Notes

Accessibility information
This page has four areas: A sidebar with information about the challenge, a tree view “File Explorer” containing the project files, a “Code blocks” section with a list of code blocks relevant to the challenge, and a code viewer section. The code viewer section has two groups of toggle buttons at the top, to select and compare the vulnerable code with possible solutions. One group selects the code comparison base and the other selects a solution to submit as an answer. Below those are tabs displaying opened files, with the currently opened file presented in a table. The presentation of the code viewer table depends on the ‘inline diff view’ option under editor settings. If unchecked, the table has 5 columns: Code block indicator, two for line number and code of the selected comparison base, and two for the line number and code of the selected solution variation. If ‘inline diff’ is checked, the table has 4 columns: Code block indicator, line number for the code from the comparison base, line number for the code from the selected solution, and a column with the code itself. In both presentations the code block indicator is only present in the first line of a code block and only if ‘vulnerable code’ is the current comparison base. Each line of code within a code block is prefixed with ‘CBX’, where X is a number used to distinguish between code blocks. Deleted code lines are prefixed with a ‘-’ symbol, and added lines with a ‘+’ symbol. Opening category information, pressing the hints or submit buttons will open a modal dialog.

Skip to Code Editor
Identify the vulnerability
Fix the vulnerability
Fix the vulnerability
Find and select the solution that fixes the vulnerability listed below. Each solution may take a different approach to address the problem, but only one solution is correct.

Vulnerability Category
Access Control - Missing Object Level Access Control

Actions
Attempts left: 1

View shortcuts keyboard hotkey:?

File Explorer
Highlighted files only: 139 files hidden


EmployeeAccessPlatform1 code blocks
Domain1 code blocks
Services1 code blocks
*PassService.cs1 code blocks
1
Code blocks
PassService.cs:42-62
Comparison baseComparison base
Selected solutionSelected solution
using Domain.Data.Entities;
using Domain.Data.Repositories;
using Domain.Enums;
using Domain.Exceptions;
using Domain.Models.DomainObjects;
using Domain.Models.RequestModels;
using Domain.Models.ResponseModels;
using Domain.Utilities;
using Shared.Models;
using Shared.Services;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;

namespace Domain.Services
{
public class PassService : BaseService, IPassService
{
private readonly PassRepository _passRepository;
private readonly PassCreationRequestRepository _passCreationRequestRepository;
private readonly UserRepository _userRepository;
private readonly ReportRepository _reportRepository;
private readonly AppLogger _appLogger;

private static string FilesFolder => Environment.GetEnvironmentVariable("FilesFolder");

public PassService(
AppLogger appLogger,
PassRepository passRepository,
PassCreationRequestRepository passCreationRequestRepository,
ReportRepository reportRepository,
UserRepository userRepository) : base(appLogger)
{
_passRepository = passRepository;
_passCreationRequestRepository = passCreationRequestRepository;
_userRepository = userRepository;
_reportRepository = reportRepository;
_appLogger = appLogger;
}

public Response<string> CreateToken(Guid passId, Guid userId)
{
Func<string> action = delegate
{
_appLogger.LogInfo($"Pass token creation begin.nUserId: {userId}nPassId: {passId}");
var passEntity = _passRepository.FindById(passId);
if (passEntity == null)
{
_appLogger.LogInfo($"Pass not found.nUserId: {userId}nPassId: {passId}");
throw new DomainException("Pass not found");
}
var personEntity = _userRepository.FindById(userId).Person;
_appLogger.LogInfo($"The user with ID '{userId}' " +
$"creates a pass token.nUserId: {userId}nPassId: {passId}");
var tokenGenerator = new PassTokenGenerator();
var token = tokenGenerator.CreateToken(passEntity);
_appLogger.LogInfo($"Pass token creation end.nUserId: {userId}nPassId: {passId}");
return token;
};
return Handle(action);
}

public Response<ICollection<FactoryPass>> FindAwaitablePassRequests()
{
Func<ICollection<FactoryPass>> action = delegate
{
var passCreationRequests = _passCreationRequestRepository.
FindByStatus(ConfirmationStatus.AwaitReview)
?? new List<PassCreationRequestEntity>();
return passCreationRequests
.Select(passEntity => new FactoryPass
{
Id = passEntity.Id,
ConfirmationStatus = passEntity.ConfirmationStatus,
Rooms = passEntity.RequestedRooms,
StartDate = passEntity.StartDate,
ValidUntil = passEntity.ValidUntil
})
.ToList();
};
return Handle(action);
}

public Response<ICollection<FactoryPass>> GetUserPasses(Guid userId)
{
Func<ICollection<FactoryPass>> action = delegate
{
var person = _userRepository.FindById(userId).Person;
return _passRepository.GetPersonPasses(person.Id)
.Select(passEntity => new FactoryPass
{
Id = passEntity.Id,
StartDate = passEntity.StartDate,
ValidUntil = passEntity.ValidUntil,
ConfirmationStatus = ConfirmationStatus.Confirmed,
Rooms = passEntity.AllowedRooms
})
.ToList();
};
return Handle(action);
}

public Response<bool> ValidateTokenAccess(
string token,
string roomIdentifier)
{
Func<bool> action = delegate
{
_appLogger.LogInfo($"The '{roomIdentifier}' begin to validate the pass token.");
var tokenGenerator = new PassTokenGenerator();
try
{
var passToken = tokenGenerator.DecryptToken(token);
if (passToken.Rooms.Contains(roomIdentifier))
{
_appLogger.LogInfo($"The '{roomIdentifier}' allowed " +
$"person with ID: {passToken.PersonId} to be accessed");
return true;
}
_appLogger.LogInfo($"The person with ID " +
$"'{passToken.PersonId}' wasn't accepted to the '{roomIdentifier}'.");
}
catch
{
_appLogger.LogInfo("The user's provided token was not validated");
}
throw new DomainException("Access denied");
};
return Handle(action);
}

public Response<Guid> MakeRequest(PassRequestCreationRequest passCreatingRequest)
{
Func<Guid> action = delegate
{
_appLogger.LogInfo($"The user request a new pass.nUserId: {passCreatingRequest.UserId}");
var factoryPassSerializer = new FactoryPassSerializer();
PassRequestingModel passRequest;
try
{
_appLogger.LogInfo($"The pass creation request data " +
$"deserialization is began.nUserId: {passCreatingRequest.UserId}");
passRequest = factoryPassSerializer.Deserialize(
passCreatingRequest.PassCreatingData);
_appLogger.LogInfo($"The pass creation request data " +
$"deserialization is done successfully.nUserId: {passCreatingRequest.UserId}");
}
catch (Exception e)
{
_appLogger.LogWarning($"Wrong pass creation request " +
$"data provided by the User with ID: '{passCreatingRequest.UserId}'", e);
throw new DomainException("Wrong pass creation request data");
}
var userDetails = _userRepository.FindById(passCreatingRequest.UserId);
var passRequestEntity = new PassCreationRequestEntity
{
Id = Guid.NewGuid(),
ConfirmationStatus = ConfirmationStatus.AwaitReview,
Description = passRequest.Description,
StartDate = passRequest.StartDate,
ValidUntil = passRequest.ValidUntil,
PersonId = userDetails.Person.Id,
RequestedRooms = passRequest.RequestedRooms
};
_passCreationRequestRepository.Add(passRequestEntity);
_appLogger.LogInfo($"The pass creation request data is " +
$"stored in the database.nUserId: {passCreatingRequest.UserId}");
return passRequestEntity.Id;
};
return Handle(action);
}

public Response<Guid> ConfirmPassRequest(PassConfirmationRequest requestModel)
{
Func<Guid> action = delegate
{
_appLogger.LogInfo($"The pass request with ID '{requestModel.PassRequestId}' is being processed.nConfirm: {requestModel.Confirm}");
var passRequestEntity = _passCreationRequestRepository.
FindById(requestModel.PassRequestId);
if (passRequestEntity == null)
{
_appLogger.LogInfo($"The pass request ID '{requestModel.PassRequestId}' not found.");
throw new DomainException("Pass creating request not found");
}
passRequestEntity.ConfirmationStatus = requestModel.Confirm
? ConfirmationStatus.Confirmed
: ConfirmationStatus.Denied;
if (passRequestEntity.ConfirmationStatus == ConfirmationStatus.Confirmed)
{
var factoryPass = new PassEntity
{
Id = Guid.NewGuid(),
AllowedRooms = passRequestEntity.RequestedRooms.ToList(),
StartDate = passRequestEntity.StartDate,
ValidUntil = passRequestEntity.ValidUntil,
PersonId = passRequestEntity.PersonId,
UserDescription = passRequestEntity.Description
};
_appLogger.LogInfo($"The pass with ID '{factoryPass.Id}' for the person with ID '{factoryPass.PersonId}' storing is started.");
_passRepository.SavePass(factoryPass);
_appLogger.LogInfo($"The pass with ID '{factoryPass.Id}' is stored successfully.");
}
_passCreationRequestRepository.Update(passRequestEntity);
_appLogger.LogInfo($"The pass request data with ID '{passRequestEntity.Id}' is updated.");
return passRequestEntity.Id;
};
return Handle(action);
}

public Response<Guid> MakeUserPassesReport(UserPassesRequest request)
{
Func<Guid> action = delegate
{
_appLogger.LogInfo($"Passes report creation is started.nUserId: {request.UserId}nPasses range: {request.StartDate}-{request.EndDate}");
var person = _userRepository.FindById(request.UserId)?.Person;
if (person == null)
{
throw new DomainException("User not found");
}
var userPasses = _passRepository.SearchPersonPasses(person.Id, request.StartDate, request.EndDate);
var fileName = $"{Guid.NewGuid()}.csv";
File.WriteAllLines(
path: Path.Combine(FilesFolder, "SecurityReports", fileName),
contents: userPasses.Select(pass => string.Join(",",
pass.Id,
pass.PersonId,
pass.StartDate,
pass.ValidUntil,
pass.UserDescription,
$""{string.Join(";", pass.AllowedRooms)}"")));
var report = new ReportEntity
{
Id = Guid.NewGuid(),
StartDate = request.StartDate,
EndDate = request.EndDate,
UserId = request.UserId,
FileName = fileName
};
_reportRepository.Add(report);
return report.Id;
};
return Handle(action);
}

public Response<Report> GetReport(DownloadReportRequest model)
{
var reportEntity = _reportRepository.FindById(model.ReportId);
if (reportEntity == null)
{
return new FailedResponse<Report>("Report not found");
}
var report = new Report
{
Filename = reportEntity.FileName,
Content = File.ReadAllBytes(Path.Combine(FilesFolder, "SecurityReports", reportEntity.FileName))
};
return new SuccessResponse<Report>(report);
}
}
}
1

using Domain.Data.Entities;
using Domain.Data.Repositories;
using Domain.Enums;
using Domain.Exceptions;
using Domain.Models.DomainObjects;
using Domain.Models.RequestModels;
using Domain.Models.ResponseModels;
using Domain.Utilities;
using Shared.Models;
using Shared.Services;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;

namespace Domain.Services
{
public class PassService : BaseService, IPassService
{
private readonly PassRepository _passRepository;
private readonly PassCreationRequestRepository _passCreationRequestRepository;
private readonly UserRepository _userRepository;
private readonly ReportRepository _reportRepository;
private readonly AppLogger _appLogger;

private static string FilesFolder => Environment.GetEnvironmentVariable("FilesFolder");

public PassService(
AppLogger appLogger,
PassRepository passRepository,
PassCreationRequestRepository passCreationRequestRepository,
ReportRepository reportRepository,
UserRepository userRepository) : base(appLogger)
{
_passRepository = passRepository;
_passCreationRequestRepository = passCreationRequestRepository;
_userRepository = userRepository;
_reportRepository = reportRepository;
_appLogger = appLogger;
}

public Response<string> CreateToken(Guid passId, Guid userId)
{
Func<string> action = delegate
{
_appLogger.LogInfo($"Pass token creation begin.nUserId: {userId}nPassId: {passId}");
var passEntity = _passRepository.FindById(passId);
if (passEntity == null)
{
_appLogger.LogInfo($"Pass not found.nUserId: {userId}nPassId: {passId}");
throw new DomainException("Pass not found");
}
var personEntity = _userRepository.FindById(userId)?.Person;
if (personEntity == null)
{
throw new DomainException("Forbidden");
}
_appLogger.LogInfo($"The user with ID '{userId}' " +
$"creates a pass token.nUserId: {userId}nPassId: {passId}");
var tokenGenerator = new PassTokenGenerator();
var token = tokenGenerator.CreateToken(passEntity);
_appLogger.LogInfo($"Pass token creation end.nUserId: {userId}nPassId: {passId}");
return token;
};
return Handle(action);
}

public Response<ICollection<FactoryPass>> FindAwaitablePassRequests()
{
Func<ICollection<FactoryPass>> action = delegate
{
var passCreationRequests = _passCreationRequestRepository.
FindByStatus(ConfirmationStatus.AwaitReview)
?? new List<PassCreationRequestEntity>();
return passCreationRequests
.Select(passEntity => new FactoryPass
{
Id = passEntity.Id,
ConfirmationStatus = passEntity.ConfirmationStatus,
Rooms = passEntity.RequestedRooms,
StartDate = passEntity.StartDate,
ValidUntil = passEntity.ValidUntil
})
.ToList();
};
return Handle(action);
}

public Response<ICollection<FactoryPass>> GetUserPasses(Guid userId)
{
Func<ICollection<FactoryPass>> action = delegate
{
var person = _userRepository.FindById(userId).Person;
return _passRepository.GetPersonPasses(person.Id)
.Select(passEntity => new FactoryPass
{
Id = passEntity.Id,
StartDate = passEntity.StartDate,
ValidUntil = passEntity.ValidUntil,
ConfirmationStatus = ConfirmationStatus.Confirmed,
Rooms = passEntity.AllowedRooms
})
.ToList();
};
return Handle(action);
}

public Response<bool> ValidateTokenAccess(
string token,
string roomIdentifier)
{
Func<bool> action = delegate
{
_appLogger.LogInfo($"The '{roomIdentifier}' begin to validate the pass token.");
var tokenGenerator = new PassTokenGenerator();
try
{
var passToken = tokenGenerator.DecryptToken(token);
if (passToken.Rooms.Contains(roomIdentifier))
{
_appLogger.LogInfo($"The '{roomIdentifier}' allowed " +
$"person with ID: {passToken.PersonId} to be accessed");
return true;
}
_appLogger.LogInfo($"The person with ID " +
$"'{passToken.PersonId}' wasn't accepted to the '{roomIdentifier}'.");
}
catch
{
_appLogger.LogInfo("The user's provided token was not validated");
}
throw new DomainException("Access denied");
};
return Handle(action);
}

public Response<Guid> MakeRequest(PassRequestCreationRequest passCreatingRequest)
{
Func<Guid> action = delegate
{
_appLogger.LogInfo($"The user request a new pass.nUserId: {passCreatingRequest.UserId}");
var factoryPassSerializer = new FactoryPassSerializer();
PassRequestingModel passRequest;
try
{
_appLogger.LogInfo($"The pass creation request data " +
$"deserialization is began.nUserId: {passCreatingRequest.UserId}");
passRequest = factoryPassSerializer.Deserialize(
passCreatingRequest.PassCreatingData);
_appLogger.LogInfo($"The pass creation request data " +
$"deserialization is done successfully.nUserId: {passCreatingRequest.UserId}");
}
catch (Exception e)
{
_appLogger.LogWarning($"Wrong pass creation request " +
$"data provided by the User with ID: '{passCreatingRequest.UserId}'", e);
throw new DomainException("Wrong pass creation request data");
}
var userDetails = _userRepository.FindById(passCreatingRequest.UserId);
var passRequestEntity = new PassCreationRequestEntity
{
Id = Guid.NewGuid(),
ConfirmationStatus = ConfirmationStatus.AwaitReview,
Description = passRequest.Description,
StartDate = passRequest.StartDate,
ValidUntil = passRequest.ValidUntil,
PersonId = userDetails.Person.Id,
RequestedRooms = passRequest.RequestedRooms
};
_passCreationRequestRepository.Add(passRequestEntity);
_appLogger.LogInfo($"The pass creation request data is " +
$"stored in the database.nUserId: {passCreatingRequest.UserId}");
return passRequestEntity.Id;
};
return Handle(action);
}

public Response<Guid> ConfirmPassRequest(PassConfirmationRequest requestModel)
{
Func<Guid> action = delegate
{
_appLogger.LogInfo($"The pass request with ID '{requestModel.PassRequestId}' is being processed.nConfirm: {requestModel.Confirm}");
var passRequestEntity = _passCreationRequestRepository.
FindById(requestModel.PassRequestId);
if (passRequestEntity == null)
{
_appLogger.LogInfo($"The pass request ID '{requestModel.PassRequestId}' not found.");
throw new DomainException("Pass creating request not found");
}
passRequestEntity.ConfirmationStatus = requestModel.Confirm
? ConfirmationStatus.Confirmed
: ConfirmationStatus.Denied;
if (passRequestEntity.ConfirmationStatus == ConfirmationStatus.Confirmed)
{
var factoryPass = new PassEntity
{
Id = Guid.NewGuid(),
AllowedRooms = passRequestEntity.RequestedRooms.ToList(),
StartDate = passRequestEntity.StartDate,
ValidUntil = passRequestEntity.ValidUntil,
PersonId = passRequestEntity.PersonId,
UserDescription = passRequestEntity.Description
};
_appLogger.LogInfo($"The pass with ID '{factoryPass.Id}' for the person with ID '{factoryPass.PersonId}' storing is started.");
_passRepository.SavePass(factoryPass);
_appLogger.LogInfo($"The pass with ID '{factoryPass.Id}' is stored successfully.");
}
_passCreationRequestRepository.Update(passRequestEntity);
_appLogger.LogInfo($"The pass request data with ID '{passRequestEntity.Id}' is updated.");
return passRequestEntity.Id;
};
return Handle(action);
}

public Response<Guid> MakeUserPassesReport(UserPassesRequest request)
{
Func<Guid> action = delegate
{
_appLogger.LogInfo($"Passes report creation is started.nUserId: {request.UserId}nPasses range: {request.StartDate}-{request.EndDate}");
var person = _userRepository.FindById(request.UserId)?.Person;
if (person == null)
{
throw new DomainException("User not found");
}
var userPasses = _passRepository.SearchPersonPasses(person.Id, request.StartDate, request.EndDate);
var fileName = $"{Guid.NewGuid()}.csv";
File.WriteAllLines(
path: Path.Combine(FilesFolder, "SecurityReports", fileName),
contents: userPasses.Select(pass => string.Join(",",
pass.Id,
pass.PersonId,
pass.StartDate,
pass.ValidUntil,
pass.UserDescription,
$""{string.Join(";", pass.AllowedRooms)}"")));
var report = new ReportEntity
{
Id = Guid.NewGuid(),
StartDate = request.StartDate,
EndDate = request.EndDate,
UserId = request.UserId,
FileName = fileName
};
_reportRepository.Add(report);
return report.Id;
};
return Handle(action);
}

public Response<Report> GetReport(DownloadReportRequest model)
{
var reportEntity = _reportRepository.FindById(model.ReportId);
if (reportEntity == null)
{
return new FailedResponse<Report>("Report not found");
}
var report = new Report
{
Filename = reportEntity.FileName,
Content = File.ReadAllBytes(Path.Combine(FilesFolder, "SecurityReports", reportEntity.FileName))
};
return new SuccessResponse<Report>(report);
}
}
}
above is question and option 1 i will paste option 2 i will paste