Skip to content

Commit 401c976

Browse files
michaelnebelmichaelnebel
committed
Java: Add tests as is.
1 parent d2f793c commit 401c976

File tree

215 files changed

+16142
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

215 files changed

+16142
-0
lines changed

‎java/test/security/CWE-016/InsecureSpringActuatorConfig.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |

‎java/test/security/CWE-016/InsecureSpringActuatorConfig.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql

‎java/test/security/CWE-016/SensitiveInfo.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import org.springframework.stereotype.Controller;
2+
import org.springframework.web.bind.annotation.RequestParam;
3+
import org.springframework.web.bind.annotation.RequestMapping;
4+
5+
@Controller
6+
public class SensitiveInfo {
7+
@RequestMapping
8+
public void handleLogin(@RequestParam String username, @RequestParam String password) throws Exception {
9+
if (!username.equals("") && password.equals("")) {
10+
//Blank processing
11+
}
12+
}
13+
}

‎java/test/security/CWE-016/SpringBootActuators.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
| SpringBootActuators.java:6:88:6:120 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
2+
| SpringBootActuators.java:10:5:10:137 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
3+
| SpringBootActuators.java:14:5:14:149 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
4+
| SpringBootActuators.java:18:5:18:101 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
5+
| SpringBootActuators.java:22:5:22:89 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
6+
| SpringBootActuators.java:26:40:26:108 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |
7+
| SpringBootActuators.java:30:5:30:113 | permitAll(...) | Unauthenticated access to Spring Boot actuator is allowed. |

‎java/test/security/CWE-016/SpringBootActuators.java

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
2+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3+
4+
public class SpringBootActuators {
5+
protected void configure(HttpSecurity http) throws Exception {
6+
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests(requests -> requests.anyRequest().permitAll());
7+
}
8+
9+
protected void configure2(HttpSecurity http) throws Exception {
10+
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
11+
}
12+
13+
protected void configure3(HttpSecurity http) throws Exception {
14+
http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
15+
}
16+
17+
protected void configure4(HttpSecurity http) throws Exception {
18+
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest().permitAll();
19+
}
20+
21+
protected void configure5(HttpSecurity http) throws Exception {
22+
http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
23+
}
24+
25+
protected void configure6(HttpSecurity http) throws Exception {
26+
http.authorizeRequests(requests -> requests.requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll());
27+
}
28+
29+
protected void configure7(HttpSecurity http) throws Exception {
30+
http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest().permitAll();
31+
}
32+
33+
protected void configureOk1(HttpSecurity http) throws Exception {
34+
http.requestMatcher(EndpointRequest.toAnyEndpoint());
35+
}
36+
37+
protected void configureOk2(HttpSecurity http) throws Exception {
38+
http.requestMatchers().requestMatchers(EndpointRequest.toAnyEndpoint());
39+
}
40+
41+
protected void configureOk3(HttpSecurity http) throws Exception {
42+
http.authorizeRequests().anyRequest().permitAll();
43+
}
44+
45+
protected void configureOk4(HttpSecurity http) throws Exception {
46+
http.authorizeRequests(authz -> authz.anyRequest().permitAll());
47+
}
48+
49+
protected void configureOkSafeEndpoints1(HttpSecurity http) throws Exception {
50+
http.requestMatcher(EndpointRequest.to("health", "info")).authorizeRequests(requests -> requests.anyRequest().permitAll());
51+
}
52+
53+
protected void configureOkSafeEndpoints2(HttpSecurity http) throws Exception {
54+
http.requestMatcher(EndpointRequest.to("health")).authorizeRequests().requestMatchers(EndpointRequest.to("health")).permitAll();
55+
}
56+
57+
protected void configureOkSafeEndpoints3(HttpSecurity http) throws Exception {
58+
http.requestMatchers(matcher -> EndpointRequest.to("health", "info")).authorizeRequests().requestMatchers(EndpointRequest.to("health", "info")).permitAll();
59+
}
60+
61+
protected void configureOkSafeEndpoints4(HttpSecurity http) throws Exception {
62+
http.requestMatcher(EndpointRequest.to("health", "info")).authorizeRequests().anyRequest().permitAll();
63+
}
64+
65+
protected void configureOkSafeEndpoints5(HttpSecurity http) throws Exception {
66+
http.authorizeRequests().requestMatchers(EndpointRequest.to("health", "info")).permitAll();
67+
}
68+
69+
protected void configureOkSafeEndpoints6(HttpSecurity http) throws Exception {
70+
http.authorizeRequests(requests -> requests.requestMatchers(EndpointRequest.to("health", "info")).permitAll());
71+
}
72+
73+
protected void configureOkSafeEndpoints7(HttpSecurity http) throws Exception {
74+
http.requestMatchers(matcher -> EndpointRequest.to("health", "info")).authorizeRequests().anyRequest().permitAll();
75+
}
76+
77+
protected void configureOkNoPermitAll1(HttpSecurity http) throws Exception {
78+
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests(requests -> requests.anyRequest());
79+
}
80+
81+
protected void configureOkNoPermitAll2(HttpSecurity http) throws Exception {
82+
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint());
83+
}
84+
85+
protected void configureOkNoPermitAll3(HttpSecurity http) throws Exception {
86+
http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint());
87+
}
88+
89+
protected void configureOkNoPermitAll4(HttpSecurity http) throws Exception {
90+
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest();
91+
}
92+
93+
protected void configureOkNoPermitAll5(HttpSecurity http) throws Exception {
94+
http.authorizeRequests().requestMatchers(EndpointRequest.toAnyEndpoint());
95+
}
96+
97+
protected void configureOkNoPermitAll6(HttpSecurity http) throws Exception {
98+
http.authorizeRequests(requests -> requests.requestMatchers(EndpointRequest.toAnyEndpoint()));
99+
}
100+
101+
protected void configureOkNoPermitAll7(HttpSecurity http) throws Exception {
102+
http.requestMatchers(matcher -> EndpointRequest.toAnyEndpoint()).authorizeRequests().anyRequest();
103+
}
104+
}

‎java/test/security/CWE-016/SpringBootActuators.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-016/SpringBootActuators.ql

‎java/test/security/CWE-016/application.properties

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#management.endpoints.web.base-path=/admin
2+
3+
# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
4+
5+
# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
6+
management.security.enabled=false
7+
8+
# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
9+
management.endpoints.web.exposure.include=*
10+
management.endpoints.web.exposure.exclude=beans
11+
12+
management.endpoint.shutdown.enabled=true
13+
14+
management.endpoint.health.show-details=when_authorized

‎java/test/security/CWE-016/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.3.8

‎java/test/security/CWE-016/pom.xml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>spring-boot-actuator-app</groupId>
8+
<artifactId>spring-boot-actuator-app</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
11+
<properties>
12+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
13+
<maven.compiler.source>1.8</maven.compiler.source>
14+
<maven.compiler.target>1.8</maven.compiler.target>
15+
</properties>
16+
17+
<parent>
18+
<groupId>org.springframework.boot</groupId>
19+
<artifactId>spring-boot-starter-parent</artifactId>
20+
<version>2.3.8.RELEASE</version>
21+
<relativePath/>
22+
</parent>
23+
24+
<dependencies>
25+
<dependency>
26+
<groupId>org.springframework.boot</groupId>
27+
<artifactId>spring-boot-starter-web</artifactId>
28+
</dependency>
29+
<dependency>
30+
<groupId>org.springframework.boot</groupId>
31+
<artifactId>spring-boot-starter-actuator</artifactId>
32+
</dependency>
33+
<dependency>
34+
<groupId>org.springframework.boot</groupId>
35+
<artifactId>spring-boot-devtools</artifactId>
36+
</dependency>
37+
<!-- dependency>
38+
<groupId>org.springframework.boot</groupId>
39+
<artifactId>spring-boot-starter-security</artifactId>
40+
</dependency -->
41+
<dependency>
42+
<groupId>org.springframework.boot</groupId>
43+
<artifactId>spring-boot-test</artifactId>
44+
</dependency>
45+
</dependencies>
46+
47+
</project>

0 commit comments

Comments
 (0)