Secure Code Warrior_.Net Core 資安練習

有害程式

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using MusicStore.Extensions;
using MusicStore.Models;
using MusicStore.Models.ViewModels.Account;
using MusicStore.Options;
using MusicStore.Repositories.Contracts;
using MusicStore.Services.Contracts;
using System;
using System.DirectoryServices.Protocols;
using System.Linq;
using System.Threading.Tasks;
using SearchScope = System.DirectoryServices.Protocols.SearchScope;

namespace MusicStore.Controllers
{
    [AutoValidateAntiforgeryToken]
    [AllowAnonymous]
    public class AccountController : Controller
    {
        private UserManager<User> userManager;
        private SignInManager<User> signInManager;
        private IRecaptchaService recaptchaService;
        private LDAPOptions LDAPOptions;
        private IListenerRepository listenerRepository;
        private IMusicianRepository musicianRepository;
        private IEmailService emailService;
        private ILogger<AccountController> logger;

        public AccountController(UserManager<User> userManager,
            SignInManager<User> signInManager,
            IRecaptchaService recaptchaService,
            IOptions<AppOptions> optionsAccessor,
            IListenerRepository listenerRepository,
            IMusicianRepository musicianRepository,
            IEmailService emailService,
            ILogger<AccountController> logger)
        {
            this.userManager = userManager;
            this.signInManager = signInManager;
            this.recaptchaService = recaptchaService;
            this.listenerRepository = listenerRepository;
            this.musicianRepository = musicianRepository;
            this.emailService = emailService;
            LDAPOptions = optionsAccessor.Value.LDAPOptions;
            this.logger = logger;
        }

        [HttpGet]
        public async Task<IActionResult> Login()
        {
            if (User.Identity.IsAuthenticated)
            {
                var role = (await userManager
                    .GetRolesAsync(await userManager.GetUserAsync(User)))
                    .SingleOrDefault();
                switch (role)
                {
                    case "Musician":
                        return RedirectToAction("Index", "Musician");
                    case "Admin":
                        return RedirectToAction("Index", "Admin");
                    case "Listener":
                        return RedirectToAction("Index", "Listener");
                    default:
                        await signInManager.SignOutAsync();
                        break;
                }
            }
            return View();
        }

        [HttpPost]
        public async Task<IActionResult> Login(LoginViewModel model)
        {
            if (ModelState.IsValid)
            {
                var captchaResponse =
                    await recaptchaService.Validate(Request.Form);
                if (!captchaResponse.Success)
                {
                    logger.LogInformation($"reCaptcha error with login " +
                        $"{model.Login}");
                    ModelState.AddModelError("reCaptchaError",
                        "reCAPTCHA error occured. Please try again.");
                    return View(model);
                }
                var result =
                    await signInManager.PasswordSignInAsync(model.Login,
                    model.Password, model.RememberMe, true);
                if (result.Succeeded)
                {
                    return RedirectToAction("Login");
                }
            }
            logger.LogInformation($"Failed authentication for login" +
                $"{model.Login}");
            ModelState.AddModelError("", $"Wrong login {model.Login} and/or password");
            return View(model);
        }

        [HttpPost]
        public async Task<IActionResult> LoginLDAP(LoginViewModel model)
        {
            string ldapPath = $"ou=People,dc=music-store,dc=com";
            string ldapDomain = LDAPOptions.LdapHost;
            var connection = new LdapConnection(ldapDomain);
            try
            {
                var captchaResponse =
                       await recaptchaService.Validate(Request.Form);
                if (!captchaResponse.Success)
                {
                    logger.LogInformation($"reCaptcha error with login " +
                        $"{model.Login}");
                    ModelState.AddModelError("reCaptchaError",
                        "reCAPTCHA error occured. Please try again.");
                    return View(model);
                }
                var filter =
                    $"(&(uid={model.Login})" +
                    $"(objectClass=musicStoreUser))";
                var request = new SearchRequest(ldapPath, filter,
                    SearchScope.Subtree);
                var response = connection.SendRequest(request)
                    as SearchResponse;
                if (response.Entries.Count > 0)
                {
                    if (userManager.PasswordHasher.VerifyHashedPassword(null,
                        response.Entries[0].Attributes["userPassword"]
                        .GetValues(typeof(string)).FirstOrDefault() as string,
                        model.Password) == PasswordVerificationResult.Success)
                    {
                        var result =
                            await signInManager.PasswordSignInAsync(model.Login,
                            model.Password, model.RememberMe, true);
                        if (result.Succeeded)
                        {
                            return RedirectToAction("Login");
                        }
                    }
                }
            }
            catch (LdapException ex)
            {
                logger.LogError($"LDAP connection error for user" +
                    $"{model.Login}. Info: {ex.Message}, " +
                    $"StackTrace: {ex.StackTrace}");
                ModelState.AddModelError("", "Wrong login and/or password");
            }
            catch (Exception ex)
            {
                logger.LogError($"Unknown error: Info: {ex.Message}, " +
                    $"StackTrace: {ex.StackTrace}");
                throw;
            }
            return View("Login", model);
        }

        [HttpGet]
        public IActionResult Register()
        {
            return View();
        }

        [HttpPost]
        public async Task<IActionResult> Register(RegisterViewModel model)
        {
            if (ModelState.IsValid)
            {
                var captchaResponse =
                    await recaptchaService.Validate(Request.Form);
                if (!captchaResponse.Success)
                {
                    logger.LogInformation($"reCaptcha register fail. Login " +
                        $"{model.Login}");
                    ModelState.AddModelError("reCaptchaError",
                        "reCAPTCHA error occured. Please try again.");
                    return View(model);
                }
                var user = new User
                {
                    UserName = model.Login,
                    Email = model.Email,
                    Name = model.Name
                };
                try
                {
                    var result = await userManager.CreateAsync(user,
                        model.Password);
                    if (result.Succeeded)
                    {
                        await userManager.AddToRoleAsync(user,
                            model.Role.GetDescription());
                        switch (model.Role)
                        {
                            case Role.Listener:
                                await listenerRepository.Create(new Listener
                                {
                                    User = user
                                });
                                break;
                            case Role.Musician:
                                await musicianRepository.Create(new Musician
                                {
                                    User = user
                                });
                                break;
                        }
                        var code = await userManager
                            .GenerateEmailConfirmationTokenAsync(user);
                        var callbackUrl = Url.Action(
                            "ConfirmEmail",
                            "Account",
                            new { userId = user.Id, code = code },
                            protocol: HttpContext.Request.Scheme);
                        await emailService.SendEmailAsync(model.Email,
                            "Confirm your account", $"Confirm account by " +
                            $"following the link: " +
                            $"<a href='{callbackUrl}'>link</a>");

                        return Content("To end registration please follow " +
                            "the instructions which have been sent to your " +
                            "email.");
                    }
                    else
                    {
                        foreach (var error in result.Errors)
                        {
                            ModelState.AddModelError("", error.Description);
                        }
                    }
                }
                catch (Exception ex)
                {
                    logger.LogError($"Error while register user. " +
                        $"Info: {ex.Message} StackTrace: {ex.StackTrace}");
                    ModelState.AddModelError("", "Unknown error has ocurred, " +
                        "please try again or contact administrator.");
                }
            }
            return View(model);
        }

        [HttpGet]
        public async Task<IActionResult> ConfirmEmail(string userId, 
            string code)
        {
            if (userId == null || code == null)
            {
                return RedirectToAction("Login");
            }
            var user = await userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return RedirectToAction("Login");
            }
            var result = await userManager.ConfirmEmailAsync(user, code);
            return RedirectToAction("Login");
        }

        [HttpGet]
        public IActionResult ForgotPassword()
        {
            return View();
        }

        [HttpPost]
        public async Task<IActionResult> ForgotPassword(
            ForgotPasswordViewModel model)
        {
            if (ModelState.IsValid)
            {
                var user = await userManager.FindByEmailAsync(model.Email);
                if (user == null ||
                    !(await userManager.IsEmailConfirmedAsync(user)))
                {
                    return Content("Instructions for changing password have " +
                        "been sent on your email");
                }

                var code = await userManager
                    .GeneratePasswordResetTokenAsync(user);
                var callbackUrl = Url.Action("ResetPassword", "Account",
                    new { userId = user.Id, code = code },
                    protocol: HttpContext.Request.Scheme);
                await emailService.SendEmailAsync(model.Email, "Reset Password",
                $"To change password follow the link: " +
                $"<a href='{callbackUrl}'>link</a>");
                return Content("Instructions for changing your password have " +
                    "been sent to your email.");
            }
            return View(model);
        }

        [HttpGet]
        public IActionResult ResetPassword(string code = null)
        {
            return code == null ? View("Login") : View(
                new ResetPasswordViewModel
                {
                    Code = code
                });
        }

        [HttpPost]
        public async Task<IActionResult> ResetPassword(
            ResetPasswordViewModel model)
        {
            if (!ModelState.IsValid)
            {
                return View(model);
            }
            var user = await userManager.FindByEmailAsync(model.Email);
            if (user == null)
            {
                return View("ResetPasswordConfirmation");
            }
            var result = await userManager.ResetPasswordAsync(user,
                model.Code, model.Password);
            if (result.Succeeded)
            {
                return View("ResetPasswordConfirmation");
            }
            foreach (var error in result.Errors)
            {
                ModelState.AddModelError(string.Empty, error.Description);
            }
            return View(model);
        }

        [HttpGet]
        [Authorize]
        public IActionResult ChangePassword()
        {
            return View();
        }

        [HttpPost]
        [Authorize]
        public async Task<IActionResult> ChangePassword(
            ChangePasswordViewModel model)
        {
            if (ModelState.IsValid)
            {
                var user = await userManager.FindByIdAsync(userManager
                    .GetUserId(User));
                var result = await userManager.ChangePasswordAsync(user,
                    model.OldPassword, model.Password);
                if (result.Succeeded)
                    return RedirectToAction("Login");
                else
                {
                    foreach (var error in result.Errors)
                        ModelState.AddModelError("", error.Description);
                }
            }
            return View(model);
        }


        [HttpGet]
        [Authorize]
        public async Task<IActionResult> LogOut()
        {
            await signInManager.SignOutAsync();
            return RedirectToAction(nameof(Login));
        }

        [HttpGet]
        [Authorize]
        public async Task<IActionResult> UserInfo()
        {
            var user = await userManager.GetUserAsync(User);
            if (user == null)
                return NotFound();
            var model = new UserInfoViewModel 
            {
                Email = user.Email,
                UserName = user.UserName
            };
            return View(model);
        }
    }
}

解決程式方案

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using MusicStore.Extensions;
using MusicStore.Models;
using MusicStore.Models.ViewModels.Account;
using MusicStore.Options;
using MusicStore.Repositories.Contracts;
using MusicStore.Services.Contracts;
using System;
using System.DirectoryServices.Protocols;
using System.Linq;
using System.Threading.Tasks;
using SearchScope = System.DirectoryServices.Protocols.SearchScope;

namespace MusicStore.Controllers
{
    [AutoValidateAntiforgeryToken]
    [AllowAnonymous]
    public class AccountController : Controller
    {
        private UserManager<User> userManager;
        private SignInManager<User> signInManager;
        private IRecaptchaService recaptchaService;
        private LDAPOptions LDAPOptions;
        private IListenerRepository listenerRepository;
        private IMusicianRepository musicianRepository;
        private IEmailService emailService;
        private ILogger<AccountController> logger;

        public AccountController(UserManager<User> userManager,
            SignInManager<User> signInManager,
            IRecaptchaService recaptchaService,
            IOptions<AppOptions> optionsAccessor,
            IListenerRepository listenerRepository,
            IMusicianRepository musicianRepository,
            IEmailService emailService,
            ILogger<AccountController> logger)
        {
            this.userManager = userManager;
            this.signInManager = signInManager;
            this.recaptchaService = recaptchaService;
            this.listenerRepository = listenerRepository;
            this.musicianRepository = musicianRepository;
            this.emailService = emailService;
            LDAPOptions = optionsAccessor.Value.LDAPOptions;
            this.logger = logger;
        }

        [HttpGet]
        public async Task<IActionResult> Login()
        {
            if (User.Identity.IsAuthenticated)
            {
                var role = (await userManager
                    .GetRolesAsync(await userManager.GetUserAsync(User)))
                    .SingleOrDefault();
                switch (role)
                {
                    case "Musician":
                        return RedirectToAction("Index", "Musician");
                    case "Admin":
                        return RedirectToAction("Index", "Admin");
                    case "Listener":
                        return RedirectToAction("Index", "Listener");
                    default:
                        await signInManager.SignOutAsync();
                        break;
                }
            }
            return View();
        }

        [HttpPost]
        public async Task<IActionResult> Login(LoginViewModel model)
        {
            if (ModelState.IsValid)
            {
                var captchaResponse =
                    await recaptchaService.Validate(Request.Form);
                if (!captchaResponse.Success)
                {
                    logger.LogInformation($"reCaptcha error with login " +
                        $"{model.Login}");
                    ModelState.AddModelError("reCaptchaError",
                        "reCAPTCHA error occured. Please try again.");
                    return View(model);
                }
                var result =
                    await signInManager.PasswordSignInAsync(model.Login,
                    model.Password, model.RememberMe, true);
                if (result.Succeeded)
                {
                    return RedirectToAction("Login");
                }
            }
            logger.LogInformation($"Failed authentication for login" +
                $"{model.Login}");
            ModelState.AddModelError("", $"Wrong login {model.Login} and/or password");
            return View(model);
        }

        [HttpPost]
        public async Task<IActionResult> LoginLDAP(LoginViewModel model)
        {
            string ldapPath = $"ou=People,dc=music-store,dc=com";
            string ldapDomain = LDAPOptions.LdapHost;
            var connection = new LdapConnection(ldapDomain);
            try
            {
                var captchaResponse =
                       await recaptchaService.Validate(Request.Form);
                if (!captchaResponse.Success)
                {
                    logger.LogInformation($"reCaptcha error with login " +
                        $"{model.Login}");
                    ModelState.AddModelError("reCaptchaError",
                        "reCAPTCHA error occured. Please try again.");
                    return View(model);
                }
                var filter =
                    "(&(uid=" +
                    Microsoft.Security.Application.Encoder
                        .LdapFilterEncode(model.Login) +
                     ")(objectClass=musicStoreUser))";
                var request = new SearchRequest(ldapPath, filter,
                    SearchScope.Subtree);
                var response = connection.SendRequest(request)
                    as SearchResponse;
                if (response.Entries.Count > 0)
                {
                    if (userManager.PasswordHasher.VerifyHashedPassword(null,
                        response.Entries[0].Attributes["userPassword"]
                        .GetValues(typeof(string)).FirstOrDefault() as string,
                        model.Password) == PasswordVerificationResult.Success)
                    {
                        var result =
                            await signInManager.PasswordSignInAsync(model.Login,
                            model.Password, model.RememberMe, true);
                        if (result.Succeeded)
                        {
                            return RedirectToAction("Login");
                        }
                    }
                }
            }
            catch (LdapException ex)
            {
                logger.LogError($"LDAP connection error for user" +
                    $"{model.Login}. Info: {ex.Message}, " +
                    $"StackTrace: {ex.StackTrace}");
                ModelState.AddModelError("", "Wrong login and/or password");
            }
            catch (Exception ex)
            {
                logger.LogError($"Unknown error: Info: {ex.Message}, " +
                    $"StackTrace: {ex.StackTrace}");
                throw;
            }
            return View("Login", model);
        }

        [HttpGet]
        public IActionResult Register()
        {
            return View();
        }

        [HttpPost]
        public async Task<IActionResult> Register(RegisterViewModel model)
        {
            if (ModelState.IsValid)
            {
                var captchaResponse =
                    await recaptchaService.Validate(Request.Form);
                if (!captchaResponse.Success)
                {
                    logger.LogInformation($"reCaptcha register fail. Login " +
                        $"{model.Login}");
                    ModelState.AddModelError("reCaptchaError",
                        "reCAPTCHA error occured. Please try again.");
                    return View(model);
                }
                var user = new User
                {
                    UserName = model.Login,
                    Email = model.Email,
                    Name = model.Name
                };
                try
                {
                    var result = await userManager.CreateAsync(user,
                        model.Password);
                    if (result.Succeeded)
                    {
                        await userManager.AddToRoleAsync(user,
                            model.Role.GetDescription());
                        switch (model.Role)
                        {
                            case Role.Listener:
                                await listenerRepository.Create(new Listener
                                {
                                    User = user
                                });
                                break;
                            case Role.Musician:
                                await musicianRepository.Create(new Musician
                                {
                                    User = user
                                });
                                break;
                        }
                        var code = await userManager
                            .GenerateEmailConfirmationTokenAsync(user);
                        var callbackUrl = Url.Action(
                            "ConfirmEmail",
                            "Account",
                            new { userId = user.Id, code = code },
                            protocol: HttpContext.Request.Scheme);
                        await emailService.SendEmailAsync(model.Email,
                            "Confirm your account", $"Confirm account by " +
                            $"following the link: " +
                            $"<a href='{callbackUrl}'>link</a>");

                        return Content("To end registration please follow " +
                            "the instructions which have been sent to your " +
                            "email.");
                    }
                    else
                    {
                        foreach (var error in result.Errors)
                        {
                            ModelState.AddModelError("", error.Description);
                        }
                    }
                }
                catch (Exception ex)
                {
                    logger.LogError($"Error while register user. " +
                        $"Info: {ex.Message} StackTrace: {ex.StackTrace}");
                    ModelState.AddModelError("", "Unknown error has ocurred, " +
                        "please try again or contact administrator.");
                }
            }
            return View(model);
        }

        [HttpGet]
        public async Task<IActionResult> ConfirmEmail(string userId, 
            string code)
        {
            if (userId == null || code == null)
            {
                return RedirectToAction("Login");
            }
            var user = await userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return RedirectToAction("Login");
            }
            var result = await userManager.ConfirmEmailAsync(user, code);
            return RedirectToAction("Login");
        }

        [HttpGet]
        public IActionResult ForgotPassword()
        {
            return View();
        }

        [HttpPost]
        public async Task<IActionResult> ForgotPassword(
            ForgotPasswordViewModel model)
        {
            if (ModelState.IsValid)
            {
                var user = await userManager.FindByEmailAsync(model.Email);
                if (user == null ||
                    !(await userManager.IsEmailConfirmedAsync(user)))
                {
                    return Content("Instructions for changing password have " +
                        "been sent on your email");
                }

                var code = await userManager
                    .GeneratePasswordResetTokenAsync(user);
                var callbackUrl = Url.Action("ResetPassword", "Account",
                    new { userId = user.Id, code = code },
                    protocol: HttpContext.Request.Scheme);
                await emailService.SendEmailAsync(model.Email, "Reset Password",
                $"To change password follow the link: " +
                $"<a href='{callbackUrl}'>link</a>");
                return Content("Instructions for changing your password have " +
                    "been sent to your email.");
            }
            return View(model);
        }

        [HttpGet]
        public IActionResult ResetPassword(string code = null)
        {
            return code == null ? View("Login") : View(
                new ResetPasswordViewModel
                {
                    Code = code
                });
        }

        [HttpPost]
        public async Task<IActionResult> ResetPassword(
            ResetPasswordViewModel model)
        {
            if (!ModelState.IsValid)
            {
                return View(model);
            }
            var user = await userManager.FindByEmailAsync(model.Email);
            if (user == null)
            {
                return View("ResetPasswordConfirmation");
            }
            var result = await userManager.ResetPasswordAsync(user,
                model.Code, model.Password);
            if (result.Succeeded)
            {
                return View("ResetPasswordConfirmation");
            }
            foreach (var error in result.Errors)
            {
                ModelState.AddModelError(string.Empty, error.Description);
            }
            return View(model);
        }

        [HttpGet]
        [Authorize]
        public IActionResult ChangePassword()
        {
            return View();
        }

        [HttpPost]
        [Authorize]
        public async Task<IActionResult> ChangePassword(
            ChangePasswordViewModel model)
        {
            if (ModelState.IsValid)
            {
                var user = await userManager.FindByIdAsync(userManager
                    .GetUserId(User));
                var result = await userManager.ChangePasswordAsync(user,
                    model.OldPassword, model.Password);
                if (result.Succeeded)
                    return RedirectToAction("Login");
                else
                {
                    foreach (var error in result.Errors)
                        ModelState.AddModelError("", error.Description);
                }
            }
            return View(model);
        }


        [HttpGet]
        [Authorize]
        public async Task<IActionResult> LogOut()
        {
            await signInManager.SignOutAsync();
            return RedirectToAction(nameof(Login));
        }

        [HttpGet]
        [Authorize]
        public async Task<IActionResult> UserInfo()
        {
            var user = await userManager.GetUserAsync(User);
            if (user == null)
                return NotFound();
            var model = new UserInfoViewModel 
            {
                Email = user.Email,
                UserName = user.UserName
            };
            return View(model);
        }
    }
}

(2021年度)駕訓學科筆試準備題庫歸納分析_法規是非題

- 8月 18, 2021

若是出現「必須」、「必需」、「...必...」、「應由」、「應先」、「應...」則很高機率是圈是非通常只要是如下字眼「不必」+動詞、「不需」「不須」、「可不」、「可以不」、「可立即」有出現或符合的都選叉 (X)1.違規記點又不登記在駕照上，所以可以不必理會而任意違反交通規則。 (X)2.發生重大交通事故，為迅速恢復交通，清除現場，可不必等待肇事處理機關之指示，即可進行。 (X)3.道路駕駛練習，行車前不必實施車輛安全檢查，因為那是駕駛教練的工作。 (X)4.開車前，不必檢查機件安全，但在行駛中要隨時注意儀錶功能顯示，確保行車安全。 (X)5.煞車油若經常低於"MIN"線，只要添加即可，不必到修理廠檢修。 (X)6.冷卻系統只要副水箱在滿水位，主水箱不必檢查也不會有問題。 (X)7.引擎冷卻水內含有防凍液或防銹劑，可不必更換。 (X)8.儀錶板上的「燃油油量錶」之指針高度，已經降低至「E」點，橘色的「低油料警示燈」點亮時，不必急著加油，到達目的地後再行補充燃油即可。 (X)9.有安全氣囊裝備的汽車，不必繫安全帶。 (X)10.煞車時有異音，是正常的情況，不必檢修。 (X)11.汽車定期檢驗不必檢驗車輛故障標誌，所以隨車不一定要帶車輛故障標誌。 (X)12.開車時不必理會義交之指揮，一切以號誌為主。 (X)13.汽車經過隧道，因隧道內燈光明亮視線良好，為省電可不必開亮頭燈。 (X)14.駕駛人只求技術優良，對遵守交通規則不必太重視。 (X)15.在開車前，不必檢查機件，以免耽誤行車時間。 (X)16.遇幼童專用車、校車、身心障礙者用特製車或教練車，不必禮讓。 (X)17.行車不必攜帶隨車工具。 (X)18.行車起駛前進，不必顯示方向燈。 (X)19.汽車通過鐵路平交道，前後兩車間，不必保持距離。 (X)20.夜間將車輛停放在無燈光設備及照明不清之道路時，亦不必顯示停車燈光或反光標識。 (X)21.在夜間或有霧靄、雨雪、風沙及晝晦時，把車輛停在路旁，不必顯示停車燈光或反光標識。 (X)22.汽車駕駛人，僅需具有優良駕駛技術，不需具備急救的常識和技能。 (X)23.汽車車身、引擎、底盤、電系等重要設備變更或調換時，不需向公路主管機關申請臨時檢驗。

閱讀完整內容

搜尋此網誌

第25個冬天

Secure Code Warrior_.Net Core 資安練習_LDAP注入

留言

張貼留言

這個網誌中的熱門文章

何謂淨重(Net Weight)、皮重(Tare Weight)與毛重(Gross Weight)

Architecture(架構) 和 Framework(框架) 有何不同?_軟體設計前的事前規劃的藍圖概念

(2021年度)駕訓學科筆試準備題庫歸納分析_法規是非題