Skip to content

Austenstone patch 1 #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Austenstone patch 1 #7

wants to merge 4 commits into from

Conversation

austenstone
Copy link

No description provided.

@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 16, 2024 •
edited
Loading

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails

Scanned Manifest Files

github-advanced-security[bot]
github-advanced-security bot found potential problems Sep 16, 2024
View reviewed changes
WebGoat/main.cs
string username = Console.ReadLine();
string query = "SELECT * FROM Users WHERE Username = '" + username + "';";
SqlConnection connection = new SqlConnection("Data Source=localhost;Initial Catalog=MyDB;User ID=" + dbUser + ";Password=" + dbPass);
SqlCommand command = new SqlCommand(query, connection);

Check failure

Code scanning / CodeQL

SQL query built from user-controlled sources

This query depends on [this read from stdin](1).
@austenstone austenstone reopened this Sep 17, 2024
github-advanced-security[bot]
github-advanced-security bot found potential problems Sep 17, 2024
View reviewed changes
WebGoat/main.cs
public class Program
{
// Hardcoded credentials (CWE-798)
private static string dbUser = "admin";

Check notice

Code scanning / CodeQL

Missed 'readonly' opportunity Note

Field 'dbUser' can be 'readonly'.
WebGoat/main.cs
{
// Hardcoded credentials (CWE-798)
private static string dbUser = "admin";
private static string dbPass = "password123";

Check notice

Code scanning / CodeQL

Missed 'readonly' opportunity Note

Field 'dbPass' can be 'readonly'.
WebGoat/main.cs
Console.WriteLine("Enter username:");
string username = Console.ReadLine();
string query = "SELECT * FROM Users WHERE Username = '" + username + "';";
SqlConnection connection = new SqlConnection("Data Source=localhost;Initial Catalog=MyDB;User ID=" + dbUser + ";Password=" + dbPass);

Check warning

Code scanning / CodeQL

Missing Dispose call on local IDisposable Warning

Disposable 'SqlConnection' is created but not disposed.
WebGoat/main.cs
string username = Console.ReadLine();
string query = "SELECT * FROM Users WHERE Username = '" + username + "';";
SqlConnection connection = new SqlConnection("Data Source=localhost;Initial Catalog=MyDB;User ID=" + dbUser + ";Password=" + dbPass);
SqlCommand command = new SqlCommand(query, connection);

Check warning

Code scanning / CodeQL

Missing Dispose call on local IDisposable Warning

Disposable 'SqlCommand' is created but not disposed.
WebGoat/main.cs
SqlConnection connection = new SqlConnection("Data Source=localhost;Initial Catalog=MyDB;User ID=" + dbUser + ";Password=" + dbPass);
SqlCommand command = new SqlCommand(query, connection);
connection.Open();
SqlDataReader reader = command.ExecuteReader();

Check warning

Code scanning / CodeQL

Useless assignment to local variable Warning

This assignment to
reader
Loading
is useless, since its value is never read.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@austenstone