Skip to content

Commit 2d8639b

Browse files
author
owen-jones-diffblue
authored
Merge pull request diffblue#345 from diffblue/owen-jones-diffblue/improve-pipeline-scripts
SEC-253: Improve pipeline scripts
2 parents 9c2f963 + e1d1402 commit 2d8639b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+668
-652
lines changed

‎benchmarks/GENUINE/Sakai_rules.json

Lines changed: 96 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -1,107 +1,96 @@
1-
[
2-
{
3-
"comment": "Potentially tained data was returned from the called function.",
4-
"class": "TaintSource",
5-
"method": "get_tainted_int:()I",
6-
"result": {
7-
"location": "return_value",
8-
"taint": "<TaintSource.get_tainted_int@Integer>"
9-
}
10-
},
11-
{
12-
"comment": "Potentially tained data was returned from the tainted input stream.",
13-
"class": "TaintedInputStream",
14-
"method": "read:([BII)I",
15-
"result": {
16-
"location": "arg1",
17-
"taint": "<TaintedInputStream.read@byte[]>"
18-
}
19-
},
20-
{
21-
"comment": "Conversion of an array of potentially tainted bytes to a string.",
22-
"class": "java.lang.String",
23-
"method": "<init>:([BII)V",
24-
"input": {
25-
"location": "arg1",
26-
"taint": "<TaintedInputStream.read@byte[]>"
27-
},
28-
"result": {
29-
"location": "arg0",
30-
"taint": "<toString(TaintedInputStream.read@byte[])@String>"
31-
}
32-
},
33-
{
34-
"comment": "Appending a potentially tainted string into the StringBuilder instance. Making the builder tainted.",
35-
"class": "java.lang.StringBuilder",
36-
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
37-
"input": {
38-
"location": "arg1",
39-
"taint": "<toString(TaintedInputStream.read@byte[])@String>"
40-
},
41-
"result": {
42-
"location": "arg0",
43-
"taint": "<StringBuilder.append(toString(TaintedInputStream.read@byte[]))@StringBuilder>"
44-
}
45-
},
46-
{
47-
"comment": "Conversion of potentially tainted data in the StringBuilder to a potentially tainted string.",
48-
"class": "java.lang.StringBuilder",
49-
"method": "toString:()Ljava/lang/String;",
50-
"input": {
51-
"location": "arg0",
52-
"taint": "<StringBuilder.append(toString(TaintedInputStream.read@byte[]))@StringBuilder>"
53-
},
54-
"result": {
55-
"location": "return_value",
56-
"taint": "<toString(TaintedInputStream.read@byte[])@String>"
57-
}
58-
},
59-
{
60-
"comment": "Inserting a potentially tainted string into a HashMap container. Making the container tainted.",
61-
"class": "java.util.HashMap",
62-
"method": "put:(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;",
63-
"input": {
64-
"location": "arg2",
65-
"taint": "<toString(TaintedInputStream.read@byte[])@String>"
66-
},
67-
"result": {
68-
"location": "arg0",
69-
"taint": "<HashMap.put(toString(TaintedInputStream.read@byte[]))@HashMap>"
70-
}
71-
},
72-
{
73-
"comment": "Retrieving a potentially tainted string from a HashMap container.",
74-
"class": "java.util.HashMap",
75-
"method": "get:(Ljava/lang/Object;)Ljava/lang/Object;",
76-
"input": {
77-
"location": "arg0",
78-
"taint": "<HashMap.put(toString(TaintedInputStream.read@byte[]))@HashMap>"
79-
},
80-
"result": {
81-
"location": "return_value",
82-
"taint": "<toString(TaintedInputStream.read@byte[])@String>"
83-
}
84-
},
85-
{
86-
"comment": "Retrieving a potentially tainted character from a potentially tainted string.",
87-
"class": "java.lang.String",
88-
"method": "charAt:(I)C",
89-
"input": {
90-
"location": "arg0",
91-
"taint": "<toString(TaintedInputStream.read@byte[])@String>"
92-
},
93-
"result": {
94-
"location": "return_value",
95-
"taint": "<charAt(toString(TaintedInputStream.read@byte[]))@Character>"
96-
}
97-
},
98-
{
99-
"comment": "Writing a potentially tainted data into the output",
100-
"class": "TaintSink",
101-
"method": "receive_taint:(C)V",
102-
"sinkTarget": {
103-
"location": "arg0",
104-
"taint": "<charAt(toString(TaintedInputStream.read@byte[]))@Character>"
105-
}
106-
}
107-
]
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Streams returned by getInputStream on ServletRequest are tainted",
7+
"class": "javax.servlet.http.HttpServletRequest",
8+
"method": "getInputStream:()Ljava/io/InputStream;",
9+
"result": {
10+
"location": "returns",
11+
"taint": "Tainted stream"
12+
}
13+
},
14+
{
15+
"comment": "Read from tainted stream gives tainted string",
16+
"class": "java.io.InputStream",
17+
"method": "read:([BII)I",
18+
"input": {
19+
"location": "this",
20+
"taint": "Tainted stream"
21+
},
22+
"result": {
23+
"location": "arg1",
24+
"namespace": "com.diffblue.security.specialized",
25+
"taint": "Tainted byte array"
26+
}
27+
},
28+
{
29+
"comment": "Construction from an array of tainted bytes gives a tainted string",
30+
"class": "java.lang.String",
31+
"method": "<init>:([BII)V",
32+
"input": {
33+
"location": "arg1",
34+
"namespace": "com.diffblue.security.specialized",
35+
"taint": "Tainted byte array"
36+
},
37+
"result": {
38+
"location": "this",
39+
"taint": "Tainted string"
40+
}
41+
},
42+
{
43+
"comment": "Bytes obtained from a tainted string are tainted.",
44+
"class": "java.lang.String",
45+
"method": "getBytes:()[B",
46+
"input": {
47+
"location": "this",
48+
"taint": "Tainted string"
49+
},
50+
"result": {
51+
"location": "returns",
52+
"namespace": "com.diffblue.security.specialized",
53+
"taint": "Tainted byte array"
54+
}
55+
},
56+
{
57+
"comment": "Streams returned by getOutputStream on ServletResponse are vulnerable",
58+
"class": "javax.servlet.http.HttpServletResponse",
59+
"method": "getOutputStream:()Ljava/io/OutputStream;",
60+
"result": {
61+
"location": "returns",
62+
"vulnerability": "Vulnerable stream"
63+
}
64+
},
65+
{
66+
"comment": "Writing potentially tainted bytes (in a given range) to a vulnerable stream is a sink.",
67+
"class": "java.io.OutputStream",
68+
"method": "write:([BII)V",
69+
"input": {
70+
"location": "arg1",
71+
"namespace": "com.diffblue.security.specialized",
72+
"taint": "Tainted byte array"
73+
},
74+
"sinkTarget": {
75+
"location": "this",
76+
"vulnerability": "Vulnerable stream"
77+
}
78+
},
79+
{
80+
"comment": "Writing potentially tainted bytes (the whole array) to a vulnerable stream is a sink.",
81+
"class": "java.io.OutputStream",
82+
"method": "write:([B)V",
83+
"input": {
84+
"location": "arg1",
85+
"namespace": "com.diffblue.security.specialized",
86+
"taint": "Tainted byte array"
87+
},
88+
"sinkTarget": {
89+
"location": "this",
90+
"vulnerability": "Vulnerable stream"
91+
},
92+
"message": "Unescaped HTML potentially written back to browser"
93+
}
94+
]
95+
}
96+

‎benchmarks/LIBRARIES/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
apache-tomcat-9
22
openjdk-8
3+
spring-framework
34

‎benchmarks/LIBRARIES/README.txt

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,51 @@ Alternative installation:
5656
2. Unpack the downloaded ZIP file into this directory and rename its root
5757
directory to: apache-tomcat-9
5858

59+
60+
(3) Spring framework
61+
--------------------
62+
63+
I. Installation from prebuilt package:
64+
65+
1. Download Spring framework binary (of a desired version) from:
66+
https://repo.spring.io/release/org/springframework/spring/
67+
NOTE: Security scanner currently do not detect version used by an
68+
analysed web app. So, you need to manually check for the version.
69+
However, default version we take is 4.3.13:
70+
https://repo.spring.io/release/org/springframework/spring/4.3.13.RELEASE/spring-framework-4.3.13.RELEASE-dist.zip
71+
2. Unpack the downloaded ZIP file to:
72+
<security-scanner-root-dir>/benchmarks/LIBRARIES
73+
That should lead to creation of a directory:
74+
<security-scanner-root-dir>/benchmarks/LIBRARIES/spring-framework<some-suffix-with-version>
75+
Rename the directory to:
76+
<security-scanner-root-dir>/benchmarks/LIBRARIES/spring-framework
77+
The rename is necessary, because our python script currently assumes the
78+
framework is on that path.
79+
80+
II. Install from sources (won't work, if you use 'encryptfs' file system).
81+
82+
1. Download Spring framework source (of a desired version) from:
83+
https://github.com/spring-projects/spring-framework/releases
84+
NOTE: Security scanner currently do not detect version used by an
85+
analysed web app. So, you need to manually check for the version.
86+
However, default version we take is 4.3.13:
87+
https://github.com/spring-projects/spring-framework/releases/tag/v4.3.13.RELEASE
88+
NOTE: Alternatively, you may consider to clone the repository:
89+
git clone [email protected]:spring-projects/spring-framework.git
90+
into the directory:
91+
<security-scanner-root-dir>/benchmarks/LIBRARIES/spring-framework
92+
In this case skip the step 2 below.
93+
2. Unpack the downloaded ZIP file to:
94+
<security-scanner-root-dir>/benchmarks/LIBRARIES
95+
That should lead to creation of a directory:
96+
<security-scanner-root-dir>/benchmarks/LIBRARIES/spring-framework<some-suffix-with-version>
97+
Rename the directory to:
98+
<security-scanner-root-dir>/benchmarks/LIBRARIES/spring-framework
99+
The rename is necessary, because our python script currently assumes the
100+
framework is on that path.
101+
3. Open a terminal and type there:
102+
cd <security-scanner-root-dir>/benchmarks/LIBRARIES/spring-framework
103+
./gradlew build
104+
NOTE: Make sure that 'Gradle' build system and its wrapper script is installed
105+
on your computer.
106+

0 commit comments

Comments
 (0)