rochomonsta/my-spendings

This is my pet-project to calculate my spendings written by using ASP.NET Core (MVC).

MySpendings

ASP.NET Core (MVC) tool in which the user can enter his spendings to create statistics

Experience gained

• Got the basics of working with ASP.NET Core (MVC)
• Learned to work with media files
• Learned to work with Razor pages
• Gained knowledge about creation N-Tier architecture
• Gained knowledge about Unit Of Work in Repository Pattern
• Gained knowledge about ASP.NET Core Authentication

Technologies used

• ASP.NET Core (MVC)
• Sweetalert2
• toastr
• TinyMCE
• Chart.js
• Bootswatch
• Bootstrap 5
• DataTables

Result

Home Page

Profile settings

Category Page

Create Category Page

Outlay Page

Create Outlay Page

my-spendings's Issues

Security bugs

1. System.Text.Encodings.Web
   A description of the vulnerability:
   Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to how text encoding is performed.
2. Antiforgery token is not used
   A description of the vulnerability:
   The application lacks a CSRF protection mechanism through the use of AntiForgery Token.
3. Newtonsoft.Json
   A description of the vulnerability:
   Affected versions of this package are vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed.
4. System.Text.RegularExpressions
   A description of the vulnerability:
   Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improperly processing of RegEx strings.
5. The database connection string is stored in the appsettings.json file
   A description of the vulnerability:
   If the database connection string is in the appsettings.json file, anyone will be able to spy on it and use it.