Create codeql-analysis.yml (#4)

* Create codeql-analysis.yml

* Adding inputs validation

* permitting - and _ in the identifiers

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,72 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '27 4 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'csharp' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines. 
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

Controllers/PetCardsController.cs

@@ -6,6 +6,7 @@
 using PatCardStorageAPI.Storage;
 using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Mvc;
+using CardStorageRestAPI;
 
 // For more information on enabling Web API for empty projects, visit https://go.microsoft.com/fwlink/?LinkID=397860
 
@@ -23,118 +24,164 @@ public PetCardsController(ICardStorage storage)
 
         // GET <PetCardsController>/pet911ru/rf123
         [EnableCors]
-        [HttpGet("{ns}/{localID}")]
-        public async Task<ActionResult<PetCard>> Get(string ns, string localID, [FromQuery] bool includeSensitiveData = false)
+        [HttpGet("{nsStr}/{localIDstr}")]
+        public async Task<ActionResult<PetCard>> Get(string nsStr, string localIDstr, [FromQuery] bool includeSensitiveData = false)
         {
             try
             {
-                Trace.TraceInformation($"Getting card for {ns}/{localID}");
-                var result = await this.storage.GetPetCardAsync(ns, localID);
-                if (result == null)
-                {
-                    Trace.TraceInformation($"card for {ns}/{localID} not found");
-                    return NotFound();
-                }
-                else
+                // verifying inputs
+                AsciiIdentifier ns = new(nsStr);
+                AsciiIdentifier localID = new(localIDstr);
+
+                try
                 {
-                    Trace.TraceInformation($"Successfully retrieved card for {ns}/{localID}");
-                    if (!includeSensitiveData)
+
+                    Trace.TraceInformation($"Getting card for {ns}/{localID}");
+                    var result = await this.storage.GetPetCardAsync(ns, localID);
+                    if (result == null)
                     {
-                        Trace.TraceInformation($"Wiping out sensitive data for {ns}/{localID}");
-                        var contacts = result.ContactInfo;
-                        if (contacts != null) {
-                            contacts.Email = new string[0];
-                            contacts.Name = "";
-                            contacts.Tel = new string[0];
-                            contacts.Website = new string[0];
-                        }
+                        Trace.TraceInformation($"card for {ns}/{localID} not found");
+                        return NotFound();
                     }
                     else
                     {
-                        Trace.TraceInformation($"Returning sensitive data to the client for {ns}/{localID}");
+                        Trace.TraceInformation($"Successfully retrieved card for {ns}/{localID}");
+                        if (!includeSensitiveData)
+                        {
+                            Trace.TraceInformation($"Wiping out sensitive data for {ns}/{localID}");
+                            var contacts = result.ContactInfo;
+                            if (contacts != null)
+                            {
+                                contacts.Email = new string[0];
+                                contacts.Name = "";
+                                contacts.Tel = new string[0];
+                                contacts.Website = new string[0];
+                            }
+                        }
+                        else
+                        {
+                            Trace.TraceInformation($"Returning sensitive data to the client for {ns}/{localID}");
+                        }
+                        return new ActionResult<PetCard>(result);
                     }
-                    return new ActionResult<PetCard>(result);
+                }
+                catch (Exception err)
+                {
+                    Trace.TraceError($"Except card for {ns}/{localID}: {err}");
+                    return StatusCode(500, err.ToString());
                 }
             }
-            catch (Exception err)
-            {
-                Trace.TraceError($"Except card for {ns}/{localID}: {err}");
-                return StatusCode(500, err.ToString());
+            catch (ArgumentException ae) {
+                Trace.TraceError(ae.ToString());
+                return BadRequest(ae);
             }
         }
 
 
-        [HttpPut("{ns}/{localID}/features/{featuresIdent}")]
-        public async Task<IActionResult> PutFeatures(string ns, string localID, string featuresIdent, [FromBody] JsonPoco.FeaturesPOCO features)
+        [HttpPut("{nsStr}/{localIDstr}/features/{featuresIdentStr}")]
+        public async Task<IActionResult> PutFeatures(string nsStr, string localIDstr, string featuresIdentStr, [FromBody] JsonPoco.FeaturesPOCO features)
         {
             try
             {
-                Trace.TraceInformation($"Setting features {featuresIdent} for {ns}/{localID}");
-                await this.storage.SetCardFeatureVectorAsync(ns, localID, featuresIdent, features.Features);
-                Trace.TraceInformation($"Successfully set features {featuresIdent} for {ns}/{localID}");
-                return Ok();
+                // verifying inputs
+                AsciiIdentifier ns = new(nsStr);
+                AsciiIdentifier localID = new(localIDstr);
+                AsciiIdentifier featuresIdent = new(featuresIdentStr);
+                try
+                {
+                    Trace.TraceInformation($"Setting features {featuresIdent} for {ns}/{localID}");
+                    await this.storage.SetCardFeatureVectorAsync(ns, localID, featuresIdent, features.Features);
+                    Trace.TraceInformation($"Successfully set features {featuresIdent} for {ns}/{localID}");
+                    return Ok();
+                }
+                catch (Exception err)
+                {
+                    Trace.TraceError($"Except card for {ns}/{localID}: {err}");
+                    return StatusCode(500, err.ToString());
+                }
             }
-            catch (Exception err)
-            {
-                Trace.TraceError($"Except card for {ns}/{localID}: {err}");
-                return StatusCode(500, err.ToString());
+            catch (ArgumentException ae) {
+                Trace.TraceError(ae.ToString());
+                return BadRequest(ae);
             }
         }
-
 
         // PUT <PetCardsController>
-        [HttpPut("{ns}/{localID}")]
+        [HttpPut("{nsStr}/{localIDstr}")]
         [ProducesResponseType(StatusCodes.Status201Created)]
         [ProducesResponseType(StatusCodes.Status409Conflict)]
         [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-        public async Task<ActionResult> Put(string ns, string localID, [FromBody] PetCard value)
+        public async Task<ActionResult> Put(string nsStr, string localIDstr, [FromBody] PetCard value)
         {
             try
             {
-                Trace.TraceInformation($"Storing {ns}/{localID} into storage");
-                var res = await this.storage.SetPetCardAsync(ns, localID, value);
-                if (res)
+                // verifying inputs
+                AsciiIdentifier ns = new(nsStr);
+                AsciiIdentifier localID = new(localIDstr);
+
+                try
                 {
-                    Trace.TraceInformation($"Stored {ns}/{localID}");
-                    return CreatedAtAction(nameof(Get),new { ns= ns, localID = localID },null);
+                    Trace.TraceInformation($"Storing {ns}/{localID} into storage");
+                    var res = await this.storage.SetPetCardAsync(ns, localID, value);
+                    if (res)
+                    {
+                        Trace.TraceInformation($"Stored {ns}/{localID}");
+                        return CreatedAtAction(nameof(Get),new { ns= ns, localID = localID },null);
+                    }
+                    else
+                    {
+                        Trace.TraceWarning($"Card {ns}/{localID} already exists");
+                        return Conflict();
+                    }
                 }
-                else
+                catch (Exception err)
                 {
-                    Trace.TraceWarning($"Card {ns}/{localID} already exists");
-                    return Conflict();
+                    Trace.TraceError($"Exception while storing {ns}/{localID}: {err}");
+                    return StatusCode(500, err.ToString());
                 }
             }
-            catch (Exception err)
+            catch (ArgumentException ae)
             {
-                Trace.TraceError($"Exception while storing {ns}/{localID}: {err}");
-                return StatusCode(500, err.ToString());
+                Trace.TraceError(ae.ToString());
+                return BadRequest(ae);
             }
-
         }
 
         // DELETE <PetCardsController>/pet911ru/rf123
-        [HttpDelete("{ns}/{localID}")]
-        public async Task<ActionResult> Delete(string ns, string localID)
+        [HttpDelete("{nsStr}/{localIDstr}")]
+        public async Task<ActionResult> Delete(string nsStr, string localIDstr)
         {
             try
             {
-                Trace.TraceInformation($"Received delete request for {ns}/{localID}");
-                var res = await this.storage.DeletePetCardAsync(ns, localID);
-                if (res)
+                // verifying inputs
+                AsciiIdentifier ns = new(nsStr);
+                AsciiIdentifier localID = new(localIDstr);
+
+                try
                 {
-                    Trace.TraceInformation($"Successfully deleted {ns}/{localID} from storage");
-                    return Ok();
+                    Trace.TraceInformation($"Received delete request for {ns}/{localID}");
+                    var res = await this.storage.DeletePetCardAsync(ns, localID);
+                    if (res)
+                    {
+                        Trace.TraceInformation($"Successfully deleted {ns}/{localID} from storage");
+                        return Ok();
+                    }
+                    else
+                    {
+                        Trace.TraceError($"Failed to delete {ns}/{localID}");
+                        return StatusCode(500);
+                    }
                 }
-                else
+                catch (Exception err)
                 {
-                    Trace.TraceError($"Failed to delete {ns}/{localID}");
-                    return StatusCode(500);
+                    Trace.TraceError($"Exception while deleting {ns}/{localID}: {err}");
+                    return StatusCode(500, err.ToString());
                 }
             }
-            catch (Exception err)
+            catch (ArgumentException ae)
             {
-                Trace.TraceError($"Exception while deleting {ns}/{localID}: {err}");
-                return StatusCode(500, err.ToString());
+                Trace.TraceError(ae.ToString());
+                return BadRequest(ae);
             }
         }
     }