FROM ruby:3.2-slim

RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y \
    build-essential \
    libpq-dev \
    nodejs \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY Gemfile Gemfile.lock ./
RUN bundle install

COPY . .

COPY entrypoint.sh /usr/bin/
RUN chmod +x /usr/bin/entrypoint.sh
ENTRYPOINT ["entrypoint.sh"]

EXPOSE 3000

CMD ["rails", "server", "-b", "0.0.0.0"]

version: '3.8'

services:
  db:
    image: postgres:15
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: security_test_development
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"

  web:
    build: .
    command: bash -c "rm -f tmp/pids/server.pid && rails server -b 0.0.0.0"
    volumes:
      - .:/app
    ports:
      - "3000:3000"
    depends_on:
      - db
    environment:
      DATABASE_URL: postgres://postgres:postgres@db:5432/security_test_development

volumes:
  postgres_data:

source 'https://rubygems.org'

ruby '3.2.0'

gem 'rails', '~> 7.1.0'
gem 'pg', '~> 1.5'
gem 'puma', '~> 6.0'
gem 'sprockets-rails'

GEM
  remote: https://rubygems.org/
  specs:
    actioncable (7.1.0)
      actionpack (= 7.1.0)
      activesupport (= 7.1.0)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
    actionmailbox (7.1.0)
      actionpack (= 7.1.0)
      activejob (= 7.1.0)
      activerecord (= 7.1.0)
      activestorage (= 7.1.0)
      activesupport (= 7.1.0)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
    actionmailer (7.1.0)
      actionpack (= 7.1.0)
      actionview (= 7.1.0)
      activejob (= 7.1.0)
      activesupport (= 7.1.0)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
      rails-dom-testing (~> 2.2)
    actionpack (7.1.0)
      actionview (= 7.1.0)
      activesupport (= 7.1.0)
      nokogiri (>= 1.8.5)
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
    actiontext (7.1.0)
      actionpack (= 7.1.0)
      activerecord (= 7.1.0)
      activestorage (= 7.1.0)
      activesupport (= 7.1.0)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
    actionview (7.1.0)
      activesupport (= 7.1.0)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
    activejob (7.1.0)
      activesupport (= 7.1.0)
      globalid (>= 0.3.6)
    activemodel (7.1.0)
      activesupport (= 7.1.0)
    activerecord (7.1.0)
      activemodel (= 7.1.0)
      activesupport (= 7.1.0)
      timeout (>= 0.4.0)
    activestorage (7.1.0)
      actionpack (= 7.1.0)
      activejob (= 7.1.0)
      activerecord (= 7.1.0)
      activesupport (= 7.1.0)
      marcel (~> 1.0)
    activesupport (7.1.0)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
      mutex_m
      tzinfo (~> 2.0)
    base64 (0.2.0)
    bigdecimal (3.1.4)
    builder (3.2.4)
    concurrent-ruby (1.2.2)
    connection_pool (2.4.1)
    crass (1.0.6)
    date (3.3.4)
    drb (2.2.0)
      ruby2_keywords
    erubi (1.12.0)
    globalid (1.2.1)
      activesupport (>= 6.1)
    i18n (1.14.1)
      concurrent-ruby (~> 1.0)
    io-console (0.6.0)
    irb (1.9.0)
      rdoc
      reline (>= 0.3.8)
    loofah (2.22.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    mail (2.8.1)
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
    marcel (1.0.2)
    mini_mime (1.1.5)
    minitest (5.20.0)
    mutex_m (0.2.0)
    net-imap (0.4.4)
      date
      net-protocol
    net-pop (0.1.2)
      net-protocol
    net-protocol (0.2.2)
      timeout
    net-smtp (0.4.0)
      net-protocol
    nio4r (2.5.9)
    nokogiri (1.15.4-arm64-darwin)
      racc (~> 1.4)
    nokogiri (1.15.4-x86_64-linux)
      racc (~> 1.4)
    psych (5.1.1)
      stringio
    puma (6.4.0)
      nio4r (~> 2.0)
    racc (1.7.3)
    rack (3.0.8)
    rack-session (2.0.0)
      rack (>= 3.0.0)
    rack-test (2.1.0)
      rack (>= 1.3)
    rackup (2.1.0)
      rack (>= 3)
      webrick (~> 1.8)
    rails (7.1.0)
      actioncable (= 7.1.0)
      actionmailbox (= 7.1.0)
      actionmailer (= 7.1.0)
      actionpack (= 7.1.0)
      actiontext (= 7.1.0)
      actionview (= 7.1.0)
      activejob (= 7.1.0)
      activemodel (= 7.1.0)
      activerecord (= 7.1.0)
      activestorage (= 7.1.0)
      activesupport (= 7.1.0)
      bundler (>= 1.15.0)
      railties (= 7.1.0)
    rails-dom-testing (2.2.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.6.0)
      loofah (~> 2.21)
      nokogiri (~> 1.14)
    railties (7.1.0)
      actionpack (= 7.1.0)
      activesupport (= 7.1.0)
      irb
      rackup (>= 1.0.0)
      rake (>= 12.2)
      thor (~> 1.0, >= 1.2.2)
      zeitwerk (~> 2.6)
    rake (13.1.0)
    rdoc (6.6.0)
      psych (>= 4.0.0)
    reline (0.4.0)
      io-console (~> 0.5)
    ruby2_keywords (0.0.5)
    sprockets (4.2.1)
      concurrent-ruby (~> 1.0)
      rack (>= 2.2.4, < 4)
    sprockets-rails (3.4.2)
      actionpack (>= 5.2)
      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
    stringio (3.0.9)
    thor (1.3.0)
    timeout (0.4.1)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    webrick (1.8.1)
    websocket-driver (0.7.6)
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    zeitwerk (2.6.12)
    pg (1.5.4)

PLATFORMS
  arm64-darwin
  x86_64-linux

DEPENDENCIES
  pg (~> 1.5)
  puma (~> 6.0)
  rails (~> 7.1.0)
  sprockets-rails

RUBY VERSION
   ruby 3.2.0p0

BUNDLED WITH
   2.4.0

#!/bin/bash
set -e

# Remove a potentially pre-existing server.pid for Rails
rm -f /app/tmp/pids/server.pid

# Wait for database
until pg_isready -h db -p 5432 -U postgres 2>/dev/null; do
  echo "Waiting for database..."
  sleep 2
done

# Run migrations
rails db:create 2>/dev/null || true
rails db:migrate

exec "$@"

require_relative "boot"
require "rails/all"

Bundler.require(*Rails.groups)

module SecurityTestApp
  class Application < Rails::Application
    config.load_defaults 7.1
    config.autoload_lib(ignore: %w(assets tasks))
  end
end

ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
require "bundler/setup"
require "bootsnap/setup" if defined?(Bootsnap)

require_relative "application"
Rails.application.initialize!

default: &default
  adapter: postgresql
  encoding: unicode
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>

development:
  <<: *default
  url: <%= ENV['DATABASE_URL'] %>

test:
  <<: *default
  database: security_test_test

production:
  <<: *default
  url: <%= ENV['DATABASE_URL'] %>

Rails.application.routes.draw do
  root "sessions#new"

  # 회원가입
  get  "/signup", to: "users#new"
  post "/users",  to: "users#create"

  # 회원목록
  get "/users", to: "users#index"

  # 로그인/로그아웃
  get    "/login",  to: "sessions#new"
  post   "/login",  to: "sessions#create"
  delete "/logout", to: "sessions#destroy"
end

require "active_support/core_ext/integer/time"

Rails.application.configure do
  config.enable_reloading = true
  config.eager_load = false
  config.consider_all_requests_local = true
  config.server_timing = true

  if Rails.root.join("tmp/caching-dev.txt").exist?
    config.action_controller.perform_caching = true
    config.action_controller.enable_fragment_cache_logging = true
    config.cache_store = :memory_store
    config.public_file_server.headers = { "Cache-Control" => "public, max-age=#{2.days.to_i}" }
  else
    config.action_controller.perform_caching = false
    config.cache_store = :null_store
  end

  config.active_storage.service = :local rescue nil
  config.action_mailer.raise_delivery_errors = false rescue nil
  config.action_mailer.perform_caching = false rescue nil
  config.active_support.deprecation = :log
  config.active_support.disallowed_deprecation = :raise
  config.active_support.disallowed_deprecation_warnings = []
  config.active_record.migration_error = :page_load
  config.active_record.verbose_query_logs = true
  config.assets.quiet = true
end

Rails.application.config.assets.version = "1.0"

require_relative "config/environment"
run Rails.application
Rails.application.load_server

require_relative "config/application"
Rails.application.load_tasks

class CreateUsers < ActiveRecord::Migration[7.1]
  def change
    create_table :users do |t|
      # [취약점] 비밀번호를 평문으로 저장 (bcrypt 미사용)
      t.string :email, null: false
      t.string :name
      t.string :password  # 평문 비밀번호 저장
      t.boolean :is_admin, default: false  # Mass Assignment 취약점용

      t.timestamps
    end

    add_index :users, :email, unique: true
  end
end

class User < ApplicationRecord
  # [취약점] 비밀번호 암호화 없음 - 평문 저장
  # [취약점] 유효성 검사 최소화
  validates :email, presence: true
end

class ApplicationRecord < ActiveRecord::Base
  primary_abstract_class
end

class ApplicationController < ActionController::Base
  # [취약점] CSRF 보호 비활성화
  skip_forgery_protection

  helper_method :current_user, :logged_in?

  def current_user
    # [취약점] 세션에서 user_id만 확인, 추가 검증 없음
    @current_user ||= User.find_by(id: session[:user_id]) if session[:user_id]
  end

  def logged_in?
    !!current_user
  end

  def require_login
    # [취약점] 인증 우회 가능 - 쿠키 조작으로 우회 가능
    unless logged_in? || cookies[:remember_token]
      redirect_to login_path, alert: "로그인이 필요합니다."
    end
  end
end

class UsersController < ApplicationController
  before_action :require_login, only: [:index]

  def new
    @user = User.new
  end

  def create
    # [취약점] Mass Assignment - 모든 파라미터 허용
    # is_admin=true 를 전송하면 관리자 계정 생성 가능
    @user = User.new(params.require(:user).permit!)

    if @user.save
      redirect_to login_path, notice: "회원가입 완료! 로그인해주세요."
    else
      render :new, status: :unprocessable_entity
    end
  end

  def index
    @users = User.all
  end
end

class SessionsController < ApplicationController
  def new
  end

  def create
    email = params[:email]
    password = params[:password]

    # [취약점] SQL Injection - 사용자 입력을 직접 쿼리에 삽입
    # 예: email에 ' OR '1'='1' -- 입력 시 인증 우회 가능
    user = User.where("email = '#{email}' AND password = '#{password}'").first

    if user
      session[:user_id] = user.id
      # [취약점] 쿠키에 민감 정보 저장 (암호화 없음)
      cookies[:remember_token] = user.id
      redirect_to users_path, notice: "로그인 성공!"
    else
      flash.now[:alert] = "이메일 또는 비밀번호가 잘못되었습니다."
      render :new, status: :unprocessable_entity
    end
  end

  def destroy
    session.delete(:user_id)
    cookies.delete(:remember_token)
    redirect_to login_path, notice: "로그아웃 되었습니다."
  end
end

<!DOCTYPE html>
<html>
<head>
  <title>Security Test App</title>
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <style>
    * { box-sizing: border-box; margin: 0; padding: 0; }
    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f5; }
    .container { max-width: 800px; margin: 0 auto; padding: 20px; }
    .header { background: #333; color: white; padding: 15px 20px; margin-bottom: 20px; }
    .header h1 { font-size: 1.5rem; }
    .header nav { margin-top: 10px; }
    .header nav a { color: #fff; margin-right: 15px; text-decoration: none; }
    .header nav a:hover { text-decoration: underline; }
    .card { background: white; border-radius: 8px; padding: 20px; margin-bottom: 20px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
    .form-group { margin-bottom: 15px; }
    .form-group label { display: block; margin-bottom: 5px; font-weight: 500; }
    .form-group input { width: 100%; padding: 10px; border: 1px solid #ddd; border-radius: 4px; font-size: 1rem; }
    .btn { background: #007bff; color: white; padding: 10px 20px; border: none; border-radius: 4px; cursor: pointer; font-size: 1rem; }
    .btn:hover { background: #0056b3; }
    .btn-danger { background: #dc3545; }
    .btn-danger:hover { background: #c82333; }
    .alert { padding: 10px 15px; border-radius: 4px; margin-bottom: 15px; }
    .alert-success { background: #d4edda; color: #155724; }
    .alert-danger { background: #f8d7da; color: #721c24; }
    table { width: 100%; border-collapse: collapse; }
    th, td { padding: 12px; text-align: left; border-bottom: 1px solid #ddd; }
    th { background: #f8f9fa; }
    .user-info { float: right; font-size: 0.9rem; }
  </style>
</head>
<body>
  <div class="header">
    <h1>🔓 Security Test App</h1>
    <nav>
      <% if logged_in? %>
        <span class="user-info">로그인: <%= current_user.email %></span>
        <a href="/users">회원목록</a>
        <%= link_to "로그아웃", logout_path, data: { turbo_method: :delete } %>
      <% else %>
        <a href="/login">로그인</a>
        <a href="/signup">회원가입</a>
      <% end %>
    </nav>
  </div>

  <div class="container">
    <% if notice %>
      <div class="alert alert-success"><%= notice %></div>
    <% end %>
    <% if alert %>
      <div class="alert alert-danger"><%= alert %></div>
    <% end %>

    <%= yield %>
  </div>
</body>
</html>

<div class="card">
  <h2>로그인</h2>
  <br>

  <!-- [취약점] SQL Injection 테스트 가능 -->
  <!-- 예시: email에 ' OR '1'='1' -- 입력 -->
  <%= form_with url: login_path, method: :post, local: true do |f| %>
    <div class="form-group">
      <%= f.label :email, "이메일" %>
      <%= f.email_field :email, placeholder: "이메일 입력" %>
    </div>

    <div class="form-group">
      <%= f.label :password, "비밀번호" %>
      <%= f.password_field :password, placeholder: "비밀번호 입력" %>
    </div>

    <%= f.submit "로그인", class: "btn" %>
  <% end %>

  <br>
  <p>계정이 없으신가요? <a href="/signup">회원가입</a></p>
</div>

<div class="card">
  <h2>회원가입</h2>
  <br>

  <!-- [취약점] Mass Assignment - is_admin=true 파라미터 추가 가능 -->
  <!-- [취약점] XSS - name 필드에 스크립트 삽입 가능 -->
  <%= form_with model: @user, url: users_path, local: true do |f| %>
    <% if @user.errors.any? %>
      <div class="alert alert-danger">
        <% @user.errors.full_messages.each do |msg| %>
          <p><%= msg %></p>
        <% end %>
      </div>
    <% end %>

    <div class="form-group">
      <%= f.label :email, "이메일" %>
      <%= f.email_field :email, placeholder: "이메일 입력" %>
    </div>

    <div class="form-group">
      <%= f.label :name, "이름" %>
      <%= f.text_field :name, placeholder: "이름 입력 (XSS 테스트: <script>alert('XSS')</script>)" %>
    </div>

    <div class="form-group">
      <%= f.label :password, "비밀번호" %>
      <%= f.password_field :password, placeholder: "비밀번호 입력" %>
    </div>

    <%= f.submit "가입하기", class: "btn" %>
  <% end %>

  <br>
  <p>이미 계정이 있으신가요? <a href="/login">로그인</a></p>
</div>

<div class="card">
  <h2>회원 목록</h2>
  <br>

  <table>
    <thead>
      <tr>
        <th>ID</th>
        <th>이메일</th>
        <th>이름</th>
        <th>관리자</th>
        <th>가입일</th>
      </tr>
    </thead>
    <tbody>
      <% @users.each do |user| %>
        <tr>
          <td><%= user.id %></td>
          <td><%= user.email %></td>
          <!-- [취약점] XSS - raw 사용으로 스크립트 실행 가능 -->
          <td><%= raw user.name %></td>
          <td><%= user.is_admin ? "✅" : "❌" %></td>
          <td><%= user.created_at.strftime("%Y-%m-%d %H:%M") %></td>
        </tr>
      <% end %>
    </tbody>
  </table>
</div>

<div class="card">
  <h3>⚠️ 포함된 취약점 목록 (테스트용)</h3>
  <br>
  <ul>
    <li><strong>SQL Injection</strong>: 로그인 시 <code>' OR '1'='1' --</code> 입력</li>
    <li><strong>XSS (Stored)</strong>: 회원가입 시 이름에 <code>&lt;script&gt;alert('XSS')&lt;/script&gt;</code> 입력</li>
    <li><strong>Mass Assignment</strong>: 회원가입 시 <code>is_admin=true</code> 파라미터 추가</li>
    <li><strong>평문 비밀번호</strong>: DB에 비밀번호가 암호화 없이 저장됨</li>
    <li><strong>CSRF 비활성화</strong>: 크로스 사이트 요청 위조 보호 없음</li>
    <li><strong>인증 우회</strong>: 쿠키 조작으로 인증 우회 가능</li>
  </ul>
</div>

# Development용 secret_key_base 설정
Rails.application.config.secret_key_base = 'development_secret_key_base_for_testing_only_do_not_use_in_production_1234567890abcdef'

Rails.application.config.session_store :cookie_store, key: '_security_test_session'

//= link_tree ../images
//= link_directory ../stylesheets .css

#!/usr/bin/env ruby
APP_PATH = File.expand_path("../config/application", __dir__)
require_relative "../config/boot"
require "rails/commands"

#!/usr/bin/env ruby
require_relative "../config/boot"
require "rake"
Rake.application.run

/* Application styles */

# 테스트용 기본 사용자 생성
User.create!(
  email: 'admin@test.com',
  name: 'Admin User',
  password: 'admin123',
  is_admin: true
)

User.create!(
  email: 'user@test.com',
  name: 'Normal User',
  password: 'user123',
  is_admin: false
)

puts "Seeds created!"
puts "Admin: admin@test.com / admin123"
puts "User: user@test.com / user123"