Skip to content

Commit e9bbcd8

Browse files
davewichersdavewichers
committed
Enhance the Fortify Scorecard generator to detect if its from Fortify OnDemand.
Fix some extraneous XXE vulns. Enhance the scorecard generator to add CWE #'s.
1 parent 21c7142 commit e9bbcd8

21 files changed

+409
-37
lines changed

‎src/main/java/org/owasp/benchmark/helpers/DatabaseHelper.java

Lines changed: 121 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,13 @@
2626
import java.sql.ResultSetMetaData;
2727
import java.sql.SQLException;
2828
import java.sql.Statement;
29+
import java.util.List;
2930

31+
import javax.naming.InitialContext;
3032
import javax.servlet.http.HttpServletResponse;
33+
import javax.sql.DataSource;
3134

35+
import org.owasp.benchmark.service.pojo.StringMessage;
3236
import org.owasp.esapi.ESAPI;
3337

3438
public class DatabaseHelper {
@@ -131,6 +135,13 @@ public static java.sql.Connection getSqlConnection() {
131135
Class.forName("org.hsqldb.jdbcDriver");
132136
String url = "jdbc:hsqldb:benchmarkDataBase;sql.enforce_size=false";
133137
conn = DriverManager.getConnection(url, "sa", "");
138+
139+
// TODO - Per Fortify, the connection should use the container's connection pool.
140+
// Not the direct/hard coded connection used above
141+
//InitialContext ctx = new InitialContext();
142+
//DataSource datasource = (DataSource)ctx.lookup(DB_DATASRC_REF);
143+
//conn = datasource.getConnection();
144+
134145
} catch (SQLException | ClassNotFoundException e) {
135146
System.out.println("Problem with getSqlConnection.");
136147
e.printStackTrace();
@@ -156,6 +167,12 @@ public static void outputUpdateComplete(String sql, HttpServletResponse response
156167
out.write("</p>\n</body>\n</html>");
157168
}
158169

170+
public static void outputUpdateComplete(String sql, List<StringMessage> resp) throws java.sql.SQLException, IOException {
171+
resp.add(new StringMessage("Message",
172+
"Update complete for query: " + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql) + "<br>\n"
173+
));
174+
}
175+
159176
public static void printResults(java.sql.Statement statement, String sql, HttpServletResponse response) throws java.sql.SQLException, IOException {
160177

161178
PrintWriter out = response.getWriter();
@@ -208,6 +225,46 @@ public static void printResults(java.sql.Statement statement, String sql, HttpSe
208225

209226
} //end printResults
210227

228+
public static void printResults(java.sql.Statement statement, String sql, List<StringMessage> resp) throws java.sql.SQLException, IOException {
229+
try {
230+
ResultSet rs = statement.getResultSet();
231+
if (rs == null) {
232+
resp.add(new StringMessage("Message",
233+
"Results set is empty for query: " + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql)
234+
));
235+
return;
236+
}
237+
ResultSetMetaData rsmd = rs.getMetaData();
238+
int numberOfColumns = rsmd.getColumnCount();
239+
resp.add(new StringMessage("Message",
240+
"Your results are:<br>\n"
241+
));
242+
while (rs.next()) {
243+
for (int i = 1; i <= numberOfColumns; i++) {
244+
if (i > 1){
245+
resp.add(new StringMessage("Message",
246+
", "
247+
));
248+
//System.out.println(", ");
249+
}
250+
String columnValue = rs.getString(i);
251+
resp.add(new StringMessage("Message",
252+
ESAPI.encoder().encodeForHTML(columnValue)
253+
));
254+
} // end for
255+
resp.add(new StringMessage("Message",
256+
"<br>\n"
257+
));
258+
} // end while
259+
260+
} finally {
261+
resp.add(new StringMessage("Message",
262+
"</p>\n</body>\n</html>"
263+
));
264+
}
265+
266+
} //end printResults
267+
211268
public static void printResults(java.sql.ResultSet rs, String sql, HttpServletResponse response) throws java.sql.SQLException, IOException {
212269

213270
PrintWriter out = response.getWriter();
@@ -237,7 +294,40 @@ public static void printResults(java.sql.ResultSet rs, String sql, HttpServletRe
237294
out.write("</p>\n</body>\n</html>");
238295
}
239296
} //end printResults
240-
297+
298+
public static void printResults(java.sql.ResultSet rs, String sql, List<StringMessage> resp) throws java.sql.SQLException, IOException {
299+
try {
300+
if (rs == null) {
301+
resp.add(new StringMessage("Message",
302+
"Results set is empty for query: " + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql)
303+
));
304+
return;
305+
}
306+
ResultSetMetaData rsmd = rs.getMetaData();
307+
int numberOfColumns = rsmd.getColumnCount();
308+
resp.add(new StringMessage("Message",
309+
"Your results are:<br>\n"
310+
));
311+
while (rs.next()) {
312+
for (int i = 1; i <= numberOfColumns; i++) {
313+
// if (i > 1){ out.write(", "); System.out.println(", ");}
314+
String columnValue = rs.getString(i);
315+
resp.add(new StringMessage("Message",
316+
ESAPI.encoder().encodeForHTML(columnValue)
317+
));
318+
} // end for
319+
resp.add(new StringMessage("Message",
320+
"<br>\n"
321+
));
322+
} // end while
323+
324+
} finally {
325+
resp.add(new StringMessage("Message",
326+
"</p>\n</body>\n</html>"
327+
));
328+
}
329+
} //end printResults
330+
241331
public static void printResults(String query, int[] counts, HttpServletResponse response) throws IOException{
242332
PrintWriter out = response.getWriter();
243333
out.write("<!DOCTYPE html>\n<html>\n<body>\n<p>");
@@ -260,6 +350,36 @@ public static void printResults(String query, int[] counts, HttpServletResponse
260350
}
261351
} //end printResults
262352

353+
public static void printResults(String query, int[] counts, List<StringMessage> resp) throws IOException{
354+
resp.add(new StringMessage("Message",
355+
"For query: " + ESAPI.encoder().encodeForHTML(query) + "<br>"
356+
));
357+
try {
358+
if(counts.length > 0){
359+
if(counts[0] == Statement.SUCCESS_NO_INFO){
360+
resp.add(new StringMessage("Message",
361+
"The SQL query was processed successfully but the number of rows affected is unknown."
362+
));
363+
System.out.println("The SQL query was processed successfully but the number of rows affected is unknown.");
364+
}else if(counts[0] == Statement.EXECUTE_FAILED){
365+
resp.add(new StringMessage("Message",
366+
"The SQL query failed to execute successfully and occurs only if a driver continues to process commands after a command fails"
367+
));
368+
System.out.println("The SQL query failed to execute successfully and occurs only if a driver continues to process commands after a command fails");
369+
}else{
370+
resp.add(new StringMessage("Message",
371+
"The number of affected rows are: " + counts[0]
372+
));
373+
System.out.println("The number of affected rows are: " + counts[0]);
374+
}
375+
}
376+
} finally {
377+
resp.add(new StringMessage("Message",
378+
"</p>\n</body>\n</html>"
379+
));
380+
}
381+
} //end printResults
382+
263383
public static void printColTypes(ResultSetMetaData rsmd, PrintWriter out) throws java.sql.SQLException {
264384
int columns = rsmd.getColumnCount();
265385
for (int i = 1; i <= columns; i++) {

0 commit comments

Comments
 (0)