diff --git a/docs/labs/README.md b/docs/labs/README.md index 4bc1c099..708133a4 100644 --- a/docs/labs/README.md +++ b/docs/labs/README.md @@ -109,7 +109,7 @@ work on. * [Call APIs for Programs and Check What Is Returned](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#call-apis-for-programs-and-check-what-is-returned) - PLANNED-2 UNASSIGNED * [Handling Errors](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#handling-errors) - DONE-2 (Avishay Balter) [handling-errors](handling-errors.html) * [Logging](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#logging) - PLANNED-2 UNASSIGNED - * [Debug and Assertion Code](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#debug-and-assertion-code) - PLANNED-1 UNASSIGNED + * [Debug and Assertion Code](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#debug-and-assertion-code) - DONE-1 (David A. Wheeler) [assert](assert.html) * Countering Denial-of-Service (DoS) Attacks - PLANNED-2 UNASSIGNED * Sending Output * [Introduction to Sending Output](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#introduction-to-sending-output) - PLANNED-2 UNASSIGNED diff --git a/docs/labs/assert.html b/docs/labs/assert.html new file mode 100644 index 00000000..8c434d45 --- /dev/null +++ b/docs/labs/assert.html @@ -0,0 +1,205 @@ + + + + + + + + + + + + + + + + + + + + + + + +
+

Lab Exercise assert

+

+This is a lab exercise on developing secure software. +For more information, see the introduction to +the labs. + +

+

Task

+

+Please fix the sample code so attackers cannot easily trigger an assertion. + +

+

Background

+

+In this exercise, we'll modify a Java server-side web application that +uses the Spring framework. + + +

+

Task Information

+

+ +

+The sample code below raises an assertion if the input fails to validate. +This approach does validate the input and reject input that fails to +validate. However, as implemented, failed assertions halt the +entire program. Attackers +can trivially provide input that fails validation, making it +easy for attackers to shut down an entire program. + +

+Please change the code below so that instead of asserting that +there are no form validation errors, check if there are errors, and +return the string "form" if it does (causing the +framework to redisplay the input form). +When incorrect input arrives it's usually better to redisplay an input form +instead of crashing the entire program. + +

+Use the “hint” and “give up” buttons if necessary. + +

+

Interactive Lab ()

+

+

+
@Controller
+public class WebController implements WebMvcConfigurer {
+
+    @Override
+    public void addViewControllers(ViewControllerRegistry registry) {
+        registry.addViewController("/results").setViewName("results");
+    }
+
+    @GetMapping("/")
+    public String showForm(PersonForm personForm) {
+        return "form";
+    }
+
+    @PostMapping("/")
+    public String checkPersonInfo(@Valid PersonForm personForm,
+                                  BindingResult bindingResult) {
+
+
+        return "redirect:/results";
+    }
+}
+
+// If you use a textarea:
+
+ + + +

+

+This lab was developed by David A. Wheeler at +The Linux Foundation. +It is based on the +validating-form-input section in the Spring.io guides. + +

+

+ +

+
+ +