Skip to content

Commit a86c870

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#183 from diffblue/benchmarks/new_training_benchmark_07
SEC-48: New training benchmark 07.
2 parents cedd7c8 + f80e143 commit a86c870

File tree

5 files changed

+303
-0
lines changed

5 files changed

+303
-0
lines changed

‎benchmarks/TRAINING/diffblue/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,6 @@ taint_traces_05/dist
1919
taint_traces_06/build
2020
taint_traces_06/dist
2121

22+
taint_traces_07/build
23+
taint_traces_07/dist
24+

‎benchmarks/TRAINING/diffblue/taint_traces_07/build.xml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<project name="taint_traces_07" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/taint_traces_07.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on">
18+
</javac>
19+
</target>
20+
21+
<target name="clean">
22+
<delete dir="${classes.dir}"/>
23+
<delete dir="${install.dir}"/>
24+
</target>
25+
26+
27+
</project>
28+
29+

‎benchmarks/TRAINING/diffblue/taint_traces_07/test.java

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
package training07;
2+
3+
class String {
4+
public String() {
5+
this.bytes = new byte[1];
6+
this.bytes[0] = 0;
7+
}
8+
public String(byte[] data, int shift, int count) {
9+
this.bytes = new byte[count];
10+
for (int i = 0; i != count; ++i)
11+
this.bytes[i] = data[shift + i];
12+
}
13+
public byte[] getBytes() {
14+
byte[] result = new byte[this.bytes.length];
15+
for (int i = 0; i != result.length; ++i)
16+
result[i] = this.bytes[i];
17+
return result;
18+
}
19+
private byte[] bytes;
20+
}
21+
22+
class InputStream {
23+
public InputStream(String init) {
24+
this.s = init.getBytes();
25+
}
26+
int read(byte[] data, int shift, int count) {
27+
for (int i = 0; i != count; ++i) {
28+
if (i == this.s.length)
29+
return i;
30+
data[shift + i] = this.s[i];
31+
}
32+
return count;
33+
}
34+
private byte[] s;
35+
int a1;
36+
int a2;
37+
int a3;
38+
int a4;
39+
int a5;
40+
int a6;
41+
int a7;
42+
int a8;
43+
int a9;
44+
}
45+
46+
class OutputStream {
47+
public OutputStream() {
48+
this.s = new byte[100];
49+
}
50+
public void write(byte[] data, int shift, int count) {
51+
for (int i = 0; i != count; ++i) {
52+
if (i == this.s.length)
53+
return;
54+
this.s[i] = data[i];
55+
}
56+
}
57+
public void write(byte[] data) {
58+
write(data,0,data.length);
59+
}
60+
private byte[] s;
61+
}
62+
63+
class ServletInputStream extends InputStream {
64+
public ServletInputStream() {
65+
super(new String());
66+
}
67+
}
68+
69+
class ServletOutputStream extends OutputStream {
70+
}
71+
72+
class HttpServletRequest {
73+
public HttpServletRequest() {
74+
this.s = new ServletInputStream();
75+
}
76+
public InputStream getInputStream() {
77+
return s;
78+
}
79+
private ServletInputStream s;
80+
}
81+
82+
class HttpServletResponse {
83+
public HttpServletResponse() {
84+
this.s = new ServletOutputStream();
85+
}
86+
public OutputStream getOutputStream() {
87+
return s;
88+
}
89+
private ServletOutputStream s;
90+
}
91+
92+
class HttpServlet {
93+
public void doGet(HttpServletRequest request, HttpServletResponse response) {}
94+
}
95+
96+
public class test extends HttpServlet {
97+
98+
@Override
99+
public void doGet(HttpServletRequest request, HttpServletResponse response) {
100+
InputStream in0 = getInStream(request);
101+
InputStream in = in0;
102+
byte[] data = new byte[2048];
103+
int size = getBytes(data,in);
104+
String str0 = new String(data, 0, size);
105+
String str = str0;
106+
str = sanitise(str);
107+
OutputStream out0 = getOutStream(response);
108+
OutputStream out = out0;
109+
out.write(data,0,size);
110+
out.write(str.getBytes());
111+
}
112+
113+
private InputStream getInStream(HttpServletRequest request) {
114+
return request.getInputStream();
115+
}
116+
117+
private int getBytes(byte[] data, InputStream in) {
118+
return in.read(data, 0, data.length);
119+
}
120+
121+
private String sanitise(String str) {
122+
//str = str.replace("<","&lt;");
123+
//str = str.replace(">","&gt;");
124+
//return str;
125+
return new String();
126+
}
127+
128+
private OutputStream getOutStream(HttpServletResponse response) {
129+
return response.getOutputStream();
130+
}
131+
}
132+

‎benchmarks/TRAINING/diffblue/taint_traces_07_evaluator.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"sources-dir": "TRAINING/diffblue/taint_traces_07",
3+
"install-dir": "TRAINING/diffblue/taint_traces_07/dist",
4+
"results-dir": "TRAINING/diffblue/RESULTS/taint_traces_07",
5+
"temp-dir": "TRAINING/diffblue/TEMP/taint_traces_07",
6+
"rules-file": "TRAINING/diffblue/taint_traces_07_rules.json",
7+
"name": "taint_traces_07",
8+
"category": "TRAINING",
9+
"source": "DiffBlue",
10+
"installer": "__benchmark_installer_TRAINING_diffblue",
11+
"custom-options-for-security-scanner": "--rebuild --verbosity 0 --dump-html-summaries --dump-html-statistics --dump-html-slice --dump-html-program --data-flow-insensitive-instrumentation",
12+
"expected-results":
13+
{
14+
"error-traces-json": "search_for_error_traces/error_traces.json",
15+
"data":
16+
[
17+
{
18+
"error_traces": {
19+
"cbmc": [
20+
"search_for_error_traces/error_trace_0.json"
21+
],
22+
"symex": []
23+
},
24+
"file": "training07/test.java",
25+
"function": "java::training07.test.doGet:(Ltraining07/HttpServletRequest;Ltraining07/HttpServletResponse;)V",
26+
"goto_binary_file": "program_slicing/instrumented_goto_program_0.gbf",
27+
"line": 109
28+
}
29+
]
30+
}
31+
}
32+
33+

‎benchmarks/TRAINING/diffblue/taint_traces_07_rules.json

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Streams returned by getInputStream on ServletRequest are tainted",
7+
"class": "training07.HttpServletRequest",
8+
"method": "getInputStream:()Ltraining07/InputStream;",
9+
"result": {
10+
"location": "returns",
11+
"taint": "Tainted stream"
12+
}
13+
},
14+
{
15+
"comment": "Read from tainted stream gives tainted string",
16+
"class": "training07.InputStream",
17+
"method": "read:([BII)I",
18+
"input": {
19+
"location": "this",
20+
"taint": "Tainted stream"
21+
},
22+
"result": {
23+
"location": "arg1",
24+
"namespace": "com.diffblue.security.specialized",
25+
"taint": "Tainted byte array"
26+
}
27+
},
28+
{
29+
"comment": "Construction from an array of tainted bytes gives a tainted string",
30+
"class": "training07.String",
31+
"method": "<init>:([BII)V",
32+
"input": {
33+
"location": "arg1",
34+
"namespace": "com.diffblue.security.specialized",
35+
"taint": "Tainted byte array"
36+
},
37+
"result": {
38+
"location": "this",
39+
"taint": "Tainted string"
40+
}
41+
},
42+
{
43+
"comment": "Bytes obtained from a tainted string are tainted.",
44+
"class": "training07.String",
45+
"method": "getBytes:()[B",
46+
"input": {
47+
"location": "this",
48+
"taint": "Tainted string"
49+
},
50+
"result": {
51+
"location": "returns",
52+
"namespace": "com.diffblue.security.specialized",
53+
"taint": "Tainted byte array"
54+
}
55+
},
56+
{
57+
"comment": "Streams returned by getOutputStream on ServletResponse are vulnerable",
58+
"class": "training07.HttpServletResponse",
59+
"method": "getOutputStream:()Ltraining07/OutputStream;",
60+
"result": {
61+
"location": "returns",
62+
"vulnerability": "Vulnerable stream"
63+
}
64+
},
65+
{
66+
"comment": "Writing potentially tainted bytes (in a given range) to a vulnerable stream is a sink.",
67+
"class": "training07.OutputStream",
68+
"method": "write:([BII)V",
69+
"input": {
70+
"location": "arg1",
71+
"namespace": "com.diffblue.security.specialized",
72+
"taint": "Tainted byte array"
73+
},
74+
"sinkTarget": {
75+
"location": "this",
76+
"vulnerability": "Vulnerable stream"
77+
}
78+
},
79+
{
80+
"comment": "Writing potentially tainted bytes (the whole array) to a vulnerable stream is a sink.",
81+
"class": "training07.OutputStream",
82+
"method": "write:([B)V",
83+
"input": {
84+
"location": "arg1",
85+
"namespace": "com.diffblue.security.specialized",
86+
"taint": "Tainted byte array"
87+
},
88+
"sinkTarget": {
89+
"location": "this",
90+
"vulnerability": "Vulnerable stream"
91+
},
92+
"message": "Unescaped HTML potentially written back to browser"
93+
},
94+
{
95+
"comment": "Calling sanitise on a tainted string removes all taint from it.",
96+
"class": "training07.test",
97+
"method": "sanitise:(Ltraining07/String;)Ltraining07/String;",
98+
"sanitizes": {
99+
"taint": "Tainted string",
100+
"location": "return_value"
101+
}
102+
}
103+
]
104+
}
105+
106+

0 commit comments

Comments
 (0)