Skip to content

Commit 7756046

Browse files
david-a-wheelerdavid-a-wheeler
authored
Merge pull request #753 from ossf/deserialization_no_yaml
Deserialization no yaml
2 parents c2466e4 + 5df103b commit 7756046

File tree

2 files changed

+140
-127
lines changed

2 files changed

+140
-127
lines changed

‎docs/labs/deserialization.html‎

Lines changed: 1 addition & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -7,137 +7,11 @@
77
<link rel="stylesheet" href="checker.css">
88
<script src="js-yaml.min.js"></script>
99
<script src="checker.js"></script>
10+
<script src="deserialization.js"></script>
1011
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
1112

1213
<!-- See create_labs.md for how to create your own lab! -->
1314

14-
<!-- Sample expected answer -->
15-
<script id="expected0" type="plain/text">
16-
const data = JSON.parse(base64Decoded);
17-
</script>
18-
<!--
19-
-->
20-
<script id="expected1" type="plain/text">
21-
if (data.username && typeof data.username == 'string' && data.username.length < 20) {
22-
</script>
23-
24-
<!-- Full pattern of correct answer -->
25-
<script id="correct0" type="plain/text">
26-
\s* const data = JSON \. parse \( base64Decoded \) \; \s*
27-
</script>
28-
<script id="correct1" type="plain/text">
29-
\s* if \( CONDALL \) \{ \s*
30-
</script>
31-
32-
<script id="info" type="application/yaml">
33-
---
34-
# Allow condition subexpressions to be optionally surrounded by parentheses
35-
# and allow the order to vary. This allows more real-world answers to be
36-
# considered acceptable.
37-
# Doing this is more easily done by buildigg up definitions,
38-
# which is annoying to write but general.
39-
definitions:
40-
- term: COND0
41-
value: |-
42-
data \. username
43-
- term: COND0
44-
value: |-
45-
(COND0|\( COND0 \))
46-
- term: COND1
47-
value: |-
48-
typeof\s+data \. username == ('string'|"string"|`string`)
49-
- term: COND1
50-
value: |-
51-
(COND1|\( COND1 \))
52-
- term: COND2
53-
value: |-
54-
data \. username \. length < 20
55-
- term: COND2
56-
value: |-
57-
(COND2|\( COND2 \))
58-
# Only the first one is likely, but we may as well allow both possibilities.
59-
# The first condition MUST be first because it checks if the value exists.
60-
- term: CONDALL
61-
value: |-
62-
(COND0 && (COND1 && COND2|COND2 && COND1))
63-
hints:
64-
- absent: |
65-
^ const data =
66-
text: The first section should begin with `const data =`
67-
- present: "json"
68-
text: the JSON built-in global object is witten in uppercase.
69-
- absent: |
70-
JSON \. parse
71-
text: Make a call to `JSON.parse` with the data retrieved, e.g.,
72-
`JSON.parse(base64Decoded)` should be stored in `data`.
73-
- present: |
74-
\+
75-
text: You should not have any concatenation (`+`) in the first section.
76-
- absent: |
77-
; $
78-
text: JavaScript does not require semicolons at the end of a
79-
statement, but since the other statements terminate with semicolons,
80-
you should also terminate your statement with a semicolon to be consistent.
81-
- absent: |-
82-
^ if \(
83-
index: 1
84-
text: The second section should start with `if (` followed by a condition.
85-
examples:
86-
-
87-
- const data = JSON.parse(base64Decoded);
88-
- |
89-
if data.username {
90-
- absent: |
91-
data \. username
92-
index: 1
93-
text: Check if the data object has a property called username. You can do this by referencing data.username.
94-
- absent: \&\&
95-
index: 1
96-
text: To combine multiple conditions in JavaScript use &&. This operator means 'and', so both conditions must be true for the entire statement to pass.
97-
- absent: typeof
98-
index: 1
99-
text: Use typeof to check the type of the operand's value.
100-
You should have `typeof data.username == 'string'`
101-
or similar.
102-
- present: |
103-
typeof data \. username == 'String'
104-
index: 1
105-
text: When using typeof, JavaScript expects "string" all lowercase.
106-
- absent: length
107-
index: 1
108-
text: check if the length of the string is smaller than 20 characters.
109-
Use the expression `data.username.length &lt; 20` to determine this.
110-
- present: |-
111-
^ if \(
112-
absent: |-
113-
^ if \( data \. username &&
114-
index: 1
115-
text: Begin the second section with `if ( data.username && ... `
116-
because you must check if data is even present before you can check
117-
various attributes of that data.
118-
examples:
119-
-
120-
- "const data = JSON.parse(base64Decoded);"
121-
- "if (typeof data.username == 'string' && data.username.length < 20 && data.username) {"
122-
successes:
123-
-
124-
- const data = JSON.parse(base64Decoded);
125-
- if (data.username && typeof data.username == 'string' && data.username.length < 20) {
126-
-
127-
- const data = JSON . parse ( base64Decoded ) ;
128-
- if ( data . username && typeof data . username == 'string' && data . username.length < 20) {
129-
-
130-
- const data = JSON.parse(base64Decoded);
131-
- if (data.username && (typeof data.username == 'string') && (data.username.length < 20)) {
132-
-
133-
- const data = JSON.parse(base64Decoded);
134-
- if (data.username && typeof data.username == 'string' && (data.username.length < 20)) {
135-
failures:
136-
-
137-
- const data = JSON.parse(base64Decoded);
138-
- if (data.username && (typeof data.username == 'string')) && (data.username.length < 20)) {
139-
# debug: true
140-
</script>
14115
</head>
14216
<body>
14317
<!-- For GitHub Pages formatting: -->

‎docs/labs/deserialization.js‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
info =
2+
{
3+
definitions: [
4+
{
5+
term: "COND0",
6+
value: String.raw`data \. username`
7+
},
8+
{
9+
term: "COND0",
10+
value: String.raw`(COND0|\( COND0 \))`
11+
},
12+
{
13+
term: "COND1",
14+
value: String.raw`typeof\s+data \. username == ('string'|"string"|${BACKQUOTE}string${BACKQUOTE})`
15+
},
16+
{
17+
term: "COND1",
18+
value: String.raw`(COND1|\( COND1 \))`
19+
},
20+
{
21+
term: "COND2",
22+
value: String.raw`data \. username \. length < 20`
23+
},
24+
{
25+
term: "COND2",
26+
value: String.raw`(COND2|\( COND2 \))`
27+
},
28+
{
29+
term: "CONDALL",
30+
value: "(COND0 && (COND1 && COND2|COND2 && COND1))"
31+
}
32+
],
33+
hints: [
34+
{
35+
absent: "^ const data =\n",
36+
text: "The first section should begin with `const data =`"
37+
},
38+
{
39+
present: "json",
40+
text: "the JSON built-in global object is witten in uppercase."
41+
},
42+
{
43+
absent: String.raw`JSON \. parse
44+
`,
45+
text: "Make a call to `JSON.parse` with the data retrieved, e.g., `JSON.parse(base64Decoded)` should be stored in `data`."
46+
},
47+
{
48+
present: String.raw`\+
49+
`,
50+
text: "You should not have any concatenation (`+`) in the first section."
51+
},
52+
{
53+
absent: "; $\n",
54+
text: "JavaScript does not require semicolons at the end of a statement, but since the other statements terminate with semicolons, you should also terminate your statement with a semicolon to be consistent."
55+
},
56+
{
57+
absent: String.raw`^ if \(`,
58+
index: 1,
59+
text: "The second section should start with `if (` followed by a condition.",
60+
examples: [
61+
[
62+
"const data = JSON.parse(base64Decoded);",
63+
"if data.username {\n"
64+
]
65+
]
66+
},
67+
{
68+
absent: String.raw`data \. username
69+
`,
70+
index: 1,
71+
text: "Check if the data object has a property called username. You can do this by referencing data.username."
72+
},
73+
{
74+
absent: String.raw`\&\&`,
75+
index: 1,
76+
text: "To combine multiple conditions in JavaScript use &&. This operator means 'and', so both conditions must be true for the entire statement to pass."
77+
},
78+
{
79+
absent: "typeof",
80+
index: 1,
81+
text: "Use typeof to check the type of the operand's value. You should have `typeof data.username == 'string'` or similar."
82+
},
83+
{
84+
present: String.raw`typeof data \. username == 'String'
85+
`,
86+
index: 1,
87+
text: "When using typeof, JavaScript expects \"string\" all lowercase."
88+
},
89+
{
90+
absent: "length",
91+
index: 1,
92+
text: "check if the length of the string is smaller than 20 characters. Use the expression `data.username.length &lt; 20` to determine this."
93+
},
94+
{
95+
present: String.raw`^ if \(`,
96+
absent: String.raw`^ if \( data \. username &&`,
97+
index: 1,
98+
text: "Begin the second section with `if ( data.username && ... ` because you must check if data is even present before you can check various attributes of that data.",
99+
examples: [
100+
[
101+
"const data = JSON.parse(base64Decoded);",
102+
"if (typeof data.username == 'string' && data.username.length < 20 && data.username) {"
103+
]
104+
]
105+
}
106+
],
107+
expected: [
108+
' const data = JSON.parse(base64Decoded);',
109+
` if (data.username && typeof data.username == 'string' && data.username.length < 20) {`
110+
],
111+
correct: [
112+
String.raw`\s* const data = JSON \. parse \( base64Decoded \) \; \s*`,
113+
String.raw`\s* if \( CONDALL \) \{ \s*`
114+
],
115+
successes: [
116+
[
117+
"const data = JSON.parse(base64Decoded);",
118+
"if (data.username && typeof data.username == 'string' && data.username.length < 20) {"
119+
],
120+
[
121+
"const data = JSON . parse ( base64Decoded ) ;",
122+
"if ( data . username && typeof data . username == 'string' && data . username.length < 20) {"
123+
],
124+
[
125+
"const data = JSON.parse(base64Decoded);",
126+
"if (data.username && (typeof data.username == 'string') && (data.username.length < 20)) {"
127+
],
128+
[
129+
"const data = JSON.parse(base64Decoded);",
130+
"if (data.username && typeof data.username == 'string' && (data.username.length < 20)) {"
131+
]
132+
],
133+
failures: [
134+
[
135+
"const data = JSON.parse(base64Decoded);",
136+
"if (data.username && (typeof data.username == 'string')) && (data.username.length < 20)) {"
137+
]
138+
]
139+
}

0 commit comments

Comments
 (0)