Skip to content

Commit 956b581

Browse files
camilaavilarinhocamilaavilarinho
authored
Add insecure deserialization lab (#627)
* Add insecure deserialization lab Signed-off-by: Camila Vilarinho <[email protected]> * Add more hints & fix spacing Signed-off-by: Camila Vilarinho <[email protected]> --------- Signed-off-by: Camila Vilarinho <[email protected]>
1 parent 74fae71 commit 956b581

File tree

1 file changed

+151
-0
lines changed

1 file changed

+151
-0
lines changed

‎docs/labs/insecure-deserialization.html‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<link rel="stylesheet" href="https://best.openssf.org/assets/css/style.css">
7+
<link rel="stylesheet" href="checker.css">
8+
<script src="js-yaml.min.js"></script>
9+
<script src="checker.js"></script>
10+
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
11+
12+
<!-- See create_labs.md for how to create your own lab! -->
13+
14+
<!-- Sample expected answer -->
15+
<script id="expected0" type="plain/text">
16+
const data = JSON.parse(base64Decoded);
17+
</script>
18+
<!--
19+
-->
20+
<script id="expected1" type="plain/text">
21+
if (data.username && typeof data.username == 'string' && data.username.length < 20) {
22+
</script>
23+
24+
<!-- Full pattern of correct answer -->
25+
<script id="correct0" type="plain/text">
26+
const\s+data = JSON \. parse \( base64Decoded \) \; \s*
27+
</script>
28+
<script id="correct1" type="plain/text">
29+
if \( data \. username && typeof\s+data \. username == ('string'|"string"|`string`) && data \. username \. length < 20 \) \{ \s*
30+
</script>
31+
32+
<script id="info" type="application/yaml">
33+
---
34+
hints:
35+
- present: "json"
36+
text: the JSON built-in global object is witten in uppercase.
37+
- absent: data.username
38+
index: 1
39+
text: Check if the data object has a property called username. You can do this by referencing data.username.
40+
- absent: \&\&
41+
index: 1
42+
text: To combine multiple conditions in JavaScript use &&. This operator means 'and', so both conditions must be true for the entire statement to pass.
43+
- absent: typeof
44+
index: 1
45+
text: Use typeof to check the type of the operand's value.
46+
- present: typeof data.username == 'String'
47+
index: 1
48+
text: When using typeof, JavaScript expects "string" all lowercase.
49+
- absent: length
50+
index: 1
51+
text: check if the length of the string is smaller than 20 characters.
52+
53+
# debug: true
54+
</script>
55+
</head>
56+
<body>
57+
<!-- For GitHub Pages formatting: -->
58+
<div class="container-lg px-3 my-5 markdown-body">
59+
<h1>Lab Exercise Insecure Deserialization</h1>
60+
<p>
61+
This is a lab exercise on developing secure software.
62+
For more information, see the <a href="introduction.html" target="_blank">introduction to
63+
the labs</a>.
64+
65+
<p>
66+
<h2>Task</h2>
67+
<p>
68+
<b>Please change the code below to prevent insecure deserialization vulnerability.</b>
69+
70+
<p>
71+
<h2>Background</h2>
72+
<p>
73+
Insecure Deserialization happens when the application’s deserialization process is exploited, allowing an attacker to manipulate the serialized data and pass harmful data into the application code.
74+
<p>
75+
The safest way to prevent this vulnerability is to not accept serialized objects from untrusted sources (user-controllable data). However, if you must accept them, there are some mitigations you can implement. In this lab, we will apply a couple of them.
76+
77+
<p>
78+
<h2>Task Information</h2>
79+
<p>
80+
81+
<p>
82+
The code below is called after an application login page. After login, a cookie is set up with the user profile, then in the homepage the cookie is deserialized and uses the username in a greeting message.
83+
<p>
84+
If you take a closer look at this code, you’ll see that it’s using <tt>eval()</tt> to deserialize the data from the cookie. This can be very dangerous as <tt>eval()</tt> evaluates a string as JavaScript code, which means any code inside that string will be executed, opening the possibility of Remote Code Execution (RCE) and Code Injection attacks.
85+
<p>
86+
For this lab we want to fix this by using an approach that prevents code execution, we will also add input validation to make sure the data we receive is what we are expecting and nothing more than that.
87+
<ol>
88+
<li>
89+
Replace <tt>eval()</tt> with <tt>JSON.parse()</tt>. JSON.parse( ) does not execute any JavaScript code like functions or methods, making it safer than some other serialization libraries.
90+
</li>
91+
<li>Besides checking if <tt>data.username</tt> exists, also check that the username is a string and not bigger than 20 characters.</li>
92+
</ol>
93+
94+
95+
<p>
96+
Use the “hint” and “give up” buttons if necessary.
97+
98+
<p>
99+
<h2>Interactive Lab (<span id="grade"></span>)</h2>
100+
<p>
101+
<p>
102+
Change the code below, adding the mitigation steps to prevent Insecure Deserialization:
103+
<ol>
104+
<li>Use a deserialization approach that prevents code execution.</li>
105+
<li>Validate the username making sure it is used only if it's a <b>string</b> and no longer than <b>20 characters</b>.</li>
106+
</ol>
107+
<form id="lab">
108+
109+
<pre><code>
110+
const express = require('express');
111+
const cookieParser = require('cookie-parser');
112+
113+
const app = express();
114+
115+
app.use(express.json());
116+
app.use(cookieParser());
117+
118+
app.get('/', (req, res) => {
119+
if (req.cookies.profile) {
120+
try {
121+
const base64Decoded = Buffer.from(req.cookies.profile, 'base64').toString('utf8');
122+
<input id="attempt0" type="text" size="60" spellcheck="false" value="const data = eval('(' + base64Decoded + ')');">
123+
124+
<input id="attempt1" type="text" size="60" spellcheck="false" value="if (data.username) {">
125+
res.send(`Hello ${data.username}`);
126+
}
127+
128+
} catch (err) {
129+
res.send('An error occurred: ' + err.message);
130+
}
131+
} else {
132+
res.send("Please Login");
133+
}
134+
});
135+
</code></pre>
136+
137+
138+
<button type="button" class="hintButton">Hint</button>
139+
<button type="button" class="resetButton">Reset</button>
140+
<button type="button" class="giveUpButton">Give up</button>
141+
<br><br>
142+
<p>
143+
<i>This lab was developed by Camila Vilarinho.</i>
144+
<br><br>
145+
<p id="correctStamp" class="small">
146+
<textarea id="debugData" class="displayNone" rows="20" cols="65" readonly>
147+
</textarea>
148+
</form>
149+
</div><!-- End GitHub pages formatting -->
150+
</body>
151+
</html>

0 commit comments

Comments
 (0)