Giter Site home page Giter Site logo

school-system-test's Introduction

Welcome to Rails

Rails is a web-application framework that includes everything needed to create database-backed web applications according to the Model-View-Control pattern.

This pattern splits the view (also called the presentation) into “dumb” templates that are primarily responsible for inserting pre-built data in between HTML tags. The model contains the “smart” domain objects (such as Account, Product, Person, Post) that holds all the business logic and knows how to persist themselves to a database. The controller handles the incoming requests (such as Save New Account, Update Product, Show Post) by manipulating the model and directing data to the view.

In Rails, the model is handled by what’s called an object-relational mapping layer entitled Active Record. This layer allows you to present the data from database rows as objects and embellish these data objects with business logic methods. You can read more about Active Record in files/vendor/rails/activerecord/README.html.

The controller and view are handled by the Action Pack, which handles both layers by its two parts: Action View and Action Controller. These two layers are bundled in a single package due to their heavy interdependence. This is unlike the relationship between the Active Record and Action Pack that is much more separate. Each of these packages can be used independently outside of Rails. You can read more about Action Pack in files/vendor/rails/actionpack/README.html.

Getting Started

  1. At the command prompt, create a new Rails application:

    <tt>rails new myapp</tt> (where <tt>myapp</tt> is the application name)
  2. Change directory to myapp and start the web server:

    <tt>cd myapp; rails server</tt> (run with --help for options)
  3. Go to localhost:3000/ and you’ll see:

    "Welcome aboard: You're riding Ruby on Rails!"
    
  4. Follow the guidelines to start developing your application. You can find

the following resources handy:

Debugging Rails

Sometimes your application goes wrong. Fortunately there are a lot of tools that will help you debug it and get it back on the rails.

First area to check is the application log files. Have “tail -f” commands running on the server.log and development.log. Rails will automatically display debugging and runtime information to these files. Debugging info will also be shown in the browser on requests from 127.0.0.1.

You can also log your own messages directly into the log file from your code using the Ruby logger class from inside your controllers. Example:

class WeblogController < ActionController::Base
  def destroy
    @weblog = Weblog.find(params[:id])
    @weblog.destroy
    logger.info("#{Time.now} Destroyed Weblog ID ##{@weblog.id}!")
  end
end

The result will be a message in your log file along the lines of:

Mon Oct 08 14:22:29 +1000 2007 Destroyed Weblog ID #1!

More information on how to use the logger is at www.ruby-doc.org/core/

Also, Ruby documentation can be found at www.ruby-lang.org/. There are several books available online as well:

These two books will bring you up to speed on the Ruby language and also on programming in general.

Debugger

Debugger support is available through the debugger command when you start your Mongrel or WEBrick server with –debugger. This means that you can break out of execution at any point in the code, investigate and change the model, and then, resume execution! You need to install ruby-debug to run the server in debugging mode. With gems, use sudo gem install ruby-debug. Example:

class WeblogController < ActionController::Base
  def index
    @posts = Post.all
    debugger
  end
end

So the controller will accept the action, run the first line, then present you with a IRB prompt in the server window. Here you can do things like:

>> @posts.inspect
=> "[#<Post:0x14a6be8
        @attributes={"title"=>nil, "body"=>nil, "id"=>"1"}>,
     #<Post:0x14a6620
        @attributes={"title"=>"Rails", "body"=>"Only ten..", "id"=>"2"}>]"
>> @posts.first.title = "hello from a debugger"
=> "hello from a debugger"

…and even better, you can examine how your runtime objects actually work:

>> f = @posts.first
=> #<Post:0x13630c4 @attributes={"title"=>nil, "body"=>nil, "id"=>"1"}>
>> f.
Display all 152 possibilities? (y or n)

Finally, when you’re ready to resume execution, you can enter “cont”.

Console

The console is a Ruby shell, which allows you to interact with your application’s domain model. Here you’ll have all parts of the application configured, just like it is when the application is running. You can inspect domain models, change values, and save to the database. Starting the script without arguments will launch it in the development environment.

To start the console, run rails console from the application directory.

Options:

  • Passing the -s, --sandbox argument will rollback any modifications made to the database.

  • Passing an environment name as an argument will load the corresponding environment. Example: rails console production.

To reload your controllers and models after launching the console run reload!

More information about irb can be found at: http://www.rubycentral.org/pickaxe/irb.html

dbconsole

You can go to the command line of your database directly through rails dbconsole. You would be connected to the database with the credentials defined in database.yml. Starting the script without arguments will connect you to the development database. Passing an argument will connect you to a different database, like rails dbconsole production. Currently works for MySQL, PostgreSQL and SQLite 3.

Description of Contents

The default directory structure of a generated Ruby on Rails application:

|-- app
|   |-- assets
|       |-- images
|       |-- javascripts
|       `-- stylesheets
|   |-- controllers
|   |-- helpers
|   |-- mailers
|   |-- models
|   `-- views
|       `-- layouts
|-- config
|   |-- environments
|   |-- initializers
|   `-- locales
|-- db
|-- doc
|-- lib
|   `-- tasks
|-- log
|-- public
|-- script
|-- test
|   |-- fixtures
|   |-- functional
|   |-- integration
|   |-- performance
|   `-- unit
|-- tmp
|   |-- cache
|   |-- pids
|   |-- sessions
|   `-- sockets
`-- vendor
    |-- assets
        `-- stylesheets
    `-- plugins

app

Holds all the code that's specific to this particular application.

app/assets

Contains subdirectories for images, stylesheets, and JavaScript files.

app/controllers

Holds controllers that should be named like weblogs_controller.rb for
automated URL mapping. All controllers should descend from
ApplicationController which itself descends from ActionController::Base.

app/models

Holds models that should be named like post.rb. Models descend from
ActiveRecord::Base by default.

app/views

Holds the template files for the view that should be named like
weblogs/index.html.erb for the WeblogsController#index action. All views use
eRuby syntax by default.

app/views/layouts

Holds the template files for layouts to be used with views. This models the
common header/footer method of wrapping views. In your views, define a layout
using the <tt>layout :default</tt> and create a file named default.html.erb.
Inside default.html.erb, call <% yield %> to render the view using this
layout.

app/helpers

Holds view helpers that should be named like weblogs_helper.rb. These are
generated for you automatically when using generators for controllers.
Helpers can be used to wrap functionality for your views into methods.

config

Configuration files for the Rails environment, the routing map, the database,
and other dependencies.

db

Contains the database schema in schema.rb. db/migrate contains all the
sequence of Migrations for your schema.

doc

This directory is where your application documentation will be stored when
generated using <tt>rake doc:app</tt>

lib

Application specific libraries. Basically, any kind of custom code that
doesn't belong under controllers, models, or helpers. This directory is in
the load path.

public

The directory available for the web server. Also contains the dispatchers and the
default HTML files. This should be set as the DOCUMENT_ROOT of your web
server.

script

Helper scripts for automation and generation.

test

Unit and functional tests along with fixtures. When using the rails generate
command, template test files will be generated for you and placed in this
directory.

vendor

External libraries that the application depends on. Also includes the plugins
subdirectory. If the app has frozen rails, those gems also go here, under
vendor/rails/. This directory is in the load path.

school-system-test's People

Contributors

reginato avatar

Watchers

 avatar  avatar

school-system-test's Issues

REG_00002.003 - AppSec Flow: Vulnerabilidade - (Stored XSS) Stored Cross-Site Scripting

ID: REG_00002.003

Categoria: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Reportado por: tconceicao

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Alto

Criticidade: Crítico

Padrões: [2013] A3 – Cross-Site Scripting (XSS), CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Descrição: The vulnerability of Cross-Site Scripting (XSS) could allow an attacker to get sensitive information from the web application. This flaw could permit the unauthorized access of an attacker. The exploitation of a XSS flaw is made after the injection of malicious code in the scope of application, doing that, the legitimate user executes this malicious code, sending back to the attacker sensitive information like cookies.

Descrição do Impacto: Aguardando preenchimento

Solução: The first step in order to mitigate the problems of XSS is to identify all points of the application where user supplied data is used in the construction of response pages. This identification procedure should include not only the points where data from a particular request are copied directly to the response pages, but must also consider any point where the data supplied by the user is persisted by the application to be shown later, this happens, for example, with the information from the submission of a registration form.
It is recommended that validation that govern the data flow input to be made based on the context of the information being received, for example, numeric fields should receive strictly numeric characters, rejecting any different character set which the application expects. This same procedure should be followed for other form fields according to the information type they wish to accept in the application: names, e-mail, phones, among others. This goal can be achieved using regular expressions to filter out unwanted character sets considered based on the context of the information received.
With respect to the validation that follows the output stream of the application data when the information is actually used to build the answers, you should ensure that potentially malicious characters are replaced as proposed by the escape sequences defined in HTML. A well-defined set of HTML entities should be used to replace literal characters as follows:
char “ replaced by &quot;
char ‘ replaced by &apos;
char & replaced by &amp;
char < replaced by &lt;
char > replaced by &gt;
In order to achieve excellence regarding the creation of filters, it is strongly recommended to adopt coding in HTML for any character not in the set of alphanumeric characters including whitespace (whitespace).

Referência: https://www.owasp.org/index.php/XSS
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)Prevention_Cheat_Sheet
https://www.owasp.org/index.php/Testing_for_Cross_site_scripting
http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting
http://www.youtube.com/watch?v=Z9RQSnf8-g
 

Tipo de falha:

**Protocolo:**http

**Método:**GET

**URL:**http://localhost

Parametros:

teste

Passo a Passo:

teste

**Requisição:**teste

**Resposta:**teste

Defect Tracker: https://app.conviso.com.br/scopes/191/projects/2180

RGB_00003.005 - AppSec Flow: Vulnerabilidade - Armazenamento Criptográfico Inseguro

ID: RGB_00003.005

Categoria: CWE-310: Cryptographic Issues

Reportado por: Rodrigo Reginato

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Baixo

Criticidade: Médio

Padrões: [2010] A7 – Insecure Cryptographic Storage, CWE-311 Missing Encryption of Sensitive Data

Descrição: As aplicação armazena dados sensíveis sem a devida codificação de segurança necessária para garantir a confidencialidade de tais informações. Essas informações podem varias desde dados de cartões de crédito até senhas de acesso. No caso de comprometimento do meio de armazenamento de tais dados (através de uma outra vulnerabilidade, por exemplo) tais informações confidenciais ficariam em total exposição ao atacante.

Descrição do Impacto: Aguardando preenchimento

Solução: Utilizar mecanismos apropriados para cifrar os dados antes do armazenamento, como algoritmos de criptografia atualizados, chaves fortes, como também funções de hashing e salt.

Referência: https://www.owasp.org/index.php/Top_10_2010-A7-Insecure_Cryptographic_Storage
http://bretthard.in/2009/09/insecure-cryptographic-storage/
http://www.infosecisland.com/blogview/21796-Insecure-Cryptographic-Storage-Explained.html
http://www.troyhunt.com/2011/06/owasp-top-10-for-net-developers-part-7.html

Tipo de falha:

**Código:**teste

**Entrada de dados:**teste

**Saída de dados:**teste

Defect Tracker: https://app.conviso.com.br/scopes/193/projects/2186

RGB_00003.004 - AppSec Flow: Vulnerabilidade - Server Side Request Forgery (SSRF)

ID: RGB_00003.004

Categoria: CWE-918 Server-Side Request Forgery (SSRF)

Reportado por: Rodrigo Reginato

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Médio

Criticidade: Alto

Padrões: n/a, CWE Incompatible

Descrição: Atacante é capaz de criar solicitações para um endereço interno ou externo. Sendo capaz de atacar redes internas que normalmente não são disponíveis para o publico em geral.

Descrição do Impacto: Aguardando preenchimento

Solução: Nunca realizar requisições a recursos externos ou internos passados pelo usuário sem uma validação. Se realmente for necessário para a aplicação fazer isso, recomenda-se criar um filtro com uma whitelist especificando os recursos que podem ser acessados, para evitar que a aplicação realize requisições a recursos internos, como exemplo o IP “127.0.0.1”, o hostname “localhost” ou IPs de rede local. Com relação aos recursos externos, pode aplicar um filtro bem similar ao anterior com o objetivo de evitar requisições maliciosas pelo servidor.
Como uma segurança adicional, é uma boa pratica a criação de regras de firewall para evitar a emissão de pacotes maliciosos gerados pela exploração desta vulnerabilidade.

Referência: http://cwe.mitre.org/data/definitions/918.html

Tipo de falha:

**Código:**teste

**Entrada de dados:**testes

**Saída de dados:**teste

Defect Tracker: https://app.conviso.com.br/scopes/193/projects/2186

RGB_00003.003 - AppSec Flow: Vulnerabilidade - (CSRF) Cross-Site Request Forgery

ID: RGB_00003.003

Categoria: CWE-345 Insufficient Verification of Data Authenticity

Reportado por: Rodrigo Reginato

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Alto

Criticidade: Crítico

Padrões: CWE-352 Cross-Site Request Forgery (CSRF)

Descrição: The links of forms don't are using a random token to prevent Cross-Site Request Forgery (CSRF) attacks. Without this token, an attacker could induce a real user to send forms without his authorization.

Descrição do Impacto: Aguardando preenchimento

Solução: Include a random token. The web server can use it to check if the request was really sent by the user.

Referência: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
http://projects.webappsec.org/w/page/13246919/Cross%20Site%20Request%20Forgery
https://www.owasp.org/index.php/Testing_for_CSRF_%28OWASP-SM-005%29
 

Tipo de falha:

Código:<script>

**Entrada de dados:**input

**Saída de dados:**output

Defect Tracker: https://app.conviso.com.br/scopes/193/projects/2186

REG_00002.002 - AppSec Flow: Vulnerabilidade - (Stored XSS) Stored Cross-Site Scripting

ID: REG_00002.002

Categoria: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Reportado por: Rodrigo Reginato

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Baixo

Criticidade: Médio

Padrões: [2013] A3 – Cross-Site Scripting (XSS), CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Descrição: The vulnerability of Cross-Site Scripting (XSS) could allow an attacker to get sensitive information from the web application. This flaw could permit the unauthorized access of an attacker. The exploitation of a XSS flaw is made after the injection of malicious code in the scope of application, doing that, the legitimate user executes this malicious code, sending back to the attacker sensitive information like cookies.

Descrição do Impacto: Aguardando preenchimento

Solução: The first step in order to mitigate the problems of XSS is to identify all points of the application where user supplied data is used in the construction of response pages. This identification procedure should include not only the points where data from a particular request are copied directly to the response pages, but must also consider any point where the data supplied by the user is persisted by the application to be shown later, this happens, for example, with the information from the submission of a registration form.
It is recommended that validation that govern the data flow input to be made based on the context of the information being received, for example, numeric fields should receive strictly numeric characters, rejecting any different character set which the application expects. This same procedure should be followed for other form fields according to the information type they wish to accept in the application: names, e-mail, phones, among others. This goal can be achieved using regular expressions to filter out unwanted character sets considered based on the context of the information received.
With respect to the validation that follows the output stream of the application data when the information is actually used to build the answers, you should ensure that potentially malicious characters are replaced as proposed by the escape sequences defined in HTML. A well-defined set of HTML entities should be used to replace literal characters as follows:
char “ replaced by &quot;
char ‘ replaced by &apos;
char & replaced by &amp;
char < replaced by &lt;
char > replaced by &gt;
In order to achieve excellence regarding the creation of filters, it is strongly recommended to adopt coding in HTML for any character not in the set of alphanumeric characters including whitespace (whitespace).

Referência: https://www.owasp.org/index.php/XSS
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)Prevention_Cheat_Sheet
https://www.owasp.org/index.php/Testing_for_Cross_site_scripting
http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting
http://www.youtube.com/watch?v=Z9RQSnf8-g
 

Tipo de falha:

**Código:**teste

**Entrada de dados:**teste

**Saída de dados:**teste

Defect Tracker: https://app.conviso.com.br/scopes/191/projects/2180

CVS_00220.002 - AppSec Flow: Vulnerabilidade - Cross-Site Request Forgery (CSRF)

ID: CVS_00220.002

Categoria: CWE-345 Insufficient Verification of Data Authenticity

Reportado por: Rodrigo Reginato

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Médio

Criticidade: Alto

Padrões: [2010] A5 – Cross-Site Request Forgery (CSRF), CWE-352 Cross-Site Request Forgery (CSRF)

Descrição: Os ataques de CSRF permitem a uma pessoa sem autorização induzir usuários legítimos a efetuarem requisições para a aplicação sem o seu consentimento. Essas requisição podem visar a criação de usuários pré-definido na aplicação, alteração ou exclusão de dados de dados, todos sem autorização ou consentimento do usuário legítimo e vitimado.

Descrição do Impacto: Aguardando preenchimento

Solução: Recomenda-se inserir um token de sessão único nos formulários e links de todos os requests realizados pela aplicação. Este token não pode ser previsível. A utilização de CAPTCHA e o processo de re-autenticação também é recomendado em conjunto com os tokens ou quando o mesmo não puder ser utilizado. Obs.: Caso a aplicação possua alguma falha de XSS, estas medidas de prevenção podem ser burladas.

Referência: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
http://projects.webappsec.org/w/page/13246919/Cross%20Site%20Request%20Forgery
https://www.owasp.org/index.php/Testing_for_CSRF_%28OWASP-SM-005%29

Tipo de falha:

**Protocolo:**asdfa

**Host:**asdfasd

Vetor:

asdfasd

Passo a Passo:

asdfasd

Defect Tracker: https://app.conviso.com.br/scopes/11/projects/2377

RGB_00003.002 - AppSec Flow: Vulnerabilidade - (Stored XSS) Stored Cross-Site Scripting

ID: RGB_00003.002

Categoria: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Reportado por: Rodrigo Reginato

Projeto: reginato/school-system-test

Criticidade:

Impacto: Alto

Probabilidade: Alto

Criticidade: Crítico

Padrões: [2013] A3 – Cross-Site Scripting (XSS), CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Descrição: The vulnerability of Cross-Site Scripting (XSS) could allow an attacker to get sensitive information from the web application. This flaw could permit the unauthorized access of an attacker. The exploitation of a XSS flaw is made after the injection of malicious code in the scope of application, doing that, the legitimate user executes this malicious code, sending back to the attacker sensitive information like cookies.

Descrição do Impacto: Aguardando preenchimento

Solução: The first step in order to mitigate the problems of XSS is to identify all points of the application where user supplied data is used in the construction of response pages. This identification procedure should include not only the points where data from a particular request are copied directly to the response pages, but must also consider any point where the data supplied by the user is persisted by the application to be shown later, this happens, for example, with the information from the submission of a registration form.
It is recommended that validation that govern the data flow input to be made based on the context of the information being received, for example, numeric fields should receive strictly numeric characters, rejecting any different character set which the application expects. This same procedure should be followed for other form fields according to the information type they wish to accept in the application: names, e-mail, phones, among others. This goal can be achieved using regular expressions to filter out unwanted character sets considered based on the context of the information received.
With respect to the validation that follows the output stream of the application data when the information is actually used to build the answers, you should ensure that potentially malicious characters are replaced as proposed by the escape sequences defined in HTML. A well-defined set of HTML entities should be used to replace literal characters as follows:
char “ replaced by &quot;
char ‘ replaced by &apos;
char & replaced by &amp;
char < replaced by &lt;
char > replaced by &gt;
In order to achieve excellence regarding the creation of filters, it is strongly recommended to adopt coding in HTML for any character not in the set of alphanumeric characters including whitespace (whitespace).

Referência: https://www.owasp.org/index.php/XSS
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)Prevention_Cheat_Sheet
https://www.owasp.org/index.php/Testing_for_Cross_site_scripting
http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting
http://www.youtube.com/watch?v=Z9RQSnf8-g
 

Tipo de falha:

**Código:**teste

**Entrada de dados:**teste

**Saída de dados:**teste

Defect Tracker: https://app.conviso.com.br/scopes/193/projects/2186

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.