Skip to content

Commit 18c9dcb

Browse files
davewichersdavewichers
committed
Enhance scorecard generator to move chart key to the right, providing more room on the chart itself.
Add new scorecard parsers for Acunetix, Rapid7, WebInspect, and Contrast. Add crawler application that will crawl every page in the Benchmark to support IAST tools. Enhance SonarQube scripts to better tell if sonarqube web app is running when we want to send it results. Add support for running the Benchmark with monitoring by Contrast (requires separate contrast.jar which isn't provided) Add scripts for producing the Contrast results file after the Benchmark is crawled by the crawler while being monitored by Contrast.
1 parent 32b195b commit 18c9dcb

29 files changed

+1931
-948
lines changed

‎SonarQubeRequest.exe

4.5 KB
Binary file not shown.

‎createAnonScorecards.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
mvn validate -Pbenchmarkscore -Dexec.args="expectedresults-1.2beta.csv results none anonymous"

‎forcontrast/contrast.config

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0"?>
2+
<contrast>
3+
<id>default</id>
4+
<url>http://example.com/Contrast/s/</url>
5+
<local-results mode="always">../../../../forcontrast/findings</local-results>
6+
<plugins>
7+
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.security.SecurityPlugin</plugin>
8+
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.architecture.ArchitecturePlugin</plugin>
9+
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.appupdater.ApplicationUpdatePlugin</plugin>
10+
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.sitemap.SitemapPlugin</plugin>
11+
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.frameworks.FrameworkSupportPlugin</plugin>
12+
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.http.HttpPlugin</plugin>
13+
</plugins>
14+
<capture-stacktraces>NONE</capture-stacktraces>
15+
<hotpatches />
16+
<sampling>
17+
<enabled>false</enabled>
18+
<baseline>5</baseline>
19+
<request-frequency>10</request-frequency>
20+
<response-frequency>50</response-frequency>
21+
<window>180</window>
22+
</sampling>
23+
</contrast>

‎forcontrast/removeUnneededEvents.sh

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/sh
2+
# This script removes ALL the filenames passed to it. It is intended to be used by the prepareContrastResults.sh script to remove all the unnecessary event files in the forcontrast/findings folder. A script had to be written because simply calling rm APP* didn’t work because the # of parameters to rm was too many.
3+
# The shift function in this loop drops the first parameter and moves all the remaining parameters down one, allowing you to delete one file at a time.
4+
#BE CAREFUL if you use it somewhere else.
5+
6+
while (( "$#" )); do
7+
8+
rm $1
9+
10+
shift
11+
12+
done
13+

‎pom.xml

Lines changed: 140 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,65 @@
88
<name>OWASP Benchmark Project</name>
99
<url>https://www.owasp.org/index.php/Benchmark</url>
1010
<profiles>
11+
<profile>
12+
<id>permute</id>
13+
<properties>
14+
<skipTests>true</skipTests>
15+
</properties>
16+
<build>
17+
<plugins>
18+
<plugin>
19+
<artifactId>maven-clean-plugin</artifactId>
20+
<version>2.6.1</version>
21+
<configuration>
22+
<filesets>
23+
<fileset>
24+
<directory>src/main/java/org/owasp/benchmark/testcode</directory>
25+
<includes>
26+
<include>**/BenchmarkTest*</include>
27+
</includes>
28+
<followSymlinks>false</followSymlinks>
29+
</fileset>
30+
<fileset>
31+
<directory>src/main/webapp</directory>
32+
<includes>
33+
<include>**/BenchmarkTest*</include>
34+
<include>**/*Index*</include>
35+
</includes>
36+
<followSymlinks>false</followSymlinks>
37+
</fileset>
38+
</filesets>
39+
</configuration>
40+
</plugin>
41+
</plugins>
42+
</build>
43+
</profile>
44+
45+
<profile>
46+
<id>crawler</id>
47+
<build>
48+
<plugins>
49+
<plugin>
50+
<groupId>org.codehaus.mojo</groupId>
51+
<artifactId>exec-maven-plugin</artifactId>
52+
<version>1.4.0</version>
53+
<executions>
54+
<execution>
55+
<phase>validate</phase>
56+
<goals>
57+
<goal>java</goal>
58+
</goals>
59+
<configuration>
60+
<mainClass>org.owasp.benchmark.tools.BenchmarkRunner</mainClass>
61+
</configuration>
62+
</execution>
63+
</executions>
64+
</plugin>
65+
</plugins>
66+
</build>
67+
</profile>
68+
69+
1170
<profile>
1271
<id>benchmarkscore</id>
1372
<build>
@@ -130,6 +189,74 @@
130189
</build>
131190
</profile>
132191

192+
<profile>
193+
<id>deploywcontrast</id>
194+
<properties>
195+
<skipTests>true</skipTests>
196+
</properties>
197+
<build>
198+
<plugins>
199+
<plugin>
200+
<artifactId>maven-antrun-plugin</artifactId>
201+
<version>1.7</version>
202+
<executions>
203+
<execution>
204+
<id>ldap-server</id>
205+
<phase>package</phase>
206+
<goals>
207+
<goal>run</goal>
208+
</goals>
209+
<configuration>
210+
<target>
211+
<ant target="run" antfile="${basedir}/src/config/build.xml">
212+
<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
213+
</ant>
214+
</target>
215+
</configuration>
216+
</execution>
217+
</executions>
218+
</plugin>
219+
<plugin>
220+
<groupId>org.codehaus.cargo</groupId>
221+
<artifactId>cargo-maven2-plugin</artifactId>
222+
<version>1.4.9</version>
223+
<configuration>
224+
<container>
225+
<timeout>300000</timeout>
226+
<containerId>tomcat8x</containerId>
227+
<zipUrlInstaller>
228+
<url>http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.21/bin/apache-tomcat-8.0.21.zip</url>
229+
</zipUrlInstaller>
230+
</container>
231+
<properties>
232+
<cargo.jvmargs>-XX:MaxPermSize=6G -Xms1G –Xmx8G</cargo.jvmargs>
233+
</properties>
234+
<configuration>
235+
<properties>
236+
<cargo.jvmargs>
237+
-Xmx4G
238+
-javaagent:${basedir}/forcontrast/contrast.jar=${basedir}/forcontrast/contrast.config
239+
-Dcontrast.dir=${basedir}/forcontrast/working
240+
-Dcontrast.saveresults=always
241+
-Dcontrast.noteamserver.enable=true
242+
-Dcontrast.teamserver.suppress=true
243+
</cargo.jvmargs>
244+
<cargo.servlet.port>8443</cargo.servlet.port>
245+
<cargo.protocol>https</cargo.protocol>
246+
<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
247+
<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
248+
<cargo.tomcat.connector.keystoreFile>../../../../.keystore</cargo.tomcat.connector.keystoreFile>
249+
<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
250+
<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
251+
<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
252+
</properties>
253+
</configuration>
254+
</configuration>
255+
</plugin>
256+
</plugins>
257+
</build>
258+
</profile>
259+
133260
<profile>
134261
<id>time</id>
135262
<build>
@@ -215,8 +342,21 @@
215342
</profile>
216343
</profiles>
217344

345+
<repositories>
346+
<repository>
347+
<id>jenkins-releases</id>
348+
<url>http://repo.jenkins-ci.org/releases/</url>
349+
</repository>
350+
</repositories>
351+
218352
<dependencies>
219353

354+
<dependency>
355+
<groupId>org.seleniumhq.selenium</groupId>
356+
<artifactId>selenium-server-standalone</artifactId>
357+
<version>2.46.0</version>
358+
</dependency>
359+
220360
<dependency>
221361
<groupId>org.slf4j</groupId>
222362
<artifactId>slf4j-api</artifactId>
@@ -523,31 +663,6 @@
523663
</compilerArgs>
524664
</configuration>
525665
</plugin>
526-
<plugin>
527-
<groupId>com.internetitem</groupId>
528-
<artifactId>write-properties-file-maven-plugin</artifactId>
529-
<version>1.0.1</version>
530-
<executions>
531-
<execution>
532-
<id>benchmarkVersion</id>
533-
<phase>validate</phase>
534-
<goals>
535-
<goal>write-properties-file</goal>
536-
</goals>
537-
<configuration>
538-
<filename>build.properties</filename>
539-
<outputDirectory>${basedir}/src/main/resources/</outputDirectory>
540-
<properties>
541-
<property>
542-
<name>version</name>
543-
<value>${project.version}</value>
544-
</property>
545-
</properties>
546-
</configuration>
547-
</execution>
548-
</executions>
549-
</plugin>
550-
551666
<!-- FindBugs Static Analysis -->
552667
<plugin>
553668
<groupId>org.codehaus.mojo</groupId>

‎prepareContrastResults.sh

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/sh
2+
3+
# TODO - Get the Benchmark version and put that in the file name
4+
5+
if [ -d forcontrast/findings ]; then
6+
7+
# clean out any APPCREATE, APPUPDATE, and SERVER events out of the Contrast findings directory before zipping everything up
8+
9+
forcontrast/removeUnneededEvents.sh forcontrast/findings/APP*.xml
10+
forcontrast/removeUnneededEvents.sh forcontrast/findings/SERVER*.xml
11+
12+
echo
13+
echo "All unneeded Contrast events removed from forcontrast/findings before zipping them up"
14+
15+
zip -q -r results/Benchmark_1.2beta-Contrast.zip forcontrast/findings && echo "Contrast findings ZIP file successfully created" || echo "Error creating Contrast findings ZIP file"
16+
17+
echo "Contrast findings all put into /results folder"
18+
echo
19+
20+
else
21+
22+
echo ""
23+
echo "ERROR: The forcontrast/findings directory doesn’t exist. You need to run the runBenchmark_wContrast script first, and then crawl the Benchmark app with runCrawler to generate the Contrast results required by this script."
24+
echo ""
25+
26+
fi
27+

‎runBenchmark_wContrast.sh

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/sh
2+
3+
if [ -f forcontrast/contrast.jar ]; then
4+
5+
if [ -d forcontrast/findings ]; then
6+
7+
rm -r forcontrast/findings
8+
rm -r forcontrast/working
9+
echo ""
10+
echo "Previous Contrast results in forcontrast/findings removed"
11+
echo ""
12+
13+
fi
14+
15+
chmod 755 src/main/resources/insecureCmd.sh
16+
mvn clean package cargo:run -Pdeploywcontrast
17+
18+
else
19+
20+
echo "Given that Contrast is a commercial product, you have to have a licensed version of Contrast in order to run it on the Benchmark. If you have access to Contrast, download the Java 1.5 version of contrast.jar from the Team Server and put it into the /forcontrast folder, and then rerun this script."
21+
22+
fi

‎runCrawler.bat

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
echo
2+
echo "NOTE: This crawler requires Firefox. Please install it if you don’t have it already."
3+
echo "ALSO: This crawler will sometimes stop if Firefox is not the window in focus. Be sure to keep Firefox in the foreground during the entire crawl in order to get the best results."
4+
echo
5+
6+
call mvn install -Pcrawler

‎runCrawler.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/sh
2+
3+
echo
4+
echo "NOTE: This crawler requires Firefox. Please install it if you don’t have it already."
5+
echo "ALSO: This crawler will sometimes stop if Firefox is not the window in focus. Be sure to keep Firefox in the foreground during the entire crawl in order to get the best results."
6+
echo
7+
8+
mvn install -Pcrawler

‎runSonarQube.bat

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,7 @@
1-
call mvn compile sonar:sonar -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes\out.csv -Dsonar.scm.disabled=true -Dsonar.skipDesign=true -Dsonar.cpd.exclusions=**/*.java -Dsonar.importSources=false -Dsonar.exclusions=**/*.xml
2-
call mvn validate -Ptime -Dexec.args="sonar"
1+
call mvn compile sonar:sonar -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes\out.csv -Dsonar.scm.disabled=true -Dsonar.skipDesign=true -Dsonar.cpd.exclusions=**/*.java -Dsonar.importSources=false -Dsonar.exclusions=**/*.xml
2+
@Echo off
3+
:DoUntil
4+
for /f %%i in ('SonarQubeRequest.exe') do set done=%%i
5+
IF NOT %done%==true GOTO DoUntil
6+
:EndDoUntil
7+
call mvn validate -Ptime -Dexec.args="sonar"

0 commit comments

Comments
 (0)