From ddac10d204b8ee0d612085633c05b06d47fb52a7 Mon Sep 17 00:00:00 2001
From: "pixeebot[bot]" <104101892+pixeebot[bot]@users.noreply.github.com>
Date: Thu, 20 Jun 2024 03:43:01 +0000
Subject: [PATCH] (CodeQL) Sets `requireSSL` attribute to true on `forms` and
 `httpCookies`.

---
 WebGoat/Web.config | 145 ++++++++++++++++++++++++---------------------
 1 file changed, 76 insertions(+), 69 deletions(-)

diff --git a/WebGoat/Web.config b/WebGoat/Web.config
index ed1e0ab0..2eeff29b 100644
--- a/WebGoat/Web.config
+++ b/WebGoat/Web.config
@@ -1,4 +1,4 @@
-<?xml version="1.0"?>
+<?xml version="1.0" encoding="utf-8"?>
 <!--
 Web.config file for DotNetGoat.
 
@@ -8,131 +8,137 @@ http://msdn2.microsoft.com/en-us/library/b5ysx397.aspx
 -->
 <configuration>
   <configSections>
-    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
+    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net"></section>
     <sectionGroup name="system.web.extensions" type="System.Web.Configuration.SystemWebExtensionsSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
       <sectionGroup name="scripting" type="System.Web.Configuration.ScriptingSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
-        <section name="scriptResourceHandler" type="System.Web.Configuration.ScriptingScriptResourceHandlerSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication" />
+        <section name="scriptResourceHandler" type="System.Web.Configuration.ScriptingScriptResourceHandlerSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"></section>
         <sectionGroup name="webServices" type="System.Web.Configuration.ScriptingWebServicesSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
-          <section name="jsonSerialization" type="System.Web.Configuration.ScriptingJsonSerializationSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="Everywhere" />
-          <section name="profileService" type="System.Web.Configuration.ScriptingProfileServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication" />
-          <section name="authenticationService" type="System.Web.Configuration.ScriptingAuthenticationServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication" />
-          <section name="roleService" type="System.Web.Configuration.ScriptingRoleServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication" />
+          <section name="jsonSerialization" type="System.Web.Configuration.ScriptingJsonSerializationSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="Everywhere"></section>
+          <section name="profileService" type="System.Web.Configuration.ScriptingProfileServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"></section>
+          <section name="authenticationService" type="System.Web.Configuration.ScriptingAuthenticationServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"></section>
+          <section name="roleService" type="System.Web.Configuration.ScriptingRoleServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"></section>
         </sectionGroup>
       </sectionGroup>
     </sectionGroup>
   </configSections>
   <log4net debug="true">
     <appender name="RollingLogFileAppender" type="log4net.Appender.RollingFileAppender">
-      <file value="App_Data/log.txt" />
-      <appendToFile value="true" />
-      <rollingStyle value="Size" />
-      <maxSizeRollBackups value="10" />
-      <maximumFileSize value="10MB" />
-      <staticLogFileName value="true" />
+      <file value="App_Data/log.txt"></file>
+      <appendToFile value="true"></appendToFile>
+      <rollingStyle value="Size"></rollingStyle>
+      <maxSizeRollBackups value="10"></maxSizeRollBackups>
+      <maximumFileSize value="10MB"></maximumFileSize>
+      <staticLogFileName value="true"></staticLogFileName>
       <layout type="log4net.Layout.PatternLayout">
-        <conversionPattern value="%-5p %d %5rms %-22.22c{1} %-18.18M - %m%n" />
+        <conversionPattern value="%-5p %d %5rms %-22.22c{1} %-18.18M - %m%n"></conversionPattern>
       </layout>
     </appender>
     <root>
-      <level value="DEBUG" />
-      <appender-ref ref="RollingLogFileAppender" />
+      <level value="DEBUG"></level>
+      <appender-ref ref="RollingLogFileAppender"></appender-ref>
     </root>
   </log4net>
   <system.web>
     <!-- this disables header checking -->
-    <httpRuntime enableHeaderChecking="false" />
+
+    <httpRuntime enableHeaderChecking="false"></httpRuntime>
     <!-- this is how you would set secure and http only on session cookies -->
-    <httpCookies httpOnlyCookies="false" requireSSL="false" />
+
+    <httpCookies httpOnlyCookies="false" requireSSL="true"></httpCookies>
     <compilation defaultLanguage="C#" debug="true">
       <assemblies>
         <!--add assembly="System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /-->
-        <add assembly="Mono.Data.Sqlite, Version=2.0.0.0, Culture=neutral, PublicKeyToken=0738eb9f132ed756" />
+
+        <add assembly="Mono.Data.Sqlite, Version=2.0.0.0, Culture=neutral, PublicKeyToken=0738eb9f132ed756"></add>
       </assemblies>
     </compilation>
     <!-- show detailed error messages -->
-    <customErrors mode="Off" />
+
+    <customErrors mode="Off"></customErrors>
     <!-- set up users -->
+
     <authentication mode="Forms">
-      <forms name="customer_login" timeout="30" loginUrl="~/WebGoatCoins/CustomerLogin.aspx" requireSSL="false" protection="All" path="/">
+      <forms name="customer_login" timeout="30" loginUrl="~/WebGoatCoins/CustomerLogin.aspx" requireSSL="true" protection="All" path="/">
         <credentials passwordFormat="Clear">
-          <user name="admin" password="admin" />
-          <user name="mario" password="luigi" />
-          <user name="bob" password="password" />
+          <user name="admin" password="admin"></user>
+          <user name="mario" password="luigi"></user>
+          <user name="bob" password="password"></user>
         </credentials>
       </forms>
     </authentication>
     <authorization>
-      <allow users="*" />
+      <allow users="*"></allow>
     </authorization>
     <httpHandlers>
-      <remove verb="*" path="*.asmx" />
-      <add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
-      <add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
-      <add verb="GET,HEAD" path="ScriptResource.axd" validate="false" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
+      <remove verb="*" path="*.asmx"></remove>
+      <add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
+      <add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
+      <add verb="GET,HEAD" path="ScriptResource.axd" validate="false" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
     </httpHandlers>
-    <trace enabled="false" localOnly="true" pageOutput="false" requestLimit="10" traceMode="SortByTime" />
-    <sessionState mode="InProc" cookieless="false" timeout="20000" />
+    <trace enabled="false" localOnly="true" pageOutput="false" requestLimit="10" traceMode="SortByTime"></trace>
+    <sessionState mode="InProc" cookieless="false" timeout="20000"></sessionState>
     <!-- setting cookieless = true breaks app -->
-    <globalization requestEncoding="utf-8" responseEncoding="utf-8" />
+
+    <globalization requestEncoding="utf-8" responseEncoding="utf-8"></globalization>
     <pages styleSheetTheme="Default">
       <namespaces>
-        <clear />
-        <add namespace="System" />
-        <add namespace="System.Collections" />
-        <add namespace="System.Collections.Generic" />
-        <add namespace="System.Collections.Specialized" />
-        <add namespace="System.Configuration" />
-        <add namespace="System.Text" />
-        <add namespace="System.Text.RegularExpressions" />
-        <add namespace="System.Web" />
-        <add namespace="System.Web.Caching" />
-        <add namespace="System.Web.SessionState" />
-        <add namespace="System.Web.Security" />
-        <add namespace="System.Web.Profile" />
-        <add namespace="System.Web.UI" />
-        <add namespace="System.Web.UI.WebControls" />
-        <add namespace="System.Web.UI.WebControls.WebParts" />
-        <add namespace="System.Web.UI.HtmlControls" />
+        <clear></clear>
+        <add namespace="System"></add>
+        <add namespace="System.Collections"></add>
+        <add namespace="System.Collections.Generic"></add>
+        <add namespace="System.Collections.Specialized"></add>
+        <add namespace="System.Configuration"></add>
+        <add namespace="System.Text"></add>
+        <add namespace="System.Text.RegularExpressions"></add>
+        <add namespace="System.Web"></add>
+        <add namespace="System.Web.Caching"></add>
+        <add namespace="System.Web.SessionState"></add>
+        <add namespace="System.Web.Security"></add>
+        <add namespace="System.Web.Profile"></add>
+        <add namespace="System.Web.UI"></add>
+        <add namespace="System.Web.UI.WebControls"></add>
+        <add namespace="System.Web.UI.WebControls.WebParts"></add>
+        <add namespace="System.Web.UI.HtmlControls"></add>
       </namespaces>
       <controls>
-        <add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
-        <add tagPrefix="asp" namespace="System.Web.UI.WebControls" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
+        <add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
+        <add tagPrefix="asp" namespace="System.Web.UI.WebControls" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
       </controls>
     </pages>
   </system.web>
   <system.codedom>
     <compilers>
       <compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CSharp.CSharpCodeProvider,System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" warningLevel="4">
-        <providerOption name="CompilerVersion" value="v3.5" />
-        <providerOption name="WarnAsError" value="false" />
+        <providerOption name="CompilerVersion" value="v3.5"></providerOption>
+        <providerOption name="WarnAsError" value="false"></providerOption>
       </compiler>
     </compilers>
   </system.codedom>
   <system.webServer>
-    <validation validateIntegratedModeConfiguration="false" />
+    <validation validateIntegratedModeConfiguration="false"></validation>
     <modules>
-      <remove name="ScriptModule" />
-      <add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
+      <remove name="ScriptModule"></remove>
+      <add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
     </modules>
     <handlers>
-      <remove name="WebServiceHandlerFactory-Integrated" />
-      <remove name="ScriptHandlerFactory" />
-      <remove name="ScriptHandlerFactoryAppServices" />
-      <remove name="ScriptResource" />
-      <add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
-      <add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
-      <add name="ScriptResource" verb="GET,HEAD" path="ScriptResource.axd" preCondition="integratedMode" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
+      <remove name="WebServiceHandlerFactory-Integrated"></remove>
+      <remove name="ScriptHandlerFactory"></remove>
+      <remove name="ScriptHandlerFactoryAppServices"></remove>
+      <remove name="ScriptResource"></remove>
+      <add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
+      <add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
+      <add name="ScriptResource" verb="GET,HEAD" path="ScriptResource.axd" preCondition="integratedMode" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"></add>
     </handlers>
   </system.webServer>
   <runtime>
     <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
       <dependentAssembly>
-        <assemblyIdentity name="System.Web.Extensions" publicKeyToken="31bf3856ad364e35" />
-        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0" />
+        <assemblyIdentity name="System.Web.Extensions" publicKeyToken="31bf3856ad364e35"></assemblyIdentity>
+        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0"></bindingRedirect>
       </dependentAssembly>
       <dependentAssembly>
-        <assemblyIdentity name="System.Web.Extensions.Design" publicKeyToken="31bf3856ad364e35" />
-        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0" />
+        <assemblyIdentity name="System.Web.Extensions.Design" publicKeyToken="31bf3856ad364e35"></assemblyIdentity>
+        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0"></bindingRedirect>
       </dependentAssembly>
     </assemblyBinding>
   </runtime>
@@ -161,11 +167,12 @@ http://msdn2.microsoft.com/en-us/library/b5ysx397.aspx
         </system.web>
     </location>
     -->
+
   <location path="Content/VerbTamperingAttack.aspx">
     <system.web>
       <authorization>
-        <allow verbs="GET" users="Admin" />
-        <deny verbs="POST,GET" users="*" />
+        <allow verbs="GET" users="Admin"></allow>
+        <deny verbs="POST,GET" users="*"></deny>
       </authorization>
     </system.web>
   </location>