Skip to content

Commit 6b09afd

Browse files
jasinnerjasinner
committed
add sending output format strings and templates lab
1 parent 76dbaf4 commit 6b09afd

File tree

1 file changed

+125
-0
lines changed

1 file changed

+125
-0
lines changed

‎docs/labs/sending_output.html‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
<!DOCTYPE html>
2+
<html><script src="template_files/page-script.js" id="bw-fido2-page-script"></script><head>
3+
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
4+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<link rel="stylesheet" href="template_files/style.css">
7+
<link rel="stylesheet" href="template_files/checker.css">
8+
<script src="template_files/js-yaml.min.js"></script>
9+
<script src="template_files/checker.js"></script>
10+
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
11+
12+
<!-- See create_labs.md for how to create your own lab! -->
13+
14+
<!-- Sample expected answer -->
15+
<script id="expected0" type="plain/text">
16+
private final List<String> allowedHosts = new String[]{"127.0.0.1"}
17+
</script>
18+
<!--
19+
-->
20+
<script id="expected1" type="plain/text">
21+
private final List<String> allowedHosts = new String[]{"localhost"}
22+
</script>
23+
24+
<!-- Full pattern of correct answer -->
25+
<script id="correct0" type="plain/text">
26+
private final List<String> allowedHosts = new String\[]{"(127\.0\.0\.1|localhost)"}
27+
</script>
28+
29+
<script id="correct1" type="plain/text">
30+
private final List<String> allowedHosts = new String\[]{"127\.0\.0\.1",(\s)*"localhost"}
31+
</script>
32+
33+
<script id="correct2" type="plain/text">
34+
private final List<String> allowedHosts = new String\[]{"locahost",(\s)*"127\.0\.0\.1"}
35+
</script>
36+
37+
<script id="info" type="application/yaml">
38+
---
39+
hints:
40+
- present: "new String[]{}"
41+
text: Add allowed hosts the string array enclosed in curly brackets.
42+
- present: "private final List<String> allowedHosts ="
43+
text: Make sure that the allowedHosts constant is an Java inline string array.
44+
# debug: true
45+
</script>
46+
</head>
47+
<body>
48+
<!-- For GitHub Pages formatting: -->
49+
<div class="container-lg px-3 my-5 markdown-body">
50+
<h1>Format Strings and Templates Lab</h1>
51+
<p>
52+
This is a lab exercise on developing secure software.
53+
For more information, see the <a href="https://best.openssf.org/labs/introduction.html" target="_blank">introduction to
54+
the labs</a>.
55+
56+
</p><p>
57+
</p><h2>Task</h2>
58+
<p>
59+
<b>Restrict the JNDI hostnames from which variables can be loaded.</b>
60+
61+
</p><p>
62+
</p><h2>Background</h2>
63+
<p>
64+
In this exercise, we'll assume that out output template allows a user to specify a JNDI hostname
65+
from which to load variables from. As is the case in the Log4j logging framework.
66+
67+
</p><p>
68+
</p><h2>Task Information</h2>
69+
<p>
70+
71+
</p><p>
72+
Please change the code below so that it restricts the JNDI hostnames from which variables can be
73+
loaded to only the local network interface (127.0.0.1). Use IPv4 addresses only.
74+
75+
76+
</p><p>
77+
</p><h2>Interactive Lab (<span id="grade">to be completed</span>)</h2>
78+
<p>
79+
</p><form id="lab">
80+
<pre><code>
81+
public class JndiManager extends AbstractManager {
82+
<input id="attempt0" type="text" size="60" spellcheck="false"
83+
value="private final List<String> allowedHosts = new String[]{}" style="background-color: yellow;">
84+
85+
/**
86+
* Looks up a named object through this JNDI context.
87+
*
88+
* @param name name of the object to look up.
89+
* @param <T> the type of the object.
90+
* @return the named object if it could be located.
91+
* @throws NamingException if a naming exception is encountered
92+
*/
93+
@SuppressWarnings("unchecked")
94+
public <T> T lookup(final String name) throws NamingException {
95+
URI uri = new URI(name);
96+
if (!allowedHosts.contains(uri.getHost())) {
97+
LOGGER.warn("Attempt to access ldap server not in allowed list");
98+
return null;
99+
}
100+
return (T) this.context.lookup(name);
101+
}
102+
}
103+
</code></pre>
104+
<button type="button" class="hintButton" title="Provide a hint given current attempt.">Hint</button>
105+
<button type="button" class="resetButton" title="Reset initial state (throwing away current attempt).">Reset</button>
106+
<button type="button" class="giveUpButton" title="Give up and show an answer.">Give up</button>
107+
<br><br>
108+
<p>
109+
<i>This lab was developed by Jason Shepherd at
110+
<a href="https://access.redhat.com/security/">Red Hat Product Security</a>.</i>
111+
<br><br>
112+
</p><p id="correctStamp" class="small">
113+
<textarea id="debugData" class="displayNone" rows="20" cols="65" readonly="readonly"></textarea>
114+
</p></form>
115+
<br><br>
116+
<p>
117+
<summary>
118+
Source: This example is a modified version of the patch for CVE-2021-44228 in
119+
<a href="https://github.com/apache/logging-log4j2/pull/608/files">apache/logging-log4j2</a>
120+
</summary>
121+
</p>
122+
</div><!-- End GitHub pages formatting -->
123+
124+
125+
</body></html>

0 commit comments

Comments
 (0)