"SoReL-20M" (short for Sophos-ReversingLabs – 20 Million), as it's called, is a dataset containing metadata, labels, and features for 20 million Windows Portable Executable (.PE) files, including 10 million disarmed malware samples, with the goal of devising machine-learning approaches for better malware detection capabilities.
You want your local web development set up to reflect your production
reality as much as possible. URL parsing, routing, redirects, avoiding
mixed-content warnings, etc. It's very easy to accidentally find oneself
on http:// when everything in 2018 should be under https://.
I'm using ASP.NET Core 2.1 which makes local SSL super easy. After installing from http://dot.net I'll "dotnet new razor" in an empty folder to make a quick web app.
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
namespace AngularTemplateDrivenFormsLab.Utils
{
public class ContentSecurityPolicyMiddleware
{
private readonly RequestDelegate _next;
public ContentSecurityPolicyMiddleware(RequestDelegate next)
{
_next = next;
}
public Task Invoke(HttpContext context)
{
context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
context.Response.Headers.Add("X-Xss-Protection", "1; mode=block");
context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
string[] csp =
{
"default-src 'self'",
"style-src 'self' 'unsafe-inline'",
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
"font-src 'self'",
"img-src 'self' data:",
"connect-src 'self'",
"media-src 'self'",
"object-src 'self'",
"report-uri /api/CspReport/Log" //TODO: Add api/CspReport/Log
};
context.Response.Headers.Add("Content-Security-Policy", string.Join("; ", csp));
return _next(context);
}
}
public static class ContentSecurityPolicyMiddlewareExtensions
{
/// <summary>
/// Make sure you add this code BEFORE app.UseStaticFiles();,
/// otherwise the headers will not be applied to your static files.
/// </summary>
public static IApplicationBuilder UseContentSecurityPolicy(this IApplicationBuilder builder)
{
return builder.UseMiddleware<ContentSecurityPolicyMiddleware>();
}
}
} public void Configure(IApplicationBuilder app)
{
app.UseContentSecurityPolicy(); context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN"); context.Response.Headers.Add("X-Xss-Protection", "1; mode=block"); context.Response.Headers.Add("X-Content-Type-Options", "nosniff"); string[] csp =
{
"default-src 'self'",
"style-src 'self' 'unsafe-inline'",
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
"font-src 'self'",
"img-src 'self' data:",
"connect-src 'self'",
"media-src 'self'",
"object-src 'self'",
"report-uri /api/CspReport/Log" //TODO: Add api/CspReport/Log
};
context.Response.Headers.Add("Content-Security-Policy", string.Join("; ", csp)); Set-Cookie: sess=abc123; path=/; SameSite
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<rewrite>
<outboundRules>
<clear />
<!-- https://scotthelme.co.uk/csrf-is-dead/ -->
<rule name="Add SameSite" preCondition="No SameSite">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; SameSite=lax" />
<conditions></conditions>
</rule>
<preConditions>
<preCondition name="No SameSite">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" pattern="; SameSite=lax" negate="true" />
</preCondition>
</preConditions>
</outboundRules>
</rewrite>
</system.webServer>
</configuration> "report-uri /api/CspReport/Log" //TODO: Add api/CspReport/Log
{
"csp-report": {
"document-uri": "http://localhost:5000/untypedSha",
"referrer": "",
"violated-directive": "script-src",
"effective-directive": "script-src",
"original-policy": "default-src 'self'; style-src 'self'; script-src 'self'; font-src 'self'; img-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'self'; report-uri /api/Home/CspReport",
"disposition": "enforce",
"blocked-uri": "eval",
"line-number": 21,
"column-number": 8,
"source-file": "http://localhost:5000/scripts.bundle.js",
"status-code": 200,
"script-sample": ""
}
} class CspPost
{
[JsonProperty("csp-report")]
public CspReport CspReport { get; set; }
}
class CspReport
{
[JsonProperty("document-uri")]
public string DocumentUri { get; set; }
[JsonProperty("referrer")]
public string Referrer { get; set; }
[JsonProperty("violated-directive")]
public string ViolatedDirective { get; set; }
[JsonProperty("effective-directive")]
public string EffectiveDirective { get; set; }
[JsonProperty("original-policy")]
public string OriginalPolicy { get; set; }
[JsonProperty("disposition")]
public string Disposition { get; set; }
[JsonProperty("blocked-uri")]
public string BlockedUri { get; set; }
[JsonProperty("line-number")]
public int LineNumber { get; set; }
[JsonProperty("column-number")]
public int ColumnNumber { get; set; }
[JsonProperty("source-file")]
public string SourceFile { get; set; }
[JsonProperty("status-code")]
public string StatusCode { get; set; }
[JsonProperty("script-sample")]
public string ScriptSample { get; set; }
} namespace AngularTemplateDrivenFormsLab.Controllers
{
[Route("api/[controller]")]
public class CspReportController : Controller
{
[HttpPost("[action]")]
[IgnoreAntiforgeryToken]
public async Task<IActionResult> Log()
{
CspPost cspPost;
using (var bodyReader = new StreamReader(this.HttpContext.Request.Body))
{
var body = await bodyReader.ReadToEndAsync().ConfigureAwait(false);
this.HttpContext.Request.Body = new MemoryStream(Encoding.UTF8.GetBytes(body));
cspPost = JsonConvert.DeserializeObject<CspPost>(body);
}
//TODO: log cspPost
return Ok();
}
}
} 
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<configSections>
<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=4.3.1.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
</configSections>
<startup useLegacyV2RuntimeActivationPolicy="true">
<supportedRuntime version="v4.0"/>
</startup>
<connectionStrings>
<clear/>
<add name="Sample09Context"
connectionString="Data Source=CodeFirst.db"
providerName="System.Data.SQLite"/>
</connectionStrings>
</configuration>
CREATE TABLE [Payees](
[Id] [integer] PRIMARY KEY AUTOINCREMENT NOT NULL,
[Name] [text] NULL,
[CreatedOn] [datetime] NOT NULL,
[CreatedBy] [text] NULL,
[ModifiedOn] [datetime] NOT NULL,
[ModifiedBy] [text] NULL
);
CREATE TABLE [Bills](
[Id] [integer] PRIMARY KEY AUTOINCREMENT NOT NULL,
[Amount] [float](18, 2) NOT NULL,
[Description] [text] NULL,
[CreatedOn] [datetime] NOT NULL,
[CreatedBy] [text] NULL,
[ModifiedOn] [datetime] NOT NULL,
[ModifiedBy] [text] NULL,
[Payee_Id] [integer] NULL
);
Database.SetInitializer<Sample09Context>(null);
<connectionStrings>
<clear/>
<add name="Sample09Context"
connectionString="Data Source=mydb.sdf;Password=1234;Encrypt Database=True"
providerName="System.Data.SqlServerCE.4.0"/>
</connectionStrings>
<connectionStrings>
<clear/>
<add name="Sample09Context"
connectionString="Datasource=localhost; Database=testdb2; Uid=root; Pwd=123;"
providerName="MySql.Data.MySqlClient"/>
</connectionStrings>
<system.data>
<DbProviderFactories>
<remove invariant="MySql.Data.MySqlClient"/>
<add name="MySQL Data Provider"
invariant="MySql.Data.MySqlClient"
description=".Net Framework Data Provider for MySQL"
type="MySql.Data.MySqlClient.MySqlClientFactory, MySql.Data, Version=6.5.4.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d" />
</DbProviderFactories>
</system.data>
CREATE TABLE IF NOT EXISTS `bills` (
`Id` int(11) NOT NULL AUTO_INCREMENT,
`Amount` float DEFAULT NULL,
`Description` varchar(400) CHARACTER SET utf8 COLLATE utf8_persian_ci NOT NULL,
`CreatedOn` datetime NOT NULL,
`CreatedBy` varchar(400) CHARACTER SET utf8 COLLATE utf8_persian_ci NOT NULL,
`ModifiedOn` datetime NOT NULL,
`ModifiedBy` varchar(400) CHARACTER SET utf8 COLLATE utf8_persian_ci NOT NULL,
`Payee_Id` int(11) NOT NULL,
PRIMARY KEY (`Id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_persian_ci AUTO_INCREMENT=1 ;
CREATE TABLE IF NOT EXISTS `payees` (
`Id` int(11) NOT NULL AUTO_INCREMENT,
`Name` varchar(400) CHARACTER SET utf8 COLLATE utf8_persian_ci NOT NULL,
`CreatedOn` datetime NOT NULL,
`CreatedBy` varchar(400) CHARACTER SET utf8 COLLATE utf8_persian_ci NOT NULL,
`ModifiedOn` datetime NOT NULL,
`ModifiedBy` varchar(400) CHARACTER SET utf8 COLLATE utf8_persian_ci NOT NULL,
PRIMARY KEY (`Id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_persian_ci AUTO_INCREMENT=1 ;
ALTER TABLE `bills` DEFAULT CHARACTER SET utf8 COLLATE utf8_persian_ci
<connectionStrings>
<clear/>
<add name="Sample09Context"
connectionString="Datasource=localhost; Database=testdb; Uid=root; Pwd=123;CHARSET=utf8"
providerName="MySql.Data.MySqlClient"/>
</connectionStrings>
○ No sorting option, or a good paging story
○ SQL Injection, without any other alternative
○ Hard to deploy and to keep current with your codebase
○ Poor development story & no testing story
○ Poor client API
○ Lots of table scans
○ Limited queries and few optimization options
○ Single document transactions (from the client)
○ No cross collection transations at all
○ Very small document sizes allowed
dotnet new -i %~dp0
C:\Projects\DNTIdentity-master>dotnet new -i %~dp0 Restoring packages for C:\Users\Marjani\.templateengine\dotnetcli\v2.1.300\scratch\restore.csproj... C:\Users\Marjani\.templateengine\dotnetcli\v2.1.300\scratch\restore.csproj : error NU1101: Unable to find package %~dp0. No packages exist with this id in source(s): C:\Program Files\dotnet\sdk\NuGetFallbackFolder, Microsoft Visual Studio Offline Packages, nuget.org Generating MSBuild file C:\Users\Marjani\.templateengine\dotnetcli\v2.1.300\scratch\obj\restore.csproj.nuget.g.props. Generating MSBuild file C:\Users\Marjani\.templateengine\dotnetcli\v2.1.300\scratch\obj\restore.csproj.nuget.g.targets. Restore failed in 1.95 sec for C:\Users\Marjani\.templateengine\dotnetcli\v2.1.300\scratch\restore.csproj.
