Lab deserialization: Allow more variation

Allow sub-conditions to be surrounded by parentheses.

Signed-off-by: David A. Wheeler <[email protected]>

Author: david-a-wheeler

docs/labs/deserialization.html

@@ -26,11 +26,40 @@
 \s* const data = JSON \. parse \( base64Decoded \) \; \s*
 </script>
 <script id="correct1" type="plain/text">
-\s* if \( data \. username && typeof\s+data \. username == ('string'|"string"|`string`) && data \. username \. length < 20 \) \{ \s*
+\s* if \( CONDALL \) \{ \s*
 </script>
 
 <script id="info" type="application/yaml">
 ---
+# Allow condition subexpressions to be optionally surrounded by parentheses
+# and allow the order to vary. This allows more real-world answers to be
+# considered acceptable.
+# Doing this is more easily done by buildigg up definitions,
+# which is annoying to write but general.
+definitions:
+- term: COND0
+  value: |-
+    data \. username
+- term: COND0
+  value: |-
+    (COND0|\( COND0 \))
+- term: COND1
+  value: |-
+    typeof\s+data \. username == ('string'|"string"|`string`)
+- term: COND1
+  value: |-
+    (COND1|\( COND1 \))
+- term: COND2
+  value: |-
+    data \. username \. length < 20
+- term: COND2
+  value: |-
+    (COND2|\( COND2 \))
+# Only the first one is likely, but we may as well allow both possibilities.
+# The first condition MUST be first because it checks if the value exists.
+- term: CONDALL
+  value: |-
+    (COND0 && (COND1 && COND2|COND2 && COND1))
 hints:
 - absent: |
     ^ const data =
@@ -49,10 +78,15 @@
   text: JavaScript does not require semicolons at the end of a
     statement, but since the other statements terminate with semicolons,
     you should also terminate your statement with a semicolon to be consistent.
-- absent: |
+- absent: |-
     ^ if \(
   index: 1
   text: The second section should start with `if (` followed by a condition.
+  examples:
+  -
+    - const data = JSON.parse(base64Decoded);
+    - |
+        if data.username {
 - absent: |
     data \. username
   index: 1
@@ -73,11 +107,35 @@
   index: 1
   text: check if the length of the string is smaller than 20 characters.
     Use the expression `data.username.length &lt; 20` to determine this.
-- present: |
-    (\&\&|\() \(
+- present: |-
+    ^ if \(
+  absent: |-
+    ^ if \( data \. username &&
   index: 1
-  text: For purposes of this lab, don't use extra parentheses
-    around each term in the condition.
+  text: Begin the second section with `if ( data.username && ... `
+    because you must check if data is even present before you can check
+    various attributes of that data.
+#   examples:
+#   -
+#     - "const data = JSON.parse(base64Decoded);"
+#     - "if (typeof data.username == 'string' && data.username.length < 20 && data.username) {"
+successes:
+  -
+    - const data = JSON.parse(base64Decoded);
+    - if (data.username && typeof data.username == 'string' && data.username.length < 20) {
+  -
+    - const data = JSON . parse ( base64Decoded ) ;
+    - if ( data . username && typeof data . username == 'string' && data . username.length < 20) {
+  -
+    - const data = JSON.parse(base64Decoded);
+    - if (data.username && (typeof data.username == 'string') && (data.username.length < 20)) {
+  -
+    - const data = JSON.parse(base64Decoded);
+    - if (data.username && typeof data.username == 'string' && (data.username.length < 20)) {
+failures:
+  -
+    - const data = JSON.parse(base64Decoded);
+    - if (data.username && (typeof data.username == 'string')) && (data.username.length < 20)) {
 # debug: true
 </script>
 </head>
@@ -107,9 +165,9 @@ <h2>Task Information</h2>
 <p>
 
 <p>
-The code below is called after an application login page. After login, a cookie is set up with the user profile, then in the homepage the cookie is deserialized and uses the username in a greeting message. 
+The code below is called after an application login page. After login, a cookie is set up with the user profile, then in the homepage the cookie is deserialized and uses the username in a greeting message.
 <p>
-If you take a closer look at this code, you’ll see that it’s using <tt>eval()</tt> to deserialize the data from the cookie. This can be very dangerous as <tt>eval()</tt> evaluates a string as JavaScript code, which means any code inside that string will be executed, opening the possibility of Remote Code Execution (RCE) and Code Injection attacks.  
+If you take a closer look at this code, you’ll see that it’s using <tt>eval()</tt> to deserialize the data from the cookie. This can be very dangerous as <tt>eval()</tt> evaluates a string as JavaScript code, which means any code inside that string will be executed, opening the possibility of Remote Code Execution (RCE) and Code Injection attacks.
 <p>
 For this lab we want to fix this by using an approach that prevents executing code from the attacker. We will also add some simple input validation to make sure the data we receive from inside the JSON data is what we are expecting.
 <ol>