Merge pull request #7 from GitHubSecurityLab/part3

Add challenges to part 3

Author: sylwia-budzynska

2/challenge-1/sql-injection.py

@@ -15,4 +15,8 @@ def show_user(request, username):
         # BAD -- Manually quoting placeholder (%s)
         cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
         user = cursor.fetchone()
+
+        # GOOD - string literal
+        cursor.execute("SELECT * FROM users WHERE username = 'johndoe'")
+        user = cursor.fetchone()
 urlpatterns = [url(r'^users/(?P<username>[^/]+)$', show_user)]

3/1/instructions.md

@@ -0,0 +1,7 @@
+You will need to set up CodeQL using one of the methods presented in [challenge 2](https://github.com/GitHubSecurityLab/codeql-zero-to-hero/blob/main/2/challenge-2/instructions.md) from CodeQL zero to hero part 2 to run the queries. Remember also to download and [select a CodeQL database](https://github.com/GitHubSecurityLab/codeql-zero-to-hero/blob/main/2/challenge-2/instructions.md#select-codeql-database) - it can be the GitHubSecurityLab/codeql-zero-to-hero database, but you may also choose another project.
+
+Run the query in this challenge to find all method calls that are called ‘execute’ and come from the `django.db` library.
+
+If the path is not displaying properly, you may need to change the view to ‘alerts’.
+
+<img src=../../images/alert-view.png>

3/1/query.ql

@@ -0,0 +1,15 @@
+/**
+ * @id codeql-zero-to-hero/3-1
+ * @severity error
+ * @kind problem
+ */
+
+import python
+import semmle.python.ApiGraphs
+
+from API::CallNode node
+where node =
+API::moduleImport("django").getMember("db").getMember("connection").getMember("cursor").getReturn().getMember("execute").getACall()
+and
+node.getLocation().getFile().getRelativePath().regexpMatch("2/challenge-1/.*")
+select node, "Call to django.db execute"

3/10/instructions.md

@@ -0,0 +1,2 @@
+Run the CWE-20 Untrusted APIs query on a repo of your choice. For Python in the VS Code CodeQL Starter Workspace, it is located in `vscode-codeql-starter/ql/python/ql/src/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.ql`.
+Try to choose a new project, download its database from GitHub (see [setup](https://github.com/GitHubSecurityLab/codeql-zero-to-hero/blob/main/2/challenge-2/instructions.md#option-b-local-installation)) and run this query on it.

3/11/instructions.md

@@ -0,0 +1,2 @@
+Set up MRVA using instructions [here](https://codeql.github.com/docs/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva/#controller-repository). Select top 10 repositories in the CodeQL extension tab. Choose one of the prewritten queries in your favorite language, right-click in the query file, and select CodeQL: Run Variant Analysis to start variant analysis. If you don’t find anything using that query, it’s likely because the project is already secured against that vulnerability. If you prefer, run one of the bigger lists with 100 or 1000 repositories.
+Caution: if you do find true positive vulnerabilities, make sure to verify them first and then report them using the coordinated disclosure process. See our [guide](https://github.blog/2022-02-09-coordinated-vulnerability-disclosure-cvd-open-source-projects/) for reporting vulnerabilities to open source.

3/2/instructions.md

@@ -0,0 +1,5 @@
+Now you know how to query for calls to functions from specific libraries.
+
+If `os.system` executes input coming from a user, it could lead to a command injection. Write a query to find calls to `os.system` and run it on the database you selected in the previous challenge.
+
+See solution in this folder.

3/2/query.ql

@@ -0,0 +1,13 @@
+/**
+ * @id codeql-zero-to-hero/3-2
+ * @severity error
+ * @kind problem
+ */
+
+import python
+import semmle.python.ApiGraphs
+
+from API::CallNode node
+where node = API::moduleImport("os").getMember("system").getACall()
+and node.getLocation().getFile().getRelativePath().regexpMatch("2/challenge-1/.*")
+select node, "Call to os.system"

3/3/instructions.md

@@ -0,0 +1,9 @@
+Flask is a popular Python web framework. Frameworks very often introduce potential sources for untrusted data, [Flask request](https://flask.palletsprojects.com/en/3.0.x/api/#incoming-request-data) being one of them. For example, a source of untrusted data could be:
+
+```
+username = request.args.get("username")
+```
+
+Write a query to find `request.args`
+
+See solution in this folder.

3/3/query.ql

@@ -0,0 +1,14 @@
+/**
+ * @id codeql-zero-to-hero/3-3
+ * @severity error
+ * @kind problem
+ */
+
+import python
+import semmle.python.ApiGraphs
+
+select API::moduleImport("flask").getMember("request").getMember("args").asSource(), "Flask request.args source"
+
+// Note that you can also use a wildcard to query for any method of the request object, for example:
+
+// select API::moduleImport("flask").getMember("request").getMember(_).asSource()

3/4/instructions.md

@@ -0,0 +1,3 @@
+Run a query with `getAQlClass` predicate.
+
+See example in this folder.