Skip to content

Commit 6f3df1d

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#304 from diffblue/enhancment/add_few_OWASP_benchmarks
SEC-15: Added 5 OWASP benchmarks.
2 parents f23ee11 + fcda22f commit 6f3df1d

File tree

29 files changed

+2562
-0
lines changed

29 files changed

+2562
-0
lines changed

‎regression/OWASP/BenchmarkTest00002/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
target

‎regression/OWASP/BenchmarkTest00002/pom.xml

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>org.owasp</groupId>
5+
<artifactId>benchmark</artifactId>
6+
<version>1.2</version>
7+
<packaging>war</packaging>
8+
<name>OWASP Benchmark Project</name>
9+
<url>https://www.owasp.org/index.php/Benchmark</url>
10+
11+
<repositories>
12+
<repository>
13+
<id>jenkins-releases</id>
14+
<url>http://repo.jenkins-ci.org/releases/</url>
15+
</repository>
16+
</repositories>
17+
18+
<dependencies>
19+
<dependency>
20+
<groupId>javax</groupId>
21+
<artifactId>javaee-api</artifactId>
22+
<version>7.0</version>
23+
<scope>provided</scope>
24+
</dependency>
25+
26+
<dependency>
27+
<groupId>javax.servlet</groupId>
28+
<artifactId>javax.servlet-api</artifactId>
29+
<version>3.1.0</version>
30+
<scope>provided</scope>
31+
</dependency>
32+
33+
<dependency>
34+
<groupId>org.owasp.esapi</groupId>
35+
<artifactId>esapi</artifactId>
36+
<version>2.1.0</version>
37+
</dependency>
38+
39+
</dependencies>
40+
41+
<build>
42+
<finalName>benchmark</finalName>
43+
<extensions>
44+
<extension>
45+
<groupId>co.leantechniques</groupId>
46+
<artifactId>maven-buildtime-extension</artifactId>
47+
<version>2.0.2</version>
48+
</extension>
49+
</extensions>
50+
51+
<resources>
52+
<resource>
53+
<directory>${basedir}/src/main/resources</directory>
54+
</resource>
55+
</resources>
56+
<plugins>
57+
<plugin>
58+
<groupId>org.apache.maven.plugins</groupId>
59+
<artifactId>maven-compiler-plugin</artifactId>
60+
<version>3.3</version>
61+
<configuration>
62+
<fork>true</fork>
63+
<meminitial>1000m</meminitial>
64+
<maxmem>2000m</maxmem>
65+
</configuration>
66+
</plugin>
67+
<plugin>
68+
<groupId>org.codehaus.mojo</groupId>
69+
<artifactId>sonar-maven-plugin</artifactId>
70+
<version>2.6</version>
71+
<configuration>
72+
<fork>true</fork>
73+
<meminitial>1024m</meminitial>
74+
<maxmem>4000m</maxmem>
75+
<compilerArgs>
76+
<arg>-XX:MaxPermSize=4000m</arg>
77+
</compilerArgs>
78+
</configuration>
79+
</plugin>
80+
<!-- FindBugs Static Analysis -->
81+
<plugin>
82+
<groupId>org.codehaus.mojo</groupId>
83+
<artifactId>findbugs-maven-plugin</artifactId>
84+
<version>3.0.1</version>
85+
<configuration>
86+
<effort>Max</effort>
87+
<threshold>Low</threshold>
88+
<failOnError>true</failOnError>
89+
</configuration>
90+
</plugin>
91+
</plugins>
92+
</build>
93+
94+
<reporting>
95+
<plugins>
96+
<plugin>
97+
<groupId>org.codehaus.mojo</groupId>
98+
<artifactId>findbugs-maven-plugin</artifactId>
99+
<version>3.0.1</version>
100+
<configuration>
101+
<argLine>-debug -maxHeap 2048 -include findbugsfilter.xml</argLine>
102+
</configuration>
103+
</plugin>
104+
<plugin>
105+
<groupId>org.apache.maven.plugins</groupId>
106+
<artifactId>maven-jxr-plugin</artifactId>
107+
<version>2.3</version>
108+
</plugin>
109+
<plugin>
110+
<groupId>org.apache.maven.plugins</groupId>
111+
<artifactId>maven-pmd-plugin</artifactId>
112+
<version>3.8</version>
113+
<configuration>
114+
<linkXref>true</linkXref>
115+
<targetJdk>1.7</targetJdk>
116+
</configuration>
117+
</plugin>
118+
</plugins>
119+
</reporting>
120+
121+
<properties>
122+
<maven.compiler.source>1.7</maven.compiler.source>
123+
<maven.compiler.target>1.7</maven.compiler.target>
124+
<failOnMissingWebXml>false</failOnMissingWebXml>
125+
<skipTests>true</skipTests>
126+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
127+
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
128+
<runenv>local</runenv>
129+
</properties>
130+
</project>
131+

‎regression/OWASP/BenchmarkTest00002/rules.json

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Writing tainted path to a cookie.",
7+
"class": "javax.servlet.http.HttpServletRequest",
8+
"method": "getRequestURI:()Ljava/lang/String;",
9+
"result": {
10+
"location": "return_value",
11+
"taint": "Tainted string"
12+
}
13+
},
14+
{
15+
"comment": "Constructing a cookie with tainted value.",
16+
"class": "javax.servlet.http.Cookie",
17+
"method": "<init>:(Ljava/lang/String;Ljava/lang/String;)V",
18+
"input": {
19+
"location": "arg2",
20+
"taint": "Tainted string"
21+
},
22+
"result": {
23+
"location": "this",
24+
"taint": "Tainted cookie"
25+
}
26+
},
27+
{
28+
"comment": "Writing tainted path to a cookie.",
29+
"class": "javax.servlet.http.Cookie",
30+
"method": "setPath:(Ljava/lang/String;)V",
31+
"input": {
32+
"location": "arg1",
33+
"taint": "Tainted string"
34+
},
35+
"result": {
36+
"location": "this",
37+
"taint": "Tainted cookie"
38+
}
39+
},
40+
{
41+
"comment": "Writing tainted value to a cookie.",
42+
"class": "javax.servlet.http.Cookie",
43+
"method": "setValue:(Ljava/lang/String;)V",
44+
"input": {
45+
"location": "arg1",
46+
"taint": "Tainted string"
47+
},
48+
"result": {
49+
"location": "this",
50+
"taint": "Tainted cookie"
51+
}
52+
},
53+
{
54+
"comment": "Writing tainted domain to a cookie.",
55+
"class": "javax.servlet.http.Cookie",
56+
"method": "setDomain:(Ljava/lang/String;)V",
57+
"input": {
58+
"location": "arg1",
59+
"taint": "Tainted string"
60+
},
61+
"result": {
62+
"location": "this",
63+
"taint": "Tainted cookie"
64+
}
65+
},
66+
{
67+
"comment": "Writing tainted comment to a cookie.",
68+
"class": "javax.servlet.http.Cookie",
69+
"method": "setComment:(Ljava/lang/String;)V",
70+
"input": {
71+
"location": "arg1",
72+
"taint": "Tainted string"
73+
},
74+
"result": {
75+
"location": "this",
76+
"taint": "Tainted cookie"
77+
}
78+
},
79+
{
80+
"comment": "Writing tainted cookie to a sink.",
81+
"class": "javax.servlet.http.HttpServletResponse",
82+
"method": "addCookie:(Ljavax.servlet.http.Cookie;)V",
83+
"sinkTarget": {
84+
"location": "arg1",
85+
"vulnerability": "Tainted cookie"
86+
}
87+
}
88+
]
89+
}

‎regression/OWASP/BenchmarkTest00002/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00002.java

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
/**
2+
* OWASP Benchmark v1.2
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Benchmark Project. For details, please see
6+
* <a href="https://www.owasp.org/index.php/Benchmark">https://www.owasp.org/index.php/Benchmark</a>.
7+
*
8+
* The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
12+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details.
14+
*
15+
* @author Dave Wichers <a href="https://www.aspectsecurity.com">Aspect Security</a>
16+
* @created 2015
17+
*/
18+
19+
package org.owasp.benchmark.testcode;
20+
21+
import java.io.IOException;
22+
23+
import javax.servlet.ServletException;
24+
import javax.servlet.annotation.WebServlet;
25+
import javax.servlet.http.HttpServlet;
26+
import javax.servlet.http.HttpServletRequest;
27+
import javax.servlet.http.HttpServletResponse;
28+
29+
@WebServlet(value="/pathtraver-00/BenchmarkTest00002")
30+
public class BenchmarkTest00002 extends HttpServlet {
31+
32+
private static final long serialVersionUID = 1L;
33+
34+
@Override
35+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
36+
javax.servlet.http.Cookie userCookie = new javax.servlet.http.Cookie("BenchmarkTest00002", "FileName");
37+
userCookie.setMaxAge(60*3); //Store cookie for 3 minutes
38+
userCookie.setSecure(true);
39+
userCookie.setPath(request.getRequestURI());
40+
response.addCookie(userCookie);
41+
javax.servlet.RequestDispatcher rd = request.getRequestDispatcher("/pathtraver-00/BenchmarkTest00002.html");
42+
rd.include(request, response);
43+
}
44+
45+
@Override
46+
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
47+
// some code
48+
response.setContentType("text/html;charset=UTF-8");
49+
50+
51+
javax.servlet.http.Cookie[] theCookies = request.getCookies();
52+
53+
String param = "noCookieValueSupplied";
54+
if (theCookies != null) {
55+
for (javax.servlet.http.Cookie theCookie : theCookies) {
56+
if (theCookie.getName().equals("BenchmarkTest00002")) {
57+
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
58+
break;
59+
}
60+
}
61+
}
62+
63+
64+
String fileName = null;
65+
java.io.FileOutputStream fos = null;
66+
67+
try {
68+
/*<@DIFFBLUE[erase]>*/
69+
// fileName = org.owasp.benchmark.helpers.Utils.testfileDir + param;
70+
/*</@DIFFBLUE>*/
71+
/*<@DIFFBLUE[insert]>*/
72+
fileName = param;
73+
/*<@DIFFBLUE/>*/
74+
75+
fos = new java.io.FileOutputStream(fileName, false);
76+
response.getWriter().println(
77+
"Now ready to write to file: " + org.owasp.esapi.ESAPI.encoder().encodeForHTML(fileName)
78+
);
79+
80+
} catch (Exception e) {
81+
System.out.println("Couldn't open FileOutputStream on file: '" + fileName + "'");
82+
// System.out.println("File exception caught and swallowed: " + e.getMessage());
83+
} finally {
84+
if (fos != null) {
85+
try {
86+
fos.close();
87+
fos = null;
88+
} catch (Exception e) {
89+
// we tried...
90+
}
91+
}
92+
}
93+
}
94+
95+
}

‎regression/OWASP/BenchmarkTest00002/test_BenchmarkTest00002.py

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
import regression.end_to_end.driver as pipeline_executor
2+
import os
3+
import pytest
4+
import regression.utils as utils
5+
6+
7+
@pytest.mark.xfail(strict=True)
8+
def test_BenchmarkTest00002():
9+
"""
10+
This (adopted) OWASP test shows a propagation of tainted data into cookies.
11+
Security scanner crashes on this test. Here is the log:
12+
method: java::org.apache.catalina.tribes.util.StringManager.getManager
13+
could not parse signature: (Ljava/lang/Class<*>;)Lorg/apache/catalina/tribes/util/StringManager;
14+
Unsupported class signature: wild card generic
15+
reverting to descriptor: (Ljava/lang/Class;)Lorg/apache/catalina/tribes/util/StringManager;
16+
terminate called after throwing an instance of 'std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >'
17+
Aborted (core dumped)
18+
"""
19+
with utils.working_dir(os.path.abspath(os.path.dirname(__file__))):
20+
os.system("mvn package")
21+
traces = pipeline_executor.run_security_analyser_pipeline(
22+
os.path.join("target", "benchmark.war"),
23+
"rules.json",
24+
os.path.realpath(os.path.dirname(__file__)),
25+
["--use-models-library", "--use-tomcat-library"]
26+
)
27+
assert traces.count_traces() == 1
28+
assert traces.trace_exists(
29+
"java::org.owasp.benchmark.testcode.BenchmarkTest00002.doGet:(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V",
30+
40
31+
)

‎regression/OWASP/BenchmarkTest00013/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
target

0 commit comments

Comments
 (0)