Skip to content

Commit 4a10dc2

Browse files
author
Dave Wichers
committed
Add support for Contrast CodeSec static analysis of Source Code
scanning for Java.
1 parent 024f25b commit 4a10dc2

File tree

1 file changed

+103
-0
lines changed

1 file changed

+103
-0
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/ContrastScanReader.java‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ public ContrastScanReader() {
3434
public Map<String, Integer> customRuleCweMappings(JSONObject driver) {
3535
Map<String, Integer> ruleCweMap = new HashMap<>();
3636

37+
// The following are the ruleIds for Contrast scan for Java war/jar files
3738
ruleCweMap.put("unsafe-code-execution", CweNumber.COMMAND_INJECTION);
3839
ruleCweMap.put("cmd-injection", CweNumber.COMMAND_INJECTION);
3940
ruleCweMap.put("cookie-flags-missing", CweNumber.INSECURE_COOKIE);
@@ -43,20 +44,122 @@ public Map<String, Integer> customRuleCweMappings(JSONObject driver) {
4344
ruleCweMap.put("header-injection", CweNumber.HTTP_RESPONSE_SPLITTING);
4445
ruleCweMap.put("hql-injection", CweNumber.HIBERNATE_INJECTION);
4546
ruleCweMap.put("ldap-injection", CweNumber.LDAP_INJECTION);
47+
ruleCweMap.put("log-injection", 117);
4648
ruleCweMap.put("nosql-injection", CweNumber.SQL_INJECTION);
4749
ruleCweMap.put("path-traversal", CweNumber.PATH_TRAVERSAL);
4850
ruleCweMap.put("reflected-xss", CweNumber.XSS);
51+
ruleCweMap.put("reflection-injection", 470); // CWE-470 Unsafe Reflection
4952
ruleCweMap.put("sql-injection", CweNumber.SQL_INJECTION);
5053
ruleCweMap.put("trust-boundary-violation", CweNumber.TRUST_BOUNDARY_VIOLATION);
54+
// CWE-111 Direct Use of Unsafe JNI
55+
ruleCweMap.put("unmanaged-code-invocation", 111);
56+
// CWE-770 Allocation of Resources Without Limits or Throttling
57+
ruleCweMap.put("unsafe-readline", 770);
58+
// CWE-601 URL Redirection to Untrusted Site (Open Redirect)
59+
ruleCweMap.put("unvalidated-redirect", 601);
5160
ruleCweMap.put("xpath-injection", CweNumber.XPATH_INJECTION);
5261
ruleCweMap.put("xxe", CweNumber.XXE);
5362
ruleCweMap.put("autocomplete-missing", 522); // CWE-522 Insufficiently Protected Creds
5463

64+
// The following are the ruleIds for Contrast scan for HTML source code files
65+
// See HTML rules: https://docs.contrastsecurity.com/en/html-scan-rules.html
66+
ruleCweMap.put(
67+
"OPT.HTML.MissingPasswordFieldMasking",
68+
549); // CWE-549 Missing Password Field Masking
69+
70+
// The following are the ruleIds for Contrast scan for Java source code files
71+
// See Java rules: https://docs.contrastsecurity.com/en/java-scan-rules.html
72+
73+
// Don't access/modify java.security config objects (Policy, Security, Provider, Principal,
74+
// KeyStore)
75+
ruleCweMap.put("OPT.JAVA.EJB.DontModifyAccessSecurity", CweNumber.DONTCARE);
76+
ruleCweMap.put("OPT.JAVA.RGS.CMP", 486); // Comparison of Classes by Name
77+
// Java access restriction subverted by using reflection. (e.g., protected/private methods).
78+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AccessibilitySubversionRule", 506); // Malicious Code
79+
// CWE-111 Direct Use of Unsafe JNI
80+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidNativeCallsRule", 111);
81+
// CWE-245: Direct Mgt of Connection
82+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EEDirectDatabaseConnection", 245);
83+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EEExplicitSocket", 246); // Direct Use of Sockets
84+
ruleCweMap.put(
85+
"OPT.JAVA.SEC_JAVA.AvoidJ2EEExplicitThreadManagement",
86+
383); // Direct Use of Threads
87+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EEJvmExit", 382); // Use of System.exit()
88+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EELeftoverDebugCode", 489); // Active Debug Code
89+
// CWE-502: Deserialization of Untrusted Data
90+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CodeInjectionWithDeserializationRule", 502);
91+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CodeInjectionRule", 94); // Code Injection
92+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CommandInjectionRule", CweNumber.COMMAND_INJECTION);
93+
// XHSM. No CWE
94+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CrossSiteRequestForgeryRule", CweNumber.CSRF);
95+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CrossSiteHistoryManipulation", CweNumber.DONTCARE);
96+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CrossSiteScriptingRule", CweNumber.XSS);
97+
// CWE-676: Use of Potentially Dangerous Function
98+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ESAPIBannedRule", 676);
99+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ExecutionAfterRedirect", 698); // Execution after Redirect
100+
// CWE-134: Use of Externally-Controlled Format String
101+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ExternalControlOfConfigurationSetting", 134);
102+
// CWE-15: External Control of System or Configuration Setting
103+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.FormatStringInjectionRule", 15);
104+
// CWE-321: Hard-coded Crypto Key
105+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HardcodedCryptoKey", 321);
106+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HardcodedUsernamePassword", 798); // Hardcoded Creds
107+
// CWE-235: Improper Handling Extra Params
108+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HttpParameterPollutionRule", 235);
109+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HttpSplittingRule", 113); // HTTP Req/Resp Splitting
110+
// Mapping InadequatePaddingRule to CWE-327 Weak Crypto, causes LOTS of False Positives
111+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InadequatePaddingRule", CweNumber.DONTCARE);
112+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InformationExposureThroughErrorMessage", 209);
113+
// CWE-20: Improper Input Validation
114+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InputPathNotCanonicalizedRule", 20);
115+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InsecureRandomnessRule", CweNumber.WEAK_RANDOM);
116+
// CWE-319: Cleartext transmission of sensitive data
117+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InsecureTransport", 319);
118+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.LdapInjectionRule", CweNumber.LDAP_INJECTION);
119+
// CWE-329: Generation of Predictable IV with CBC Mode
120+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.NonRandomIVWithCBCMode", 329);
121+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.OpenRedirectRule", 601); // CWE-601 Open Redirect
122+
ruleCweMap.put(
123+
"OPT.JAVA.SEC_JAVA.PasswordInCommentRule", 615); // Sensitive Info in Comments
124+
ruleCweMap.put(
125+
"OPT.JAVA.SEC_JAVA.PasswordInConfigurationFile", 256); // Plaintext Password Storage
126+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.PathTraversalRule", CweNumber.PATH_TRAVERSAL);
127+
// CWE-315: Cleartext Storage of Sensitive Info in Cookie
128+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.PlaintextStorageInACookieRule", 315);
129+
ruleCweMap.put(
130+
"OPT.JAVA.SEC_JAVA.PlaintextStorageOfPassword", 256); // Plaintext Password Storage
131+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.PotentialInfiniteLoop", 835); // Infinite Loop
132+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ProcessControlRule", 114); // Process Control
133+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ServerSideRequestForgeryRule", 918); // SSRF
134+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.SqlInjectionRule", CweNumber.SQL_INJECTION);
135+
ruleCweMap.put(
136+
"OPT.JAVA.SEC_JAVA.TrustBoundaryViolationRule", CweNumber.TRUST_BOUNDARY_VIOLATION);
137+
ruleCweMap.put(
138+
"OPT.JAVA.SEC_JAVA.UnnormalizedInputString", 20); // Improper Input Validation
139+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.UnsafeCookieRule", 614); // No secure attribute
140+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.UnsafeReflection", 470); // Unsafe Reflection
141+
// CWE-566: Authorization Bypass Thru User-Controlled SQL Primary Key
142+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.UserControlledSQLPrimaryKey", 566);
143+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.WeakCryptographicHashRule", CweNumber.WEAK_HASH_ALGO);
144+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.WeakEncryptionRule", CweNumber.WEAK_CRYPTO_ALGO);
145+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.WebXmlSecurityMisconfigurationsRule", CweNumber.DONTCARE);
146+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.XPathInjectionRule", CweNumber.XPATH_INJECTION);
147+
55148
return ruleCweMap;
56149
}
57150

58151
@Override
59152
public void setVersion(ResultFile resultFile, TestSuiteResults testSuiteResults) {
60153
// SARIF file contains several nulls as version, just ignoring it
154+
// Instead, we use the 'version' to set the type of CodeSec scan. WAR, JAR, SAST, etc.
155+
JSONObject firstrun = resultFile.json().getJSONArray("runs").getJSONObject(0);
156+
String commandLine =
157+
firstrun.getJSONArray("invocations").getJSONObject(0).getString("commandLine");
158+
159+
if (commandLine.contains("contrast-scan-java-cli")) {
160+
if (commandLine.endsWith("jar")) testSuiteResults.setToolVersion("OfJAR");
161+
else if (commandLine.endsWith("war")) testSuiteResults.setToolVersion("OfWAR");
162+
} else if (commandLine.contains("sast-engine"))
163+
testSuiteResults.setToolVersion("OfSourceCode");
61164
}
62165
}

0 commit comments

Comments
 (0)