diff --git a/modules/2-owasp.livemd b/modules/2-owasp.livemd index 4b31bf5..8400588 100644 --- a/modules/2-owasp.livemd +++ b/modules/2-owasp.livemd @@ -101,25 +101,29 @@ Notable CWEs included are CWE-259: Use of Hard-coded Password, CWE-327: Broken o _Please uncomment the function call that you believe is correct._ - + ```elixir result = - defmodule PasswordCompare do - def option_one(password, md5_hash) do - case :crypto.hash(:md5, password) == md5_hash do - true -> :entry_granted_op1 - false -> :entry_denied_op1 + ( + defmodule PasswordCompare do + def option_one(password, md5_hash) do + case :crypto.hash(:md5, password) == md5_hash do + true -> :entry_granted_op1 + false -> :entry_denied_op1 + end end - end - def option_two(password, bcrypt_salted_hash) do - case Bcrypt.verify_pass(password, bcrypt_salted_hash) do - true -> :entry_granted_op2 - false -> :entry_denied_op2 + def option_two(password, bcrypt_salted_hash) do + case Bcrypt.verify_pass(password, bcrypt_salted_hash) do + true -> :entry_granted_op2 + false -> :entry_denied_op2 + end end end - end + + PasswordCompare.option_two("users_password", bcrypt_salted_hash) + ) case GradingClient.check_answer(OWASP, 1, result) do :correct -> diff --git a/modules/3-ssdlc.livemd b/modules/3-ssdlc.livemd index 276c1e2..b948c47 100644 --- a/modules/3-ssdlc.livemd +++ b/modules/3-ssdlc.livemd @@ -47,10 +47,10 @@ A very easy way to prevent secrets being added to files is to access them via En _Use `System.get_env/1` on line 2._ - + ```elixir -result = super_secret_password = "p@ssw0rd" +result = super_secret_password = System.get_env("envar_secret") case GradingClient.check_answer(SDLC, 1, result) do :correct -> diff --git a/modules/5-elixir.livemd b/modules/5-elixir.livemd index a3afc69..62283cd 100644 --- a/modules/5-elixir.livemd +++ b/modules/5-elixir.livemd @@ -50,7 +50,7 @@ Beware of functions in applications/libraries that create atoms from input value _You should get a `true` result when you successfully fix the function._ - + ```elixir result = @@ -58,7 +58,7 @@ result = malicious_user_input = UUID.uuid4() try do - malicious_user_input |> String.to_atom() + malicious_user_input |> String.to_existing_atom() rescue e -> e end @@ -117,7 +117,7 @@ name = Kino.Input.text("What's your name?") ```elixir textfield_value = Kino.Input.read(name) -{result, binding} = Code.eval_string("a", a: textfield_value) +{result, binding} = Code.eval_string("a", a: textfield_value, ) "Hello, " <> result ``` @@ -181,7 +181,7 @@ user_input = "HASH_OF_asdfasdf" Benchwarmer.benchmark(fn -> Susceptible.compare(user_input, password) end) Benchwarmer.benchmark(fn -> Constant.compare(user_input, password) end) -# IO.puts(:comparison_ran) +IO.puts(:comparison_ran) ``` ## Boolean Coercion @@ -213,7 +213,7 @@ The latter will raise a `BadBooleanError` when the function returns `:ok` or `{: _Uncomment the if statement that uses the correct boolean comparison._ - + ```elixir result = @@ -234,6 +234,9 @@ result = :ok try do + if SecurityCheck.validate(user_input, password) or raise(SecurityCheck) do + :you_let_a_baddie_in + end rescue e -> e end @@ -304,12 +307,12 @@ This prevents the table from being read by other processes, such as remote shell **We have decided that we do not want this ETS table to be read from other processes, so try making it private:** - + ```elixir result = ( - secret_table = :ets.new(:secret_table, [:public]) + secret_table = :ets.new(:secret_table, [:private]) :ets.info(secret_table)[:protection] ) diff --git a/modules/6-cookies.livemd b/modules/6-cookies.livemd index ec4f5a4..86ea09a 100644 --- a/modules/6-cookies.livemd +++ b/modules/6-cookies.livemd @@ -181,12 +181,23 @@ In the Phoenix Framework, you would use functionality found within the [Plug lib _Fill out the `put_resp_cookie/4` function arguments with the settings outlined in the previous section, no other code changes should be necessary._ - + ```elixir result = ( - cookie_name = "CHANGE_ME" + cookie_name = "__Host-perfect_cookie" + + conn = + Plug.Conn.put_resp_cookie( + conn, + cookie_name, + <<0::8, 42::8>>, + path: "/", + secure: true, + http_only: true, + same_site: "Strict" + ) cookie = conn