base on A GitHub Security Lab initiative, providing an in-repo learning experience, where learners secure intentionally vulnerable code. <header> <!-- <<< Author notes: Course header >>> Read <https://skills.github.com/quickstart> for more information about how to build courses using this template. Include a 1280×640 image, course name in sentence case, and a concise description in emphasis. In your repository settings: enable template repository, add your 1280×640 social image, auto delete head branches. Next to "About", add description & tags; disable releases, packages, & environments. Add your open source license, GitHub uses the MIT license. --> # Secure Code Game 📣 **SEASON 2 JUST DROPPED! READY TO PLAY?** 📣 _A GitHub Security Lab initiative, providing an in-repo learning experience, where learners secure intentionally vulnerable code. At the same time, this is an open source project that welcomes your [contributions](https://github.com/skills/secure-code-game/blob/main/CONTRIBUTING.md) as a way to give back to the community._ </header> <!-- <<< Author notes: Course start >>> Include start button, a note about Actions minutes, and tell the learner why they should take the course. --> ## Welcome - **Who is this for**: Developers, students. - **What you'll learn**: How to spot and fix vulnerable patterns in real-world code, build security into your workflows, and understand security alerts generated against your code. - **What you'll build**: You will develop fixes on functional but vulnerable code. - **Prerequisites**: For the first season, you will need some knowledge of `python3` for most levels and `C` for Level 2. For the second season, you will need some knowledge of `GitHub Actions` for level 1, `go` for level 2, `python3` for level 3, and `javascript` for levels 4 and 5. - **How long**: Each season is five levels long and takes 2-9 hours to complete. The complete course has 2 seasons. ### How to start this course <!-- For start course, run in JavaScript: 'https://github.com/new?' + new URLSearchParams({ template_owner: 'skills', template_name: 'secure-code-game', owner: '@me', name: 'skills-secure-code-game', description: 'My clone repository', visibility: 'public', }).toString() --> [](https://github.com/new?template_owner=skills&template_name=secure-code-game&owner=%40me&name=skills-secure-code-game&description=My+clone+repository&visibility=public) 1. Right-click **Start course** and open the link in a new tab. 1. In the new tab, most of the prompts will automatically fill in for you. - For owner, choose your personal account or an organization to host the repository. - We recommend creating a public repository, as private repositories will [use Actions minutes](https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions). - Scroll down and click the **Create repository** button at the bottom of the form. 1. You can now proceed to the 🛠️ set up section. ## 🛠️ The set up #### 🖥️ Using codespaces All levels are configured to run instantly with GitHub Codespaces. If you chose to use codespaces, be aware that this course **will count towards your 60 hours of monthly free allowance**. For more information about GitHub Codespaces, see the "[GitHub Codespaces overview](https://docs.github.com/en/codespaces/overview)." If you prefer to work locally, please follow the local installation guide in the next section. 1. To create a codespace, click the **Code** drop down button in the upper-right of your repository navigation bar. 1. Click **Create codespace on main**. 1. After creating a codespace, relax and wait for VS Code extensions and background installations to complete. This should take less than three minutes. 1. At this point, you can get started with Season-1 or Season-2 by navigating on the respective folders and reading the `README.md` file. 1. Once you click on individual levels, a banner might appear on the bottom right asking you if you want to create a virtual environment. Dismiss this notification as you _don't_ need to create a virtual environment. Optional: We recommend these free-of-charge additional extensions, but we haven't pre-installed them for you: 1. `github.copilot-labs` to receive AI-generated code explanations. 1. `alexcvzz.vscode-sqlite` to visualize the SQL database created in Season-1/Level-4 and the effects of our exploits on its content. If you need assistance, don't hesitate to ask for help in our [GitHub Discussions](https://github.com/skills/secure-code-game/discussions) or on our [Slack](https://gh.io/securitylabslack), at the [#secure-code-game](https://ghsecuritylab.slack.com/archives/C05DH0PSBEZ) channel. #### 💻 Local installation Please note: You don't need a local installation if you are using GitHub Codespaces. The following local installation guide is adapted to Debian/Ubuntu and CentOS/RHEL. 1. Open your terminal. 1. Install OpenLDAP headers needed to compile `python-ldap`, depending on your Linux distribution. Check by running: ```bash uname -a ``` - For Debian/Ubuntu, run: ```bash sudo apt-get update sudo apt-get install libldap2-dev libsasl2-dev ``` - For CentOS/RHEL, run: ```bash sudo yum install python-devel openldap-devel ``` - For Archlinux, run: ```bash sudo pacman -Sy libldap libsasl ``` - Then, for all of the above Linux distributions install `pyOpenSSL` by running: ```bash pip3 install pyOpenSSL ``` Once installation has completed, clone your repository to your local machine and install required dependencies. 1. From your repository, click the **Code** drop down button in the upper-right of your repository navigation bar. 1. Select the `Local` tab from the menu. 1. Copy your preferred URL. 1. In your terminal, change the working directory to the location where you want the cloned directory. 1. Type `git clone` and paste the copied URL. ``` $ git clone https://github.com/YOUR-USERNAME/YOUR-REPOSITORY ``` 6. Press **Enter** to create your local clone. 7. Change the working directory to the cloned directory. 8. Install dependencies by running: ```bash pip3 install -r requirements.txt ``` - Programming Languages 1. To play Season 1, you will need to have `python3` and `c` installed. 1. To play Season 2, you will need to have `yaml`, `go`, `python3` and `node` installed. If you are using VS Code locally, you can install the above programming languages through the editor extensions with these identifiers: 1. `ms-python.python` 1. `ms-python.vscode-pylance` 1. `ms-vscode.cpptools-extension-pack` 1. `redhat.vscode-yaml` 1. `golang.go` Please note that for the `go` programming language, you need to perform an extra step, which is to visit the [official website](https://go.dev/dl/) and download the driver corresponding to your operating system. Now, it's necessary to install `node` to get the `npm` packages we have provided. To do so: 1. Start by installing a package manager like `homebrew` by running: ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` 2. Install `node`: ```bash brew install node ``` Adapt the command to the package manager you have chosen if it's not homebrew. 3. The `npm` packages needed are specified in `package.json` and `package-lock.json`. Navigate to the `secure-code-game` repository and install them by running: ```bash npm install --prefix Season-2/Level-4/ Season-2/Level-4/ && npm install --global mocha ``` 4. At this point, you can get started with Season-1 or Season-2 by navigating on the respective folders and reading the `README.md` file. We recommend these free-of-charge additional extensions: 1. `github.copilot-labs` to receive AI-generated code explanations. 1. `alexcvzz.vscode-sqlite` to visualize the SQL database created and the effects of our exploits on its content. For more information about cloning repositories, see "[Cloning a repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository)." <footer> <!-- <<< Author notes: Footer >>> Add a link to get support, GitHub status page, code of conduct, license link. --> --- Get help: Email us at [email protected] &bull; [Review the GitHub status page](https://www.githubstatus.com/) &copy; 2024 GitHub &bull; [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/code_of_conduct.md) &bull; [MIT License](https://gh.io/mit) </footer> ", Assign "at most 3 tags" to the expected json: {"id":"6029","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"