Skip to content

Commit d74cda6

Browse files
davewichersdavewichers
committed
Remove cookies as sources of attack for the XSS test cases. To much debate on both
sides as to whether they are safe or not. So just remove them to avoid arguments as to the validity of those tests.
1 parent 96213ff commit d74cda6

8,267 files changed

Lines changed: 121675 additions & 132106 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎expectedresults-1.2beta.csv‎

Lines changed: 2721 additions & 2774 deletions
Large diffs are not rendered by default.

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00001.java‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -44,22 +44,14 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
4444

4545
javax.servlet.http.Cookie[] theCookies = request.getCookies();
4646

47-
String param = null;
48-
boolean foundit = false;
47+
String param = "";
4948
if (theCookies != null) {
5049
for (javax.servlet.http.Cookie theCookie : theCookies) {
5150
if (theCookie.getName().equals("vector")) {
5251
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
53-
foundit = true;
52+
break;
5453
}
5554
}
56-
if (!foundit) {
57-
// no cookie found in collection
58-
param = "";
59-
}
60-
} else {
61-
// no cookies
62-
param = "";
6355
}
6456

6557

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00002.java‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -44,22 +44,14 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
4444

4545
javax.servlet.http.Cookie[] theCookies = request.getCookies();
4646

47-
String param = null;
48-
boolean foundit = false;
47+
String param = "";
4948
if (theCookies != null) {
5049
for (javax.servlet.http.Cookie theCookie : theCookies) {
5150
if (theCookie.getName().equals("vector")) {
5251
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
53-
foundit = true;
52+
break;
5453
}
5554
}
56-
if (!foundit) {
57-
// no cookie found in collection
58-
param = "";
59-
}
60-
} else {
61-
// no cookies
62-
param = "";
6355
}
6456

6557

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00003.java‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -44,22 +44,14 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
4444

4545
javax.servlet.http.Cookie[] theCookies = request.getCookies();
4646

47-
String param = null;
48-
boolean foundit = false;
47+
String param = "";
4948
if (theCookies != null) {
5049
for (javax.servlet.http.Cookie theCookie : theCookies) {
5150
if (theCookie.getName().equals("vector")) {
5251
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
53-
foundit = true;
52+
break;
5453
}
5554
}
56-
if (!foundit) {
57-
// no cookie found in collection
58-
param = "";
59-
}
60-
} else {
61-
// no cookies
62-
param = "";
6355
}
6456

6557

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00004.java‎

Lines changed: 7 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -44,53 +44,21 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
4444

4545
javax.servlet.http.Cookie[] theCookies = request.getCookies();
4646

47-
String param = null;
48-
boolean foundit = false;
47+
String param = "";
4948
if (theCookies != null) {
5049
for (javax.servlet.http.Cookie theCookie : theCookies) {
5150
if (theCookie.getName().equals("vector")) {
5251
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
53-
foundit = true;
52+
break;
5453
}
5554
}
56-
if (!foundit) {
57-
// no cookie found in collection
58-
param = "";
59-
}
60-
} else {
61-
// no cookies
62-
param = "";
6355
}
6456

6557

66-
String cmd = "";
67-
String a1 = "";
68-
String a2 = "";
69-
String[] args = null;
70-
String osName = System.getProperty("os.name");
71-
72-
if (osName.indexOf("Windows") != -1) {
73-
a1 = "cmd.exe";
74-
a2 = "/c";
75-
cmd = "echo ";
76-
args = new String[]{a1, a2, cmd, param};
77-
} else {
78-
a1 = "sh";
79-
a2 = "-c";
80-
cmd = org.owasp.benchmark.helpers.Utils.getOSCommandString("ls");
81-
args = new String[]{a1, a2,cmd + param};
82-
}
83-
84-
String[] argsEnv = { "foo=bar" };
85-
86-
Runtime r = Runtime.getRuntime();
87-
88-
try {
89-
Process p = r.exec(args, argsEnv, new java.io.File(System.getProperty("user.dir")));
90-
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
91-
} catch (IOException e) {
92-
System.out.println("Problem executing cmdi - TestCase");
93-
throw new ServletException(e);
94-
}
58+
// javax.servlet.http.HttpSession.setAttribute(java.lang.String^,java.lang.Object)
59+
request.getSession().setAttribute( param, "10340");
60+
61+
response.getWriter().println("Item: '" + org.owasp.benchmark.helpers.Utils.encodeForHTML(param)
62+
+ "' with value: '10340' saved in session.");
9563
}
9664
}

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00004.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<test-metadata>
22
<benchmark-version>1.2beta</benchmark-version>
3-
<category>cmdi</category>
3+
<category>trustbound</category>
44
<test-number>00004</test-number>
55
<vulnerability>true</vulnerability>
6-
<cwe>78</cwe>
6+
<cwe>501</cwe>
77
</test-metadata>

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00005.java‎

Lines changed: 64 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -42,42 +42,73 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
4242
response.setContentType("text/html");
4343

4444

45-
javax.servlet.http.Cookie[] theCookies = request.getCookies();
46-
47-
String param = null;
48-
boolean foundit = false;
49-
if (theCookies != null) {
50-
for (javax.servlet.http.Cookie theCookie : theCookies) {
51-
if (theCookie.getName().equals("vector")) {
52-
param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8");
53-
foundit = true;
54-
}
55-
}
56-
if (!foundit) {
57-
// no cookie found in collection
58-
param = "";
59-
}
60-
} else {
61-
// no cookies
62-
param = "";
63-
}
45+
String param = request.getHeader("vector");
46+
if (param == null) param = "";
6447

6548

49+
// Code based on example from:
50+
// http://examples.javacodegeeks.com/core-java/crypto/encrypt-decrypt-file-stream-with-des/
51+
// 8-byte initialization vector
52+
byte[] iv = {
53+
(byte)0xB2, (byte)0x12, (byte)0xD5, (byte)0xB2,
54+
(byte)0x44, (byte)0x21, (byte)0xC3, (byte)0xC3033
55+
};
56+
6657
try {
67-
String sql = "SELECT TOP 1 USERNAME from USERS where USERNAME='foo' and PASSWORD='"+ param + "'";
68-
69-
Object results = org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.queryForObject(sql,new Object[]{}, String.class);
70-
java.io.PrintWriter out = response.getWriter();
71-
out.write("Your results are: ");
72-
// System.out.println("Your results are");
73-
out.write(org.owasp.esapi.ESAPI.encoder().encodeForHTML(results.toString()));
74-
// System.out.println(results.toString());
75-
} catch (org.springframework.dao.DataAccessException e) {
76-
if (org.owasp.benchmark.helpers.DatabaseHelper.hideSQLErrors) {
77-
response.getWriter().println("Error processing request.");
78-
return;
79-
}
80-
else throw new ServletException(e);
58+
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding");
59+
60+
// Prepare the cipher to encrypt
61+
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
62+
java.security.spec.AlgorithmParameterSpec paramSpec = new javax.crypto.spec.IvParameterSpec(iv);
63+
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);
64+
65+
// encrypt and store the results
66+
byte[] input = { (byte)'?' };
67+
Object inputParam = param;
68+
if (inputParam instanceof String) input = ((String) inputParam).getBytes();
69+
if (inputParam instanceof java.io.InputStream) {
70+
byte[] strInput = new byte[1000];
71+
int i = ((java.io.InputStream) inputParam).read(strInput);
72+
if (i == -1) {
73+
response.getWriter().println("This input source requires a POST, not a GET. Incompatible UI for the InputStream source.");
74+
return;
75+
}
76+
input = java.util.Arrays.copyOf(strInput, i);
77+
}
78+
byte[] result = c.doFinal(input);
79+
80+
java.io.File fileTarget = new java.io.File(
81+
new java.io.File(org.owasp.benchmark.helpers.Utils.testfileDir),"passwordFile.txt");
82+
java.io.FileWriter fw = new java.io.FileWriter(fileTarget,true); //the true will append the new data
83+
fw.write("secret_value=" + org.owasp.esapi.ESAPI.encoder().encodeForBase64(result, true) + "\n");
84+
fw.close();
85+
response.getWriter().println("Sensitive value: '" + org.owasp.esapi.ESAPI.encoder().encodeForHTML(new String(input)) + "' encrypted and stored<br/>");
86+
87+
} catch (java.security.NoSuchAlgorithmException e) {
88+
response.getWriter().println("Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
89+
e.printStackTrace(response.getWriter());
90+
throw new ServletException(e);
91+
} catch (javax.crypto.NoSuchPaddingException e) {
92+
response.getWriter().println("Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
93+
e.printStackTrace(response.getWriter());
94+
throw new ServletException(e);
95+
} catch (javax.crypto.IllegalBlockSizeException e) {
96+
response.getWriter().println("Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
97+
e.printStackTrace(response.getWriter());
98+
throw new ServletException(e);
99+
} catch (javax.crypto.BadPaddingException e) {
100+
response.getWriter().println("Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
101+
e.printStackTrace(response.getWriter());
102+
throw new ServletException(e);
103+
} catch (java.security.InvalidKeyException e) {
104+
response.getWriter().println("Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
105+
e.printStackTrace(response.getWriter());
106+
throw new ServletException(e);
107+
} catch (java.security.InvalidAlgorithmParameterException e) {
108+
response.getWriter().println("Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
109+
e.printStackTrace(response.getWriter());
110+
throw new ServletException(e);
81111
}
112+
response.getWriter().println("Crypto Test javax.crypto.Cipher.getInstance(java.lang.String) executed");
82113
}
83114
}

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00005.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<test-metadata>
22
<benchmark-version>1.2beta</benchmark-version>
3-
<category>sqli</category>
3+
<category>crypto</category>
44
<test-number>00005</test-number>
55
<vulnerability>true</vulnerability>
6-
<cwe>89</cwe>
6+
<cwe>327</cwe>
77
</test-metadata>

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java‎

Lines changed: 21 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -46,37 +46,28 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
4646
if (param == null) param = "";
4747

4848

49+
java.util.List<String> argList = new java.util.ArrayList<String>();
50+
51+
String osName = System.getProperty("os.name");
52+
if (osName.indexOf("Windows") != -1) {
53+
argList.add("cmd.exe");
54+
argList.add("/c");
55+
} else {
56+
argList.add("sh");
57+
argList.add("-c");
58+
}
59+
argList.add("echo " + param);
60+
61+
ProcessBuilder pb = new ProcessBuilder();
62+
63+
pb.command(argList);
64+
4965
try {
50-
java.util.Properties benchmarkprops = new java.util.Properties();
51-
benchmarkprops.load(this.getClass().getClassLoader().getResourceAsStream("benchmark.properties"));
52-
String algorithm = benchmarkprops.getProperty("hashAlg2", "SHA5");
53-
java.security.MessageDigest md = java.security.MessageDigest.getInstance(algorithm);
54-
byte[] input = { (byte)'?' };
55-
Object inputParam = param;
56-
if (inputParam instanceof String) input = ((String) inputParam).getBytes();
57-
if (inputParam instanceof java.io.InputStream) {
58-
byte[] strInput = new byte[1000];
59-
int i = ((java.io.InputStream) inputParam).read(strInput);
60-
if (i == -1) {
61-
response.getWriter().println("This input source requires a POST, not a GET. Incompatible UI for the InputStream source.");
62-
return;
63-
}
64-
input = java.util.Arrays.copyOf(strInput, i);
65-
}
66-
md.update(input);
67-
68-
byte[] result = md.digest();
69-
java.io.File fileTarget = new java.io.File(
70-
new java.io.File(org.owasp.benchmark.helpers.Utils.testfileDir),"passwordFile.txt");
71-
java.io.FileWriter fw = new java.io.FileWriter(fileTarget,true); //the true will append the new data
72-
fw.write("hash_value=" + org.owasp.esapi.ESAPI.encoder().encodeForBase64(result, true) + "\n");
73-
fw.close();
74-
response.getWriter().println("Sensitive value '" + org.owasp.esapi.ESAPI.encoder().encodeForHTML(new String(input)) + "' hashed and stored<br/>");
75-
} catch (java.security.NoSuchAlgorithmException e) {
76-
System.out.println("Problem executing hash - TestCase");
77-
throw new ServletException(e);
66+
Process p = pb.start();
67+
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
68+
} catch (IOException e) {
69+
System.out.println("Problem executing cmdi - java.lang.ProcessBuilder(java.util.List) Test Case");
70+
throw new ServletException(e);
7871
}
79-
80-
response.getWriter().println("Hash Test java.security.MessageDigest.getInstance(java.lang.String) executed");
8172
}
8273
}

‎src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<test-metadata>
22
<benchmark-version>1.2beta</benchmark-version>
3-
<category>hash</category>
3+
<category>cmdi</category>
44
<test-number>00006</test-number>
5-
<vulnerability>false</vulnerability>
6-
<cwe>328</cwe>
5+
<vulnerability>true</vulnerability>
6+
<cwe>78</cwe>
77
</test-metadata>

0 commit comments

Comments
 (0)