Skip to content

Commit 5e11686

Browse files
JohnDumbellJohnDumbell
authored
Merge pull request diffblue#441 from diffblue/feature/citeseerx_script
[SEC-435] Adds in script to download & patch CiteSeerX then run SA on it
2 parents 7c52fe4 + fee9518 commit 5e11686

File tree

3 files changed

+196
-0
lines changed

3 files changed

+196
-0
lines changed

‎benchmarks/GENUINE/CiteSeerX.sh

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/usr/bin/env bash
2+
3+
if [ $1 ]; then
4+
SECURITY_SCANNER_HOME=$1
5+
fi
6+
7+
if [ -z "$SECURITY_SCANNER_HOME" ]; then
8+
echo "Need to set SECURITY_SCANNER_HOME to cmake directory"
9+
exit 1
10+
fi
11+
12+
SCRIPT_WORKING_DIR=$(pwd)
13+
REPO_DIR=$SCRIPT_WORKING_DIR/CiteSeerX
14+
15+
# Clone repo and check out a commit which builds (head of master)
16+
cd $REPO_DIR
17+
git clone https://github.com/SeerLabs/CiteSeerX.git .
18+
git checkout 8a62545ffc904f2b41b4ecd30ce91900dc7790f4
19+
20+
# There are some example 'template' files that we need to rename to build correctly
21+
rename 's/\.template//' conf/*.template
22+
23+
# Apply the git patch to remove sanitization of query
24+
patch -p1 -f < $SCRIPT_WORKING_DIR/CiteSeerX_files/introduce_XXS_vulnerability.patch
25+
26+
# Build
27+
ant
28+
29+
# Run security-analyser
30+
cd $SECURITY_SCANNER_HOME
31+
32+
python3 $SCRIPT_WORKING_DIR/../../driver/run.py \
33+
-C $SCRIPT_WORKING_DIR/CiteSeerXRules.json \
34+
-I $REPO_DIR \
35+
-L $REPO_DIR \
36+
-R $SCRIPT_WORKING_DIR/CiteSeerX.results \
37+
-T $SCRIPT_WORKING_DIR/CiteSeerX.tmp \
38+
--name CiteSeerX --verbosity 9 \
39+
--use-models-library \
40+
--timeout 10000000 \
41+
--entry-point edu.psu.citeseerx.web.SearchController.handleRequest \
42+
--do-not-use-precise-access-paths \
43+
--dump-html-program \
44+
--dump-html-summaries \
45+
--dump-html-statistics \
46+
--rebuild \

‎benchmarks/GENUINE/CiteSeerXRules.json

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"class": "org.springframework.web.bind.ServletRequestUtils",
7+
"method": "getStringParameter:(Ljavax/servlet/ServletRequest;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
8+
"result": {
9+
"location": "returns",
10+
"taint": "Tainted string"
11+
}
12+
},
13+
{
14+
"class": "java.util.HashMap",
15+
"method": "put:(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;",
16+
"input": {
17+
"location": "arg2",
18+
"taint": "Tainted string"
19+
},
20+
"result": {
21+
"location": "this",
22+
"taint": "Tainted map"
23+
}
24+
},
25+
{
26+
"class": "java.util.HashMap",
27+
"method": "get:(Ljava/lang/Object;)Ljava/lang/Object;",
28+
"input": {
29+
"location": "this",
30+
"taint": "Tainted map"
31+
},
32+
"result": {
33+
"location": "returns",
34+
"taint": "Tainted string"
35+
}
36+
},
37+
{
38+
"class": "org.jsoup.Jsoup",
39+
"method": "clean:(Ljava/lang/String;Lorg/jsoup/safety/Whitelist;)Ljava/lang/String;",
40+
"sanitizes": {
41+
"location": "returns",
42+
"taint": "Tainted string"
43+
}
44+
},
45+
{
46+
"class": "java.lang.String",
47+
"method": "replaceAll:(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
48+
"input": {
49+
"location": "this",
50+
"taint": "Tainted string"
51+
},
52+
"result": {
53+
"location": "returns",
54+
"taint": "Tainted string"
55+
}
56+
},
57+
{
58+
"class": "java.lang.StringBuilder",
59+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
60+
"input": {
61+
"location": "arg1",
62+
"taint": "Tainted string"
63+
},
64+
"result": {
65+
"location": "returns",
66+
"taint": "Tainted string builder"
67+
}
68+
},
69+
{
70+
"class": "java.lang.StringBuilder",
71+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
72+
"input": {
73+
"location": "arg1",
74+
"taint": "Tainted string"
75+
},
76+
"result": {
77+
"location": "this",
78+
"taint": "Tainted string builder"
79+
}
80+
},
81+
{
82+
"class": "java.lang.StringBuilder",
83+
"method": "toString:()Ljava/lang/String;",
84+
"input": {
85+
"location": "this",
86+
"taint": "Tainted string builder"
87+
},
88+
"result": {
89+
"location": "returns",
90+
"taint": "Tainted string"
91+
}
92+
},
93+
{
94+
"class": "java.lang.StringBuffer",
95+
"method": "<init>:(Ljava/lang/String;)V",
96+
"input": {
97+
"location": "arg1",
98+
"taint": "Tainted string"
99+
},
100+
"result": {
101+
"location": "this",
102+
"taint": "Tainted string buffer"
103+
}
104+
},
105+
{
106+
"class": "java.lang.StringBuffer",
107+
"method": "toString:()Ljava/lang/String;",
108+
"input": {
109+
"location": "this",
110+
"taint": "Tainted string buffer"
111+
},
112+
"result": {
113+
"location": "returns",
114+
"taint": "Tainted string"
115+
}
116+
},
117+
{
118+
"class": "org.springframework.web.servlet.ModelAndView",
119+
"method": "<init>:(Ljava/lang/String;Ljava/util/Map;)V",
120+
"sinkTarget": {
121+
"location": "arg2",
122+
"vulnerability": "Tainted map"
123+
}
124+
}
125+
]
126+
}

‎benchmarks/GENUINE/CiteSeerX_files/introduce_XXS_vulnerability.patch

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Index: CiteSeerX/src/java/edu/psu/citeseerx/web/SearchController.java
2+
IDEA additional info:
3+
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
4+
<+>UTF-8
5+
===================================================================
6+
--- CiteSeerX/src/java/edu/psu/citeseerx/web/SearchController.java (date 1520977748000)
7+
+++ CiteSeerX/src/java/edu/psu/citeseerx/web/SearchController.java (date 1528210112000)
8+
@@ -219,12 +219,11 @@
9+
String queststr = null;
10+
String quest_organic = ServletRequestUtils.getStringParameter(request,
11+
QUERY_PARAMETER, null);
12+
- if (quest_organic != null) {
13+
- queststr = Jsoup.clean(quest_organic, Whitelist.none());
14+
-
15+
- }
16+
+// if (quest_organic != null) {
17+
+// queststr = Jsoup.clean(quest_organic, Whitelist.none());
18+
+// }
19+
20+
- queryParameters.put(QUERY_PARAMETER, queststr);
21+
+ queryParameters.put(QUERY_PARAMETER, quest_organic);
22+
queryParameters.put(QUERY_TYPE,
23+
ServletRequestUtils.getStringParameter(request, QUERY_TYPE,
24+
DOCUMENT_QUERY));

0 commit comments

Comments
 (0)