Skip to content

Commit a4fcc99

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#369 from diffblue/improvement_of_sakai_rules
SEC-232: Added rules up to the write to the temp file. Added rules after the write to the temp file. (still not complete)
2 parents 298bd26 + 7a6a5a1 commit a4fcc99

File tree

1 file changed

+288
-30
lines changed

1 file changed

+288
-30
lines changed

‎benchmarks/GENUINE/Sakai_rules.json

Lines changed: 288 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,116 @@
33
"rules":
44
[
55
{
6-
"comment": "Streams returned by getInputStream on ServletRequest are tainted",
6+
"comment": "Obtained ServletRequest's attribute with potentially tainted data.",
77
"class": "javax.servlet.http.HttpServletRequest",
8+
"method": "getAttribute:(Ljava/lang/String;)Ljava/lang/Object;",
9+
"result": {
10+
"location": "returns",
11+
"taint": "Tainted servlet attribute"
12+
}
13+
},
14+
{
15+
"comment": "Obtained stream from the tainted servlet attribute.",
16+
"class": "org.apache.commons.fileupload.FileItem",
817
"method": "getInputStream:()Ljava/io/InputStream;",
18+
"input": {
19+
"location": "this",
20+
"taint": "Tainted servlet attribute"
21+
},
922
"result": {
1023
"location": "returns",
11-
"taint": "Tainted stream"
24+
"taint": "Tainted input stream"
25+
}
26+
},
27+
{
28+
"comment": "Writing content of a tainted stream to disk is a sink.",
29+
"class": "java.nio.file.Files",
30+
"method": "copy:(Ljava/io/InputStream;Ljava/nio/file/Path;[Ljava/nio/file/CopyOption;)J",
31+
"sinkTarget": {
32+
"location": "arg0",
33+
"vulnerability": "Tainted input stream"
34+
}
35+
},
36+
{
37+
"comment": "Marking path to the file where is written the content of a tainted stream as tainted.",
38+
"class": "java.nio.file.Files",
39+
"method": "copy:(Ljava/io/InputStream;Ljava/nio/file/Path;[Ljava/nio/file/CopyOption;)J",
40+
"input": {
41+
"location": "arg0",
42+
"taint": "Tainted input stream"
43+
},
44+
"result": {
45+
"location": "arg1",
46+
"taint": "Tainted pathname"
47+
}
48+
},
49+
{
50+
"comment": "Obtained ZIP file from potentially tainted file.",
51+
"class": "java.util.zip.ZipFile",
52+
"method": "<init>:(Ljava/io/File;Ljava/nio/charset/Charset;)V;",
53+
"input": {
54+
"location": "arg1",
55+
"taint": "Tainted file"
56+
},
57+
"result": {
58+
"location": "this",
59+
"taint": "Tainted zip file"
60+
}
61+
},
62+
{
63+
"comment": "Collection of entries from tainted ZIP file are tainted.",
64+
"class": "java.util.zip.ZipFile",
65+
"method": "entries:()Ljava/util/Enumeration;",
66+
"input": {
67+
"location": "this",
68+
"taint": "Tainted zip file"
69+
},
70+
"result": {
71+
"location": "returns",
72+
"taint": "Tainted zip entries"
73+
}
74+
},
75+
{
76+
"comment": "Any entry from tainted collection of ZIP entries is tainted.",
77+
"class": "java.util.Enumeration",
78+
"method": "nextElement:()Ljava/lang/Object;",
79+
"input": {
80+
"location": "this",
81+
"taint": "Tainted zip entries"
82+
},
83+
"result": {
84+
"location": "returns",
85+
"taint": "Tainted zip entry"
86+
}
87+
},
88+
{
89+
"comment": "Input stream returned from tainted ZIP file is tainted.",
90+
"class": "java.util.zip.ZipFile",
91+
"method": "getInputStream:(Ljava/util/zip/ZipEntry;)Ljava/io/InputStream;",
92+
"input": {
93+
"location": "this",
94+
"taint": "Tainted zip file"
95+
},
96+
"result": {
97+
"location": "returns",
98+
"taint": "Tainted input stream"
1299
}
13100
},
14101
{
15-
"comment": "Read from tainted stream gives tainted string",
102+
"comment": "Input stream returned from a ZIP file for tainted ZIP entry is tainted.",
103+
"class": "java.util.zip.ZipFile",
104+
"method": "getInputStream:(Ljava/util/zip/ZipEntry;)Ljava/io/InputStream;",
105+
"input": {
106+
"location": "arg1",
107+
"taint": "Tainted zip entry"
108+
},
109+
"result": {
110+
"location": "returns",
111+
"taint": "Tainted input stream"
112+
}
113+
},
114+
{
115+
"comment": "Read from tainted stream gives tainted array of bytes",
16116
"class": "java.io.InputStream",
17117
"method": "read:([BII)I",
18118
"input": {
@@ -21,17 +121,46 @@
21121
},
22122
"result": {
23123
"location": "arg1",
24-
"namespace": "com.diffblue.security.specialized",
25124
"taint": "Tainted byte array"
26125
}
27126
},
28127
{
29-
"comment": "Construction from an array of tainted bytes gives a tainted string",
128+
"comment": "Read from tainted stream gives tainted array of bytes",
129+
"class": "java.io.InputStream",
130+
"method": "read:([B)I",
131+
"input": {
132+
"location": "this",
133+
"taint": "Tainted stream"
134+
},
135+
"result": {
136+
"location": "arg1",
137+
"taint": "Tainted byte array"
138+
}
139+
},
140+
{
141+
"comment": "Writing potentially tainted bytes to a file stream is a sink.",
142+
"class": "java.io.FileOutputStream",
143+
"method": "write:([BII)V",
144+
"sinkTarget": {
145+
"location": "arg1",
146+
"taint": "Tainted byte array"
147+
}
148+
},
149+
{
150+
"comment": "Read from file channel gives tainted buffer of bytes",
151+
"class": "java.nio.channels.FileChannel",
152+
"method": "read:(Ljava/nio/ByteBuffer;)I",
153+
"result": {
154+
"location": "arg1",
155+
"taint": "Tainted byte buffer"
156+
}
157+
},
158+
{
159+
"comment": "Construction of string from an array of tainted bytes gives a tainted string.",
30160
"class": "java.lang.String",
31161
"method": "<init>:([BII)V",
32162
"input": {
33163
"location": "arg1",
34-
"namespace": "com.diffblue.security.specialized",
35164
"taint": "Tainted byte array"
36165
},
37166
"result": {
@@ -40,57 +169,186 @@
40169
}
41170
},
42171
{
43-
"comment": "Bytes obtained from a tainted string are tainted.",
44-
"class": "java.lang.String",
45-
"method": "getBytes:()[B",
172+
"comment": "Tainted string appended to a StringBuilder makes the builder tainted/",
173+
"class": "java.lang.StringBuilder",
174+
"method": "append:(Ljava/lang/String;)Ljava/lang/StringBuilder;",
175+
"input": {
176+
"location": "arg1",
177+
"taint": "Tainted string"
178+
},
179+
"result": {
180+
"location": "this",
181+
"taint": "Tainted string builder"
182+
}
183+
},
184+
{
185+
"comment": "A string returnded from a tainted StringBuilder is tainted.",
186+
"class": "java.lang.StringBuilder",
187+
"method": "toString:()Ljava/lang/String;",
46188
"input": {
47189
"location": "this",
190+
"taint": "Tainted string builder"
191+
},
192+
"result": {
193+
"location": "returns",
194+
"taint": "Tainted string"
195+
}
196+
},
197+
{
198+
"comment": "Trimmed tainted string remains tainted.",
199+
"class": "org.apache.commons.lang3.StringUtils",
200+
"method": "trimToNull:(Ljava/lang/String;)Ljava/lang/String;",
201+
"input": {
202+
"location": "arg0",
48203
"taint": "Tainted string"
49204
},
50205
"result": {
51206
"location": "returns",
52-
"namespace": "com.diffblue.security.specialized",
53-
"taint": "Tainted byte array"
207+
"taint": "Tainted string"
54208
}
55209
},
56210
{
57-
"comment": "Streams returned by getOutputStream on ServletResponse are vulnerable",
58-
"class": "javax.servlet.http.HttpServletResponse",
59-
"method": "getOutputStream:()Ljava/io/OutputStream;",
211+
"comment": "Tainted string with some replaced cheracters remains tainted.",
212+
"class": "java.lang.String",
213+
"method": "replaceAll:(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
214+
"input": {
215+
"location": "arg0",
216+
"taint": "Tainted string"
217+
},
60218
"result": {
61219
"location": "returns",
62-
"vulnerability": "Vulnerable stream"
220+
"taint": "Tainted string"
63221
}
64222
},
65223
{
66-
"comment": "Writing potentially tainted bytes (in a given range) to a vulnerable stream is a sink.",
67-
"class": "java.io.OutputStream",
68-
"method": "write:([BII)V",
224+
"comment": "Substring of a tainted string remains tainted.",
225+
"class": "java.lang.String",
226+
"method": "substring:(II)Ljava/lang/String;",
227+
"input": {
228+
"location": "this",
229+
"taint": "Tainted string"
230+
},
231+
"result": {
232+
"location": "returns",
233+
"taint": "Tainted string"
234+
}
235+
},
236+
{
237+
"comment": "UploadGradeWrapper gets tainted by a tainted comment string.",
238+
"class": "org.sakaiproject.assignment.tool.AssignmentAction.UploadGradeWrapper",
239+
"method": "setComment:(Ljava/lang/String;)V",
69240
"input": {
70241
"location": "arg1",
71-
"namespace": "com.diffblue.security.specialized",
72-
"taint": "Tainted byte array"
242+
"taint": "Tainted string"
73243
},
74-
"sinkTarget": {
244+
"result": {
245+
"location": "this",
246+
"taint": "Tainted upload wrapper by string"
247+
}
248+
},
249+
{
250+
"comment": "UploadGradeWrapper gets tainted by a tainted comment string.",
251+
"class": "org.sakaiproject.assignment.tool.AssignmentAction.UploadGradeWrapper",
252+
"method": "setFeedbackText:(Ljava/lang/String;)V",
253+
"input": {
254+
"location": "arg1",
255+
"taint": "Tainted string"
256+
},
257+
"result": {
258+
"location": "this",
259+
"taint": "Tainted upload wrapper by string"
260+
}
261+
},
262+
{
263+
"comment": "UploadGradeWrapper gets tainted by a tainted comment string.",
264+
"class": "org.sakaiproject.assignment.tool.AssignmentAction.UploadGradeWrapper",
265+
"method": "setText:(Ljava/lang/String;)V",
266+
"input": {
267+
"location": "arg1",
268+
"taint": "Tainted string"
269+
},
270+
"result": {
75271
"location": "this",
76-
"vulnerability": "Vulnerable stream"
272+
"taint": "Tainted upload wrapper by string"
77273
}
78274
},
79275
{
80-
"comment": "Writing potentially tainted bytes (the whole array) to a vulnerable stream is a sink.",
81-
"class": "java.io.OutputStream",
82-
"method": "write:([B)V",
276+
"comment": "UploadGradeWrapper gets tainted by a tainted comment string.",
277+
"class": "org.sakaiproject.assignment.tool.AssignmentAction.UploadGradeWrapper",
278+
"method": "setSubmissionTimestamp:(Ljava/lang/String;)V",
83279
"input": {
84280
"location": "arg1",
85-
"namespace": "com.diffblue.security.specialized",
281+
"taint": "Tainted string"
282+
},
283+
"result": {
284+
"location": "this",
285+
"taint": "Tainted upload wrapper by string"
286+
}
287+
},
288+
{
289+
"comment": "UploadGradeWrapper gets tainted by a tainted comment string.",
290+
"class": "org.sakaiproject.assignment.tool.AssignmentAction",
291+
"method": "readIntoBytes:(Ljava/io/InputStream;Ljava/lang/String;J)[B",
292+
"input": {
293+
"location": "arg1",
294+
"taint": "Tainted string"
295+
},
296+
"result": {
297+
"location": "returns",
86298
"taint": "Tainted byte array"
299+
}
300+
},
301+
{
302+
"comment": "Put a tainted object to a map makes the map tainted.",
303+
"class": "java.util.Map",
304+
"method": "put:(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;",
305+
"input": {
306+
"location": "arg2",
307+
"taint": "Tainted upload wrapper by string"
87308
},
88-
"sinkTarget": {
309+
"result": {
310+
"location": "returns",
311+
"taint": "Tainted map by upload wrapper by string"
312+
}
313+
},
314+
{
315+
"comment": "Put a tainted object to a map makes the map tainted.",
316+
"class": "java.util.Map",
317+
"method": "put:(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;",
318+
"input": {
319+
"location": "arg2",
320+
"taint": "Tainted upload wrapper by attachments"
321+
},
322+
"result": {
323+
"location": "returns",
324+
"taint": "Tainted map by upload wrapper by attachments"
325+
}
326+
},
327+
{
328+
"comment": "Gut an object from a tainted map is a tainted object.",
329+
"class": "java.util.Map",
330+
"method": "get:(Ljava/lang/Object;)Ljava/lang/Object;",
331+
"input": {
89332
"location": "this",
90-
"vulnerability": "Vulnerable stream"
333+
"taint": "Tainted map by upload wrapper by string"
91334
},
92-
"message": "Unescaped HTML potentially written back to browser"
335+
"result": {
336+
"location": "returns",
337+
"taint": "Tainted upload wrapper by string"
338+
}
339+
},
340+
{
341+
"comment": "Gut an object from a tainted map is a tainted object.",
342+
"class": "java.util.Map",
343+
"method": "get:(Ljava/lang/Object;)Ljava/lang/Object;",
344+
"input": {
345+
"location": "this",
346+
"taint": "Tainted map by upload wrapper by attachments"
347+
},
348+
"result": {
349+
"location": "returns",
350+
"taint": "Tainted upload wrapper by attachments"
351+
}
93352
}
94353
]
95354
}
96-

0 commit comments

Comments
 (0)