODO: Uncommenting this line causes EF to throw exception when creating the order.</CodeLine>
177+
<Checked>False</Checked>
178+
<CheckColour>LawnGreen</CheckColour>
179+
</CodeIssue>
180+
<CodeIssue>
181+
<Priority>6</Priority>
182+
<Severity>Suspicious Comment</Severity>
183+
<Title>Comment Indicates Potentially Unfinished Code</Title>
184+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
185+
<FileName>C:\Projects\WebGoat.Net\XtremelyEvilWebApp\StealCookies.aspx.cs</FileName>
186+
<Line>19</Line>
187+
<CodeLine>TODO: Mail the cookie in real time.</CodeLine>
188+
<Checked>False</Checked>
189+
<CheckColour>LawnGreen</CheckColour>
190+
</CodeIssue>
191+
<CodeIssue>
192+
<Priority>3</Priority>
193+
<Severity>Medium</Severity>
194+
<Title>.NET Debugging Enabled</Title>
195+
<Description>The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.</Description>
196+
<FileName>C:\Projects\WebGoat.Net\XtremelyEvilWebApp\Web.config</FileName>
197+
<Line>6</Line>
198+
<CodeLine/>
199+
<Checked>False</Checked>
200+
<CheckColour>LawnGreen</CheckColour>
201+
</CodeIssue>
202+
</CodeIssueCollection>

0 commit comments

Comments
 (0)