Merge pull request diffblue#419 from diffblue/integrate_webgoat_to_genuine_benchmarks

SEC-33: Integrate webgoat to genuine benchmarks

Author: marek-trtik

benchmarks/GENUINE/.gitignore

@@ -1,6 +1,7 @@
 RESULTS
 TEMP
 
+WebGoat
 Alfresco
 DSpace
 encuestame

benchmarks/GENUINE/README.txt

@@ -18,6 +18,62 @@ For each benchmark there is a detailed installation guide and a short textual
 description of the application below.
 
 
+(0) WebGoat
+------------
+
+WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web 
+application security lessons.
+
+This program is a demonstration of common server-side application flaws. The exercises are 
+intended to be used by people to learn about application security and penetration testing 
+techniques.
+
+Repository: https://github.com/WebGoat/WebGoat
+
+Install guide for Ubuntu:
+
+  1. git clone [email protected]:WebGoat/WebGoat.git
+  2. cd WebGoat
+  3. git checkout develop
+  4. (optional) Open the file:
+        ./WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/introduction/SqlInjectionLesson5a.java
+     and insert into the line 59 the following code:
+            static String makeTainted(String accountName) {
+                return accountName;
+            }
+
+            public void main() {
+                String test = makeTainted("dave");
+                completed(test);
+            }
+            
+     The code adds an artificial entry point (the function "main") and also
+     an artificial function "makeTainted" for making input to the function
+     "completed" tainted. The reason for "makeTainted" function is that the
+     WebGoat uses the Spring servlet framework which delivers the already 
+     potentially tainted data to the method "completed". But we do not have
+     any feature in our rules specification which would capture that.
+     
+     NOTE: the entry-point for the Python driver script should thus then be:
+         --entry-point org.owasp.webgoat.plugin.introduction.SqlInjectionLesson5a.main
+
+  4. mvn clean install -DskipTests
+  5. cd ..
+  6. rm -rf ./webgoat-container
+  
+The WebGoat does not seem to have a deployment step. Fortunately, the whole
+app is relatively small, so we can load everything for each lesson. It means
+that we can pass to the Python driver script these options:
+    -I <security-scanner-root-dir>/benchmarks/GENUINE/WebGoat
+    -L <security-scanner-root-dir>/benchmarks/GENUINE/WebGoat
+  
+General notes: The project is set up in a relatively standard way, likely to allow people to
+understand easily what's going on if they look at the code. The main vulnerabilities are
+in the webgoat-lessons folder, which holds server web service endpoints that then test if
+the pupils have managed to exploit the particular issue they are highlighting.
+
+This makes the traces trivial to detect and analyze.'
+
 
 (1) Alfresco
 ------------

benchmarks/GENUINE/WebGoatRules.json

@@ -0,0 +1,50 @@
+{
+  "namespace": "com.diffblue.security",
+  "rules":
+    [
+      {
+        "comment": "Incoming accountName is potentially dangerous.",
+        "class": "org.owasp.webgoat.plugin.introduction.SqlInjectionLesson5a",
+        "method": "makeTainted:(Ljava/lang/String;)Ljava/lang/String;",
+        "result": {
+          "location": "returns",
+          "taint": "Tainted string"
+        }
+      },
+      {
+        "comment": "Appending a potentially tainted string into the StringBuilder instance. Making the builder tainted.",
+        "class": "java.lang.StringBuilder",
+        "method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
+        "input": {
+          "location": "arg1",
+          "taint": "Tainted string"
+        },
+        "result": {
+          "location": "this",
+          "taint": "Tainted string builder"
+        }
+      },
+      {
+        "comment": "Conversion of potentially tainted data in the StringBuilder to a potentially tainted string.",
+        "class": "java.lang.StringBuilder",
+        "method": "toString:()Ljava/lang/String;",
+        "input": {
+          "location": "arg0",
+          "taint": "Tainted string builder"
+        },
+        "result": {
+          "location": "return_value",
+          "taint": "Tainted string"
+        }
+      },
+      {
+        "comment": "Executing a tainted query is a sink.",
+        "class": "java.sql.Statement",
+        "method": "executeQuery:(Ljava/lang/String;)Ljava/sql/ResultSet;",
+        "sinkTarget": {
+          "location": "arg1",
+          "taint": "Tainted string"
+        }
+      }
+    ]
+}