This forum is provided to promote discussion amongst students enrolled in
CITS3007 Secure Coding.
If posting a question, it's suggested you check first whether your question
is answered in the unit Frequently Asked Questions (FAQ) list, and use the search box
(on the right) to see if an answer to your question has already been posted.
Please consider offering answers and suggestions to help other students!
And if you fix a problem by following a suggestion here,
it would be great if other interested students could see a short
"Great, fixed it!" followup message.
Hi Joel,
Unfortunately not - though I'd love to have project marks and feedback available before the exam, I'm constrained by the marking resources available to me.
Cheers
Arran
Hi,
Sure, just email me - you're correct, the late submissions area isn't open by default. (If I make it open by default, Moodle starts warning all the people with on-time submissions that they have an assessment due.)
Cheers
Arran
Hi Arran,
I have decided to submit again, but I've discovered that the late project submissions area of Moodle is not open for me to submit. I've seen in an earlier thread that you've fixed it for others, but maybe it is not working for me because I d...
Hi,
The cli function is expected to print output to stdout and stderr, so printing to those file-streams won't interfere with the marking scripts. The marking scripts capture your function's output by creating in-memory "files" using memfd create(...
Hi Shashwat,
That's not what the Moodle logs say. They say that you were still using the testbed area up until 4 58 01 PM. At 4 59 55 PM, you opened the project submission area for the first time ever. And at 5 00 pm, having failed to make a submissi...
Somehow, I have only just remembered that there is a difference between stdout and stderr. My project code has been printing error messages to stdout. Would this interfere with the marking scripts, and is it worth putting in a late submission now tha...
I submitted my code on moddle however, it kicked me out and didnt save my code. Now it is not letting me submit anything or open the submission.
Please help
Would you be willing to restate the answer, or link the previously given response? I've made an honest effort to look through the help forum, but there's only so many vaguely titled articles I can trawl through before losing my mind.
Thanks
It's nearly always a good idea to include newlines at the end of output to stdout or stderr.
Besides the fact that it makes the output more legible, output to a file stream is buffered - see here
https www.gnu.org software libc manual html node B...
Hi,
Are we able to use newlines at the end of our stderr message? I am aware that we should for the stdout outputs but I would like to make sure for stderr, given the automated marking system.
Thank you
Hoping to get some clarification as to how we should be handling cases where an out of range int is passed into the caesar functions.
From crypto.h, we know that a precondition of key is that it must fall within the range of (range low - range hig...
Answered off-forum.
But in brief what we're writing in the project isn't really a program , but a library (admittedly a very small one) - a set of functions serving some common purpose. So as library maintainers, we can just declare caesar decry...
This student contacted me off-forum, so I won't make a full reply here, but briefly
- Anything from the lectures is non-normative (https developer.mozilla.org en-US docs Glossary Non-normative) - it's the project spec you should be working off
- Wh...
An addition to this question is how the similar pre condition for Caesar works if a key outside the range of -26 and 26 is passed, do we modulo to bring it back into range, or check this condition before calling the function and return? To me it see...
Based on the project spec and the most recent lecture, the vigenere function can accept a key that contains both numbers and letters. What is the expected logic to process such a key, and could you please explain how this would allowed with the pre c...
Reimplementing the logic seems unecessary and redundant, as suitable code already exists in another function. It potentially also improves the readability of the function. On the other hand, it prevents any potential separation of caesar decrypt from...
Hi Luke,
That doesn't sound right. Where do you see that stipulation? Can you please give the relevant part of the project specification? Also, can you clarify, what do you mean by "the program"? The specification doesn't ask you to submit a "program"...
For this assignment the stipulation is that if the program is detected to fail we abort it and return 1, the standard practice of saying that a program encountered an error. A lot has been said about the assert function which I'm wondering if we are...
Hi Hugo.
Well, where are you getting the requirement from that the Vigen re key shouldn't contain digits or characters outside the range? That might provide some clue as to how a violation needs to be handled.
Cheers
Arran
Hi Arran,
What should happen if the vigenere key contains digits or characters that are outside the range? Should a string like "abcd9" be rejected? What about "abcd "?
Thanks in advance
Hi,
No worries. To clarify just paste your implementations (including any documentation for cli ) into Moodle. As the header file itself says, it isn't to be submitted, so just include your documentation block for cli with the source. (It's common t...
Hi,
Well, really it's up to you to apply your best understanding of appropriate software development principles, and decide this for yourself. But perhaps expand on your thinking here, a little bit - can you suggest reasons for or against calling cae...
Hi,
They don't need to be explicitly called, no. (You can if you want, but tbh it makes the code rather awkward.) The intent is just for you to make use of the logic you came up with while implementing the Caesar functions my apologies, the spec...
Hi,
I assume you mean "the submission area", not "the test area".
It works by compiling your code using GCC, and then linking it against a "main.c" file which calls the implemented functions. If the code fails to compile or link, then that indicates th...
Forgive my confusion, but I'm just curious as to how our code and header file (assuming that this needs to be submitted due to the documentation requirement of cli() ) need to be submitted via Moodle.
Will there be two fields, one where we paste the C...
Hi all,
I've enable a "testbed" area in Moodle as well. It's no substitute for running your own tests (with sanitizers enabled, and at varying optimization levels), and if you rely on it solely, you may well miss errors in your code. But it's there fo...
Hi,
Are we allowed to call caesar-encrypt with a sign change for the key (ie negative to positive or positive to negative) within the caesar-decrypt function? This is my interpretation of "Calling it with some key n is exactly equivalent to calling ca...
Hi Arron,
how the test area works, I made mine into 2 files crypto.c main.c , also I provided make file
how I can test it now OR that's mean I should change all my work into only one c file ??
Hi Arran,
In the project spec it says the following We will first implement the Caesar cipher (functions
caesar encrypt and caesar decrypt), and then make use of those functions to implement the Vigenere cipher.
I want to know whether the caesar encryp...
Hi Spencer,
The cli function is an important deliverable for the project, and is definitely not "just for" testing You may want to review last week's lecture, since I discussed the cli function and its purpose in a reasonable amount of detail.
Als...
Hi Spencer,
I'll enable the test sandbox shortly. But really, you shouldn't rely on it, and it won't help you much. The project spec and the labs make it clear that part of the work of the project is for students to make use of sanitizers, static anal...
The other two questions still stand, but I just remembered that the user can call the functions and cli is just for testing, please ignore the second question.
Hi I just have a couple questions for the project submission,
First, is the project submission section the sandbox we can use? And will we be able to take multiple "attempts" at submitting because it looks like a test format and I want to be sure befo...
Hi,
If anyone has suggestions for addressing this problem, feel free to post.
It's not something I'm able to assist with at the moment, as there is not nearly enough information to go on the name of the signal that caused an error isn't sufficient,...
Hi,
Apologies for the delay. The submission area is available on Moodle. I'll also enable the test area - but bear in mind that it won't substitute for your own testing.
cheers
Arran
ANONYMOUS wrote
Hey everyone, hope your doing well )
I have a query about this address sanitizer error (AddressSanitizer DEADLYSIGNAL). I keep getting this error in my code, even after I have continuously tested it over and over again.
Interestingly, I tried running ...
Hi Arran,
I hope you're well I'm just enquiring about whether the sandbox and the final submission have been made public yet on the Moodle, because currently I'm not able to view it if it is.
Thank you for your help
Hi all,
The revised project spec is available there are a few minor improvements to wording, but other than that, no very significant changes beyond what's already been flagged in this forum.
You can see the exact changes made to the spec document ...
Hi
ANONYMOUS wrote
Well, based on what was said in the lecture, what do you think? What's your interpretation, and if there are bits of the lecture you didn't understand, what exactly were they? Feel free to give timestamps to exact positions in the ...
Hey Arran,
I was reading through crypto.h and I saw the preconditions. Is this for us to worry about, or does the caller of the function have to worry about these preconditions? In the lecture slides, it states "should we assert() that the preconditio...
Hi,
A couple of things.
The reason you're getting warnings is because the code you're compiling is not, in fact, from the spec. Check the compiler messages carefully You've said you're trying to compile this
fragment A
char cipher text sizeo...
I was trying to run this section of the code from the project outline.
This is the code I was trying to run
char plain text "HELLOWORLD";
char cipher text sizeof(plain text) 0 ;
caesar encrypt('A', 'Z', 3, plain text, cipher text);
I compil...
Hi,
It's entirely up to you how you organize your code. What you need to submit is definitions for the 5 required functions (and any helper functions you might define). Anything extra you submit will be ignored, unless it hinders readability or causes...
Hi,
Just to clarify, my suggestion was that you come up with (ideally multiple) ways the apparent contradiction might be resolved the idea here is for students to actively engage with the project specification, and think about how project requirem...
Just "Arran" is fine.
I'm going to ask you to reflect a bit more on your question. Can you think of any ways of resolving this possible contradiction? What are they? Suggest some ideas.
Cheers
Arran
Hello Sir,
If using assert() to check preconditions, doesn't this go against the project specification where it says never print to standard out or standard error? As I think assert() does print to stderr.
Thanks
Gotcha - the crypto.h version is the correct one (for the reasons I gave - the output parameter comes last).
So that's how you need to code your implementation - does that help?
Cheers
Arran
Hi Arran,
Apologies, I copied the wrong function in my initial question,
In the pdf the caesar decrypt declaration has plain text before cipher text
void caesar decrypt(char range low, char range high, int key, const char plain text, char cipher te...
Hi,
Sure, that sounds mostly right. The code really should be pretty easy, so there should be plenty of time to focus on making sure your code is correct, covers edge cases, and is clear and understandable. Therefore markers will expect a fairly hig...
Hi,
I'll amend the spec to clarify this the key must fall in the "encryptable range" specified by range low and range high . For each letter of the plaintext which is to be encrypted, we work out an appropriate caesar cipher by subtracting low ra...
Hi Taylah,
No, that's not a typo. Typically in related functions, we put input and output parameters in a consistent order. In the encryption function, cipher text is an output. But in the decryption function, plain text is the input, and ciphe...
Hi,
I think you may have a fairly major misunderstanding of the project specification and the header file you're provided with. My first suggestion would be to first make sure you've read through the whole of the specification and the provided heade...
Hi all, Just checking if I understand the project right,
so we need to implement encryption and decryption functions for both the Caesar and Vigenere ciphers, following the provided specifications in the crypto.h header file. Additionally, we'll crea...
Hey I think I've found another typo.
In the pdf the caesar decrypt declaration has plain text before cipher text
void caesar decrypt(char range low, char range high, int key, const char plain text, char cipher text);
But crypto.h has them the other...
Hey I think I've found another typo.
In the pdf the caesar decrypt declaration has plain text before cipher text
void caesar encrypt(char range low, char range high, int key, const char plain text, char cipher text);
But crypto.h has them the other...
Hi,
Can the key for the Vigenere encrypt and decrypt functions have spaces or punctuation characters in it? Or does it have to be a stream of alphabets? The project spec doesn't mention anything about this..
Hi,
I don't understand what the function call would look like if we were including punctuation within the range.
Would you be able to provide an example of this?
Thanks.
Hi Arran,
I found this function declaration in crypto.h
void vigenere decrypt(char range low, char range high, int key, const char cipher text, char plain text);
can I assume that the key is supposed to be passed as a string instead of an int?...
No worries. Just to explain why it's done this way often, example presentations of e.g. the Caesar cipher will operate only on uppercase alphabetic characters, and everything else is "passed through". But sometimes you might want to treat, say, pu...
Hi again,
Yes, sorry for not clarifying, the section that you mentioned is what I was referring to. My understanding is that we should encrypt and decrypt according to those range low and range high values, incorporating wraparound. I have since had a...
Hi,
Can you clarify, what part of the spec or code are you referring to, when you say "The project only mentions that the plain text must be between this range"? I can't spot anything in the spec which imposes such a requirement.
Amongst other things, ...
Hi,
Are we able to assume that the given range does not apply to the output of an encrypt function call or do we need to fit the output of the function to match this range?
For example, if encrypting from 'A' to 'Z', can the cipher text go outside thes...
Hi all,
The project spec is now available on the website at https cits3007.github.io assessment project , together with a zipped header file.
I've adjusted the due date to 23 May (week 12), as I wanted to allow more than 2 weeks to do it in. Studen...
Hi Hugo,
Apologies for the delay. Yes, the project will be out tomorrow morning - and I'll extend the deadline by a week. (I'll amend the dates on the website shortly.)
Cheers
Arran
Hi Arran,
I have two questions about the project
- Will it be released this week?
- Will it be due on the 16th of May like the unit outline says?
Thankyou in advance