diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json new file mode 100644 index 000000000..940cbb116 --- /dev/null +++ b/.devcontainer/devcontainer-lock.json @@ -0,0 +1,52 @@ +{ + "features": { + "ghcr.io/devcontainers-extra/features/terraform-docs:1": { + "version": "1.0.6", + "resolved": "ghcr.io/devcontainers-extra/features/terraform-docs@sha256:06dd6e80f0608d3715d40b60d409c4bbcbcd08c8ac1b6b0cc36860e07c08972c", + "integrity": "sha256:06dd6e80f0608d3715d40b60d409c4bbcbcd08c8ac1b6b0cc36860e07c08972c" + }, + "ghcr.io/devcontainers/features/common-utils:2": { + "version": "2.5.9", + "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a", + "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a" + }, + "ghcr.io/devcontainers/features/docker-in-docker:4.1.0": { + "version": "4.1.0", + "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7", + "integrity": "sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7" + }, + "ghcr.io/devcontainers/features/git:1": { + "version": "1.3.8", + "resolved": "ghcr.io/devcontainers/features/git@sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2", + "integrity": "sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2" + }, + "ghcr.io/devcontainers/features/github-cli:1": { + "version": "1.1.2", + "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805", + "integrity": "sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805" + }, + "ghcr.io/devcontainers/features/go:1": { + "version": "1.3.4", + "resolved": "ghcr.io/devcontainers/features/go@sha256:d85e921f91b41340055bb12b325d9d551170ed04b3b832e33530bf42f167c032", + "integrity": "sha256:d85e921f91b41340055bb12b325d9d551170ed04b3b832e33530bf42f167c032" + }, + "ghcr.io/devcontainers/features/node:2": { + "version": "2.1.0", + "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857", + "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857" + }, + "ghcr.io/devcontainers/features/python:1": { + "version": "1.8.0", + "resolved": "ghcr.io/devcontainers/features/python@sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511", + "integrity": "sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511" + }, + "ghcr.io/devcontainers/features/terraform:1.5.0": { + "version": "1.5.0", + "resolved": "ghcr.io/devcontainers/features/terraform@sha256:bc9eaf21aaba050bace59f411c282cb58058535a48232c059e60c19f86caa8f5", + "integrity": "sha256:bc9eaf21aaba050bace59f411c282cb58058535a48232c059e60c19f86caa8f5", + "dependsOn": [ + "ghcr.io/devcontainers/features/github-cli:1" + ] + } + } +} diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 000000000..a3a6afa39 --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,72 @@ +{ + "name": "OWASP WrongSecrets (Java 26 & Node.js 26 Dev Container)", + "image": "eclipse-temurin:26-jdk-resolute", //resolute + "features": { + "ghcr.io/devcontainers/features/node:2": { + "version": "26", + "npmVersion": "11.19.0" + }, + "ghcr.io/devcontainers/features/python:1": { + "version": "3.12" + }, + "ghcr.io/devcontainers/features/terraform:1.5.0": { + "version": "latest", + "tflint": "latest" + }, + "ghcr.io/devcontainers-extra/features/terraform-docs:1": {}, + "ghcr.io/devcontainers/features/docker-in-docker:4.1.0": { + "enableOnStartup": true, + "version": "latest", + "moby": false + }, + "ghcr.io/devcontainers/features/go:1": { + "version": "1.22" + }, + "ghcr.io/devcontainers/features/git:1": {}, + "ghcr.io/devcontainers/features/common-utils:2": { + "installZsh": true, + "configureZshAsDefaultShell": true + } + }, + "containerEnv": { + "DEVCONTAINER_SECRET": "WSECR-devcontainer-token-774921" + }, + "forwardPorts": [8080, 8090], + "portsAttributes": { + "8080": { + "label": "WrongSecrets Web UI", + "onAutoForward": "notify" + }, + "8090": { + "label": "WrongSecrets Vault UI", + "onAutoForward": "silent" + } + }, + "customizations": { + "vscode": { + "extensions": [ + "vscjava.vscode-java-pack", + "ms-azuretools.vscode-docker", + "redhat.vscode-yaml", + "redhat.vscode-xml", + "eamodio.gitlens", + "dbaeumer.vscode-eslint", + "esbenp.prettier-vscode", + "asciidoctor.asciidoctor-vscode", + "hashicorp.terraform" + ], + "settings": { + "java.configuration.runtimes": [ + { + "name": "JavaSE-26", + "path": "/opt/java/openjdk", + "default": true + } + ], + "java.compile.nullAnalysis.mode": "automatic" + } + } + }, + "postCreateCommand": "chmod +x ./mvnw && ./mvnw dependency:resolve -DskipTests && npm install && pip install pre-commit && pre-commit install && pre-commit install --hook-type commit-msg", + "remoteUser": "root" +} diff --git a/.github/workflows/github-pages-preview.yml b/.github/workflows/github-pages-preview.yml index 2309c0063..2c689cf4c 100644 --- a/.github/workflows/github-pages-preview.yml +++ b/.github/workflows/github-pages-preview.yml @@ -14,7 +14,7 @@ permissions: id-token: write pull-requests: write -# Allow only one concurrent deployment per PR, but allow multiple PRs to deploy simultaneously +# Allow only one concurrent deployment per PR, but allow multiple PRs to deploy concurrency: group: "pages-pr-${{ github.event.number }}" cancel-in-progress: true @@ -22,11 +22,10 @@ concurrency: env: NVD_API_KEY: ${{ secrets.NVD_API_KEY }} - jobs: generate-static-preview: runs-on: ubuntu-latest - if: github.event.action != 'closed' + if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }}pr-${{ github.event.number }}/ diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml index 01ac11b13..5b567570b 100644 --- a/.github/workflows/pr-preview.yml +++ b/.github/workflows/pr-preview.yml @@ -20,7 +20,7 @@ env: jobs: build-preview: runs-on: ubuntu-latest - if: github.event.action != 'closed' + if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository outputs: image-tag: ${{ steps.meta.outputs.tags }} image-digest: ${{ steps.build.outputs.digest }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 415e305f6..7fbdce32c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -165,6 +165,40 @@ Pull requests should be as small/atomic as possible. Large, wide-sweeping change ## How to set up your Contributor Environment +### Using Dev Containers (Zero Local Dependencies) + +The project includes a fully configured Dev Container for **VS Code** and **GitHub Codespaces**. You do not need to install Java, Maven, Node.js, Python, or Terraform tools locally on your machine—everything is self-contained inside the Dev Container. + +The Dev Container environment automatically provides: +- **JDK 26** & **Maven Wrapper** (`./mvnw`) +- **Node.js 26** & **npm** (for commitlint, ESLint, and frontend build) +- **Python 3** & **pre-commit** hooks +- **Terraform**, **tflint**, and **terraform-docs** (for pre-commit validation) +- **Docker-in-Docker** (for running Docker-based challenge environments) +- Pre-configured VS Code extensions and settings + +#### 1. Open in Dev Container +- **In VS Code**: Press `Ctrl+Shift+P` (or `Cmd+Shift+P` on macOS) -> select **"Dev Containers: Reopen in Container"** (or click the prompt in the bottom-left corner). +- **In GitHub Codespaces**: Select **Code** -> **Codespaces** -> **Create codespace on this branch**. + +*(The container automatically installs all dependencies, configures pre-commit hooks, and runs dependency resolution on launch).* + +#### 2. Build and Test the Application +Inside the Dev Container integrated terminal, run: + +```bash +# Compile and run tests +./mvnw clean compile test + +# Start the application +./mvnw spring-boot:run + +# Run pre-commit checks across all files +pre-commit run --all-files +``` + +### Manual Setup + 1. Create a GitHub account. Multiple different GitHub subscription plans are available, but you only need a free one. Follow [these steps](https://help.github.com/en/articles/signing-up-for-a-new-github-account "Signing up for a new GitHub account") to set up your account. 2. Fork the repository. Creating a fork means creating a copy of the repository on your own account, which you can modify without any impact on this repository. GitHub has an [article that describes all the needed steps](https://help.github.com/en/articles/fork-a-repo "Fork a repo"). 3. Clone your own repository to your host computer so that you can make modifications. If you followed the GitHub tutorial from step 2, you have already done this. diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge71.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge71.java new file mode 100644 index 000000000..9673bbc2b --- /dev/null +++ b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge71.java @@ -0,0 +1,27 @@ +package org.owasp.wrongsecrets.challenges.docker; + +import org.owasp.wrongsecrets.challenges.FixedAnswerChallenge; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.stereotype.Component; + +/** Challenge for finding secrets leaked in Dev Container configurations and environments. */ +@Component +public class Challenge71 extends FixedAnswerChallenge { + + private final String devcontainerSecret; + + /** + * Constructor for creating a new Challenge71 object. + * + * @param devcontainerSecret The secret configured in the Dev Container environment. + */ + public Challenge71( + @Value("${DEVCONTAINER_SECRET:WSECR-devcontainer-token-774921}") String devcontainerSecret) { + this.devcontainerSecret = devcontainerSecret; + } + + @Override + public String getAnswer() { + return this.devcontainerSecret; + } +} diff --git a/src/main/resources/challenges/challenge-71/challenge-71.snippet b/src/main/resources/challenges/challenge-71/challenge-71.snippet new file mode 100644 index 000000000..3fe81c7a1 --- /dev/null +++ b/src/main/resources/challenges/challenge-71/challenge-71.snippet @@ -0,0 +1,20 @@ +
+

🐳 Dev Container Configuration Inspector

+

Development containers allow teams to share reproducible development environments. However, committing hardcoded environment variables or secrets into .devcontainer/devcontainer.json can expose sensitive credentials to anyone with repository access.

+ +
+ // .devcontainer/devcontainer.json excerpt
+ {
+   "name": "OWASP WrongSecrets (Java 26 & Node.js 26 Dev Container)",
+   "image": "eclipse-temurin:26-jdk-jammy",
+   "containerEnv": {
+     "DEVCONTAINER_SECRET": "WSECR-devcontainer-token-774921"
+   },
+   "postCreateCommand": "chmod +x ./mvnw && ./mvnw dependency:resolve -DskipTests && npm install && pip install pre-commit && pre-commit install"
+ } +
+ +
+ 💡 Tip: Check the DEVCONTAINER_SECRET environment variable defined in the Dev Container configuration. +
+
diff --git a/src/main/resources/explanations/challenge71.adoc b/src/main/resources/explanations/challenge71.adoc new file mode 100644 index 000000000..ac05004e6 --- /dev/null +++ b/src/main/resources/explanations/challenge71.adoc @@ -0,0 +1,11 @@ +=== Dev Container Secret Leak + +Development containers (Dev Containers) allow teams to define reproducible development environments using containerization tools like VS Code Remote - Containers and GitHub Codespaces. By encapsulating tools, runtimes, and dependencies within `.devcontainer/devcontainer.json`, developers can get started without installing complex local software stacks. + +However, developers frequently make the mistake of embedding sensitive tokens, passwords, API keys, or private registry access credentials directly into `.devcontainer/devcontainer.json` (such as in `containerEnv`, `remoteEnv`, or lifecycle scripts) and committing them to version control. + +To solve this challenge: + +. Inspect the `.devcontainer/devcontainer.json` configuration file in the project repository or review the configuration snippet in the UI. +. Identify the leaked `DEVCONTAINER_SECRET` or token defined in the container environment. +. Submit the discovered secret in the input field below. diff --git a/src/main/resources/explanations/challenge71_hint.adoc b/src/main/resources/explanations/challenge71_hint.adoc new file mode 100644 index 000000000..4a89c8cd9 --- /dev/null +++ b/src/main/resources/explanations/challenge71_hint.adoc @@ -0,0 +1,10 @@ +You can solve this challenge using the following steps: + +1. Inspect the Dev Container configuration file: +- Open the `.devcontainer/devcontainer.json` file in the root of the repository. +- Look for the `containerEnv` or `remoteEnv` sections where environment variables are defined. + +2. Inspect the running container environment: +- If running inside a dev container or Docker container, check the environment variables with `printenv DEVCONTAINER_SECRET` or `echo $DEVCONTAINER_SECRET`. + +3. Review the UI snippet provided on this challenge page for the exposed configuration. diff --git a/src/main/resources/explanations/challenge71_reason.adoc b/src/main/resources/explanations/challenge71_reason.adoc new file mode 100644 index 000000000..5b287c2e9 --- /dev/null +++ b/src/main/resources/explanations/challenge71_reason.adoc @@ -0,0 +1,16 @@ += Dev Container Configuration Secret Exposure + +*Why Hardcoding Secrets in Dev Containers is a Critical Security Risk* + +Dev Containers are shared development environments configured via `.devcontainer/devcontainer.json`. Because these files are typically tracked in version control, hardcoding secrets into devcontainer definitions presents several security dangers: + +1. **Exposure to All Repository Readers**: Anyone with read access to the source repository (or public forks and clones in open-source projects) can read secrets hardcoded in `.devcontainer/devcontainer.json`. +2. **Environment Variable Leakage**: Credentials defined in `containerEnv` or `remoteEnv` are injected into every process inside the container, making them accessible to any script, child process, or diagnostic tool running in the container. +3. **Persistent in Git History**: Once committed, removing the secret requires git history rewrites, and stale keys often remain valid indefinitely if rotation is not performed. + +*Remediation and Best Practices:* + +- **Use GitHub Codespaces Secrets / VS Code Dev Container Secrets**: Inject secrets dynamically via Codespaces repository/user secrets or VS Code settings rather than hardcoding them in configuration files. +- **Use Local Environment Substitution**: Reference host environment variables dynamically in `devcontainer.json` using `${localEnv:MY_SECRET}` syntax. +- **Use `.env` files with `.gitignore`**: Place development secrets in local `.env` files that are explicitly excluded from version control in `.gitignore`. +- **Adopt Secret Management Solutions**: Fetch secrets at runtime using dedicated secret managers (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager). diff --git a/src/main/resources/wrong-secrets-configuration.yaml b/src/main/resources/wrong-secrets-configuration.yaml index 9b88ec387..1c7eff993 100644 --- a/src/main/resources/wrong-secrets-configuration.yaml +++ b/src/main/resources/wrong-secrets-configuration.yaml @@ -1040,6 +1040,7 @@ configurations: category: *ai ctf: enabled: true + - name: Challenge 70 short-name: "challenge-70" sources: @@ -1053,3 +1054,17 @@ configurations: category: *ai ctf: enabled: true + + - name: Challenge 71 + short-name: "challenge-71" + sources: + - class-name: "org.owasp.wrongsecrets.challenges.docker.Challenge71" + explanation: "explanations/challenge71.adoc" + hint: "explanations/challenge71_hint.adoc" + reason: "explanations/challenge71_reason.adoc" + ui-snippet: "challenges/challenge-71/challenge-71.snippet" + environments: *all_envs + difficulty: *easy + category: *docker_tech + ctf: + enabled: true diff --git a/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge71Test.java b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge71Test.java new file mode 100644 index 000000000..ca9fbae31 --- /dev/null +++ b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge71Test.java @@ -0,0 +1,32 @@ +package org.owasp.wrongsecrets.challenges.docker; + +import static org.assertj.core.api.Assertions.assertThat; + +import org.junit.jupiter.api.Test; +import org.owasp.wrongsecrets.challenges.Spoiler; + +class Challenge71Test { + + private static final String DEFAULT_SECRET = "WSECR-devcontainer-token-774921"; + + @Test + void spoilerShouldRevealAnswer() { + var challenge = new Challenge71(DEFAULT_SECRET); + + assertThat(challenge.spoiler()).isEqualTo(new Spoiler(DEFAULT_SECRET)); + } + + @Test + void rightAnswerShouldSolveChallenge() { + var challenge = new Challenge71(DEFAULT_SECRET); + + assertThat(challenge.answerCorrect(DEFAULT_SECRET)).isTrue(); + } + + @Test + void incorrectAnswerShouldNotSolveChallenge() { + var challenge = new Challenge71(DEFAULT_SECRET); + + assertThat(challenge.answerCorrect("wrong-secret-token")).isFalse(); + } +}