I've built an API using AWS ElasticBeanstalk with integrated EC2 + Postgres RDS, and secured the endpoints with OAuth 2.
I received an email from an independent security auditor with a picture that they were able to gain access to production ENV variables. The ENV variables are managed through Elastic Beanstalk's configuration.
Here's a snippet of the picture they shared, in which they clearly have access to the ENVs:
I'm curious how they were able to view these sensitive env variables.
You are publishing an API on port 80 via PHP with no firewalling or access control.
You are running debugbar on a production site.
Basically, debugbar has very kindly included all of your environment variables in your HTML page.
<head></head><body style="margin-bottom: 38px;">Welcome to the Spywatch Lex Staging API ver 1.0<link rel="stylesheet" type="text/css" property="stylesheet" href="//3.95.51.53/_debugbar/assets/stylesheets?v=1586742726"><script type="text/javascript" src="//3.95.51.53/_debugbar/assets/javascript?v=1586742726"></script><script type="text/javascript">jQuery.noConflict(true);</script>
<script type="text/javascript">
var phpdebugbar = new PhpDebugBar.DebugBar();
phpdebugbar.addTab("messages", new PhpDebugBar.DebugBar.Tab({"icon":"list-alt","title":"Messages", "widget": new PhpDebugBar.Widgets.MessagesWidget()}));
phpdebugbar.addIndicator("time", new PhpDebugBar.DebugBar.Indicator({"icon":"clock-o","tooltip":"Request Duration"}), "right");
phpdebugbar.addTab("timeline", new PhpDebugBar.DebugBar.Tab({"icon":"tasks","title":"Timeline", "widget": new PhpDebugBar.Widgets.TimelineWidget()}));
phpdebugbar.addIndicator("memory", new PhpDebugBar.DebugBar.Indicator({"icon":"cogs","tooltip":"Memory Usage"}), "right");
phpdebugbar.addTab("exceptions", new PhpDebugBar.DebugBar.Tab({"icon":"bug","title":"Exceptions", "widget": new PhpDebugBar.Widgets.ExceptionsWidget()}));
phpdebugbar.addTab("views", new PhpDebugBar.DebugBar.Tab({"icon":"leaf","title":"Views", "widget": new PhpDebugBar.Widgets.TemplatesWidget()}));
phpdebugbar.addTab("route", new PhpDebugBar.DebugBar.Tab({"icon":"share","title":"Route", "widget": new PhpDebugBar.Widgets.VariableListWidget()}));
phpdebugbar.addIndicator("currentroute", new PhpDebugBar.DebugBar.Indicator({"icon":"share","tooltip":"Route"}), "right");
phpdebugbar.addTab("queries", new PhpDebugBar.DebugBar.Tab({"icon":"database","title":"Queries", "widget": new PhpDebugBar.Widgets.LaravelSQLQueriesWidget()}));
phpdebugbar.addTab("emails", new PhpDebugBar.DebugBar.Tab({"icon":"inbox","title":"Mails", "widget": new PhpDebugBar.Widgets.MailsWidget()}));
phpdebugbar.addTab("auth", new PhpDebugBar.DebugBar.Tab({"icon":"lock","title":"Auth", "widget": new PhpDebugBar.Widgets.VariableListWidget()}));
phpdebugbar.addIndicator("auth.name", new PhpDebugBar.DebugBar.Indicator({"icon":"user","tooltip":"Auth status"}), "right");
phpdebugbar.addTab("gate", new PhpDebugBar.DebugBar.Tab({"icon":"list-alt","title":"Gate", "widget": new PhpDebugBar.Widgets.MessagesWidget()}));
phpdebugbar.addTab("session", new PhpDebugBar.DebugBar.Tab({"icon":"archive","title":"Session", "widget": new PhpDebugBar.Widgets.VariableListWidget()}));
phpdebugbar.addTab("request", new PhpDebugBar.DebugBar.Tab({"icon":"tags","title":"Request", "widget": new PhpDebugBar.Widgets.VariableListWidget()}));
phpdebugbar.setDataMap({
"messages": ["messages.messages", []],
"messages:badge": ["messages.count", null],
"time": ["time.duration_str", '0ms'],
"timeline": ["time", {}],
"memory": ["memory.peak_usage_str", '0B'],
"exceptions": ["exceptions.exceptions", []],
"exceptions:badge": ["exceptions.count", null],
"views": ["views", []],
"views:badge": ["views.nb_templates", 0],
"route": ["route", {}],
"currentroute": ["route.uri", ],
"queries": ["queries", []],
"queries:badge": ["queries.nb_statements", 0],
"emails": ["swiftmailer_mails.mails", []],
"emails:badge": ["swiftmailer_mails.count", null],
"auth": ["auth.user", {}],
"auth.name": ["auth.name", ],
"gate": ["gate.messages", []],
"gate:badge": ["gate.count", null],
"session": ["session", {}],
"request": ["request", {}]
});
phpdebugbar.restoreState();
phpdebugbar.ajaxHandler = new PhpDebugBar.AjaxHandler(phpdebugbar);
phpdebugbar.ajaxHandler.bindToXHR();
phpdebugbar.setOpenHandler(new PhpDebugBar.OpenHandler({"url":"http:\/\/3.95.51.53\/_debugbar\/open"}));
phpdebugbar.addDataSet({"__meta":{"id":"1d34aa80b5b5d635d1fb5842750a3165","datetime":"2020-10-29 15:01:14","utime":1603983674.769273,"method":"GET","uri":"\/1.0","ip":"86.191.207.60"},"php":{"version":"7.2.19","interface":"apache2handler"},"messages":{"count":0,"messages":[]},"time":{"start":1603983674.682,"end":1603983674.769287,"duration":0.08728718757629395,"duration_str":"87.29ms","measures":[{"label":"Booting","start":1603983674.682,"relative_start":0,"end":1603983674.767149,"relative_end":1603983674.767149,"duration":0.08514904975891113,"duration_str":"85.15ms","params":[],"collector":null},{"label":"Application","start":1603983674.68708,"relative_start":0.005079984664916992,"end":1603983674.769289,"relative_end":1.9073486328125e-6,"duration":0.08220911026000977,"duration_str":"82.21ms","params":[],"collector":null}]},"memory":{"peak_usage":4194304,"peak_usage_str":"4MB"},"exceptions":{"count":0,"exceptions":[]},"views":{"nb_templates":0,"templates":[]},"route":{"uri":"GET 1.0","middleware":"cors","uses":"Closure {#132\n class: \"App\\Providers\\RouteServiceProvider\"\n this: App\\Providers\\RouteServiceProvider {#106 \u2026}\n file: \"\/var\/app\/current\/app\/Http\/routes.php\"\n line: \"22 to 25\"\n}","namespace":"App\\Http\\Controllers","prefix":"\/1.0","where":[],"file":"app\/Http\/routes.php:22-25"},"queries":{"nb_statements":0,"nb_failed_statements":0,"accumulated_duration":0,"accumulated_duration_str":"0\u03bcs","statements":[]},"swiftmailer_mails":{"count":0,"mails":[]},"auth":{"name":"Guest","user":{"guest":true}},"gate":{"count":0,"messages":[]},"session":{"_token":"j8Z5CzG5Laiomm5HyeJM7ZmKCP14llKHn6wyORkW","PHPDEBUGBAR_STACK_DATA":"[]","_previous":"array:1 [\n \"url\" => \"http:\/\/3.95.51.53\"\n]","flash":"array:2 [\n \"old\" => []\n \"new\" => []\n]"},"request":{"format":"html","content_type":"text\/html; charset=UTF-8","status_text":"OK","status_code":"200","request_query":"[]","request_request":"[]","request_headers":"array:8 [\n \"host\" => array:1 [\n 0 => \"3.95.51.53\"\n ]\n \"user-agent\" => array:1 [\n 0 => \"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko\/20100101 Firefox\/81.0\"\n ]\n \"accept\" => array:1 [\n 0 => \"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\"\n ]\n \"accept-language\" => array:1 [\n 0 => \"en-US,en;q=0.5\"\n ]\n \"accept-encoding\" => array:1 [\n 0 => \"gzip, deflate\"\n ]\n \"connection\" => array:1 [\n 0 => \"keep-alive\"\n ]\n \"cookie\" => array:1 [\n 0 => \"laravel_session=eyJpdiI6IjZxK0NmeFJRSjJwbE5JbDdPS0h1VWc9PSIsInZhbHVlIjoiUFVoYUxXSnlOanJFSWg2SHNsYWlZK2Z6SlR2aFFtcGEzM21xWUJWckJFTDZFdmVGd2l4S01cL3FRWkFjejNDZzNhbXJTdlR3WWtxWUZidW9vT2puV2lBPT0iLCJtYWMiOiI0MTRlN2U4YTgxNmJjMWE0YWNlNjMzYjc2YWI3ZmVmOGY3MmVkYWUwZWZhMDJmMmU4ZTg2NTljNGQ4OTBjY2M0In0%3D\"\n ]\n \"upgrade-insecure-requests\" => array:1 [\n 0 => \"1\"\n ]\n]","request_server":"array:99 [\n \"REDIRECT_APP\" => \"https:\/\/staging.spywatchlex.com\"\n \"REDIRECT_APP_ENV\" => \"staging\"\n \"REDIRECT_MAIL_USERNAME\" => \"postmaster#mg.spywatchlex.com\"\n \"REDIRECT_MAILGUN_DOMAIN\" => \"postmaster#mg.spywatchlex.com\"\n \"REDIRECT_APP_KEY\" => \"******\"\n \"REDIRECT_DB_HOST\" => \"aa1czcdcnsnpmyq.cuqlyug9ccbu.us-east-1.rds.amazonaws.com\"\n \"REDIRECT_QUEUE_DRIVER\" => \"sync\"\n \"REDIRECT_MAIL_PORT\" => \"2525\"\n \"REDIRECT_OAUTH_TTL\" => \"86400\"\n \"REDIRECT_SESSION_DRIVER\" => \"file\"\n \"REDIRECT_TWITTER_CALLBACK_URL\" => \"https:\/\/staging.spywatchlex.com\"\n \"REDIRECT_DB_USERNAME\" => \"Growler\"\n \"REDIRECT_EMAIL_BASE_URL\" => \"https:\/\/staging.spywatchlex.com\"\n \"REDIRECT_DB_CONNECTION\" => \"pgsql\"\n \"REDIRECT_CACHE_DRIVER\" => \"file\"\n \"REDIRECT_APP_DEBUG\" => \"true\"\n \"REDIRECT_MAIL_PASSWORD\" => \"******\"\n \"REDIRECT_MAILGUN_SECRET\" => \"******\"\n \"REDIRECT_DB_DATABASE\" => \"spywatch-lex\"\n \"REDIRECT_DB_PASSWORD\" => \"******\"\n \"REDIRECT_RDS_PORT\" => \"5432\"\n \"REDIRECT_RDS_HOSTNAME\" => \"aa1czcdcnsnpmyq.cuqlyug9ccbu.us-east-1.rds.amazonaws.com\"\n \"REDIRECT_RDS_USERNAME\" => \"Growler\"\n \"REDIRECT_RDS_DB_NAME\" => \"ebdb\"\n \"REDIRECT_RDS_PASSWORD\" => \"******\"\n \"REDIRECT_PHP_MEMORY_LIMIT\" => \"512M\"\n \"REDIRECT_PHP_MAX_EXECUTION_TIME\" => \"60\"\n \"REDIRECT_PHP_DISPLAY_ERRORS\" => \"Off\"\n \"REDIRECT_PHP_COMPOSER_OPTIONS\" => \"\"\n \"REDIRECT_PHP_ALLOW_URL_FOPEN\" => \"On\"\n \"REDIRECT_PHP_ZLIB_OUTPUT_COMPRESSION\" => \"Off\"\n \"REDIRECT_PHP_DOCUMENT_ROOT\" => \
You get the picture. It's a small mercy the passwords are somewhat redacted.
Steps to reproduce:
load your landing page
click "view source"
expand the <script type="text/javascript">...</script> block.
Please do several things.
change your passwords.
remove this API from the public internet
uninstall phpdebug from your production api
spend some time familiarizing yourself with how to actually secure PHP and AWS.
Sorry if this comes across as abrasive, but I don't even KNOW php and I found this in five minutes.
I am new to elixir an phoenix an got some problems accessing nested elements inside a test. I am testing a controller and got so far following response:
.[%{"attributes" => %{"first_name" => "Timmy 96", "last_name" =>
"Assistant"},
"id" => "bca58c53-7c6e-4281-9bc8-0c4616a30051",
"relationships" => %{"avatar" => %{"data" => %{"id" => "011300fd-ca98-42b4-
9561-f1cdc93d2d25",
"type" => "pictures"}}}, "type" => "users"}]
I am using JSON-API-format for the response and am fetching the attributes with userdata:
user_attr = Enum.filter(includes, fn(item)->
item["relationships"]["avatar"] != nil
end)
IO.inspect user_attr
case Enum.fetch(user_attr ,0) do
{:ok, value} ->
assert value["attributes"]["first_name"] == user.first_name
assert value["attributes"]["last_name"] == user.last_name
{_} ->
assert false
end
I want to shorten this part, dont want to use a case, but no idea how to get the value of the user_attr without using the value part in the case.
I would also want to asser the id of the relationships -> avatar -> data -> id with the id I inserted before, but no idea how to access this value. The id is part of the picture i inserted before so I would like to
assert XXX == picture.id
But how to get the XXX?
Hope someone can help me. Last years only Java and C#, never Ruby and now I got somehow into elixir :/
Thanks.
You can use get_in/2 to do this.
iex()> list
[%{"attributes" => %{"first_name" => "Timmy 96", "last_name" =>
"Assistant"},
"id" => "bca58c53-7c6e-4281-9bc8-0c4616a30051",
"relationships" => %{"avatar" => %{"data" => %{"id" => "011300fd-ca98-
42b4-\n9561-f1cdc93d2d25",
"type" => "pictures"}}}, "type" => "users"}]
iex()> [map] = list
[%{"attributes" => %{"first_name" => "Timmy 96", "last_name" =>
"Assistant"},
"id" => "bca58c53-7c6e-4281-9bc8-0c4616a30051",
"relationships" => %{"avatar" => %{"data" => %{"id" => "011300fd-ca98-
42b4-\n9561-f1cdc93d2d25",
"type" => "pictures"}}}, "type" => "users"}]
iex()> get_in map, ["attributes", "first_name"]
"Timmy 96"
iex()> get_in map, ["attributes", "last_name"]
"Assistant"
iex()> get_in map, ["relationships", "avatar", "data", "id"]
"011300fd-ca98-42b4-\n9561-f1cdc93d2d25"
You should try using pattern matching more.
# fixture data.
user = %{first_name: "Timmy 96", last_name: "Assistant"}
picture = %{id: "011300fd-ca98-42b4-\n9561-f1cdc93d2d25"}
value = %{
"attributes" => %{"first_name" => "Timmy 96", "last_name" => "Assistant"},
"id" => "bca58c53-7c6e-4281-9bc8-0c4616a30051",
"relationships" => %{
"avatar" => %{
"data" => %{
"id" => "011300fd-ca98-42b4-\n9561-f1cdc93d2d25",
"type" => "pictures",
},
},
},
"type" => "users",
}
assert %{"attributes" => attributes} = value
# ensure the expected value match with actual value and than bind the attributes variable with actual attributes map.
assert %{"first_name" => user.first_name, "last_name" => user.last_name} == attributes
assert %{"relationships" => %{"avatar" => %{ "data" => avatar_data}}} = value
assert %{"id" => picture.id, "type" => "pictures"} == avatar_data
One of Elixir's most powerful features is pattern matching via the = operator(match operator).
The above example shows you that we can use match operator to assert that the data structures of expected value match with actual value.
Learn more about testing and pattern matching:
https://semaphoreci.com/community/tutorials/introduction-to-testing-elixir-applications-with-exunit
I am trying to implement filtering on child grid in kendo-ui hierarchical grid in MVC but it's giving error.
HTML Code Sample :
.Columns(col =>
{
col.Bound(o => o.Id).Hidden(true);
col.Bound(o => o.Column1).Width(100).ClientTemplate("\\#= BuildLink(data,'1') \\#");
col.Bound(o => o.Column2).Width(100).ClientTemplate("\\#= BuildLink(data,'2') \\#");
col.Bound(o => o.Column3).Width(100).ClientTemplate("\\#= BuildLink(data,'3') \\#");
col.Bound(o => o.YTDSailedCalls).Width(100).ClientTemplate("\\#= BuildLink(data,'4') \\#");
})
.Sortable().Scrollable().Filterable()
.Pageable(pageable => pageable.Refresh(true)
.PageSizes(new int[5] { 20, 40, 80, 100, 200 })
.ButtonCount(5))
but its giving error in browser console and nothing get displayed.
Please reply as soon as possible if anyone face this issue or have solution for this.
Try like this-
#(Html.Kendo().Grid<Kendo.Mvc.Examples.Models.OrderViewModel>()
.Name("grid")
.Columns(columns =>
{
columns.Bound(p => p.OrderID).Filterable(ftb => ftb.Cell(cell => cell.ShowOperators(false))).Width(225);
columns.Bound(p => p.ShipName).Width(500).Filterable(ftb => ftb.Cell(cell => cell.Operator("contains")));
columns.Bound(p => p.Freight).Width(255).Filterable(ftb => ftb.Cell(cell => cell.Operator("gte")));
columns.Bound(p => p.OrderDate).Format("{0:MM/dd/yyyy}");
})
.Pageable()
.Sortable()
.Scrollable()
.Filterable(ftb => ftb.Mode(GridFilterMode.Row))
.HtmlAttributes(new { style = "height:550px;" })
.DataSource(dataSource => dataSource
.Ajax()
.PageSize(20)
.ServerOperation(true)
.Read(read => read.Action("Orders_Read", "Grid"))
)
)
For more assistance refer this link-
Kendo Grid filter
I am trying to get the state of a toggle switch in my native app.
This is the query of the switch itself, when ON:
query "Switch id:'quadrant_buzz'"
and its results
[
[0] {
"class" => "android.widget.Switch",
"tag" => nil,
"description" => "android.widget.Switch{29ddf658 VFED..C. ........ 877,0-1017,81 #7f10017f app:id/quadrant_buzz}",
"id" => "quadrant_buzz",
"text" => "",
"visible" => true,
"rect" => {
"height" => 81,
"width" => 140,
"y" => 1303,
"x" => 877,
"center_x" => 947,
"center_y" => 1343
},
"enabled" => true,
"contentDescription" => nil
}]
This is the result of the query when the switch is OFF:
[
[0] {
"class" => "android.widget.Switch",
"tag" => nil,
"description" => "android.widget.Switch{29ddf658 VFED..C. ........ 877,0-1017,81 #7f10017f app:id/quadrant_buzz}",
"id" => "quadrant_buzz",
"text" => "",
"visible" => true,
"rect" => {
"height" => 81,
"width" => 140,
"y" => 1213,
"x" => 877,
"center_x" => 947,
"center_y" => 1253
},
"enabled" => true,
"contentDescription" => nil
}]
I am unsure how to check for its on/off state. When I tap/touch the switch, nothing changes in the returned query. The only difference I see is the center-y.
Is there something in the Calabash Api for this?
Thanks
Looking up the documentation for a Switch widget on Android developers it is the method "isChecked". http://developer.android.com/reference/android/widget/Switch.html
Therefore you can find this value in Calabash by invoking
query("Switch id:'quadrant_buzz'", :isChecked)
You could also used just :checked in Calabash.
The isChecked works.
irb(main):001:0> query("android.widget.Switch",:isChecked)
[
[0] true
]
Migrate gmaps4rails v1 to v2 (great gem!). But i cannot get the custom marker images only the default one.
output code:
handler.buildMap({ provider: {}, internal: {id: 'map'}}, function(){
markers = handler.addMarkers([{"lat":43.3851,"lng":12.3856,"picture":{"picture":"/assets/house.png","width":"32","height":"32"},"title":"blablabla"}
controller
#locations = Location.where(:region => #region.id)
#hash = Gmaps4rails.build_markers(#locations) do |location, marker|
marker.lat location.latitude
marker.lng location.longitude
marker.infowindow location.description
marker.picture({
"picture" => "/assets/house.png",
"width" => "32",
"height" => "32"
})
marker.json({:title => location.description})
end
If you look ate the output the code works...but i don't see the custom marker house.png.
Am i doing something wrong here? Security issue?
Thanks..remco
You're simply not following the doc/examples, use:
marker.picture({
"url" => "/assets/house.png",
"width" => "32",
"height" => "32"
})