Skip to content

Commit 0da8be7

Browse files
jackgkafatyjackgkafaty
committed
ASP.NET C# Code scanning
1 parent 5569359 commit 0da8be7

File tree

710 files changed

+52330
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

710 files changed

+52330
-2
lines changed

‎.gitignore

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Project Files #
2+
#################
3+
*.userprefs
4+
*.pidb
5+
*.suo
6+
*swp
7+
bin
8+
obj
9+
WebGoat/App_Data/*.txt
10+
*.sqlite*
11+
WebGoat/Configuration/*.config
12+
13+
# Trash Files #
14+
###############
15+
.DS_Store

‎README.md

Lines changed: 216 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,216 @@
1-
# ASP.NET_CSharp_Example
2-
ASP.NET and C# code scanning example
1+
# Code Scanning C# Tutorial
2+
3+
Welcome to the Code Scanning C# Tutorial! This tutorial will take you through how to set up GitHub Advanced Security's Code Scanning, as well as interpret results that it may find. The following repository contains cross-site scripting vulnerabilities for demonstration purposes.
4+
5+
## Introduction
6+
7+
Code Scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub.
8+
9+
You can use Code Scanning with CodeQL, a semantic code analysis engine. CodeQL treats code as data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.
10+
11+
This tutorial will use CodeQL analysis with Code Scanning in order to search for vulnerabilities within your code.
12+
13+
## Instructions
14+
15+
<details>
16+
<summary>Fork this repo</summary>
17+
<p>
18+
19+
Begin by [forking this repo](https://docs.github.com/en/free-pro-team@latest/github/getting-started-with-github/fork-a-repo).
20+
</p>
21+
</details>
22+
23+
<details>
24+
<summary>Enable Code Scanning</summary>
25+
<p>
26+
27+
#### Security tab
28+
29+
Click on the `Security` tab.
30+
31+
32+
<img src="images/00-repo-security-tab.png" width="70%"/>
33+
34+
#### Set up code scanning
35+
36+
Click `Set up code scanning`.
37+
38+
<img src="images/01-repo-secruity-setup-code-scanning.png" width="70%"/>
39+
40+
#### Setup Workflow
41+
42+
Click the `Setup this workflow` button by CodeQL Analysis.
43+
44+
<img src="images/02-repo-security-setup-codeql-workflow.png" width="70%"/>
45+
46+
This will create a GitHub Actions Workflow file with CodeQL already set up. Since Java is a compiled language you will need to setup the build in later steps. See the [documentation](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system) if you would like to configure CodeQL Analysis with a 3rd party CI system instead of using GitHub Actions.
47+
</p>
48+
</details>
49+
50+
<details>
51+
52+
<summary>Actions Workflow file</summary>
53+
<p>
54+
55+
#### Actions Workflow
56+
57+
The Actions Workflow file contains a number of different sections including:
58+
59+
1. Checking out the repository
60+
2. Initializing the CodeQL Action
61+
3. Running Autobuilder (or code your own build steps if autobuild doesn't work)
62+
4. Running the CodeQL Analysis
63+
64+
<img src="images/03-actions-sample-workflow.png" width="80%"/>
65+
66+
Please change `line 35` to only use `csharp` for this demonstration.
67+
68+
<img src="images/03a-csharp-scanning.png" width="80%"/>
69+
70+
Click `Start Commit` -> `Commit this file` to commit the changes to the _main_ branch.
71+
</p>
72+
</details>
73+
74+
<details>
75+
76+
<summary>Workflow triggers</summary>
77+
<p>
78+
79+
#### Workflow triggers
80+
81+
There are a [number of events](https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows) that can trigger a GitHub Actions workflow. In this example, the workflow will be triggered on:
82+
83+
<img src="images/04-actions-sample-events.png" width="50%"/>
84+
85+
- push to the _main_ branch
86+
- pull request to merge to the _main_ branch
87+
- on schedule, at 6:33 every Thursday
88+
89+
Setting up the new CodeQL workflow and committing it to the _main_ branch in the step above will trigger the scan.
90+
91+
</p>
92+
</details>
93+
94+
95+
<details>
96+
<summary>GitHub Actions Progress</summary>
97+
98+
<p>
99+
100+
#### GitHub Actions Progress
101+
102+
Click `Actions` tab -> `CodeQL`
103+
104+
Click the specific workflow run. You can view the progress of the Workflow run until the analysis completes.
105+
106+
<img src="images/05-actions-completed.png" width="80%"/>
107+
108+
</p>
109+
</details>
110+
111+
<details>
112+
<summary>Security Issues</summary>
113+
<p>
114+
115+
Once the Workflow has completed, click the `Security` tab -> ` Code Scanning Alerts`. You can see 29 alerts, select the first "Cross-site scripting" alert.
116+
117+
<img src="images/06-select-cross-site-scripting.png" width="80%"/>
118+
119+
#### Security Alert View
120+
121+
Clicking on the security alert will provide details about the security alert including:
122+
123+
- A description of the issue
124+
- A tag to the CWE that it is connected to as well as the type of alert (Error, Warning, Note)
125+
- The line of code that triggered the security alert
126+
- The ability to dismiss the alert depending on certain conditions (`False positive`? `Won't fix`? `Used in tests`?)
127+
128+
<img src="images/06-security-codeql-alert.png" width="80%"/>
129+
130+
#### Security Alert Description
131+
132+
Click `Show more` to view a full desciption of the alert including examples and links to additional information.
133+
134+
<img src="images/07-security-codeql-show-more.png" width="80%"/>
135+
136+
#### Security Full Description
137+
138+
<img width="80%" src="images/08-security-codeql-full-desc.png">
139+
140+
</p>
141+
</details>
142+
143+
<details>
144+
<summary>Show Paths</summary>
145+
<p>
146+
147+
#### Show Paths Button
148+
149+
CodeQL Analysis is able to trace the dataflow path from source to sink and gives you the ability to view the path traversal within the alert.
150+
151+
Click `show paths` in order to see the dataflow path that resulted in this alert.
152+
153+
<img src="images/09-security-codeql-show-paths.png" width="80%"/>
154+
155+
#### Show Paths View
156+
157+
<img src="images/10-security-codeql-show-paths-details.png" width="80%"/>
158+
159+
</p>
160+
</details>
161+
162+
<details>
163+
<p>
164+
165+
<summary>Fix the Security Alert</summary>
166+
167+
In order to fix this specific alert, we will need to ensure the content being write to the `HttpContext`'s response is validated and sanitized.
168+
169+
Click on the `Code` tab and [Edit](https://docs.github.com/en/free-pro-team@latest/github/managing-files-in-a-repository/editing-files-in-your-repository) the file [`Autocomplete.ashx.cs`](./WebGoat/WebGoatCoins/Autocomplete.ashx.cs) in the `WebGoat/WebGoatCoins` folder. For this demonstration purpose, we will simply write some hardcoded value to the `HttpContext` instance, this granatees the parameter is sanitized and safe.
170+
171+
<img src="images/11-fix-source-code.png" width="80%"/>
172+
173+
Click `Create a new branch for this commit and start a pull request`, name the branch `fix-cross-site-scripting`, and create the Pull Request.
174+
175+
#### Pull Request Status Check
176+
177+
In the Pull Request, you will notice that the CodeQL Analysis has started as a status check. Wait until it completes.
178+
179+
<img src="images/12-fix-pr-in-progress.png" width="80%"/>
180+
181+
#### Security Alert Details
182+
183+
After the Workflow has completed click on `Details` by the `Code Scanning Results / CodeQL` status check.
184+
185+
<img src="images/13-fix-pr-done.png" width="80%"/>
186+
187+
#### Fixed Alert
188+
189+
Notice that Code Scanning has detected that this Pull Request will fix the cross-site scripting vulnerability that was detected before.
190+
191+
<img src="images/14-fix-detail.png" width="80%"/>
192+
193+
Merge the Pull Request. After the Pull Request has been merged, another Workflow will kick off to scan the repository for any vulnerabilties.
194+
195+
#### Closed Security Alerts
196+
197+
After the final Workflow has completed, navigate back to the `Security` tab and click `Closed`. Notice that the **Cross-site scripting** security alert now shows up as a closed issue.
198+
199+
<img src="images/15-fixed-alert.png" width="80%"/>
200+
201+
#### Traceability
202+
203+
Click on the security alert and notice that it details when the fix was made, by whom, and the specific commit. This provides full traceability to detail when and how a security alert was fixed and exactly what was changed to remediate the issue.
204+
205+
<img src="images/16-fix-history.png" width="80%"/>
206+
207+
</p>
208+
</details>
209+
210+
## Next Steps
211+
212+
Ready to talk about Advanced Security features for GitHub Enterprise? [Contact Sales](https://enterprise.github.com/contact) for more information!
213+
214+
Check out [GitHub's Security feature page](https://github.com/features/security) for more security features embedded into GitHub.
215+
216+
Check out the Code Scanning [documentation](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) for additional configuration options and technical details.

0 commit comments

Comments
 (0)