diff --git a/docs/labs/README.md b/docs/labs/README.md index 708133a4..43dd971a 100644 --- a/docs/labs/README.md +++ b/docs/labs/README.md @@ -79,7 +79,7 @@ work on. * Using Regular Expressions for Text Input Validation - DONE-0 [regex1](regex1.html), [input2](input2.html) * [Countering ReDoS Attacks on Regular Expressions](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#countering-redos-attacks-on-regular-expressions) - DONE-2 (Camila Vilarinho, 2026-07-19) [redos](redos.html) * Input Validation: Beyond Numbers and Text - * [Insecure Deserialization](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#insecure-deserialization) - PLANNED-2 (Camila Vilarinho) + * [Insecure Deserialization](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#insecure-deserialization) - PLANNED-2 (Camila Vilarinho) [deserialization](deserialization.html) * [Input Validation: Beyond Numbers and Text](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#input-validation-beyond-numbers-and-text) - PLANNED-2 UNASSIGNED * [Minimizing Attack Surface, Identification, Authentication, and Authorization](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#minimizing-attack-surface-identification-authentication-and-authorization) - PLANNED-2 UNASSIGNED * [Search Paths and Environment Variables (including setuid/setgid Programs)](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#search-paths-and-environment-variables-including-setuidsetgid-programs) - PLANNED-2 UNASSIGNED @@ -133,6 +133,7 @@ Thanks to the following people who have created or offered to create labs (sorted by given/first name): * Avishay Balter (Microsoft) +* Camila Vilarinho * David A. Wheeler (Linux Foundation) * Dhananjay Arunesh * Elijah Everett diff --git a/docs/labs/insecure-deserialization.html b/docs/labs/deserialization.html similarity index 50% rename from docs/labs/insecure-deserialization.html rename to docs/labs/deserialization.html index 6aeb3a8b..dcc300a8 100644 --- a/docs/labs/insecure-deserialization.html +++ b/docs/labs/deserialization.html @@ -23,18 +23,72 @@
-

Lab Exercise Insecure Deserialization

+

Lab Exercise deserialization

This is a lab exercise on developing secure software. For more information, see the introduction to @@ -79,19 +165,18 @@

Task Information

-The code below is called after an application login page. After login, a cookie is set up with the user profile, then in the homepage the cookie is deserialized and uses the username in a greeting message. +The code below is called after an application login page. After login, a cookie is set up with the user profile, then in the homepage the cookie is deserialized and uses the username in a greeting message.

-If you take a closer look at this code, you’ll see that it’s using eval() to deserialize the data from the cookie. This can be very dangerous as eval() evaluates a string as JavaScript code, which means any code inside that string will be executed, opening the possibility of Remote Code Execution (RCE) and Code Injection attacks. +If you take a closer look at this code, you’ll see that it’s using eval() to deserialize the data from the cookie. This can be very dangerous as eval() evaluates a string as JavaScript code, which means any code inside that string will be executed, opening the possibility of Remote Code Execution (RCE) and Code Injection attacks.

-For this lab we want to fix this by using an approach that prevents code execution, we will also add input validation to make sure the data we receive is what we are expecting and nothing more than that. +For this lab we want to fix this by using an approach that prevents executing code from the attacker. We will also add some simple input validation to make sure the data we receive from inside the JSON data is what we are expecting.

  1. - Replace eval() with JSON.parse(). JSON.parse( ) does not execute any JavaScript code like functions or methods, making it safer than some other serialization libraries. + Replace eval() with JSON.parse(). JSON.parse( ) does not execute any JavaScript code like functions or methods, making it a much more secure approach for deserialization.
    2. -
  2. Besides checking if data.username exists, also check that the username is a string and not bigger than 20 characters.
    3. +
  3. Besides checking if data.username exists, perform simple validations of its value. Ensure it is a string (typeof data.username == 'string') and that it's less than 20 characters long (data.username.length < 20).
-

Use the “hint” and “give up” buttons if necessary. @@ -101,13 +186,13 @@

Interactive Lab ()

Change the code below, adding the mitigation steps to prevent Insecure Deserialization:

    -
  1. Use a deserialization approach that prevents code execution.
    2. -
  2. Validate the username making sure it is used only if it's a string and no longer than 20 characters.
    3. +
  3. Use a deserialization approach that prevents code execution of untrusted code.
    4. +
  4. Validate the username making sure a reply is only sent if it's a string and less than 20 characters.
-

-const express = require('express');
+
const express = require('express');
 const cookieParser = require('cookie-parser');
 
 const app = express();
@@ -118,15 +203,19 @@ 
Interactive Lab ()

 app.get('/', (req, res) => {
   if (req.cookies.profile) {
     try {
-      const base64Decoded = Buffer.from(req.cookies.profile, 'base64').toString('utf8');
-      
-
-      
-        res.send(`Hello ${data.username}`);
+      const base64Decoded = Buffer.from(
+        req.cookies.profile, 'base64').toString('utf8');
+      
+
+      
+            // To prevent XSS, avoid res.send with untrusted data
+            res.render('index', {username: data.username});
       }
 
     } catch (err) {
-      res.send('An error occurred: ' + err.message);
+      res.send('An error occurred.');
     }
   } else {
     res.send("Please Login");