From bd0be975a03f9e66dd69ea1719a6dd59b76734fd Mon Sep 17 00:00:00 2001 From: TommyNguyen Date: Mon, 27 Jul 2026 17:20:35 -0400 Subject: [PATCH 1/2] ci: add PR template for lab submissions --- .github/PULL_REQUEST_LAB_1.md | 83 +++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 .github/PULL_REQUEST_LAB_1.md diff --git a/.github/PULL_REQUEST_LAB_1.md b/.github/PULL_REQUEST_LAB_1.md new file mode 100644 index 00000000..57ffa379 --- /dev/null +++ b/.github/PULL_REQUEST_LAB_1.md @@ -0,0 +1,83 @@ +# Lab 1 — Submission + +## Triage Report: OWASP Juice Shop + +### Scope & Asset +- Asset: OWASP Juice Shop (local lab instance) +- Image: `bkimminich/juice-shop:v20.0.0` +- Image digest: + sha256:fd58bdc9745416afce8184ee0666278a436574633ea7880365153a63bfd418b0 +- Host OS: + macOS 26.5.1 +- Docker version: + 29.6.2 + +### Deployment Details +- Run command used: `docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop:v20.0.0` +- Access URL: http://127.0.0.1:3000 +- Network exposure: 127.0.0.1 only? [/] Yes [ ] No (explain if No) +- Container restart policy: + +### Health Check +- HTTP code on `/`: + yes 200 ok +- API check (first 200 chars of `/api/Products`): + ``` + { + "status": "success", + "data": [ + { + "id": 1, + "name": "Apple Juice (1000ml)", + "description": "The all-time classic.", + "price": 1.99, + "deluxePrice": 0.99, + "ima + ``` +- Container uptime: + 3 hours + +### Initial Surface Snapshot (from browser exploration) +- Login/Registration visible: [X] Yes [ ] No — notes: <...> +- Product listing/search present: [X] Yes [ ] No — notes: <...> +- Admin or account area discoverable: [X] Yes [ ] No — notes: <...> +- Client-side errors in DevTools console: [ ] Yes [X] No — notes: <...> +- Pre-populated local storage / cookies: + nothing in the local storage, for cookies it shows the welcome banner and the language. + +### Security Headers (Quick Look) +Run: `curl -I http://127.0.0.1:3000 2>&1 | head -20`. Paste output: +``` + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 9903 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 +HTTP/1.1 200 OK +Access-Control-Allow-Origin: * +X-Content-Type-Options: nosniff +X-Frame-Options: SAMEORIGIN +Feature-Policy: payment 'self' +X-Recruiting: /#/jobs +Accept-Ranges: bytes +Cache-Control: public, max-age=0 +Last-Modified: Sun, 26 Jul 2026 22:38:20 GMT +ETag: W/"26af-19fa0944a58" +Content-Type: text/html; charset=UTF-8 +Content-Length: 9903 +Vary: Accept-Encoding +Date: Mon, 27 Jul 2026 02:07:33 GMT +Connection: keep-alive +Keep-Alive: timeout=5 +``` +Which of these are MISSING? (cross-reference Lecture 1 OWASP Top 10:2025 — A06) +- [X] `Content-Security-Policy` +- [X] `Strict-Transport-Security` +- [ ] `X-Content-Type-Options: nosniff` +- [ ] `X-Frame-Options` + +### Top 3 Risks Observed (2-3 sentences each, in your own words) +1. **** — + A05:2025 Injection - Allows a user to alter the database tables without going through the correct process/authentications "admin@juice-sh.op'--" +2. **** — + A06:2025 Insecure Design - Does not have the correct system design to prevent users from easily accessing restricted areas - missing Content-Security-Policy and Strict-Transport-Security +3. **** — + A01:2025 Broken Access Control - Allows users to enter in guessed urls to access restricted areas. \ No newline at end of file From 0d32c4f9df16025e47a1d885047885c964eb7a79 Mon Sep 17 00:00:00 2001 From: TommyNguyen Date: Mon, 27 Jul 2026 17:28:38 -0400 Subject: [PATCH 2/2] ci: add PR template for lab submissions --- .github/PULL_REQUEST_TEMPLATE.md | 12 ++++++++++++ .github/PULL_REQUEST_LAB_1.md => submissions/lab1.md | 8 ++++++++ 2 files changed, 20 insertions(+) create mode 100644 .github/PULL_REQUEST_TEMPLATE.md rename .github/PULL_REQUEST_LAB_1.md => submissions/lab1.md (92%) diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 00000000..68e8ab7d --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,12 @@ +Required sections (the template must include all four): + +1. **Goal** — what this PR delivers (1 sentence) +2. **Changes** — bullet list of artifacts added/modified +3. **Testing** — how you verified it works (commands + observed output) +4. **Artifacts & Screenshots** — links to files in this PR, image embeds where useful + +Required checklist (the template must include all three items): + +- [ ] Title is clear (`feat(labN): ` style) +- [ ] No secrets/large temp files committed +- [ ] Submission file at `submissions/labN.md` exists \ No newline at end of file diff --git a/.github/PULL_REQUEST_LAB_1.md b/submissions/lab1.md similarity index 92% rename from .github/PULL_REQUEST_LAB_1.md rename to submissions/lab1.md index 57ffa379..4ede061b 100644 --- a/.github/PULL_REQUEST_LAB_1.md +++ b/submissions/lab1.md @@ -1,5 +1,13 @@ # Lab 1 — Submission +```markdown +## PR Template Setup + +- File: `.github/PULL_REQUEST_TEMPLATE.md` +- Sections included: Goal / Changes / Testing / Artifacts & Screenshots +- Checklist items: +- Auto-fill verified: [ ] Yes — PR description showed my template (screenshot or link to draft PR) +``` ## Triage Report: OWASP Juice Shop ### Scope & Asset