Skip to content

Commit

Permalink
beautifying headers
Browse files Browse the repository at this point in the history
  • Loading branch information
@jkcso
jkcso committed Jan 5, 2024
1 parent b6db4b6 commit f1b0dc5
Show file tree
Hide file tree
Showing 24 changed files with 197 additions and 232 deletions.
20 changes: 10 additions & 10 deletions Season-1/Level-1/code.py
View file
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
'''
////////////////////////////////////////////////////////////
/// ///
/// 0. tests.py is passing but the code is vulnerable ///
/// 1. Review the code. Can you spot the bug? ///
/// 2. Fix the code but ensure that tests.py passes ///
/// 3. Run hack.py and if passing then CONGRATS! ///
/// 4. If stuck then read the hint ///
/// 5. Compare your solution with solution.py ///
/// ///
////////////////////////////////////////////////////////////
Welcome to Secure Code Game Season-1/Level-1!
Follow the instructions below to get started:
1. tests.py is passing but code.py is vulnerable
2. Review the code. Can you spot the bug?
3. Fix the code but ensure that tests.py passes
4. Run hack.py and if passing then CONGRATS!
5. If stuck then read the hint
6. Compare your solution with solution.py
'''

from collections import namedtuple
Expand Down
16 changes: 8 additions & 8 deletions Season-1/Level-2/code.h
View file
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
////////////////////////////////////////////////////////
/// ///
/// 0. Perform code review. Can you spot the bug? ///
/// 1. Run tests.c to test the functionality ///
/// 2. Run hack.c and if passing then CONGRATS! ///
/// 3. Compare your solution with solution.c ///
/// ///
////////////////////////////////////////////////////////
// Welcome to Secure Code Game Season-1/Level-2!

// Follow the instructions below to get started:

// 1. Perform code review. Can you spot the bug?
// 2. Run tests.c to test the functionality
// 3. Run hack.c and if passing then CONGRATS!
// 4. Compare your solution with solution.c

#include <stdbool.h>
#include <stddef.h>
Expand Down
25 changes: 9 additions & 16 deletions Season-1/Level-2/hack.c
View file
Original file line number Diff line number Diff line change
@@ -1,19 +1,12 @@
///////////////////////////////////////////////////////////////////////////
/// RUN HACK ///
/// ___________________________________________________________________ ///
/// ///
/// This file exploits the vulnerabilities in code.h ///
/// Running this file will fail initially (it contains ///
/// failing tests). As all other levels, your goal is ///
/// to get this file to pass. Run this file using: ///
/// ///
/// Run hack by opening a terminal and running the following: ///
/// $ make Season-1/Level-2/hack && ./Season-1/Level-2/hack ///
/// ///
/// As a reminder, to pass this level, both this file ///
/// alongside tests.c must pass. ///
/// ///
///////////////////////////////////////////////////////////////////////////
// Run hack.c by following the instructions below:

// This file exploits the vulnerabilities in code.h. Running this file will fail initially as it contains failing tests.
// As all other levels, your goal is to get this file to pass.

// Run hack by opening a terminal and running the following:
// $ make Season-1/Level-2/hack && ./Season-1/Level-2/hack

// As a reminder, to pass this level, both this file alongside tests.c must pass.

#include "code.h"

Expand Down
8 changes: 2 additions & 6 deletions Season-1/Level-2/solution.c
View file
Original file line number Diff line number Diff line change
@@ -1,9 +1,5 @@
///////////////////////////////////////////////////
/// ///
/// Vulnerability was in line 83 of code.h ///
/// Fix can be found in line 82 below ///
/// ///
///////////////////////////////////////////////////
// Vulnerability was in line 83 of code.h
// Fix can be found in line 77 below

#include <stdbool.h>
#include <stddef.h>
Expand Down
Binary file added Season-1/Level-2/tests
View file
Binary file not shown.
16 changes: 6 additions & 10 deletions Season-1/Level-2/tests.c
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
///////////////////////////////////////////////////////////////////////////
/// RUN TESTS ///
/// ___________________________________________________________________ ///
/// ///
/// This file contains passing tests. ///
/// ///
/// Run them by opening a terminal and running the following: ///
/// $ make Season-1/Level-2/tests && ./Season-1/Level-2/tests ///
/// ///
///////////////////////////////////////////////////////////////////////////
// Run tests.c by following the instructions below:

// This file contains passing tests.

// Run them by opening a terminal and running the following:
// $ make Season-1/Level-2/tests && ./Season-1/Level-2/tests

#include "code.h"

Expand Down
4 changes: 4 additions & 0 deletions Season-1/Level-3/code.py
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Welcome to Secure Code Game Season-1/Level-3!

# You know how to play by now, good luck!

import os
from flask import Flask, request

Expand Down
4 changes: 4 additions & 0 deletions Season-1/Level-5/code.py
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Welcome to Secure Code Game Season-1/Level-5!

# This is the last level of our first season, good luck!

import binascii
import random
import secrets
Expand Down
4 changes: 4 additions & 0 deletions Season-2/Level-1/code.yml
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
# Welcome to Secure Code Game Season-2/Level-1!

# Follow the instructions below to get started:

# Due to the nature of GitHub Actions, please find this level's vulnerable code inside:
# .github/workflows/jarvis-code.yml

Expand Down
22 changes: 11 additions & 11 deletions Season-2/Level-2/code.go
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
///////////////////////////////////////////////////////////////////
/// ///
/// 0. code_test.go is passing but the code is vulnerable ///
/// 1. Review the code. Can you spot the bugs(s)? ///
/// 2. Fix the code.go, but ensure that code_test.go passes ///
/// 3. Run hack_test.go and if passing then CONGRATS! ///
/// 4. If stuck then read the hint ///
/// 5. Compare your solution with solution/solution.go ///
/// ///
///////////////////////////////////////////////////////////////////
// Welcome to Secure Code Game Season-2/Level-2!

// Follow the instructions below to get started:

// 1. code_test.go is passing but the code is vulnerable
// 2. Review the code. Can you spot the bugs(s)?
// 3. Fix the code.go, but ensure that code_test.go passes
// 4. Run hack_test.go and if passing then CONGRATS!
// 5. If stuck then read the hint
// 6. Compare your solution with solution/solution.go

package main

Expand Down Expand Up @@ -88,4 +88,4 @@ func main() {
if err != nil {
log.Fatalf("HTTP server ListenAndServe: %q", err)
}
}
}
24 changes: 10 additions & 14 deletions Season-2/Level-2/code_test.go
View file
Original file line number Diff line number Diff line change
@@ -1,16 +1,12 @@
/////////////////////////////////////////////////////////////////////////////
/// RUN TESTS ///
/// _____________________________________________________________________ ///
/// ///
/// This file contains passing tests. ///
/// ///
/// Run them by opening a terminal and running the following: ///
/// $ go test -v Season-2/Level-2/code.go Season-2/Level-2/code_test.go ///
/// ///
/// If 'go' is not found when running the above, install it from: ///
/// https://go.dev/dl/ ///
/// ///
/////////////////////////////////////////////////////////////////////////////
// Run code_test.go by following the instructions below:

// This file contains passing tests.

// Run them by opening a terminal and running the following:
// $ go test -v Season-2/Level-2/code.go Season-2/Level-2/code_test.go

// If 'go' is not found when running the above, install it from:
// https://go.dev/dl/

package main

Expand Down Expand Up @@ -135,4 +131,4 @@ func TestMain(m *testing.M) {

exitCode := m.Run()
os.Exit(exitCode)
}
}
35 changes: 15 additions & 20 deletions Season-2/Level-2/hack_test.go
View file
Original file line number Diff line number Diff line change
@@ -1,22 +1,17 @@
/////////////////////////////////////////////////////////////////////////////
/// RUN HACK ///
/// _____________________________________________________________________ ///
/// ///
/// This file exploits the vulnerabilities in code. ///
/// Running this file will fail initially (it contains ///
/// failing tests). As all other levels, your goal is ///
/// to get this file to pass. Run this file using: ///
/// ///
/// Run hack by opening a terminal and running the following: ///
/// $ go test -v Season-2/Level-2/code.go Season-2/Level-2/hack_test.go ///
/// ///
/// As a reminder, to pass this level, both this file ///
/// alongside code_test.go must pass. ///
/// ///
/// If 'go' is not found when running the above, install it from: ///
/// https://go.dev/dl/ ///
/// ///
/////////////////////////////////////////////////////////////////////////////
// Run hack_test.go by following the instructions below:

// This file exploits the vulnerabilities in code. Running this file will fail initially
// (it contains failing tests). As all other levels, your goal is to get this file to pass.

// Run this file using:

// Run hack by opening a terminal and running the following:
// $ go test -v Season-2/Level-2/code.go Season-2/Level-2/hack_test.go

// As a reminder, to pass this level, both this file alongside code_test.go must pass.

// If 'go' is not found when running the above, install it from:
// https://go.dev/dl/

package main

Expand Down Expand Up @@ -104,4 +99,4 @@ func TestLoginHandler_SensitiveLog_ValidCredentials_FIXME(t *testing.T) {
t.Errorf("Expected body %q, but got %q", expectedRespLog, logOutput)
t.Fail()
}
}
}
34 changes: 16 additions & 18 deletions Season-2/Level-2/solution/solution.go
View file
Original file line number Diff line number Diff line change
@@ -1,20 +1,18 @@
////////////////////////////////////////////////////////////////////////////////////////////////////
/// FIX ///
/// ____________________________________________________________________________________________ ///
/// ///
/// 1) Remove the email being logged here: ///
/// log.Printf("Invalid email format: %q", email) ///
/// log.Printf("Invalid email format") ///
/// ///
/// 2) Fix the error message to prevent user enumeration here: ///
/// http.Error(w, "invalid email or password", http.StatusUnauthorized) ///
/// http.Error(w, "Invalid Email or Password", http.StatusUnauthorized) ///
/// ///
/// 3) Remove the email and password being logged here: ///
/// log.Printf("User %q logged in successfully with a valid password %q", email, password) ///
/// log.Printf("Successful login request") ///
/// ///
////////////////////////////////////////////////////////////////////////////////////////////////////
// Solution explained:

// 1) Remove the email being logged here:
// log.Printf("Invalid email format: %q", email)
// log.Printf("Invalid email format")

// 2) Fix the error message to prevent user enumeration here:
// http.Error(w, "invalid email or password", http.StatusUnauthorized)
// http.Error(w, "Invalid Email or Password", http.StatusUnauthorized)

// 3) Remove the email and password being logged here:
// log.Printf("User %q logged in successfully with a valid password %q", email, password)
// log.Printf("Successful login request")

// Full solution follows:

package main

Expand Down Expand Up @@ -101,4 +99,4 @@ func main() {
if err != nil {
log.Fatalf("HTTP server ListenAndServe: %q", err)
}
}
}
26 changes: 11 additions & 15 deletions Season-2/Level-2/solution/solution_test.go
View file
Original file line number Diff line number Diff line change
@@ -1,17 +1,13 @@
///////////////////////////////////////////////////////////////////////////////////////////////////////
/// RUN TESTS ///
/// _______________________________________________________________________________________________ ///
/// ///
/// This file is a copy of code_test.go and hack_test.go ///
/// It tests the solution for failing and passing payloads ///
/// ///
/// Run them by opening a terminal and running the following: ///
/// $ go test -v Season-2/Level-2/solution/solution.go Season-2/Level-2/solution/solution_test.go ///
/// ///
/// If 'go' is not found when running the above, install it from: ///
/// https://go.dev/dl/ ///
/// ///
///////////////////////////////////////////////////////////////////////////////////////////////////////
// Run solution_test.go by following the instructions below:

// This file is a copy of code_test.go and hack_test.go
// It tests the solution for failing and passing payloads

// Run them by opening a terminal and running the following:
// $ go test -v Season-2/Level-2/solution/solution.go Season-2/Level-2/solution/solution_test.go

// If 'go' is not found when running the above, install it from:
// https://go.dev/dl/

package main

Expand Down Expand Up @@ -215,4 +211,4 @@ func TestMain(m *testing.M) {
}

// Contribute new levels to the game in 3 simple steps!
// Read our Contribution Guideline at github.com/skills/secure-code-game/blob/main/CONTRIBUTING.md
// Read our Contribution Guideline at github.com/skills/secure-code-game/blob/main/CONTRIBUTING.md
35 changes: 16 additions & 19 deletions Season-2/Level-3/code.py
View file
Original file line number Diff line number Diff line change
@@ -1,22 +1,19 @@
# //////////////////////////////////////////////////////////////////////
# /// ///
# /// 0. tests.py file is passing but the code here is vulnerable ///
# /// 1. Review the code in this file. Can you spot the bugs(s)? ///
# /// 2. Fix the bug(s) in code.py. Ensure that tests.py passes ///
# /// 3. Run hack.py and if passing then CONGRATS! ///
# /// 4. If stuck then read the hint ///
# /// 5. Compare your solution with solution.txt ///
# /// ///
# //////////////////////////////////////////////////////////////////////

# //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
# /// RUN CODE (RECOMMENDED TO PASS THIS LEVEL) ///
# /// __________________________________________________________________________________________________________________ ///
# /// ///
# /// Run by opening a terminal and running the following: ///
# /// $ export FLASK_APP=Season-2/Level-3/code.py && export FLASK_ENV=development && export FLASK_DEBUG=0 && flask run ///
# /// ///
# //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
# Welcome to Secure Code Game Season-2/Level-3!

# Follow the instructions below to get started:

# 1. tests.py file is passing but code.py is vulnerable
# 2. Review the code in this file. Can you spot the bugs(s)?
# 3. Fix the bug(s) in code.py. Ensure that tests.py passes
# 4. Run hack.py and if passing then CONGRATS!
# 5. If stuck then read the hint
# 6. Compare your solution with solution.txt


# Run code.py (RECOMMENDED for this level) by following the instructions below:

# Run by opening a terminal and running the following:
# $ export FLASK_APP=Season-2/Level-3/code.py && export FLASK_ENV=development && export FLASK_DEBUG=0 && flask run

import os
import re
Expand Down
30 changes: 13 additions & 17 deletions Season-2/Level-3/hack.py
View file
Original file line number Diff line number Diff line change
@@ -1,20 +1,16 @@
# ///////////////////////////////////////////////////////////////////////
# /// RUN HACK ///
# /// _______________________________________________________________ ///
# /// ///
# /// This file exploits the vulnerabilities in code.py ///
# /// To run this file, you must be running code.py (flask app) ///
# /// in parallel. To do this, we recommend opening 2 terminals. ///
# /// In the first terminal, run the app following the instructions ///
# /// in code.py, and in the second terminal run this file using: ///
# /// ///
# /// $ python3 Season-2/Level-3/hack.py ///
# /// ///
# /// Running this file will fail initially (it contains failing ///
# /// tests). As all other levels, your goal is to get this file ///
# /// to pass while ensuring that the tests.py file still passes. ///
# /// ///
# ///////////////////////////////////////////////////////////////////////
# Run hack.py by following the instructions below:

# This file exploits the vulnerabilities in code.py
# To run this file, you must be running code.py (flask app)
# in parallel. To do this, we recommend opening 2 terminals.

# In the first terminal, run the app following the instructions
# in code.py, and in the second terminal run this file using:
# $ python3 Season-2/Level-3/hack.py

# Running this file will fail initially (it contains failing
# tests). As all other levels, your goal is to get this file
# to pass while ensuring that the tests.py file still passes.

import requests

Expand Down
Loading

0 comments on commit f1b0dc5

Please sign in to comment.