mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 20:19:29 +00:00
feat(propose-adjudicate-prove): overlay adjudicates inventory before prove
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
This commit is contained in:
Marius Ciepluch
@@ -0,0 +1,21 @@
|
||||
# SAST bake-off slice (OWASP + Juliet + Python)
|
||||
|
||||
Labeled true/false cases from the suites SAST papers actually quote. Not
|
||||
cheat-sheet fixtures and not the 90% smoke gate.
|
||||
|
||||
| Suite | Upstream | License | Protocol |
|
||||
| --- | --- | --- | --- |
|
||||
| OWASP Benchmark Java v1.2 | [OWASP-Benchmark/BenchmarkJava](https://github.com/OWASP-Benchmark/BenchmarkJava) | GPL-2.0 | true file = TP if we fire; false file = FP if we fire. Score = TPR − FPR. |
|
||||
| OWASP Benchmark Python v0.1 | [OWASP-Benchmark/BenchmarkPython](https://github.com/OWASP-Benchmark/BenchmarkPython) | GPL-3.0 | Same CSV protocol (`expectedresults-0.1.csv`). |
|
||||
| Juliet C 1.3 | [arichardson/juliet-test-suite-c](https://github.com/arichardson/juliet-test-suite-c) | CC0 | `bad()` vs `goodB2G()` / `goodG2B()`. |
|
||||
| Juliet Java 1.3 | [UnitTestBot/juliet-java-test-suite](https://github.com/UnitTestBot/juliet-java-test-suite) | CC0 | `bad()` vs `goodG2B()` (same sink, hardcoded source). |
|
||||
|
||||
This directory vendors a **representative slice**, not the full 2,740 / 180k cases.
|
||||
|
||||
```bash
|
||||
uv run ousast pairs --slice sast
|
||||
```
|
||||
|
||||
`slice=sast` is an honesty dashboard: CI still only fails the local fixture pairs.
|
||||
Juliet `goodG2B` often keeps the dangerous sink (`strcpy`, `Runtime.exec`); a
|
||||
regex harness is *supposed* to keep firing there.
|
||||
@@ -0,0 +1,253 @@
|
||||
# Labeled SAST bake-off slice. OWASP true/false files and Juliet bad/good sinks.
|
||||
# slice = "sast" — honesty dashboard, not the local 100% CI gate.
|
||||
# Do not add these names to LANGUAGE_MANIFESTS.
|
||||
|
||||
# --- OWASP Benchmark for Python v0.1 ---
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-python-codeinj"
|
||||
slice = "sast"
|
||||
language = "python"
|
||||
origin = "owasp-benchmark-python"
|
||||
license = "GPL-3.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkPython"
|
||||
cwe = "CWE-94"
|
||||
vuln = "owasp-python/BenchmarkTest00074.py"
|
||||
fixed = "owasp-python/BenchmarkTest00073.py"
|
||||
relpath = "testcode/BenchmarkTest00074.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-94"
|
||||
class = "code injection"
|
||||
path = "testcode/BenchmarkTest00074.py"
|
||||
rule_id = "python-unsafe-eval"
|
||||
sink = "exec"
|
||||
evidence = "exec executes attacker-controlled input"
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-python-deser"
|
||||
slice = "sast"
|
||||
language = "python"
|
||||
origin = "owasp-benchmark-python"
|
||||
license = "GPL-3.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkPython"
|
||||
cwe = "CWE-502"
|
||||
vuln = "owasp-python/BenchmarkTest00078.py"
|
||||
fixed = "owasp-python/BenchmarkTest00079.py"
|
||||
relpath = "testcode/BenchmarkTest00078.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-502"
|
||||
class = "insecure deserialization"
|
||||
path = "testcode/BenchmarkTest00078.py"
|
||||
rule_id = "python-unsafe-deserialization"
|
||||
sink = "pickle"
|
||||
evidence = "pickle.loads deserializes untrusted input"
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-python-cmdi"
|
||||
slice = "sast"
|
||||
language = "python"
|
||||
origin = "owasp-benchmark-python"
|
||||
license = "GPL-3.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkPython"
|
||||
cwe = "CWE-78"
|
||||
vuln = "owasp-python/BenchmarkTest00165.py"
|
||||
fixed = "owasp-python/BenchmarkTest00350.py"
|
||||
relpath = "testcode/BenchmarkTest00165.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-78"
|
||||
class = "command injection"
|
||||
path = "testcode/BenchmarkTest00165.py"
|
||||
rule_id = "python-shell-true"
|
||||
sink = "subprocess"
|
||||
evidence = "subprocess runs an attacker-controlled command"
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-python-sqli"
|
||||
slice = "sast"
|
||||
language = "python"
|
||||
origin = "owasp-benchmark-python"
|
||||
license = "GPL-3.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkPython"
|
||||
cwe = "CWE-89"
|
||||
vuln = "owasp-python/BenchmarkTest00099.py"
|
||||
fixed = "owasp-python/BenchmarkTest00011.py"
|
||||
relpath = "testcode/BenchmarkTest00099.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-89"
|
||||
class = "sql injection"
|
||||
path = "testcode/BenchmarkTest00099.py"
|
||||
rule_id = "python-sql-injection"
|
||||
sink = "execute"
|
||||
evidence = "execute runs a SQL string built from request input"
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-python-hash"
|
||||
slice = "sast"
|
||||
language = "python"
|
||||
origin = "owasp-benchmark-python"
|
||||
license = "GPL-3.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkPython"
|
||||
cwe = "CWE-327"
|
||||
vuln = "owasp-python/BenchmarkTest00054.py"
|
||||
fixed = "owasp-python/BenchmarkTest00055.py"
|
||||
relpath = "testcode/BenchmarkTest00054.py"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-327"
|
||||
class = "weak cryptography"
|
||||
path = "testcode/BenchmarkTest00054.py"
|
||||
rule_id = "python-weak-hash"
|
||||
sink = "md5"
|
||||
evidence = "md5 is a weak hash"
|
||||
|
||||
# --- OWASP Benchmark Java v1.2 ---
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-java-cmdi"
|
||||
slice = "sast"
|
||||
language = "java"
|
||||
origin = "owasp-benchmark-java"
|
||||
license = "GPL-2.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkJava"
|
||||
cwe = "CWE-78"
|
||||
vuln = "owasp-java/BenchmarkTest00007.java"
|
||||
fixed = "owasp-java/BenchmarkTest00090.java"
|
||||
relpath = "org/owasp/benchmark/testcode/BenchmarkTest00007.java"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-78"
|
||||
class = "command injection"
|
||||
path = "org/owasp/benchmark/testcode/BenchmarkTest00007.java"
|
||||
rule_id = "java-command-exec"
|
||||
sink = "exec"
|
||||
evidence = "Runtime.exec runs an attacker-controlled command"
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-java-sqli"
|
||||
slice = "sast"
|
||||
language = "java"
|
||||
origin = "owasp-benchmark-java"
|
||||
license = "GPL-2.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkJava"
|
||||
cwe = "CWE-89"
|
||||
vuln = "owasp-java/BenchmarkTest00008.java"
|
||||
fixed = "owasp-java/BenchmarkTest00052.java"
|
||||
relpath = "org/owasp/benchmark/testcode/BenchmarkTest00008.java"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-89"
|
||||
class = "sql injection"
|
||||
path = "org/owasp/benchmark/testcode/BenchmarkTest00008.java"
|
||||
rule_id = "java-sql-injection"
|
||||
sink = "prepareCall"
|
||||
evidence = "SQL is concatenated with request input"
|
||||
|
||||
[[pair]]
|
||||
name = "owasp-java-hash"
|
||||
slice = "sast"
|
||||
language = "java"
|
||||
origin = "owasp-benchmark-java"
|
||||
license = "GPL-2.0"
|
||||
repo = "OWASP-Benchmark/BenchmarkJava"
|
||||
cwe = "CWE-327"
|
||||
vuln = "owasp-java/BenchmarkTest00003.java"
|
||||
fixed = "owasp-java/BenchmarkTest00009.java"
|
||||
relpath = "org/owasp/benchmark/testcode/BenchmarkTest00003.java"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-327"
|
||||
class = "weak cryptography"
|
||||
path = "org/owasp/benchmark/testcode/BenchmarkTest00003.java"
|
||||
rule_id = "java-weak-hash"
|
||||
sink = "MessageDigest"
|
||||
evidence = "MessageDigest uses a weak hash algorithm"
|
||||
|
||||
# --- Juliet C/C++ 1.3 (CC0) ---
|
||||
|
||||
[[pair]]
|
||||
name = "juliet-c-cwe134-printf"
|
||||
slice = "sast"
|
||||
language = "c_cpp"
|
||||
origin = "juliet-c"
|
||||
license = "CC0-1.0"
|
||||
repo = "arichardson/juliet-test-suite-c"
|
||||
cwe = "CWE-134"
|
||||
vuln = "juliet-c/cwe134-printf-vuln.c"
|
||||
fixed = "juliet-c/cwe134-printf-fixed.c"
|
||||
relpath = "CWE134_char_console_printf_01.c"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-134"
|
||||
class = "format string"
|
||||
path = "CWE134_char_console_printf_01.c"
|
||||
rule_id = "c-unsafe-format"
|
||||
sink = "printf"
|
||||
evidence = "printf uses attacker-controlled format string"
|
||||
|
||||
[[pair]]
|
||||
name = "juliet-c-cwe121-strcpy"
|
||||
slice = "sast"
|
||||
language = "c_cpp"
|
||||
origin = "juliet-c"
|
||||
license = "CC0-1.0"
|
||||
repo = "arichardson/juliet-test-suite-c"
|
||||
cwe = "CWE-120"
|
||||
vuln = "juliet-c/cwe121-strcpy-vuln.c"
|
||||
fixed = "juliet-c/cwe121-strcpy-fixed.c"
|
||||
relpath = "CWE121_char_declare_cpy_01.c"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-120"
|
||||
class = "buffer overflow"
|
||||
path = "CWE121_char_declare_cpy_01.c"
|
||||
rule_id = "c-unsafe-copy"
|
||||
sink = "strcpy"
|
||||
evidence = "strcpy copies into a buffer without a null terminator"
|
||||
|
||||
# --- Juliet Java 1.3 (CC0) ---
|
||||
|
||||
[[pair]]
|
||||
name = "juliet-java-cwe78-exec"
|
||||
slice = "sast"
|
||||
language = "java"
|
||||
origin = "juliet-java"
|
||||
license = "CC0-1.0"
|
||||
repo = "UnitTestBot/juliet-java-test-suite"
|
||||
cwe = "CWE-78"
|
||||
vuln = "juliet-java/cwe78-exec-vuln.java"
|
||||
fixed = "juliet-java/cwe78-exec-fixed.java"
|
||||
relpath = "CWE78_OS_Command_Injection__console_readLine_01.java"
|
||||
min_recall = 1.0
|
||||
fix_policy = "silent"
|
||||
|
||||
[[pair.expected]]
|
||||
cwe = "CWE-78"
|
||||
class = "command injection"
|
||||
path = "CWE78_OS_Command_Injection__console_readLine_01.java"
|
||||
rule_id = "java-command-exec"
|
||||
sink = "exec"
|
||||
evidence = "Runtime.exec concatenates attacker-controlled input into a command"
|
||||
+99
@@ -0,0 +1,99 @@
|
||||
/* TEMPLATE GENERATED TESTCASE FILE
|
||||
Filename: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
|
||||
Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE193.label.xml
|
||||
Template File: sources-sink-01.tmpl.c
|
||||
*/
|
||||
/*
|
||||
* @description
|
||||
* CWE: 121 Stack Based Buffer Overflow
|
||||
* BadSource: Point data to a buffer that does not have space for a NULL terminator
|
||||
* GoodSource: Point data to a buffer that includes space for a NULL terminator
|
||||
* Sink: cpy
|
||||
* BadSink : Copy string to data using strcpy()
|
||||
* Flow Variant: 01 Baseline
|
||||
*
|
||||
* */
|
||||
|
||||
#include "std_testcase.h"
|
||||
|
||||
#ifndef _WIN32
|
||||
#include <wchar.h>
|
||||
#endif
|
||||
|
||||
/* MAINTENANCE NOTE: The length of this string should equal the 10 */
|
||||
#define SRC_STRING "AAAAAAAAAA"
|
||||
|
||||
#ifndef OMITBAD
|
||||
|
||||
void CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_bad()
|
||||
{
|
||||
char * data;
|
||||
char dataBadBuffer[10];
|
||||
char dataGoodBuffer[10+1];
|
||||
/* FLAW: Set a pointer to a buffer that does not leave room for a NULL terminator when performing
|
||||
* string copies in the sinks */
|
||||
data = dataBadBuffer;
|
||||
data[0] = '\0'; /* null terminate */
|
||||
{
|
||||
char source[10+1] = SRC_STRING;
|
||||
/* POTENTIAL FLAW: data may not have enough space to hold source */
|
||||
strcpy(data, source);
|
||||
printLine(data);
|
||||
}
|
||||
}
|
||||
|
||||
#endif /* OMITBAD */
|
||||
|
||||
#ifndef OMITGOOD
|
||||
|
||||
/* goodG2B uses the GoodSource with the BadSink */
|
||||
static void goodG2B()
|
||||
{
|
||||
char * data;
|
||||
char dataBadBuffer[10];
|
||||
char dataGoodBuffer[10+1];
|
||||
/* FIX: Set a pointer to a buffer that leaves room for a NULL terminator when performing
|
||||
* string copies in the sinks */
|
||||
data = dataGoodBuffer;
|
||||
data[0] = '\0'; /* null terminate */
|
||||
{
|
||||
char source[10+1] = SRC_STRING;
|
||||
/* POTENTIAL FLAW: data may not have enough space to hold source */
|
||||
strcpy(data, source);
|
||||
printLine(data);
|
||||
}
|
||||
}
|
||||
|
||||
void CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_good()
|
||||
{
|
||||
goodG2B();
|
||||
}
|
||||
|
||||
#endif /* OMITGOOD */
|
||||
|
||||
/* Below is the main(). It is only used when building this testcase on
|
||||
* its own for testing or for building a binary to use in testing binary
|
||||
* analysis tools. It is not used when compiling all the testcases as one
|
||||
* application, which is how source code analysis tools are tested.
|
||||
*/
|
||||
|
||||
#ifdef INCLUDEMAIN
|
||||
|
||||
int main(int argc, char * argv[])
|
||||
{
|
||||
/* seed randomness */
|
||||
srand( (unsigned)time(NULL) );
|
||||
#ifndef OMITGOOD
|
||||
printLine("Calling good()...");
|
||||
CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_good();
|
||||
printLine("Finished good()");
|
||||
#endif /* OMITGOOD */
|
||||
#ifndef OMITBAD
|
||||
printLine("Calling bad()...");
|
||||
CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_bad();
|
||||
printLine("Finished bad()");
|
||||
#endif /* OMITBAD */
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif
|
||||
+143
@@ -0,0 +1,143 @@
|
||||
/* TEMPLATE GENERATED TESTCASE FILE
|
||||
Filename: CWE134_Uncontrolled_Format_String__char_console_printf_01.c
|
||||
Label Definition File: CWE134_Uncontrolled_Format_String.label.xml
|
||||
Template File: sources-sinks-01.tmpl.c
|
||||
*/
|
||||
/*
|
||||
* @description
|
||||
* CWE: 134 Uncontrolled Format String
|
||||
* BadSource: console Read input from the console
|
||||
* GoodSource: Copy a fixed string into data
|
||||
* Sinks: printf
|
||||
* GoodSink: printf with "%s" as the first argument and data as the second
|
||||
* BadSink : printf with only data as an argument
|
||||
* Flow Variant: 01 Baseline
|
||||
*
|
||||
* */
|
||||
|
||||
#include "std_testcase.h"
|
||||
|
||||
#ifndef _WIN32
|
||||
#include <wchar.h>
|
||||
#endif
|
||||
|
||||
#ifndef OMITBAD
|
||||
|
||||
void CWE134_Uncontrolled_Format_String__char_console_printf_01_bad()
|
||||
{
|
||||
char * data;
|
||||
char dataBuffer[100] = "";
|
||||
data = dataBuffer;
|
||||
{
|
||||
/* Read input from the console */
|
||||
size_t dataLen = strlen(data);
|
||||
/* if there is room in data, read into it from the console */
|
||||
if (100-dataLen > 1)
|
||||
{
|
||||
/* POTENTIAL FLAW: Read data from the console */
|
||||
if (fgets(data+dataLen, (int)(100-dataLen), stdin) != NULL)
|
||||
{
|
||||
/* The next few lines remove the carriage return from the string that is
|
||||
* inserted by fgets() */
|
||||
dataLen = strlen(data);
|
||||
if (dataLen > 0 && data[dataLen-1] == '\n')
|
||||
{
|
||||
data[dataLen-1] = '\0';
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
printLine("fgets() failed");
|
||||
/* Restore NUL terminator if fgets fails */
|
||||
data[dataLen] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
/* POTENTIAL FLAW: Do not specify the format allowing a possible format string vulnerability */
|
||||
printf(data);
|
||||
}
|
||||
|
||||
#endif /* OMITBAD */
|
||||
|
||||
#ifndef OMITGOOD
|
||||
|
||||
/* goodG2B uses the GoodSource with the BadSink */
|
||||
static void goodG2B()
|
||||
{
|
||||
char * data;
|
||||
char dataBuffer[100] = "";
|
||||
data = dataBuffer;
|
||||
/* FIX: Use a fixed string that does not contain a format specifier */
|
||||
strcpy(data, "fixedstringtest");
|
||||
/* POTENTIAL FLAW: Do not specify the format allowing a possible format string vulnerability */
|
||||
printf(data);
|
||||
}
|
||||
|
||||
/* goodB2G uses the BadSource with the GoodSink */
|
||||
static void goodB2G()
|
||||
{
|
||||
char * data;
|
||||
char dataBuffer[100] = "";
|
||||
data = dataBuffer;
|
||||
{
|
||||
/* Read input from the console */
|
||||
size_t dataLen = strlen(data);
|
||||
/* if there is room in data, read into it from the console */
|
||||
if (100-dataLen > 1)
|
||||
{
|
||||
/* POTENTIAL FLAW: Read data from the console */
|
||||
if (fgets(data+dataLen, (int)(100-dataLen), stdin) != NULL)
|
||||
{
|
||||
/* The next few lines remove the carriage return from the string that is
|
||||
* inserted by fgets() */
|
||||
dataLen = strlen(data);
|
||||
if (dataLen > 0 && data[dataLen-1] == '\n')
|
||||
{
|
||||
data[dataLen-1] = '\0';
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
printLine("fgets() failed");
|
||||
/* Restore NUL terminator if fgets fails */
|
||||
data[dataLen] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
/* FIX: Specify the format disallowing a format string vulnerability */
|
||||
printf("%s\n", data);
|
||||
}
|
||||
|
||||
void CWE134_Uncontrolled_Format_String__char_console_printf_01_good()
|
||||
{
|
||||
goodG2B();
|
||||
goodB2G();
|
||||
}
|
||||
|
||||
#endif /* OMITGOOD */
|
||||
|
||||
/* Below is the main(). It is only used when building this testcase on
|
||||
its own for testing or for building a binary to use in testing binary
|
||||
analysis tools. It is not used when compiling all the testcases as one
|
||||
application, which is how source code analysis tools are tested. */
|
||||
|
||||
#ifdef INCLUDEMAIN
|
||||
|
||||
int main(int argc, char * argv[])
|
||||
{
|
||||
/* seed randomness */
|
||||
srand( (unsigned)time(NULL) );
|
||||
#ifndef OMITGOOD
|
||||
printLine("Calling good()...");
|
||||
CWE134_Uncontrolled_Format_String__char_console_printf_01_good();
|
||||
printLine("Finished good()");
|
||||
#endif /* OMITGOOD */
|
||||
#ifndef OMITBAD
|
||||
printLine("Calling bad()...");
|
||||
CWE134_Uncontrolled_Format_String__char_console_printf_01_bad();
|
||||
printLine("Finished bad()");
|
||||
#endif /* OMITBAD */
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,10 @@
|
||||
/* Juliet CWE-121 goodG2B still copies with strcpy (larger buffer, same sink).
|
||||
* Regex SAST is expected to keep firing — that is the Juliet goodG2B trap.
|
||||
* Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
|
||||
*/
|
||||
#include <string.h>
|
||||
|
||||
void CWE121_char_declare_cpy_01_goodG2B(char *data, char *source)
|
||||
{
|
||||
strcpy(data, source);
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
/* Juliet CWE-121 flow variant 01 — bad sink only.
|
||||
* Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
|
||||
* https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
#include <string.h>
|
||||
|
||||
void CWE121_char_declare_cpy_01_bad(char *data, char *source)
|
||||
{
|
||||
/* POTENTIAL FLAW: data may not have enough space to hold source */
|
||||
strcpy(data, source);
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
/* Juliet CWE-134 flow variant 01 — goodB2G sink only.
|
||||
* Upstream: CWE134_Uncontrolled_Format_String__char_console_printf_01.c
|
||||
* https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
#include <stdio.h>
|
||||
|
||||
void CWE134_char_console_printf_01_goodB2G(char *data)
|
||||
{
|
||||
/* FIX: Specify the format disallowing a format string vulnerability */
|
||||
printf("%s\n", data);
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
/* Juliet CWE-134 flow variant 01 — bad sink only.
|
||||
* Upstream: testcases/CWE134_Uncontrolled_Format_String/s01/
|
||||
* CWE134_Uncontrolled_Format_String__char_console_printf_01.c
|
||||
* https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
#include <stdio.h>
|
||||
|
||||
void CWE134_char_console_printf_01_bad(char *data)
|
||||
{
|
||||
/* POTENTIAL FLAW: Do not specify the format allowing a format string vulnerability */
|
||||
printf(data);
|
||||
}
|
||||
+143
@@ -0,0 +1,143 @@
|
||||
/* TEMPLATE GENERATED TESTCASE FILE
|
||||
Filename: CWE78_OS_Command_Injection__console_readLine_01.java
|
||||
Label Definition File: CWE78_OS_Command_Injection.label.xml
|
||||
Template File: sources-sink-01.tmpl.java
|
||||
*/
|
||||
/*
|
||||
* @description
|
||||
* CWE: 78 OS Command Injection
|
||||
* BadSource: console_readLine Read data from the console using readLine()
|
||||
* GoodSource: A hardcoded string
|
||||
* BadSink: exec dynamic command execution with Runtime.getRuntime().exec()
|
||||
* Flow Variant: 01 Baseline
|
||||
*
|
||||
* */
|
||||
|
||||
package juliet.testcases.CWE78_OS_Command_Injection;
|
||||
|
||||
import juliet.support.*;
|
||||
|
||||
import javax.servlet.http.*;
|
||||
|
||||
import java.io.BufferedReader;
|
||||
import java.io.InputStreamReader;
|
||||
import java.io.IOException;
|
||||
|
||||
import java.util.logging.Level;
|
||||
|
||||
public class CWE78_OS_Command_Injection__console_readLine_01 extends AbstractTestCase
|
||||
{
|
||||
/* uses badsource and badsink */
|
||||
public void bad() throws Throwable
|
||||
{
|
||||
String data;
|
||||
|
||||
data = ""; /* Initialize data */
|
||||
|
||||
{
|
||||
InputStreamReader readerInputStream = null;
|
||||
BufferedReader readerBuffered = null;
|
||||
|
||||
/* read user input from console with readLine */
|
||||
try
|
||||
{
|
||||
readerInputStream = new InputStreamReader(System.in, "UTF-8");
|
||||
readerBuffered = new BufferedReader(readerInputStream);
|
||||
|
||||
/* POTENTIAL FLAW: Read data from the console using readLine */
|
||||
data = readerBuffered.readLine();
|
||||
}
|
||||
catch (IOException exceptIO)
|
||||
{
|
||||
IO.logger.log(Level.WARNING, "Error with stream reading", exceptIO);
|
||||
}
|
||||
finally
|
||||
{
|
||||
try
|
||||
{
|
||||
if (readerBuffered != null)
|
||||
{
|
||||
readerBuffered.close();
|
||||
}
|
||||
}
|
||||
catch (IOException exceptIO)
|
||||
{
|
||||
IO.logger.log(Level.WARNING, "Error closing BufferedReader", exceptIO);
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
if (readerInputStream != null)
|
||||
{
|
||||
readerInputStream.close();
|
||||
}
|
||||
}
|
||||
catch (IOException exceptIO)
|
||||
{
|
||||
IO.logger.log(Level.WARNING, "Error closing InputStreamReader", exceptIO);
|
||||
}
|
||||
}
|
||||
}
|
||||
/* NOTE: Tools may report a flaw here because buffread and isr are not closed. Unfortunately, closing those will close System.in, which will cause any future attempts to read from the console to fail and throw an exception */
|
||||
|
||||
String osCommand;
|
||||
if(System.getProperty("os.name").toLowerCase().indexOf("win") >= 0)
|
||||
{
|
||||
/* running on Windows */
|
||||
osCommand = "c:\\WINDOWS\\SYSTEM32\\cmd.exe /c dir ";
|
||||
}
|
||||
else
|
||||
{
|
||||
/* running on non-Windows */
|
||||
osCommand = "/bin/ls ";
|
||||
}
|
||||
|
||||
/* POTENTIAL FLAW: command injection */
|
||||
Process process = Runtime.getRuntime().exec(osCommand + data);
|
||||
process.waitFor();
|
||||
|
||||
}
|
||||
|
||||
public void good() throws Throwable
|
||||
{
|
||||
goodG2B();
|
||||
}
|
||||
|
||||
/* goodG2B() - uses goodsource and badsink */
|
||||
private void goodG2B() throws Throwable
|
||||
{
|
||||
String data;
|
||||
|
||||
/* FIX: Use a hardcoded string */
|
||||
data = "foo";
|
||||
|
||||
String osCommand;
|
||||
if(System.getProperty("os.name").toLowerCase().indexOf("win") >= 0)
|
||||
{
|
||||
/* running on Windows */
|
||||
osCommand = "c:\\WINDOWS\\SYSTEM32\\cmd.exe /c dir ";
|
||||
}
|
||||
else
|
||||
{
|
||||
/* running on non-Windows */
|
||||
osCommand = "/bin/ls ";
|
||||
}
|
||||
|
||||
/* POTENTIAL FLAW: command injection */
|
||||
Process process = Runtime.getRuntime().exec(osCommand + data);
|
||||
process.waitFor();
|
||||
|
||||
}
|
||||
|
||||
/* Below is the main(). It is only used when building this testcase on
|
||||
* its own for testing or for building a binary to use in testing binary
|
||||
* analysis tools. It is not used when compiling all the juliet.testcases as one
|
||||
* application, which is how source code analysis tools are tested.
|
||||
*/
|
||||
public static void main(String[] args) throws ClassNotFoundException,
|
||||
InstantiationException, IllegalAccessException
|
||||
{
|
||||
mainFromParent(args);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
/* Juliet CWE-78 goodG2B — hardcoded source, same Runtime.exec sink.
|
||||
* Regex SAST is expected to keep firing — Juliet goodG2B trap.
|
||||
* Upstream: CWE78_OS_Command_Injection__console_readLine_01.java
|
||||
*/
|
||||
public class CWE78_OS_Command_Injection__console_readLine_01 {
|
||||
public void goodG2B() throws Throwable {
|
||||
String data = "foo";
|
||||
String osCommand = "/bin/ls ";
|
||||
Process process = Runtime.getRuntime().exec(osCommand + data);
|
||||
process.waitFor();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
/* Juliet CWE-78 flow variant 01 — bad sink only.
|
||||
* Upstream: CWE78_OS_Command_Injection__console_readLine_01.java
|
||||
* https://github.com/UnitTestBot/juliet-java-test-suite (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
public class CWE78_OS_Command_Injection__console_readLine_01 {
|
||||
public void bad(String data) throws Throwable {
|
||||
String osCommand = "/bin/ls ";
|
||||
Process process = Runtime.getRuntime().exec(osCommand + data);
|
||||
process.waitFor();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/hash-00/BenchmarkTest00003")
|
||||
public class BenchmarkTest00003 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
javax.servlet.http.Cookie userCookie =
|
||||
new javax.servlet.http.Cookie("BenchmarkTest00003", "someSecret");
|
||||
userCookie.setMaxAge(60 * 3); // Store cookie for 3 minutes
|
||||
userCookie.setSecure(true);
|
||||
userCookie.setHttpOnly(true);
|
||||
userCookie.setPath(request.getRequestURI());
|
||||
userCookie.setDomain(new java.net.URL(request.getRequestURL().toString()).getHost());
|
||||
response.addCookie(userCookie);
|
||||
javax.servlet.RequestDispatcher rd =
|
||||
request.getRequestDispatcher("/hash-00/BenchmarkTest00003.html");
|
||||
rd.include(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
javax.servlet.http.Cookie[] theCookies = request.getCookies();
|
||||
|
||||
String param = "noCookieValueSupplied";
|
||||
if (theCookies != null) {
|
||||
for (javax.servlet.http.Cookie theCookie : theCookies) {
|
||||
if (theCookie.getName().equals("BenchmarkTest00003")) {
|
||||
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
java.util.Properties benchmarkprops = new java.util.Properties();
|
||||
benchmarkprops.load(
|
||||
this.getClass().getClassLoader().getResourceAsStream("benchmark.properties"));
|
||||
String algorithm = benchmarkprops.getProperty("hashAlg1", "SHA512");
|
||||
java.security.MessageDigest md = java.security.MessageDigest.getInstance(algorithm);
|
||||
byte[] input = {(byte) '?'};
|
||||
Object inputParam = param;
|
||||
if (inputParam instanceof String) input = ((String) inputParam).getBytes();
|
||||
if (inputParam instanceof java.io.InputStream) {
|
||||
byte[] strInput = new byte[1000];
|
||||
int i = ((java.io.InputStream) inputParam).read(strInput);
|
||||
if (i == -1) {
|
||||
response.getWriter()
|
||||
.println(
|
||||
"This input source requires a POST, not a GET. Incompatible UI for the InputStream source.");
|
||||
return;
|
||||
}
|
||||
input = java.util.Arrays.copyOf(strInput, i);
|
||||
}
|
||||
md.update(input);
|
||||
|
||||
byte[] result = md.digest();
|
||||
java.io.File fileTarget =
|
||||
new java.io.File(
|
||||
new java.io.File(org.owasp.benchmark.helpers.Utils.TESTFILES_DIR),
|
||||
"passwordFile.txt");
|
||||
java.io.FileWriter fw =
|
||||
new java.io.FileWriter(fileTarget, true); // the true will append the new data
|
||||
fw.write(
|
||||
"hash_value="
|
||||
+ org.owasp.esapi.ESAPI.encoder().encodeForBase64(result, true)
|
||||
+ "\n");
|
||||
fw.close();
|
||||
response.getWriter()
|
||||
.println(
|
||||
"Sensitive value '"
|
||||
+ org.owasp
|
||||
.esapi
|
||||
.ESAPI
|
||||
.encoder()
|
||||
.encodeForHTML(new String(input))
|
||||
+ "' hashed and stored<br/>");
|
||||
|
||||
} catch (java.security.NoSuchAlgorithmException e) {
|
||||
System.out.println("Problem executing hash - TestCase");
|
||||
throw new ServletException(e);
|
||||
}
|
||||
|
||||
response.getWriter()
|
||||
.println(
|
||||
"Hash Test java.security.MessageDigest.getInstance(java.lang.String) executed");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,70 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/cmdi-00/BenchmarkTest00007")
|
||||
public class BenchmarkTest00007 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("BenchmarkTest00007") != null) {
|
||||
param = request.getHeader("BenchmarkTest00007");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String cmd =
|
||||
org.owasp.benchmark.helpers.Utils.getInsecureOSCommandString(
|
||||
this.getClass().getClassLoader());
|
||||
String[] args = {cmd};
|
||||
String[] argsEnv = {param};
|
||||
|
||||
Runtime r = Runtime.getRuntime();
|
||||
|
||||
try {
|
||||
Process p = r.exec(args, argsEnv);
|
||||
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
|
||||
} catch (IOException e) {
|
||||
System.out.println("Problem executing cmdi - TestCase");
|
||||
response.getWriter()
|
||||
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/sqli-00/BenchmarkTest00008")
|
||||
public class BenchmarkTest00008 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
if (request.getHeader("BenchmarkTest00008") != null) {
|
||||
param = request.getHeader("BenchmarkTest00008");
|
||||
}
|
||||
|
||||
// URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
|
||||
param = java.net.URLDecoder.decode(param, "UTF-8");
|
||||
|
||||
String sql = "{call " + param + "}";
|
||||
|
||||
try {
|
||||
java.sql.Connection connection =
|
||||
org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection();
|
||||
java.sql.CallableStatement statement = connection.prepareCall(sql);
|
||||
java.sql.ResultSet rs = statement.executeQuery();
|
||||
org.owasp.benchmark.helpers.DatabaseHelper.printResults(rs, sql, response);
|
||||
|
||||
} catch (java.sql.SQLException e) {
|
||||
if (org.owasp.benchmark.helpers.DatabaseHelper.hideSQLErrors) {
|
||||
response.getWriter().println("Error processing request.");
|
||||
} else throw new ServletException(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,124 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/hash-00/BenchmarkTest00009")
|
||||
public class BenchmarkTest00009 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
String param = "";
|
||||
java.util.Enumeration<String> names = request.getHeaderNames();
|
||||
while (names.hasMoreElements()) {
|
||||
String name = (String) names.nextElement();
|
||||
|
||||
if (org.owasp.benchmark.helpers.Utils.commonHeaders.contains(name)) {
|
||||
continue; // If standard header, move on to next one
|
||||
}
|
||||
|
||||
java.util.Enumeration<String> values = request.getHeaders(name);
|
||||
if (values != null && values.hasMoreElements()) {
|
||||
param = name; // Grabs the name of the first non-standard header as the parameter
|
||||
// value
|
||||
break;
|
||||
}
|
||||
}
|
||||
// Note: We don't URL decode header names because people don't normally do that
|
||||
|
||||
java.security.Provider[] provider = java.security.Security.getProviders();
|
||||
java.security.MessageDigest md;
|
||||
|
||||
try {
|
||||
if (provider.length > 1) {
|
||||
|
||||
md = java.security.MessageDigest.getInstance("sha-384", provider[0]);
|
||||
} else {
|
||||
md = java.security.MessageDigest.getInstance("sha-384", "SUN");
|
||||
}
|
||||
byte[] input = {(byte) '?'};
|
||||
Object inputParam = param;
|
||||
if (inputParam instanceof String) input = ((String) inputParam).getBytes();
|
||||
if (inputParam instanceof java.io.InputStream) {
|
||||
byte[] strInput = new byte[1000];
|
||||
int i = ((java.io.InputStream) inputParam).read(strInput);
|
||||
if (i == -1) {
|
||||
response.getWriter()
|
||||
.println(
|
||||
"This input source requires a POST, not a GET. Incompatible UI for the InputStream source.");
|
||||
return;
|
||||
}
|
||||
input = java.util.Arrays.copyOf(strInput, i);
|
||||
}
|
||||
md.update(input);
|
||||
|
||||
byte[] result = md.digest();
|
||||
java.io.File fileTarget =
|
||||
new java.io.File(
|
||||
new java.io.File(org.owasp.benchmark.helpers.Utils.TESTFILES_DIR),
|
||||
"passwordFile.txt");
|
||||
java.io.FileWriter fw =
|
||||
new java.io.FileWriter(fileTarget, true); // the true will append the new data
|
||||
fw.write(
|
||||
"hash_value="
|
||||
+ org.owasp.esapi.ESAPI.encoder().encodeForBase64(result, true)
|
||||
+ "\n");
|
||||
fw.close();
|
||||
response.getWriter()
|
||||
.println(
|
||||
"Sensitive value '"
|
||||
+ org.owasp
|
||||
.esapi
|
||||
.ESAPI
|
||||
.encoder()
|
||||
.encodeForHTML(new String(input))
|
||||
+ "' hashed and stored<br/>");
|
||||
|
||||
} catch (java.security.NoSuchAlgorithmException e) {
|
||||
System.out.println(
|
||||
"Problem executing hash - TestCase java.security.MessageDigest.getInstance(java.lang.String,java.security.Provider)");
|
||||
throw new ServletException(e);
|
||||
} catch (java.security.NoSuchProviderException e) {
|
||||
System.out.println(
|
||||
"Problem executing hash - TestCase java.security.MessageDigest.getInstance(java.lang.String,java.security.Provider)");
|
||||
throw new ServletException(e);
|
||||
}
|
||||
|
||||
response.getWriter()
|
||||
.println(
|
||||
"Hash Test java.security.MessageDigest.getInstance(java.lang.String,java.security.Provider) executed");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/**
|
||||
* OWASP Benchmark v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Dave Wichers
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/sqli-00/BenchmarkTest00052")
|
||||
public class BenchmarkTest00052 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
doPost(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
// some code
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
org.owasp.benchmark.helpers.SeparateClassRequest scr =
|
||||
new org.owasp.benchmark.helpers.SeparateClassRequest(request);
|
||||
String param = scr.getTheValue("BenchmarkTest00052");
|
||||
|
||||
String sql = "{call " + param + "}";
|
||||
|
||||
try {
|
||||
java.sql.Connection connection =
|
||||
org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection();
|
||||
java.sql.CallableStatement statement =
|
||||
connection.prepareCall(
|
||||
sql,
|
||||
java.sql.ResultSet.TYPE_FORWARD_ONLY,
|
||||
java.sql.ResultSet.CONCUR_READ_ONLY,
|
||||
java.sql.ResultSet.CLOSE_CURSORS_AT_COMMIT);
|
||||
java.sql.ResultSet rs = statement.executeQuery();
|
||||
org.owasp.benchmark.helpers.DatabaseHelper.printResults(rs, sql, response);
|
||||
} catch (java.sql.SQLException e) {
|
||||
if (org.owasp.benchmark.helpers.DatabaseHelper.hideSQLErrors) {
|
||||
response.getWriter().println("Error processing request.");
|
||||
} else throw new ServletException(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,91 @@
|
||||
/**
|
||||
* OWASP Benchmark Project v1.2
|
||||
*
|
||||
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
|
||||
* details, please see <a
|
||||
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
|
||||
*
|
||||
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
* of the GNU General Public License as published by the Free Software Foundation, version 2.
|
||||
*
|
||||
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
* PURPOSE. See the GNU General Public License for more details.
|
||||
*
|
||||
* @author Nick Sanidas
|
||||
* @created 2015
|
||||
*/
|
||||
package org.owasp.benchmark.testcode;
|
||||
|
||||
import java.io.IOException;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.annotation.WebServlet;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
@WebServlet(value = "/cmdi-00/BenchmarkTest00090")
|
||||
public class BenchmarkTest00090 extends HttpServlet {
|
||||
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Override
|
||||
public void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
javax.servlet.http.Cookie userCookie =
|
||||
new javax.servlet.http.Cookie("BenchmarkTest00090", "ls");
|
||||
userCookie.setMaxAge(60 * 3); // Store cookie for 3 minutes
|
||||
userCookie.setSecure(true);
|
||||
userCookie.setHttpOnly(true);
|
||||
userCookie.setPath(request.getRequestURI());
|
||||
userCookie.setDomain(new java.net.URL(request.getRequestURL().toString()).getHost());
|
||||
response.addCookie(userCookie);
|
||||
javax.servlet.RequestDispatcher rd =
|
||||
request.getRequestDispatcher("/cmdi-00/BenchmarkTest00090.html");
|
||||
rd.include(request, response);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doPost(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
response.setContentType("text/html;charset=UTF-8");
|
||||
|
||||
javax.servlet.http.Cookie[] theCookies = request.getCookies();
|
||||
|
||||
String param = "noCookieValueSupplied";
|
||||
if (theCookies != null) {
|
||||
for (javax.servlet.http.Cookie theCookie : theCookies) {
|
||||
if (theCookie.getName().equals("BenchmarkTest00090")) {
|
||||
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
String bar;
|
||||
|
||||
// Simple if statement that assigns constant to bar on true condition
|
||||
int num = 86;
|
||||
if ((7 * 42) - num > 200) bar = "This_should_always_happen";
|
||||
else bar = param;
|
||||
|
||||
String cmd = "";
|
||||
String osName = System.getProperty("os.name");
|
||||
if (osName.indexOf("Windows") != -1) {
|
||||
cmd = org.owasp.benchmark.helpers.Utils.getOSCommandString("echo");
|
||||
}
|
||||
|
||||
Runtime r = Runtime.getRuntime();
|
||||
|
||||
try {
|
||||
Process p = r.exec(cmd + bar);
|
||||
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
|
||||
} catch (IOException e) {
|
||||
System.out.println("Problem executing cmdi - TestCase");
|
||||
response.getWriter()
|
||||
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00011', methods=['GET'])
|
||||
def BenchmarkTest00011_get():
|
||||
response = make_response(render_template('web/sqli-00/BenchmarkTest00011.html'))
|
||||
response.set_cookie('BenchmarkTest00011', 'bar',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00011_post()
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00011', methods=['POST'])
|
||||
def BenchmarkTest00011_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00011", "noCookieValueSupplied"))
|
||||
|
||||
bar = "This should never happen"
|
||||
if 'should' in bar:
|
||||
bar = param
|
||||
|
||||
import helpers.db_sqlite
|
||||
|
||||
sql = f'SELECT username from USERS where password = ?'
|
||||
con = helpers.db_sqlite.get_connection()
|
||||
cur = con.cursor()
|
||||
cur.execute(sql, (bar,))
|
||||
RESPONSE += (
|
||||
helpers.db_sqlite.results(cur, sql)
|
||||
)
|
||||
con.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00054', methods=['GET'])
|
||||
def BenchmarkTest00054_get():
|
||||
response = make_response(render_template('web/hash-00/BenchmarkTest00054.html'))
|
||||
response.set_cookie('BenchmarkTest00054', 'someSecret',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00054_post()
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00054', methods=['POST'])
|
||||
def BenchmarkTest00054_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00054", "noCookieValueSupplied"))
|
||||
|
||||
string26833 = ''
|
||||
data12 = ''
|
||||
copy = string26833
|
||||
string26833 = ''
|
||||
string26833 += param
|
||||
copy += 'SomeOKString'
|
||||
bar = copy
|
||||
|
||||
import hashlib, base64
|
||||
import io, helpers.utils
|
||||
|
||||
input = ''
|
||||
if isinstance(bar, str):
|
||||
input = bar.encode('utf-8')
|
||||
elif isinstance(bar, io.IOBase):
|
||||
input = bar.read(1000)
|
||||
|
||||
if len(input) == 0:
|
||||
RESPONSE += (
|
||||
'Cannot generate hash: Input was empty.'
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
hash = hashlib.new('md5')
|
||||
hash.update(input)
|
||||
|
||||
result = hash.digest()
|
||||
f = open(f'{helpers.utils.TESTFILES_DIR}/passwordFile.txt', 'a')
|
||||
f.write(f'hash_value={base64.b64encode(result)}\n')
|
||||
RESPONSE += (
|
||||
f'Sensitive value \'{helpers.utils.escape_for_html(input.decode('utf-8'))}\' hashed and stored.'
|
||||
)
|
||||
f.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00055', methods=['GET'])
|
||||
def BenchmarkTest00055_get():
|
||||
response = make_response(render_template('web/hash-00/BenchmarkTest00055.html'))
|
||||
response.set_cookie('BenchmarkTest00055', 'someSecret',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00055_post()
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00055', methods=['POST'])
|
||||
def BenchmarkTest00055_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00055", "noCookieValueSupplied"))
|
||||
|
||||
num = 106
|
||||
|
||||
bar = "This should never happen" if (7*42) - num > 200 else param
|
||||
|
||||
import hashlib, base64
|
||||
import io, helpers.utils
|
||||
|
||||
input = ''
|
||||
if isinstance(bar, str):
|
||||
input = bar.encode('utf-8')
|
||||
elif isinstance(bar, io.IOBase):
|
||||
input = bar.read(1000)
|
||||
|
||||
if len(input) == 0:
|
||||
RESPONSE += (
|
||||
'Cannot generate hash: Input was empty.'
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
hash = hashlib.new('sha384')
|
||||
hash.update(input)
|
||||
|
||||
result = hash.digest()
|
||||
f = open(f'{helpers.utils.TESTFILES_DIR}/passwordFile.txt', 'a')
|
||||
f.write(f'hash_value={base64.b64encode(result)}\n')
|
||||
RESPONSE += (
|
||||
f'Sensitive value \'{helpers.utils.escape_for_html(input.decode('utf-8'))}\' hashed and stored.'
|
||||
)
|
||||
f.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,62 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00073', methods=['GET'])
|
||||
def BenchmarkTest00073_get():
|
||||
response = make_response(render_template('web/codeinj-00/BenchmarkTest00073.html'))
|
||||
response.set_cookie('BenchmarkTest00073', '%27ECHOOO%27',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00073_post()
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00073', methods=['POST'])
|
||||
def BenchmarkTest00073_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00073", "noCookieValueSupplied"))
|
||||
|
||||
string41416 = 'help'
|
||||
string41416 += param
|
||||
string41416 += 'snapes on a plane'
|
||||
bar = string41416[4:-17]
|
||||
|
||||
if not bar.startswith('\'') or not bar.endswith('\'') or '\'' in bar[1:-1]:
|
||||
RESPONSE += (
|
||||
"Eval argument must be a plain string literal."
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
try:
|
||||
RESPONSE += (
|
||||
eval(bar)
|
||||
)
|
||||
except:
|
||||
RESPONSE += (
|
||||
f'Error evaluating expression \'{escape_for_html(bar)}\''
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00074', methods=['GET'])
|
||||
def BenchmarkTest00074_get():
|
||||
response = make_response(render_template('web/codeinj-00/BenchmarkTest00074.html'))
|
||||
response.set_cookie('BenchmarkTest00074', '%27RESPONSE+%2B%3D+%5C%27ECHOOO%5C%27%27',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00074_post()
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00074', methods=['POST'])
|
||||
def BenchmarkTest00074_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00074", "noCookieValueSupplied"))
|
||||
|
||||
import configparser
|
||||
|
||||
bar = 'safe!'
|
||||
conf90091 = configparser.ConfigParser()
|
||||
conf90091.add_section('section90091')
|
||||
conf90091.set('section90091', 'keyA-90091', 'a-Value')
|
||||
conf90091.set('section90091', 'keyB-90091', param)
|
||||
bar = conf90091.get('section90091', 'keyB-90091')
|
||||
|
||||
try:
|
||||
exec(bar)
|
||||
except:
|
||||
RESPONSE += (
|
||||
f'Error executing statement \'{escape_for_html(bar)}\''
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00078', methods=['GET'])
|
||||
def BenchmarkTest00078_get():
|
||||
response = make_response(render_template('web/deserialization-00/BenchmarkTest00078.html'))
|
||||
response.set_cookie('BenchmarkTest00078', 'gASVNwAAAAAAAACMCF9fbWFpbl9flIwOc2FmZV90b19waWNrbGWUk5QpgZR9lCiMAWGUjANmb2-UjAFilEtjdWIu',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00078_post()
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00078', methods=['POST'])
|
||||
def BenchmarkTest00078_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00078", "noCookieValueSupplied"))
|
||||
|
||||
string9895 = 'help'
|
||||
string9895 += param
|
||||
string9895 += 'snapes on a plane'
|
||||
bar = string9895[4:-17]
|
||||
|
||||
import pickle
|
||||
import base64
|
||||
import helpers.utils
|
||||
|
||||
helpers.utils.sharedstr = "no pickles to be seen here"
|
||||
|
||||
try:
|
||||
unpickled = pickle.loads(base64.urlsafe_b64decode(bar))
|
||||
except:
|
||||
RESPONSE += (
|
||||
'Unpickling failed!'
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
RESPONSE += (
|
||||
f'shared string is {helpers.utils.sharedstr}'
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00079', methods=['GET'])
|
||||
def BenchmarkTest00079_get():
|
||||
response = make_response(render_template('web/deserialization-00/BenchmarkTest00079.html'))
|
||||
response.set_cookie('BenchmarkTest00079', 'name%3A+safe+data%0Atext%3A+act+like+this+is+conf+data',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00079_post()
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00079', methods=['POST'])
|
||||
def BenchmarkTest00079_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00079", "noCookieValueSupplied"))
|
||||
|
||||
bar = param
|
||||
|
||||
import yaml
|
||||
|
||||
try:
|
||||
yobj = yaml.safe_load(bar)
|
||||
|
||||
RESPONSE += (
|
||||
yobj['text']
|
||||
)
|
||||
except:
|
||||
RESPONSE += (
|
||||
"There was an error loading the configuration"
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00099', methods=['GET'])
|
||||
def BenchmarkTest00099_get():
|
||||
return BenchmarkTest00099_post()
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00099', methods=['POST'])
|
||||
def BenchmarkTest00099_post():
|
||||
RESPONSE = ""
|
||||
|
||||
param = request.form.get("BenchmarkTest00099")
|
||||
if not param:
|
||||
param = ""
|
||||
|
||||
import configparser
|
||||
|
||||
bar = 'safe!'
|
||||
conf52528 = configparser.ConfigParser()
|
||||
conf52528.add_section('section52528')
|
||||
conf52528.set('section52528', 'keyA-52528', 'a-Value')
|
||||
conf52528.set('section52528', 'keyB-52528', param)
|
||||
bar = conf52528.get('section52528', 'keyB-52528')
|
||||
|
||||
import helpers.db_sqlite
|
||||
|
||||
sql = f'SELECT username from USERS where password = \'{bar}\''
|
||||
con = helpers.db_sqlite.get_connection()
|
||||
cur = con.cursor()
|
||||
cur.execute(sql)
|
||||
RESPONSE += (
|
||||
helpers.db_sqlite.results(cur, sql)
|
||||
)
|
||||
con.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,63 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00165', methods=['GET'])
|
||||
def BenchmarkTest00165_get():
|
||||
return BenchmarkTest00165_post()
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00165', methods=['POST'])
|
||||
def BenchmarkTest00165_post():
|
||||
RESPONSE = ""
|
||||
|
||||
param = request.form.get("BenchmarkTest00165")
|
||||
if not param:
|
||||
param = ""
|
||||
|
||||
bar = ""
|
||||
if param:
|
||||
lst = []
|
||||
lst.append('safe')
|
||||
lst.append(param)
|
||||
lst.append('moresafe')
|
||||
lst.pop(0)
|
||||
bar = lst[0]
|
||||
|
||||
import os
|
||||
import subprocess
|
||||
import helpers.utils
|
||||
|
||||
argList = []
|
||||
if "Windows" in os.name:
|
||||
argList.append("cmd.exe")
|
||||
argList.append("-c")
|
||||
else:
|
||||
argList.append("sh")
|
||||
argList.append("-c")
|
||||
argList.append(f"echo {bar}")
|
||||
|
||||
proc = subprocess.run(argList, capture_output=True, encoding="utf-8")
|
||||
RESPONSE += (
|
||||
helpers.utils.commandOutput(proc)
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00350', methods=['GET'])
|
||||
def BenchmarkTest00350_get():
|
||||
return BenchmarkTest00350_post()
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00350', methods=['POST'])
|
||||
def BenchmarkTest00350_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import helpers.separate_request
|
||||
|
||||
wrapped = helpers.separate_request.request_wrapper(request)
|
||||
param = wrapped.get_form_parameter("BenchmarkTest00350")
|
||||
if not param:
|
||||
param = ""
|
||||
|
||||
map11630 = {}
|
||||
map11630['keyA-11630'] = 'a-Value'
|
||||
map11630['keyB-11630'] = param
|
||||
map11630['keyC'] = 'another-Value'
|
||||
bar = "safe!"
|
||||
bar = map11630['keyB-11630']
|
||||
bar = map11630['keyA-11630']
|
||||
|
||||
import platform
|
||||
import subprocess
|
||||
import helpers.utils
|
||||
|
||||
argStr = ""
|
||||
if platform.system() == "Windows":
|
||||
argStr = "cmd.exe /c "
|
||||
else:
|
||||
argStr = "sh -c "
|
||||
argStr += f"echo {bar}"
|
||||
|
||||
try:
|
||||
proc = subprocess.run(argStr, shell=True, capture_output=True, encoding="utf-8")
|
||||
|
||||
RESPONSE += (
|
||||
helpers.utils.commandOutput(proc)
|
||||
)
|
||||
except IOError:
|
||||
RESPONSE += (
|
||||
"Problem executing cmdi - subprocess.run(list) Test Case"
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
Reference in New Issue
Block a user