Skip to content

Commit 155e841

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#377 from diffblue/introduce_rules_files_for_dspace
SEC-352: Introduced rules JSON file for DSPACE.
2 parents 03870ff + 4b80cac commit 155e841

File tree

1 file changed

+223
-0
lines changed

1 file changed

+223
-0
lines changed

‎benchmarks/GENUINE/DSpace_rules.json

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Obtained ServletRequest's attribute with potentially tainted data.",
7+
"class": "javax.servlet.http.HttpServletRequest",
8+
"method": "getAttribute:(Ljava/lang/String;)Ljava/lang/Object;",
9+
"result": {
10+
"location": "returns",
11+
"taint": "Tainted request attribute"
12+
}
13+
},
14+
{
15+
"comment": "Obtained ServletRequest's poarameter with potentially tainted data.",
16+
"class": "javax.servlet.http.HttpServletRequest",
17+
"method": "getParameter:(Ljava/lang/String;)Ljava/lang/String;",
18+
"result": {
19+
"location": "returns",
20+
"taint": "Tainted string"
21+
}
22+
},
23+
24+
25+
26+
27+
{
28+
"comment": "Obtained stream from the tainted request attribute.",
29+
"class": "org.apache.commons.fileupload.FileItem",
30+
"method": "getInputStream:()Ljava/io/InputStream;",
31+
"input": {
32+
"location": "this",
33+
"taint": "Tainted request attribute"
34+
},
35+
"result": {
36+
"location": "returns",
37+
"taint": "Tainted input stream"
38+
}
39+
},
40+
{
41+
"comment": "Trimmed tainted string remains tainted.",
42+
"class": "org.apache.commons.lang3.StringUtils",
43+
"method": "trimToNull:(Ljava/lang/String;)Ljava/lang/String;",
44+
"input": {
45+
"location": "arg0",
46+
"taint": "Tainted string"
47+
},
48+
"result": {
49+
"location": "returns",
50+
"taint": "Tainted string"
51+
}
52+
},
53+
{
54+
"comment": "Writing content of a tainted stream to disk is a sink.",
55+
"class": "java.nio.file.Files",
56+
"method": "copy:(Ljava/io/InputStream;Ljava/nio/file/Path;[Ljava/nio/file/CopyOption;)J",
57+
"sinkTarget": {
58+
"location": "arg0",
59+
"vulnerability": "Tainted input stream"
60+
}
61+
},
62+
63+
{
64+
"comment": "Streams returned by getInputStream on ServletRequest are tainted",
65+
"class": "training07.HttpServletRequest",
66+
"method": "getInputStream:()Ltraining07/InputStream;",
67+
"result": {
68+
"location": "returns",
69+
"taint": "Tainted stream"
70+
}
71+
},
72+
{
73+
"comment": "Read up to exact number of bytes from tainted stream gives tainted array of bytes",
74+
"class": "java.io.InputStream",
75+
"method": "read:([BII)I",
76+
"input": {
77+
"location": "this",
78+
"taint": "Tainted stream"
79+
},
80+
"result": {
81+
"location": "arg1",
82+
"taint": "Tainted byte array"
83+
}
84+
},
85+
{
86+
"comment": "Read some number of bytes from tainted stream gives tainted array of bytes",
87+
"class": "java.io.InputStream",
88+
"method": "read:([B)I",
89+
"input": {
90+
"location": "this",
91+
"taint": "Tainted stream"
92+
},
93+
"result": {
94+
"location": "arg1",
95+
"taint": "Tainted byte array"
96+
}
97+
},
98+
{
99+
"comment": "Writing potentially tainted bytes to a file stream is a sink.",
100+
"class": "java.io.FileOutputStream",
101+
"method": "write:([BII)V",
102+
"sinkTarget": {
103+
"location": "arg1",
104+
"taint": "Tainted byte array"
105+
}
106+
},
107+
{
108+
"comment": "Read from file channel gives tainted buffer of bytes.",
109+
"class": "java.nio.channels.FileChannel",
110+
"method": "read:(Ljava/nio/ByteBuffer;)I",
111+
"result": {
112+
"location": "arg1",
113+
"taint": "Tainted byte buffer"
114+
}
115+
},
116+
{
117+
"comment": "Read from tainted buffer of bytes gives a tainted string.",
118+
"class": "java.nio.ByteBuffer",
119+
"method": "toString:()Ljava/lang/String;",
120+
"input": {
121+
"location": "this",
122+
"taint": "Tainted byte buffer"
123+
},
124+
"result": {
125+
"location": "arg1",
126+
"taint": "Tainted string"
127+
}
128+
},
129+
{
130+
"comment": "Construction of string from an array of tainted bytes gives a tainted string.",
131+
"class": "java.lang.String",
132+
"method": "<init>:([BII)V",
133+
"input": {
134+
"location": "arg1",
135+
"taint": "Tainted byte array"
136+
},
137+
"result": {
138+
"location": "this",
139+
"taint": "Tainted string"
140+
}
141+
},
142+
{
143+
"comment": "Tainted string appended to a StringBuilder makes the builder tainted/",
144+
"class": "java.lang.StringBuilder",
145+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
146+
"input": {
147+
"location": "arg1",
148+
"taint": "Tainted string"
149+
},
150+
"result": {
151+
"location": "this",
152+
"taint": "Tainted string builder"
153+
}
154+
},
155+
{
156+
"comment": "A string returnded from a tainted StringBuilder is tainted.",
157+
"class": "java.lang.StringBuilder",
158+
"method": "toString:()Ljava/lang/String;",
159+
"input": {
160+
"location": "this",
161+
"taint": "Tainted string builder"
162+
},
163+
"result": {
164+
"location": "returns",
165+
"taint": "Tainted string"
166+
}
167+
},
168+
{
169+
"comment": "Tainted string with some replaced cheracters remains tainted.",
170+
"class": "java.lang.String",
171+
"method": "replaceAll:(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
172+
"input": {
173+
"location": "arg0",
174+
"taint": "Tainted string"
175+
},
176+
"result": {
177+
"location": "returns",
178+
"taint": "Tainted string"
179+
}
180+
},
181+
{
182+
"comment": "Substring of a tainted string remains tainted.",
183+
"class": "java.lang.String",
184+
"method": "substring:(II)Ljava/lang/String;",
185+
"input": {
186+
"location": "this",
187+
"taint": "Tainted string"
188+
},
189+
"result": {
190+
"location": "returns",
191+
"taint": "Tainted string"
192+
}
193+
},
194+
195+
196+
{
197+
"comment": "Storing tainted string in a list; making the list tainted.",
198+
"class": "java.util.List",
199+
"method": "add:(Ljava/lang/Object;)Z",
200+
"input": {
201+
"location": "arg1",
202+
"taint": "Tainted string"
203+
},
204+
"result": {
205+
"location": "this",
206+
"taint": "Tainted list"
207+
}
208+
},
209+
{
210+
"comment": "Converting tainted list to an array.",
211+
"class": "java.util.List",
212+
"method": "toArray:()[Ljava/lang/Object;",
213+
"input": {
214+
"location": "this",
215+
"taint": "Tainted list"
216+
},
217+
"result": {
218+
"location": "returns",
219+
"taint": "Tainted array"
220+
}
221+
}
222+
]
223+
}

0 commit comments

Comments
 (0)