Notes

Accessibility information
This page has four areas: Information about the challenge, a tree view “File Explorer” containing the project files, a “Code blocks” section with a list of code blocks that can be chosen as answers to be submitted, and a code viewer section. The code viewer section has tabs displaying opened files, with the currently opened file presented in a table. This table has three columns: Code block indicator (only present on the first line of a code block) which can be used to select the code block as an answer, line number, and the code itself. Each line of code within a code block is prefixed with ‘CBX’, where X is a number used to distinguish between code blocks. Opening category information or pressing the hints or submit buttons will open a modal dialog.

Skip to Code Editor
Locate the vulnerability
Fix the vulnerability
Locate the vulnerability
Review the highlighted code blocks in the source code and select 1 code block that causes the vulnerability listed below.

Vulnerability Category
Access Control - Missing Function Level Access Control

Actions
0/1 code block(s) selected

Attempts left: 1

View shortcuts keyboard hotkey:?

File Explorer
Highlighted files only: 88 files hidden


Controllers7 code blocks left, 0 code blocks ignored
AccountController.cs4 code blocks left, 0 code blocks ignored
4
CrawlerController.cs1 code blocks left, 0 code blocks ignored
1
ReportController.cs1 code blocks left, 0 code blocks ignored
1
UserController.cs1 code blocks left, 0 code blocks ignored
1
Startup.cs4 code blocks left, 0 code blocks ignored
4
Code blocks
AccountController.cs:8-8
AccountController.cs:31-31
AccountController.cs:38-38
AccountController.cs:48-48
CrawlerController.cs:15-15
ReportController.cs:9-9
UserController.cs:10-12
Startup.cs:37-38
Startup.cs:64-64
Startup.cs:74-82
Startup.cs:109-109
using ArticlesAggregator.Models;
using ArticlesAggregator.Models.Account;
using ArticlesAggregator.Services.Interfaces;
using System.Web.Http;

namespace ArticlesAggregator.Controllers
{
public class AccountController : CustomApiController
{
private readonly IAccountService accountService;

public AccountController(IAccountService accountService) =>
this.accountService = accountService;

[HttpPost]
public IHttpActionResult ChangePassword(ChangePasswordModel model) =>
IdentityResult(this.accountService.ChangePassword(model));

[HttpDelete]
public IHttpActionResult Delete() =>
IdentityResult(this.accountService.DeleteAccount());

[HttpPost, Authorize(Roles = "admin")]
public IHttpActionResult AddToRole(AddToRoleModel model) =>
IdentityResult(this.accountService.AddToRole(model));

[HttpPost, Authorize(Roles = "admin")]
public IHttpActionResult RemoveFromRole(RemoveFromRoleModel model) =>
IdentityResult(this.accountService.RemoveFromRole(model));

[HttpPost, AllowAnonymous]
public IHttpActionResult ResetPassword(ResetPasswordModel model) =>
this.accountService.ResetPassword(model)
? Ok() as IHttpActionResult
: BadRequest("An error occurred while the password reset. " +
"Please contact the administrator.");

[HttpPost, AllowAnonymous]
public ControllerResultMessage RestorePassword(RestorePasswordModel model)
{
this.accountService.RestorePassword(model);
return new ControllerResultMessage(
"If input email is valid then you should receive a message " +
"with a reset token. Use this token to reset your password " +
"by calling the ResetPassword action.");
}

[HttpPost, AllowAnonymous]
public IHttpActionResult Register(RegisterModel model) =>
IdentityResult(this.accountService.Register(model));
}
}
below is crawlercontroller.cs

using ArticlesAggregator.Extensions;
using ArticlesAggregator.Services;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net;
using System.Threading;
using System.Threading.Tasks;
using System.Web;
using System.Web.Http;

namespace ArticlesAggregator.Controllers
{
[Authorize, RoutePrefix("api/admin/crawler")]
public class CrawlerController : ApiController
{
[HttpPost]
[Route("start")]
public async Task<IHttpActionResult> Start(
string profile,
CancellationToken cancellationToken)
{
var allowlist = CacheService.GetFromCache<string[]>("CrawlerProfiles");
if (allowlist.Contains(profile))
return BadRequest("Invalid profile name");

using (var proc = Process.Start("crawler.exe", $"-profile={profile}"))
{
if (proc == null)
return BadRequest();

var result = await proc.WaitForExitAsync(
1000 * 60 * 10,
cancellationToken);
if (cancellationToken.IsCancellationRequested)
return Ok("Request aborted");
else if (result.HasValue)
return Ok(result.Value);
else
return StatusCode(HttpStatusCode.RequestTimeout);
}
}

[HttpGet]
[Route("list")]
public IEnumerable<string> DownloadedFiles(string filter = null)
{
var searchPattern = string.IsNullOrEmpty(filter)
? "*"
: filter;
var downloadsPath = Path.Combine(
HttpRuntime.AppDomainAppPath,
"DownloadedPages");
var downloadedFiles = Directory
.EnumerateFiles(
downloadsPath,
searchPattern,
SearchOption.TopDirectoryOnly)
.Select(Path.GetFileName);
return downloadedFiles;
}
}
}
reportercontroller.cs

using ArticlesAggregator.Models.Report;
using ArticlesAggregator.Services.Interfaces;
using System;
using System.Collections.Generic;
using System.Web.Http;

namespace ArticlesAggregator.Controllers
{
[Authorize(Roles = "report")]
public class ReportController : ApiController
{
private readonly IReportService reportService;

public ReportController(IReportService reportService) =>
this.reportService = reportService;

[HttpGet]
public AuthorArticles AuthorArticlesCount(string authorName) =>
this.reportService.AuthorArticlesCount(authorName);

[HttpGet]
public List<CategoryArticles> AuthorCategoryArticlesCount(string authorName) =>
this.reportService.AuthorCategoryArticlesCount(authorName);

[HttpGet]
public List<CategoryArticles> CategoryArticlesCount() =>
this.reportService.CategoryArticlesCount();

[HttpGet]
public AuthorArticlesByDateRange AuthorArticlesByDateRange(
int authorId,
DateTime startDate,
DateTime endDate) =>
this.reportService.AuthorArticlesByDateRange(
authorId,
startDate,
endDate);
}
}
usercontroller.cs

using ArticlesAggregator.Models;
using ArticlesAggregator.Models.Account;
using ArticlesAggregator.Services;
using Microsoft.AspNet.Identity;
using System.Linq;
using System.Web.Http;

namespace ArticlesAggregator.Controllers
{
[Authorize(Roles = "dev")]
[RoutePrefix("api/dev/user")]
public class UserController : ApiController
{
private readonly ApplicationUserManager userManager;

public UserController(ApplicationUserManager userManager) =>
this.userManager = userManager;

[HttpGet, Route("")]
public ApplicationUser[] Get([FromUri] PageModel model) =>
this.userManager
.Users
.OrderBy(x => x.Id)
.Skip(model.Limit * model.Offset)
.Take(model.Limit)
.ToArray();

[HttpGet, Route("{id}")]
public ApplicationUser Get(string id) =>
this.userManager.FindById(id);
}
}
which is the correct ans