demo
734f73afb5
ASP.NET Core (.NET 8), intentionally outdated NuGet packages (Newtonsoft.Json 12.0.2, Microsoft.Data.SqlClient 2.0.0) for SCA demo. CWE-89, CWE-327, CWE-798, CWE-22, CWE-330 in LegacyReports.cs.
44 lines
1.4 KiB
C#
44 lines
1.4 KiB
C#
// LEGACY MODULE — INTENTIONAL VULNERABILITIES FOR DEMO
|
|
// Included in full security scans, excluded from the blocking SAST gate.
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using Microsoft.Data.SqlClient;
|
|
|
|
namespace InventoryApi.Legacy;
|
|
|
|
public static class LegacyReports
|
|
{
|
|
// CWE-798: Hardcoded credentials
|
|
public const string ConnectionString =
|
|
"Server=inventory-db;Database=inventory;User Id=sa;Password=Inv3ntory2019!;";
|
|
public const string AwsAccessKeyId = "AKIA5NETDEMO7INVENTY";
|
|
public const string ReportSigningKey = "legacy-report-signing-key-2019";
|
|
|
|
// CWE-89: SQL Injection via string concatenation
|
|
public static SqlCommand GetStockReport(SqlConnection conn, string warehouse)
|
|
{
|
|
return new SqlCommand(
|
|
"SELECT * FROM stock WHERE warehouse = '" + warehouse + "'", conn);
|
|
}
|
|
|
|
// CWE-327: Weak cryptographic hash
|
|
public static string HashApiKey(string apiKey)
|
|
{
|
|
using var md5 = MD5.Create();
|
|
return Convert.ToHexString(md5.ComputeHash(Encoding.UTF8.GetBytes(apiKey)));
|
|
}
|
|
|
|
// CWE-22: Path traversal
|
|
public static string ReadReport(string baseDir, string fileName)
|
|
{
|
|
return File.ReadAllText(baseDir + "/" + fileName);
|
|
}
|
|
|
|
// CWE-330: Insecure randomness for tokens
|
|
public static string ExportToken()
|
|
{
|
|
var rnd = new Random();
|
|
return rnd.Next().ToString("x") + rnd.Next().ToString("x");
|
|
}
|
|
}
|