Init commit

veracode · Aug 9, 2021 · 12f2bd1 · 12f2bd1
1 parent 8615f8f
commit 12f2bd1
Show file tree

Hide file tree

Showing 57 changed files with 27,636 additions and 0 deletions.
diff --git a/.DS_Store b/.DS_Store
diff --git a/README.md b/README.md
@@ -0,0 +1,18 @@
+# VeraDemoDotNet
+
+VeraDemoDotNet is a great test application for Veracode IDE Scanner for Visual Studio, Visual Studio Code, and the Veracode Static Pipeline Scanner. 
+This example uses Azure Dev Ops to build and test VeraDemoDotNet with the Veracode Static Pipeline scanner.  A Veracode subscription is required.
+
+Clone or connect this repo to Azure Dev Ops. Create a Pipeline using included example azure-pipelines.yml.
+
+Setup API ID and Key in Pipeline Variables –
+- VERACODE_API_ID
+- VERACODE_API_KEY
+
+Once build completes you can download results.json from build summary screen or view them in the console output for the Pipeline scanner step.  
+
+Check the results.json into source code and reference it in the command to break build on new findings. 
+
+To break on new flaws found from previous scan, add "- bf results.json" to string and remove "|| true" at the end of the string so the step will break the build process on new flaws.
+
+Find further options here:https://help.veracode.com/r/r_pipeline_scan_commands
diff --git a/Verademo-Dotnet/App_Start/BundleConfig.cs b/Verademo-Dotnet/App_Start/BundleConfig.cs
@@ -0,0 +1,31 @@
+using System.Web;
+using System.Web.Optimization;
+
+namespace Verademo_dotnet
+{
+    public class BundleConfig
+    {
+        // For more information on bundling, visit http://go.microsoft.com/fwlink/?LinkId=301862
+        public static void RegisterBundles(BundleCollection bundles)
+        {
+            bundles.Add(new ScriptBundle("~/bundles/jquery").Include(
+                        "~/Scripts/jquery-{version}.js"));
+
+            bundles.Add(new ScriptBundle("~/bundles/jqueryval").Include(
+                        "~/Scripts/jquery.validate*"));
+
+            // Use the development version of Modernizr to develop with and learn from. Then, when you're
+            // ready for production, use the build tool at http://modernizr.com to pick only the tests you need.
+            bundles.Add(new ScriptBundle("~/bundles/modernizr").Include(
+                        "~/Scripts/modernizr-*"));
+
+            bundles.Add(new ScriptBundle("~/bundles/bootstrap").Include(
+                      "~/Scripts/bootstrap.js",
+                      "~/Scripts/respond.js"));
+
+            bundles.Add(new StyleBundle("~/Content/css").Include(
+                      "~/Content/bootstrap.css",
+                      "~/Content/site.css"));
+        }
+    }
+}
diff --git a/Verademo-Dotnet/App_Start/FilterConfig.cs b/Verademo-Dotnet/App_Start/FilterConfig.cs
@@ -0,0 +1,13 @@
+using System.Web;
+using System.Web.Mvc;
+
+namespace Verademo_dotnet
+{
+    public class FilterConfig
+    {
+        public static void RegisterGlobalFilters(GlobalFilterCollection filters)
+        {
+            filters.Add(new HandleErrorAttribute());
+        }
+    }
+}
diff --git a/Verademo-Dotnet/App_Start/RouteConfig.cs b/Verademo-Dotnet/App_Start/RouteConfig.cs
@@ -0,0 +1,23 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Web;
+using System.Web.Mvc;
+using System.Web.Routing;
+
+namespace Verademo_dotnet
+{
+    public class RouteConfig
+    {
+        public static void RegisterRoutes(RouteCollection routes)
+        {
+            routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
+
+            routes.MapRoute(
+                name: "Default",
+                url: "{controller}/{action}/{id}",
+                defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional }
+            );
+        }
+    }
+}
diff --git a/Verademo-Dotnet/CommandInjection.aspx b/Verademo-Dotnet/CommandInjection.aspx
@@ -0,0 +1,16 @@
+<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="CommandInjection.aspx.cs" Inherits="Verademo_dotnet.WebForm1" %>
+
+<!DOCTYPE html>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head runat="server">
+    <title></title>
+</head>
+<body>
+    <form id="FormCommandInjectionExample" runat="server">
+    <div>
+
+    </div>
+    </form>
+</body>
+</html>
diff --git a/Verademo-Dotnet/CommandInjection.aspx.cs b/Verademo-Dotnet/CommandInjection.aspx.cs
@@ -0,0 +1,22 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Web;
+using System.Web.UI;
+using System.Web.UI.WebControls;
+
+namespace Verademo_dotnet
+{
+    public partial class WebForm1 : System.Web.UI.Page
+    {
+        protected void Page_Load(object sender, EventArgs e)
+        {
+            if (Request.QueryString["command"] != null)
+            {
+                // bad
+                // System.Diagnostics.Process.Start(Request.QueryString["command"]);
+
+            }
+        }
+    }
+}
diff --git a/Verademo-Dotnet/CommandInjection.aspx.designer.cs b/Verademo-Dotnet/CommandInjection.aspx.designer.cs
diff --git a/Verademo-Dotnet/Content/Site.css b/Verademo-Dotnet/Content/Site.css
@@ -0,0 +1,24 @@
+body {
+    padding-top: 50px;
+    padding-bottom: 20px;
+}
+
+/* Set padding to keep content from hitting the edges */
+.body-content {
+    padding-left: 15px;
+    padding-right: 15px;
+}
+
+/* Override the default bootstrap behavior where horizontal description lists 
+   will truncate terms that are too long to fit in the left column 
+*/
+.dl-horizontal dt {
+    white-space: normal;
+}
+
+/* Set width on the form input elements since they're 100% wide by default */
+input,
+select,
+textarea {
+    max-width: 280px;
+}