Skip to content

Commit 21a1954

Browse files
author
owen-jones-diffblue
authored
Merge pull request diffblue#478 from diffblue/owen-jones-diffblue/webgoat-script-extra-lesson
Add CrossSiteScriptingLesson5a to WebGoat script
2 parents 53c1efd + df458a0 commit 21a1954

File tree

3 files changed

+221
-6
lines changed

3 files changed

+221
-6
lines changed

‎benchmarks/GENUINE/WebGoat.sh

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ if [ -z "$SECURITY_SCANNER_HOME" ]; then
55
exit 1
66
fi
77

8-
LESSONS_WHICH_WORK='SqlInjectionLesson5a SqlInjectionLesson5b SqlInjectionLesson6a SqlInjectionLesson12a SqlInjectionChallenge Assignment5 Assignment6 CrossSiteScriptingLesson5a SimpleXXE BlindSendFileAssignment'
9-
LESSONS_WHICH_DO_NOT_WORK='CrossSiteScriptingLesson5a Assignment3 ContentTypeAssignment VulnerableComponentsLesson MissingFunctionACUsers'
8+
# Two sets of lessons which work depending on which rules file to use
9+
LESSONS_WHICH_WORK_SQL='SqlInjectionLesson5a SqlInjectionLesson5b SqlInjectionLesson6a SqlInjectionLesson12a SqlInjectionChallenge Assignment5 Assignment6 SimpleXXE BlindSendFileAssignment'
10+
LESSONS_WHICH_WORK_XSS='CrossSiteScriptingLesson5a'
11+
LESSONS_WHICH_DO_NOT_WORK='Assignment3 ContentTypeAssignment VulnerableComponentsLesson MissingFunctionACUsers'
1012

1113
# Stop script if a command does not succeed
1214
set -e
@@ -50,10 +52,25 @@ fi
5052
# Run security-analyser on each lesson which works separately
5153
cd $SECURITY_SCANNER_HOME
5254

53-
for LESSON in $LESSONS_WHICH_WORK
55+
for LESSON in $LESSONS_WHICH_WORK_SQL
5456
do
5557
python3 $SCRIPT_DIR/../../driver/run.py \
56-
-C $SCRIPT_DIR/WebGoatRules.json \
58+
-C $SCRIPT_DIR/WebGoatRulesSQL.json \
59+
-I $DEPLOY_DIR \
60+
-L $DEPLOY_DIR \
61+
-R $OUTPUT_DIR/WebGoat/results/$LESSON \
62+
-T $OUTPUT_DIR/WebGoat/temp \
63+
--name WebGoat \
64+
--use-models-library \
65+
--timeout 10000000 --verbosity 9 --rebuild \
66+
--do-not-use-precise-access-paths \
67+
--entry-point Main.$LESSON
68+
done
69+
70+
for LESSON in $LESSONS_WHICH_WORK_XSS
71+
do
72+
python3 $SCRIPT_DIR/../../driver/run.py \
73+
-C $SCRIPT_DIR/WebGoatRulesXSS.json \
5774
-I $DEPLOY_DIR \
5875
-L $DEPLOY_DIR \
5976
-R $OUTPUT_DIR/WebGoat/results/$LESSON \

‎benchmarks/GENUINE/WebGoatRulesSQL.json

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Incoming accountName is potentially dangerous.",
7+
"class": "Main",
8+
"method": "makeTainted:(Ljava/lang/String;)Ljava/lang/String;",
9+
"result": {
10+
"location": "returns",
11+
"taint": "Tainted string"
12+
}
13+
},
14+
{
15+
"comment": "Appending a potentially tainted string into the StringBuilder instance. Making the builder tainted.",
16+
"class": "java.lang.StringBuilder",
17+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
18+
"input": {
19+
"location": "arg1",
20+
"taint": "Tainted string"
21+
},
22+
"result": {
23+
"location": "this",
24+
"taint": "Tainted string builder"
25+
}
26+
},
27+
{
28+
"comment": "Conversion of potentially tainted data in the StringBuilder to a potentially tainted string.",
29+
"class": "java.lang.StringBuilder",
30+
"method": "toString:()Ljava/lang/String;",
31+
"input": {
32+
"location": "this",
33+
"taint": "Tainted string builder"
34+
},
35+
"result": {
36+
"location": "return_value",
37+
"taint": "Tainted string"
38+
}
39+
},
40+
{
41+
"comment": "Appends StringBuilder-built tainted string into the StringBuffer for returning.",
42+
"class": "java.lang.StringBuffer",
43+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuffer;",
44+
"input": {
45+
"location": "arg1",
46+
"taint": "Tainted string"
47+
},
48+
"result": {
49+
"location": "this",
50+
"taint": "Tainted string buffer"
51+
}
52+
},
53+
{
54+
"comment": "A string obtained from a tainted StringBuffer is tainted.",
55+
"class": "java.lang.StringBuffer",
56+
"method": "toString:()Ljava/lang/String;",
57+
"input": {
58+
"location": "this",
59+
"taint": "Tainted string buffer"
60+
},
61+
"result": {
62+
"location": "return_value",
63+
"taint": "Tainted string"
64+
}
65+
},
66+
{
67+
"comment": "An SQL statement is tainted by a tainted string.",
68+
"class": "java.sql.Connection",
69+
"method": "prepareStatement:(Ljava/lang/String;)Ljava/sql/PreparedStatement;",
70+
"input": {
71+
"location": "arg1",
72+
"taint": "Tainted string"
73+
},
74+
"result": {
75+
"location": "return_value",
76+
"taint": "Tainted SQL statement"
77+
}
78+
},
79+
{
80+
"comment": "An SQL statement is tainted by a tainted string.",
81+
"class": "java.sql.PreparedStatement",
82+
"method": "setString:(ILjava/lang/String;)V",
83+
"input": {
84+
"location": "arg2",
85+
"taint": "Tainted string"
86+
},
87+
"result": {
88+
"location": "this",
89+
"taint": "Tainted SQL statement"
90+
}
91+
},
92+
93+
94+
{
95+
"comment": "A StringReader instance becomes tainted by initialisation on a tainted string.",
96+
"class": "java.io.StringReader",
97+
"method": "<init>:(Ljava/lang/String;)V",
98+
"input": {
99+
"location": "arg1",
100+
"taint": "Tainted string"
101+
},
102+
"result": {
103+
"location": "this",
104+
"taint": "Tainted string reader"
105+
}
106+
},
107+
{
108+
"comment": "A StringReader instance becomes wrapped by HierarchicalStreamReader.",
109+
"class": "com.thoughtworks.xstream.io.HierarchicalStreamDriver",
110+
"method": "createReader:(Ljava/io/StringReader;)Lcom/thoughtworks/xstream/io/HierarchicalStreamReader;",
111+
"input": {
112+
"location": "arg1",
113+
"taint": "Tainted string reader"
114+
},
115+
"result": {
116+
"location": "return_value",
117+
"taint": "Tainted string reader"
118+
}
119+
},
120+
{
121+
"comment": "A string reader is 'unmarshaled' into a tainted object.",
122+
"class": "com.thoughtworks.xstream.MarshallingStrategy",
123+
"method": "unmarshal:(Ljava/lang/Object;Lcom/thoughtworks/xstream/io/HierarchicalStreamReader;Lcom/thoughtworks/xstream/converters/DataHolder;Lcom/thoughtworks/xstream/converters/ConverterLookup;Lcom/thoughtworks/xstream/mapper/Mapper;)Ljava/lang/Object;",
124+
"input": {
125+
"location": "arg2",
126+
"taint": "Tainted string reader"
127+
},
128+
"result": {
129+
"location": "return_value",
130+
"taint": "Tainted object"
131+
}
132+
},
133+
{
134+
"comment": "A tainted XML string is parsed into a tainted object.",
135+
"class": "com.thoughtworks.xstream.XStream",
136+
"method": "fromXML:(Ljava/lang/String;)Ljava/lang/Object;",
137+
"input": {
138+
"location": "arg1",
139+
"taint": "Tainted string"
140+
},
141+
"result": {
142+
"location": "return_value",
143+
"taint": "Tainted object"
144+
}
145+
},
146+
{
147+
"comment": "Calling 'toString' on a tainted object is a tainted string.",
148+
"class": "java.lang.Object",
149+
"method": "toString:()Ljava/lang/String;",
150+
"input": {
151+
"location": "this",
152+
"taint": "Tainted object"
153+
},
154+
"result": {
155+
"location": "return_value",
156+
"taint": "Tainted string"
157+
}
158+
},
159+
{
160+
"comment": "Result builder becomes tainted by a tainted string.",
161+
"class": "javax.xml.stream.XMLInputFactory",
162+
"method": "createXMLStreamReader:(Ljava/io/Reader;)Ljavax/xml/stream/XMLStreamReader;",
163+
"sinkTarget": {
164+
"location": "arg1",
165+
"taint": "Tainted string reader"
166+
}
167+
},
168+
{
169+
"comment": "Executing a tainted query is a sink.",
170+
"class": "java.sql.PreparedStatement",
171+
"method": "executeQuery:()Ljava/sql/ResultSet;",
172+
"sinkTarget": {
173+
"location": "this",
174+
"taint": "Tainted SQL statement"
175+
}
176+
},
177+
{
178+
"comment": "Executing a tainted query is a sink.",
179+
"class": "java.sql.Statement",
180+
"method": "executeQuery:(Ljava/lang/String;)Ljava/sql/ResultSet;",
181+
"sinkTarget": {
182+
"location": "arg1",
183+
"taint": "Tainted string"
184+
}
185+
},
186+
187+
188+
{
189+
"comment": "ARTIFICIAL sink (for debug purposes; not used directly in Webgoat).",
190+
"class": "org.owasp.webgoat.plugin.challenge3.Assignment3",
191+
"method": "sink:(Ljava/lang/String;)V",
192+
"sinkTarget": {
193+
"location": "arg0",
194+
"taint": "Tainted string"
195+
}
196+
}
197+
]
198+
}

‎benchmarks/GENUINE/WebGoatRules.json renamed to ‎benchmarks/GENUINE/WebGoatRulesXSS.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@
168168
{
169169
"comment": "Result builder becomes tainted by a tainted string.",
170170
"class": "org.owasp.webgoat.assignments.AttackResult$AttackResultBuilder",
171-
"method": "output_XXXXXX:(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult$AttackResultBuilder;",
171+
"method": "output:(Ljava/lang/String;)Lorg/owasp/webgoat/assignments/AttackResult$AttackResultBuilder;",
172172
"sinkTarget": {
173173
"location": "arg1",
174174
"taint": "Tainted string"
@@ -177,7 +177,7 @@
177177
{
178178
"comment": "Result builder becomes tainted by a tainted string.",
179179
"class": "org.owasp.webgoat.assignments.AttackResult$AttackResultBuilder",
180-
"method": "feedbackArgs_XXXXXX:([Ljava/lang/Object;)Lorg/owasp/webgoat/assignments/AttackResult$AttackResultBuilder;",
180+
"method": "feedbackArgs:([Ljava/lang/Object;)Lorg/owasp/webgoat/assignments/AttackResult$AttackResultBuilder;",
181181
"sinkTarget": {
182182
"location": "arg1",
183183
"taint": "Tainted array"

0 commit comments

Comments
 (0)