Skip to content

Commit 2a349a5

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#282 from diffblue/marek/splitting_test_tainted-string-type
SEC-142: Splitting composed regression test 'tainted-string-type' into 2 tests.
2 parents 184c8c0 + e848003 commit 2a349a5

File tree

12 files changed

+137
-79
lines changed

12 files changed

+137
-79
lines changed

‎regression/end_to_end/tainted-string-type/src/build.xml renamed to ‎regression/end_to_end/tainted-string-type-concat/build.xml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
<project name="Main" basedir="." default="jar">
1+
<project name="concat" basedir="." default="jar">
22

33
<property name="root.dir" value="./"/>
4-
<property name="src.dir" value="${root.dir}"/>
4+
<property name="src.dir" value="${root.dir}/src"/>
55
<property name="classes.dir" value="${root.dir}/build"/>
66
<property name="install.dir" value="${root.dir}/dist"/>
77

‎regression/end_to_end/tainted-string-type-concat/rules.json

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"rules": [
3+
{
4+
"comment": "Taint source",
5+
"id": "basic1_source",
6+
"class": "concat",
7+
"method": "source:()Ljava/lang/String;",
8+
"result": {
9+
"location": "return_value",
10+
"taint": "XXX"
11+
}
12+
},
13+
{
14+
"comment": "Cleans argument",
15+
"id": "basic1_sanitiser",
16+
"class": "concat",
17+
"method": "mark_clean:(Ljava/lang/String;)V",
18+
"sanitizes": {
19+
"location": "arg0",
20+
"taint": "XXX"
21+
}
22+
},
23+
{
24+
"comment": "Taint sink",
25+
"id": "basic1_sink",
26+
"class": "concat",
27+
"method": "sink:(Ljava/lang/String;)V",
28+
"sinkTarget": {
29+
"location": "arg0",
30+
"vulnerability": "XXX"
31+
}
32+
},
33+
{
34+
"comment": "Taint leaves StringBuilder",
35+
"id": "sb_tostring",
36+
"class": "java.lang.StringBuilder",
37+
"method": "toString:()Ljava/lang/String;",
38+
"input": {
39+
"location": "this",
40+
"taint": "SBXXX"
41+
},
42+
"result": {
43+
"location": "return_value",
44+
"taint": "XXX"
45+
}
46+
},
47+
{
48+
"comment": "Taint appended to StringBuilder",
49+
"id": "sb_append",
50+
"class": "java.lang.StringBuilder",
51+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
52+
"input": {
53+
"location": "arg1",
54+
"taint": "XXX"
55+
},
56+
"result": {
57+
"location": "this",
58+
"taint": "SBXXX"
59+
}
60+
},
61+
{
62+
"comment": "Taint preserved by substring operation",
63+
"id": "substring",
64+
"class": "java.lang.String",
65+
"method": "substring:(II)Ljava/lang/String;",
66+
"input": {
67+
"location": "this",
68+
"taint": "XXX"
69+
},
70+
"result": {
71+
"location": "return_value",
72+
"taint": "XXX"
73+
}
74+
}
75+
]
76+
}

‎regression/end_to_end/tainted-string-type/src/concat.java renamed to ‎regression/end_to_end/tainted-string-type-concat/src/concat.java

+8-4
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,23 @@
11
public class concat {
22

3+
public static void mark_clean(String x) { }
4+
public static String source() { return new String("Pure evil"); }
5+
public static void sink(String x) { }
6+
37
public static void main(int unknown) {
48

5-
String tainted = test.source();
9+
String tainted = source();
610
String untainted = "No worries here";
711
String taint_concat = tainted + " addition";
812
String taint_sub = taint_concat.substring(5, 10);
913

1014
String maybe_tainted = unknown == 100 ? taint_sub : untainted;
1115

1216
if(unknown == 200) {
13-
test.mark_clean(maybe_tainted);
14-
test.sink(maybe_tainted);
17+
mark_clean(maybe_tainted);
18+
sink(maybe_tainted);
1519
}
16-
test.sink(maybe_tainted);
20+
sink(maybe_tainted);
1721

1822
}
1923

‎regression/end_to_end/tainted-string-type/src/java/lang/String.java renamed to ‎regression/end_to_end/tainted-string-type-concat/src/java/lang/String.java

File renamed without changes.

‎regression/end_to_end/tainted-string-type/src/java/lang/StringBuilder.java renamed to ‎regression/end_to_end/tainted-string-type-concat/src/java/lang/StringBuilder.java

File renamed without changes.

‎regression/end_to_end/tainted-string-type-concat/test_tainted_string_type_concat.py

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import regression.end_to_end.driver as pipeline_executor
2+
import os.path
3+
import pytest
4+
import subprocess
5+
6+
7+
@pytest.mark.xfail
8+
def test_taint_crossing_substr_and_concatenation():
9+
with pipeline_executor.working_dir(os.path.abspath(os.path.dirname(__file__))):
10+
subprocess.call("ant")
11+
traces = pipeline_executor.run_security_analyser_pipeline(
12+
"dist/concat.jar",
13+
"rules.json",
14+
os.path.realpath(os.path.dirname(__file__)))
15+
assert traces.count_traces() > 0
16+
assert not traces.trace_exists("java::concat.main:(I)V", 18)
17+
assert traces.trace_exists("java::concat.main:(I)V", 20)

‎regression/end_to_end/tainted-string-type/build.xml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<project name="test" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}/src"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/test.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on" />
18+
</target>
19+
20+
<target name="clean">
21+
<delete dir="${classes.dir}"/>
22+
<delete dir="${install.dir}"/>
23+
</target>
24+
25+
26+
</project>
27+

‎regression/end_to_end/tainted-string-type/concat.jar

-2.62 KB
Binary file not shown.

‎regression/end_to_end/tainted-string-type/rules.json

-56
Original file line numberDiff line numberDiff line change
@@ -29,62 +29,6 @@
2929
"location": "arg0",
3030
"vulnerability": "XXX"
3131
}
32-
},
33-
{
34-
"comment": "Taint enters StringBuilder",
35-
"id": "sb_constructor",
36-
"class": "java.lang.StringBuilder",
37-
"method": "<init>:()V",
38-
"input": {
39-
"location": "arg0",
40-
"taint": "XXX"
41-
},
42-
"result": {
43-
"location": "this",
44-
"taint": "SBXXX"
45-
}
46-
},
47-
{
48-
"comment": "Taint leaves StringBuilder",
49-
"id": "sb_tostring",
50-
"class": "java.lang.StringBuilder",
51-
"method": "toString:()Ljava/lang/String;",
52-
"input": {
53-
"location": "this",
54-
"taint": "SBXXX"
55-
},
56-
"result": {
57-
"location": "return_value",
58-
"taint": "XXX"
59-
}
60-
},
61-
{
62-
"comment": "Taint appended to StringBuilder",
63-
"id": "sb_append",
64-
"class": "java.lang.StringBuilder",
65-
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
66-
"input": {
67-
"location": "arg1",
68-
"taint": "XXX"
69-
},
70-
"result": {
71-
"location": "this",
72-
"taint": "SBXXX"
73-
}
74-
},
75-
{
76-
"comment": "Taint preserved by substring operation",
77-
"id": "substring",
78-
"class": "java.lang.String",
79-
"method": "substring:(II)Ljava/lang/String;",
80-
"input": {
81-
"location": "this",
82-
"taint": "XXX"
83-
},
84-
"result": {
85-
"location": "return_value",
86-
"taint": "XXX"
87-
}
8832
}
8933
]
9034
}

‎regression/end_to_end/tainted-string-type/src/java/lang/StringBuilder.class

-388 Bytes
Binary file not shown.

‎regression/end_to_end/tainted-string-type/test.class

-855 Bytes
Binary file not shown.

‎regression/end_to_end/tainted-string-type/test_tainted_string_type.py

+7-17
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,14 @@
1-
2-
from regression.end_to_end.driver \
3-
import run_security_analyser_pipeline
4-
1+
import regression.end_to_end.driver as pipeline_executor
52
import os.path
6-
import pytest
3+
import subprocess
4+
75

86
def test_tainted_string():
9-
traces = run_security_analyser_pipeline(
10-
"test.class",
7+
with pipeline_executor.working_dir(os.path.abspath(os.path.dirname(__file__))):
8+
subprocess.call("ant")
9+
traces = pipeline_executor.run_security_analyser_pipeline(
10+
"dist/test.jar",
1111
"rules.json",
1212
os.path.realpath(os.path.dirname(__file__)))
1313
assert traces.count_traces() > 0
1414
assert traces.trace_exists("java::test.main:(I)V", 16)
15-
16-
@pytest.mark.xfail
17-
def test_taint_crossing_substr_and_concatenation():
18-
traces = run_security_analyser_pipeline(
19-
"concat.jar",
20-
"rules.json",
21-
os.path.realpath(os.path.dirname(__file__)))
22-
assert traces.count_traces() > 0
23-
assert not traces.trace_exists("java::concat.main:(I)V", 14)
24-
assert traces.trace_exists("java::concat.main:(I)V", 16)

0 commit comments

Comments
 (0)