search

SasanLabs / VulnerableApp

OWASP VulnerableApp Project: For Security Enthusiasts by Security Enthusiasts.
https://sasanlabs.github.io/VulnerableApp/
Apache License 2.0
261 stars 357 forks source link

New unrestricted file upload size vulnerability (#351) #454

Closed tkomlodi closed 6 months ago

tkomlodi commented 7 months ago

As proposed earlier, I added a new level 10 endpoint to UnrestrictedFileUpload which accepts unlimited sized files. These files are stored in-memory on the heap to allow triggering an out-of-memory condition.

VulnerableAppConfiguration was updated to remove the default file size limit for the new endpoint only.

Two new maven dependencies were added:

  1. commons-fileupload: facilitates the configuration change
  2. spring-test: allows mocking multipart files in the new unit test

I didn't add the new labels to the non-English i18n files. Let me know if that is required.

The unit test does not test the actual enforcement (or lack of) the file size limit. That could only be done with an integration test which I did not want to introduce. I manually tested that the limit is removed from the new endpoint but it still applies to all the other ones.

This change contains the prior fix for #449 (https://github.com/SasanLabs/VulnerableApp/pull/453). This is the only way I can run the application in my environment. I hope that, if that is merged first, it won't cause any issues. However, I'm not 100% sure how github will react.

Thanks!

codecov-commenter commented 6 months ago

Codecov Report

Attention: 44 lines in your changes are missing coverage. Please review.

Comparison is base (a867b67) 23.15% compared to head (b7adbc2) 23.08%. Report is 1 commits behind head on master.

Files Patch % Lines
...Injection/UnionBasedSQLInjectionVulnerability.java 27.27% 24 Missing :warning:
...labs/configuration/VulnerableAppConfiguration.java 0.00% 10 Missing :warning:
...lnerability/fileupload/UnrestrictedFileUpload.java 0.00% 8 Missing :warning:
...ice/vulnerability/sqlInjection/CarInformation.java 0.00% 2 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #454 +/- ## ============================================ - Coverage 23.15% 23.08% -0.08% - Complexity 206 207 +1 ============================================ Files 55 55 Lines 1831 1880 +49 Branches 196 196 ============================================ + Hits 424 434 +10 - Misses 1365 1404 +39 Partials 42 42 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

preetkaran20 commented 6 months ago

Thanks @tkomlodi for the PR and presenting Idea for fixing this issue.