Skip to content

Commit e0e8fa8

Browse files
jpbowiejpbowie
committed
Added sample scan data for new imports
Updated features.rst for new import options Removed unnecessary import template files Removed unneeded information about the generic findings import
1 parent e229909 commit e0e8fa8

File tree

9 files changed

+966
-46
lines changed

9 files changed

+966
-46
lines changed

‎docker/sample_data/scans/SampleGenericImport.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Date,Title,CweId,Url,Severity,Description,Mitigation,Impact,References,Active,Verified,FalsePositive,Duplicate
2+
11/7/16,Potential XSS Vulnerability,79,,High,"FileName: default.aspx.csDescription: Potential XSS VulnerabilityLine:18Code Line: Response.Write(output);",None,,,TRUE,FALSE,FALSE,FALSE
3+
11/7/16,Potential SQL Injection,112,,High,"FileName: UserData.csDescription: Potential SQL Injection VulnerabilityLine:42Code Line: strSQL=""SELECT * FROM users WHERE user_id="" + request_user_id",None,,Test Reference,TRUE,FALSE,TRUE,FALSE
4+
11/7/16,Weak Cryptography,327,https://myserver.mycompany.com/Login.aspx,Low,"Url:https://myserver.mycompany.com/Login.aspxDescription: Using weak crypto algorithm",None,Potential impact,,TRUE,FALSE,FALSE,TRUE

‎docker/sample_data/scans/VCG-WebGoatNet-Results.csv‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Core\Cart.cs,16,"TODO: Refactor this. Use LINQ with aggregation to get SUM.",False,"LawnGreen"
2+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Core\Cart.cs,41,"TODO: Add ability to delete an orderDetail and to change quantities.",False,"LawnGreen"
3+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Core\Order.cs,27,"TODO: Shipments and Payments should be singular. Like customer.",False,"LawnGreen"
4+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\BlogEntryRepository.cs,18,"TODO: should put this in a try/catch",False,"LawnGreen"
5+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\BlogResponseRepository.cs,18,"TODO: should put this in a try/catch",False,"LawnGreen"
6+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\CustomerRepository.cs,41,"TODO: Add try/catch logic",False,"LawnGreen"
7+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\Infrastructure\ShipperRepository.cs,37,"/ TODO: Use the check digit algorithms to make it realistic.",False,"LawnGreen"
8+
4,Standard,"URL Request Gets Path from Variable","The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.",C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs,25," Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));",False,"LawnGreen"
9+
4,Standard,"URL Request Gets Path from Variable","The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.",C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs,72," Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));",False,"LawnGreen"
10+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs,58,"TODO: Put this in try/catch as well",False,"LawnGreen"
11+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs,59,"TODO: Feels like this is too much business logic. Should be moved to OrderDetail constructor?",False,"LawnGreen"
12+
3,Medium,".NET Debugging Enabled","The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.",C:\Projects\WebGoat.Net\WebSite\Web.config,25,"",False,"LawnGreen"
13+
4,Standard,"URL Request Gets Path from Variable","The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.",C:\Projects\WebGoat.Net\WebSite\Account\Register.aspx.cs,35," Response.Redirect(continueUrl);",False,"LawnGreen"
14+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Account\ViewAccountInfo.aspx.cs,22,"ContactName is being repurposed as the foreign key to the user table. Kludgey, I know.",False,"LawnGreen"
15+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs,102,"TODO: Throws an error if we don't set the date. Try to set it to null or something.",False,"LawnGreen"
16+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs,145,"TODO: Uncommenting this line causes EF to throw exception when creating the order.",False,"LawnGreen"
17+
6,Suspicious Comment,"Comment Indicates Potentially Unfinished Code","The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.",C:\Projects\WebGoat.Net\XtremelyEvilWebApp\StealCookies.aspx.cs,19,"TODO: Mail the cookie in real time.",False,"LawnGreen"
18+
3,Medium,".NET Debugging Enabled","The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.",C:\Projects\WebGoat.Net\XtremelyEvilWebApp\Web.config,6,"",False,"LawnGreen"

‎docker/sample_data/scans/VCG-WebGoatNet-Results.xml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!--XML Export of VCG Results for directory: C:\Projects\WebGoat.Net. Scanned for C# security issues.-->
3+
<CodeIssueCollection>
4+
<CodeIssue>
5+
<Priority>6</Priority>
6+
<Severity>Suspicious Comment</Severity>
7+
<Title>Comment Indicates Potentially Unfinished Code</Title>
8+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
9+
<FileName>C:\Projects\WebGoat.Net\Core\Cart.cs</FileName>
10+
<Line>16</Line>
11+
<CodeLine>TODO: Refactor this. Use LINQ with aggregation to get SUM.</CodeLine>
12+
<Checked>False</Checked>
13+
<CheckColour>LawnGreen</CheckColour>
14+
</CodeIssue>
15+
<CodeIssue>
16+
<Priority>6</Priority>
17+
<Severity>Suspicious Comment</Severity>
18+
<Title>Comment Indicates Potentially Unfinished Code</Title>
19+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
20+
<FileName>C:\Projects\WebGoat.Net\Core\Cart.cs</FileName>
21+
<Line>41</Line>
22+
<CodeLine>TODO: Add ability to delete an orderDetail and to change quantities.</CodeLine>
23+
<Checked>False</Checked>
24+
<CheckColour>LawnGreen</CheckColour>
25+
</CodeIssue>
26+
<CodeIssue>
27+
<Priority>6</Priority>
28+
<Severity>Suspicious Comment</Severity>
29+
<Title>Comment Indicates Potentially Unfinished Code</Title>
30+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
31+
<FileName>C:\Projects\WebGoat.Net\Core\Order.cs</FileName>
32+
<Line>27</Line>
33+
<CodeLine>TODO: Shipments and Payments should be singular. Like customer.</CodeLine>
34+
<Checked>False</Checked>
35+
<CheckColour>LawnGreen</CheckColour>
36+
</CodeIssue>
37+
<CodeIssue>
38+
<Priority>6</Priority>
39+
<Severity>Suspicious Comment</Severity>
40+
<Title>Comment Indicates Potentially Unfinished Code</Title>
41+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
42+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\BlogEntryRepository.cs</FileName>
43+
<Line>18</Line>
44+
<CodeLine>TODO: should put this in a try/catch</CodeLine>
45+
<Checked>False</Checked>
46+
<CheckColour>LawnGreen</CheckColour>
47+
</CodeIssue>
48+
<CodeIssue>
49+
<Priority>6</Priority>
50+
<Severity>Suspicious Comment</Severity>
51+
<Title>Comment Indicates Potentially Unfinished Code</Title>
52+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
53+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\BlogResponseRepository.cs</FileName>
54+
<Line>18</Line>
55+
<CodeLine>TODO: should put this in a try/catch</CodeLine>
56+
<Checked>False</Checked>
57+
<CheckColour>LawnGreen</CheckColour>
58+
</CodeIssue>
59+
<CodeIssue>
60+
<Priority>6</Priority>
61+
<Severity>Suspicious Comment</Severity>
62+
<Title>Comment Indicates Potentially Unfinished Code</Title>
63+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
64+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\CustomerRepository.cs</FileName>
65+
<Line>41</Line>
66+
<CodeLine>TODO: Add try/catch logic</CodeLine>
67+
<Checked>False</Checked>
68+
<CheckColour>LawnGreen</CheckColour>
69+
</CodeIssue>
70+
<CodeIssue>
71+
<Priority>6</Priority>
72+
<Severity>Suspicious Comment</Severity>
73+
<Title>Comment Indicates Potentially Unfinished Code</Title>
74+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
75+
<FileName>C:\Projects\WebGoat.Net\Infrastructure\ShipperRepository.cs</FileName>
76+
<Line>37</Line>
77+
<CodeLine>/ TODO: Use the check digit algorithms to make it realistic.</CodeLine>
78+
<Checked>False</Checked>
79+
<CheckColour>LawnGreen</CheckColour>
80+
</CodeIssue>
81+
<CodeIssue>
82+
<Priority>4</Priority>
83+
<Severity>Standard</Severity>
84+
<Title>URL Request Gets Path from Variable</Title>
85+
<Description>The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.</Description>
86+
<FileName>C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs</FileName>
87+
<Line>25</Line>
88+
<CodeLine> Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));</CodeLine>
89+
<Checked>False</Checked>
90+
<CheckColour>LawnGreen</CheckColour>
91+
</CodeIssue>
92+
<CodeIssue>
93+
<Priority>4</Priority>
94+
<Severity>Standard</Severity>
95+
<Title>URL Request Gets Path from Variable</Title>
96+
<Description>The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.</Description>
97+
<FileName>C:\Projects\WebGoat.Net\WebSite\PackageTracking.aspx.cs</FileName>
98+
<Line>72</Line>
99+
<CodeLine> Response.Redirect(Order.GetPackageTrackingUrl(_carrier, _trackingNumber));</CodeLine>
100+
<Checked>False</Checked>
101+
<CheckColour>LawnGreen</CheckColour>
102+
</CodeIssue>
103+
<CodeIssue>
104+
<Priority>6</Priority>
105+
<Severity>Suspicious Comment</Severity>
106+
<Title>Comment Indicates Potentially Unfinished Code</Title>
107+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
108+
<FileName>C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs</FileName>
109+
<Line>58</Line>
110+
<CodeLine>TODO: Put this in try/catch as well</CodeLine>
111+
<Checked>False</Checked>
112+
<CheckColour>LawnGreen</CheckColour>
113+
</CodeIssue>
114+
<CodeIssue>
115+
<Priority>6</Priority>
116+
<Severity>Suspicious Comment</Severity>
117+
<Title>Comment Indicates Potentially Unfinished Code</Title>
118+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
119+
<FileName>C:\Projects\WebGoat.Net\WebSite\Product.aspx.cs</FileName>
120+
<Line>59</Line>
121+
<CodeLine>TODO: Feels like this is too much business logic. Should be moved to OrderDetail constructor?</CodeLine>
122+
<Checked>False</Checked>
123+
<CheckColour>LawnGreen</CheckColour>
124+
</CodeIssue>
125+
<CodeIssue>
126+
<Priority>3</Priority>
127+
<Severity>Medium</Severity>
128+
<Title>.NET Debugging Enabled</Title>
129+
<Description>The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.</Description>
130+
<FileName>C:\Projects\WebGoat.Net\WebSite\Web.config</FileName>
131+
<Line>25</Line>
132+
<CodeLine/>
133+
<Checked>False</Checked>
134+
<CheckColour>LawnGreen</CheckColour>
135+
</CodeIssue>
136+
<CodeIssue>
137+
<Priority>4</Priority>
138+
<Severity>Standard</Severity>
139+
<Title>URL Request Gets Path from Variable</Title>
140+
<Description>The URL used in the HTTP request appears to be loaded from a variable. Check the code manually to ensure that malicious URLs cannot be submitted by an attacker.</Description>
141+
<FileName>C:\Projects\WebGoat.Net\WebSite\Account\Register.aspx.cs</FileName>
142+
<Line>35</Line>
143+
<CodeLine> Response.Redirect(continueUrl);</CodeLine>
144+
<Checked>False</Checked>
145+
<CheckColour>LawnGreen</CheckColour>
146+
</CodeIssue>
147+
<CodeIssue>
148+
<Priority>6</Priority>
149+
<Severity>Suspicious Comment</Severity>
150+
<Title>Comment Indicates Potentially Unfinished Code</Title>
151+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
152+
<FileName>C:\Projects\WebGoat.Net\WebSite\Account\ViewAccountInfo.aspx.cs</FileName>
153+
<Line>22</Line>
154+
<CodeLine>ContactName is being repurposed as the foreign key to the user table. Kludgey, I know.</CodeLine>
155+
<Checked>False</Checked>
156+
<CheckColour>LawnGreen</CheckColour>
157+
</CodeIssue>
158+
<CodeIssue>
159+
<Priority>6</Priority>
160+
<Severity>Suspicious Comment</Severity>
161+
<Title>Comment Indicates Potentially Unfinished Code</Title>
162+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
163+
<FileName>C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs</FileName>
164+
<Line>102</Line>
165+
<CodeLine>TODO: Throws an error if we don't set the date. Try to set it to null or something.</CodeLine>
166+
<Checked>False</Checked>
167+
<CheckColour>LawnGreen</CheckColour>
168+
</CodeIssue>
169+
<CodeIssue>
170+
<Priority>6</Priority>
171+
<Severity>Suspicious Comment</Severity>
172+
<Title>Comment Indicates Potentially Unfinished Code</Title>
173+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
174+
<FileName>C:\Projects\WebGoat.Net\WebSite\Checkout\Checkout.aspx.cs</FileName>
175+
<Line>145</Line>
176+
<CodeLine>TODO: Uncommenting this line causes EF to throw exception when creating the order.</CodeLine>
177+
<Checked>False</Checked>
178+
<CheckColour>LawnGreen</CheckColour>
179+
</CodeIssue>
180+
<CodeIssue>
181+
<Priority>6</Priority>
182+
<Severity>Suspicious Comment</Severity>
183+
<Title>Comment Indicates Potentially Unfinished Code</Title>
184+
<Description>The comment includes some wording which indicates that the developer regards it as unfinished or does not trust it to work correctly.</Description>
185+
<FileName>C:\Projects\WebGoat.Net\XtremelyEvilWebApp\StealCookies.aspx.cs</FileName>
186+
<Line>19</Line>
187+
<CodeLine>TODO: Mail the cookie in real time.</CodeLine>
188+
<Checked>False</Checked>
189+
<CheckColour>LawnGreen</CheckColour>
190+
</CodeIssue>
191+
<CodeIssue>
192+
<Priority>3</Priority>
193+
<Severity>Medium</Severity>
194+
<Title>.NET Debugging Enabled</Title>
195+
<Description>The application is configured to return .NET debug information. This can provide an attacker with useful information and should not be used in a live application.</Description>
196+
<FileName>C:\Projects\WebGoat.Net\XtremelyEvilWebApp\Web.config</FileName>
197+
<Line>6</Line>
198+
<CodeLine/>
199+
<Checked>False</Checked>
200+
<CheckColour>LawnGreen</CheckColour>
201+
</CodeIssue>
202+
</CodeIssueCollection>

0 commit comments

Comments
 (0)