Skip to content

Commit cdcc087

Browse files
marek-trtikmarek-trtik
committed
New training benchmark 07.
This benchmark mostly reproduces the benchmark 06; The key difference is that it replaces of uses of Java libraries by locally defined classes. It thus simplifies and boost development of the data-flow-sensitive instrumenter as the program is still small (no need to load libraries) and does not suffer from the issue of functions without bodies (if we do not load libraries e.g. with the benchmark 06).
1 parent e7d0feb commit cdcc087

File tree

5 files changed

+336
-0
lines changed

5 files changed

+336
-0
lines changed

‎benchmarks/TRAINING/diffblue/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,6 @@ taint_traces_05/dist
1919
taint_traces_06/build
2020
taint_traces_06/dist
2121

22+
taint_traces_07/build
23+
taint_traces_07/dist
24+

‎benchmarks/TRAINING/diffblue/taint_traces_07/build.xml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<project name="taint_traces_07" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/taint_traces_07.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on">
18+
</javac>
19+
</target>
20+
21+
<target name="clean">
22+
<delete dir="${classes.dir}"/>
23+
<delete dir="${install.dir}"/>
24+
</target>
25+
26+
27+
</project>
28+
29+

‎benchmarks/TRAINING/diffblue/taint_traces_07/test.java

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
package training07;
2+
3+
class BBB
4+
{
5+
int bbb;
6+
private byte[] s;
7+
public BBB() {
8+
bbb = 0;
9+
s = new byte[10];
10+
}
11+
}
12+
13+
class DDD extends BBB
14+
{
15+
int ddd;
16+
private byte[] ss = new byte[20];
17+
}
18+
19+
class XXX {
20+
public DDD ddd;
21+
};
22+
23+
class String {
24+
public String() {
25+
this.bytes = new byte[1];
26+
this.bytes[0] = 0;
27+
}
28+
public String(byte[] data, int shift, int count) {
29+
this.bytes = new byte[count];
30+
for (int i = 0; i != count; ++i)
31+
this.bytes[i] = data[shift + i];
32+
}
33+
public byte[] getBytes() {
34+
byte[] result = new byte[this.bytes.length];
35+
for (int i = 0; i != result.length; ++i)
36+
result[i] = this.bytes[i];
37+
return result;
38+
}
39+
private byte[] bytes;
40+
}
41+
42+
class InputStream {
43+
public InputStream(String init) {
44+
this.s = init.getBytes();
45+
}
46+
int read(byte[] data, int shift, int count) {
47+
for (int i = shift; i != count; ++i)
48+
data[i] = this.s[i];
49+
return count;
50+
}
51+
private byte[] s;
52+
int a1;
53+
int a2;
54+
int a3;
55+
int a4;
56+
int a5;
57+
int a6;
58+
int a7;
59+
int a8;
60+
int a9;
61+
}
62+
63+
class OutputStream {
64+
public OutputStream() {
65+
this.s = new byte[100];
66+
}
67+
public void write(byte[] data, int shift, int count) {
68+
for (int i = 0; i != count; ++i)
69+
this.s[i] = data[i];
70+
}
71+
public void write(byte[] data) {
72+
write(data,0,data.length);
73+
}
74+
private byte[] s;
75+
}
76+
77+
class ServletInputStream extends InputStream {
78+
public ServletInputStream() {
79+
super(new String());
80+
}
81+
}
82+
83+
class ServletOutputStream extends OutputStream {
84+
}
85+
86+
class HttpServletRequest {
87+
public HttpServletRequest() {
88+
this.s = new ServletInputStream();
89+
}
90+
public InputStream getInputStream() {
91+
return s;
92+
}
93+
private ServletInputStream s;
94+
}
95+
96+
class HttpServletResponse {
97+
public HttpServletResponse() {
98+
this.s = new ServletOutputStream();
99+
}
100+
public OutputStream getOutputStream() {
101+
return s;
102+
}
103+
private ServletOutputStream s;
104+
}
105+
106+
class HttpServlet {
107+
public void doGet(HttpServletRequest request, HttpServletResponse response) {}
108+
}
109+
110+
public class test extends HttpServlet {
111+
112+
@Override
113+
public void doGet(HttpServletRequest request, HttpServletResponse response) {
114+
InputStream in0 = getInStream(request);
115+
InputStream in = in0;
116+
byte[] data = new byte[2048];
117+
int size = getBytes(data,in);
118+
String str0 = new String(data, 0, size);
119+
String str = str0;
120+
//str = sanitise(str);
121+
OutputStream out0 = getOutStream(response);
122+
OutputStream out = out0;
123+
out.write(data,0,size);
124+
out.write(str.getBytes());
125+
foo();
126+
}
127+
128+
private InputStream getInStream(HttpServletRequest request) {
129+
return request.getInputStream();
130+
}
131+
132+
private int getBytes(byte[] data, InputStream in) {
133+
return in.read(data, 0, data.length);
134+
}
135+
136+
private String sanitise(String str) {
137+
//str = str.replace("<","&lt;");
138+
//str = str.replace(">","&gt;");
139+
//return str;
140+
return new String();
141+
}
142+
143+
private OutputStream getOutStream(HttpServletResponse response) {
144+
return response.getOutputStream();
145+
}
146+
147+
public void foo() {
148+
XXX xxx = new XXX();
149+
xxx.ddd = new DDD();
150+
}
151+
}
152+
153+

‎benchmarks/TRAINING/diffblue/taint_traces_07_evaluator.json

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"sources-dir": "TRAINING/diffblue/taint_traces_07",
3+
"install-dir": "TRAINING/diffblue/taint_traces_07/dist",
4+
"results-dir": "TRAINING/diffblue/RESULTS/taint_traces_07",
5+
"temp-dir": "TRAINING/diffblue/TEMP/taint_traces_07",
6+
"rules-file": "TRAINING/diffblue/taint_traces_07_rules.json",
7+
"name": "taint_traces_07",
8+
"category": "TRAINING",
9+
"source": "DiffBlue",
10+
"installer": "__benchmark_installer_TRAINING_diffblue",
11+
"custom-options-for-security-scanner": "--rebuild --verbosity 0 --dump-html-summaries --dump-html-statistics --dump-html-slice --dump-html-program --data-flow-insensitive-instrumentation",
12+
"expected-results":
13+
{
14+
"error-traces-json": "search_for_error_traces/error_traces.json",
15+
"data":
16+
[
17+
{
18+
"error_traces": {
19+
"cbmc": [
20+
"search_for_error_traces/error_trace_0.json"
21+
],
22+
"symex": []
23+
},
24+
"file": "training07/test.java",
25+
"function": "java::training07.test.doGet:(Ltraining07/HttpServletRequest;Ltraining07/HttpServletResponse;)V",
26+
"goto_binary_file": "program_slicing/instrumented_goto_program_0.gbf",
27+
"line": 123
28+
},
29+
{
30+
"error_traces": {
31+
"cbmc": [
32+
"search_for_error_traces/error_trace_0.json"
33+
],
34+
"symex": []
35+
},
36+
"file": "training07/test.java",
37+
"function": "java::training07.test.doGet:(Ltraining07/HttpServletRequest;Ltraining07/HttpServletResponse;)V",
38+
"goto_binary_file": "program_slicing/instrumented_goto_program_0.gbf",
39+
"line": 124
40+
}
41+
]
42+
}
43+
}
44+
45+

‎benchmarks/TRAINING/diffblue/taint_traces_07_rules.json

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Streams returned by getInputStream on ServletRequest are tainted",
7+
"class": "training07.HttpServletRequest",
8+
"method": "getInputStream:()Ltraining07/InputStream;",
9+
"result": {
10+
"location": "returns",
11+
"taint": "Tainted stream"
12+
}
13+
},
14+
{
15+
"comment": "Read from tainted stream gives tainted string",
16+
"class": "training07.InputStream",
17+
"method": "read:([BII)I",
18+
"input": {
19+
"location": "this",
20+
"taint": "Tainted stream"
21+
},
22+
"result": {
23+
"location": "arg1",
24+
"namespace": "com.diffblue.security.specialized",
25+
"taint": "Tainted byte array"
26+
}
27+
},
28+
{
29+
"comment": "Construction from an array of tainted bytes gives a tainted string",
30+
"class": "training07.String",
31+
"method": "<init>:([BII)V",
32+
"input": {
33+
"location": "arg1",
34+
"namespace": "com.diffblue.security.specialized",
35+
"taint": "Tainted byte array"
36+
},
37+
"result": {
38+
"location": "this",
39+
"taint": "Tainted string"
40+
}
41+
},
42+
{
43+
"comment": "Bytes obtained from a tainted string are tainted.",
44+
"class": "training07.String",
45+
"method": "getBytes:()[B",
46+
"input": {
47+
"location": "this",
48+
"taint": "Tainted string"
49+
},
50+
"result": {
51+
"location": "returns",
52+
"namespace": "com.diffblue.security.specialized",
53+
"taint": "Tainted byte array"
54+
}
55+
},
56+
{
57+
"comment": "Streams returned by getOutputStream on ServletResponse are vulnerable",
58+
"class": "training07.HttpServletResponse",
59+
"method": "getOutputStream:()Ltraining07/OutputStream;",
60+
"result": {
61+
"location": "returns",
62+
"vulnerability": "Vulnerable stream"
63+
}
64+
},
65+
{
66+
"comment": "Writing potentially tainted bytes (in a given range) to a vulnerable stream is a sink.",
67+
"class": "training07.OutputStream",
68+
"method": "write:([BII)V",
69+
"input": {
70+
"location": "arg1",
71+
"namespace": "com.diffblue.security.specialized",
72+
"taint": "Tainted byte array"
73+
},
74+
"sinkTarget": {
75+
"location": "this",
76+
"vulnerability": "Vulnerable stream"
77+
}
78+
},
79+
{
80+
"comment": "Writing potentially tainted bytes (the whole array) to a vulnerable stream is a sink.",
81+
"class": "training07.OutputStream",
82+
"method": "write:([B)V",
83+
"input": {
84+
"location": "arg1",
85+
"namespace": "com.diffblue.security.specialized",
86+
"taint": "Tainted byte array"
87+
},
88+
"sinkTarget": {
89+
"location": "this",
90+
"vulnerability": "Vulnerable stream"
91+
},
92+
"message": "Unescaped HTML potentially written back to browser"
93+
},
94+
{
95+
"comment": "Calling sanitise on a tainted string removes all taint from it.",
96+
"class": "training07.test",
97+
"method": "sanitise:(Ltraining07/String;)Ltraining07/String;",
98+
"sanitizes": {
99+
"taint": "Tainted string",
100+
"location": "return_value"
101+
}
102+
}
103+
]
104+
}
105+
106+

0 commit comments

Comments
 (0)