Skip to content

Commit 3b558de

Browse files
wakingrufuswakingrufus
committed
add archrules-security rules library
1 parent 2c64803 commit 3b558de

File tree

9 files changed

+270
-25
lines changed

9 files changed

+270
-25
lines changed

‎archrules-deprecation/gradle.lockfile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,18 @@
33
# This file is expected to be part of source control.
44
ch.qos.logback:logback-classic:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
55
ch.qos.logback:logback-core:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
6-
com.netflix.nebula:archrules-joda:0.1.3=archRules
7-
com.netflix.nebula:archrules-nullability:0.1.3=archRules
8-
com.netflix.nebula:archrules-testing-frameworks:0.1.3=archRules
9-
com.netflix.nebula:nebula-archrules-core:0.1.5=archRules
10-
com.netflix.nebula:nebula-archrules-core:0.2.3=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
6+
com.netflix.nebula:archrules-joda:0.3.0=archRules
7+
com.netflix.nebula:archrules-nullability:0.3.0=archRules
8+
com.netflix.nebula:archrules-testing-frameworks:0.3.0=archRules
9+
com.netflix.nebula:nebula-archrules-core:0.2.3=archRules
10+
com.netflix.nebula:nebula-archrules-core:0.2.4=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1111
com.tngtech.archunit:archunit:1.4.1=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1212
net.bytebuddy:byte-buddy:1.17.7=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1313
org.apiguardian:apiguardian-api:1.1.2=archRulesTestCompileClasspath
1414
org.assertj:assertj-core:3.27.6=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1515
org.jetbrains.kotlin:kotlin-stdlib:2.2.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1616
org.jetbrains:annotations:13.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
17-
org.jspecify:jspecify:1.0.0=archRulesCompileClasspath,archRulesRuntimeClasspath
17+
org.jspecify:jspecify:1.0.0=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath
1818
org.junit.jupiter:junit-jupiter-api:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1919
org.junit.jupiter:junit-jupiter-engine:5.12.2=archRulesTestRuntimeClasspath
2020
org.junit.jupiter:junit-jupiter-params:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath

‎archrules-joda/gradle.lockfile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,17 @@
33
# This file is expected to be part of source control.
44
ch.qos.logback:logback-classic:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
55
ch.qos.logback:logback-core:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
6-
com.netflix.nebula:archrules-deprecation:0.1.3=archRules
7-
com.netflix.nebula:archrules-nullability:0.1.3=archRules
8-
com.netflix.nebula:archrules-testing-frameworks:0.1.3=archRules
9-
com.netflix.nebula:nebula-archrules-core:0.1.5=archRules
10-
com.netflix.nebula:nebula-archrules-core:0.2.3=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
6+
com.netflix.nebula:archrules-deprecation:0.3.0=archRules
7+
com.netflix.nebula:archrules-nullability:0.3.0=archRules
8+
com.netflix.nebula:archrules-testing-frameworks:0.3.0=archRules
9+
com.netflix.nebula:nebula-archrules-core:0.2.3=archRules
10+
com.netflix.nebula:nebula-archrules-core:0.2.4=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1111
com.tngtech.archunit:archunit:1.4.1=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1212
joda-time:joda-time:2.14.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1313
net.bytebuddy:byte-buddy:1.17.7=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1414
org.apiguardian:apiguardian-api:1.1.2=archRulesTestCompileClasspath
1515
org.assertj:assertj-core:3.27.6=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
16-
org.jspecify:jspecify:1.0.0=archRulesCompileClasspath,archRulesRuntimeClasspath
16+
org.jspecify:jspecify:1.0.0=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath
1717
org.junit.jupiter:junit-jupiter-api:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1818
org.junit.jupiter:junit-jupiter-engine:5.12.2=archRulesTestRuntimeClasspath
1919
org.junit.jupiter:junit-jupiter-params:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath

‎archrules-nullability/gradle.lockfile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@
44
ch.qos.logback:logback-classic:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
55
ch.qos.logback:logback-core:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
66
com.google.code.findbugs:jsr305:3.0.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
7-
com.netflix.nebula:archrules-deprecation:0.1.3=archRules
8-
com.netflix.nebula:archrules-joda:0.1.3=archRules
9-
com.netflix.nebula:archrules-testing-frameworks:0.1.3=archRules
10-
com.netflix.nebula:nebula-archrules-core:0.1.5=archRules
11-
com.netflix.nebula:nebula-archrules-core:0.2.3=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
7+
com.netflix.nebula:archrules-deprecation:0.3.0=archRules
8+
com.netflix.nebula:archrules-joda:0.3.0=archRules
9+
com.netflix.nebula:archrules-testing-frameworks:0.3.0=archRules
10+
com.netflix.nebula:nebula-archrules-core:0.2.3=archRules
11+
com.netflix.nebula:nebula-archrules-core:0.2.4=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1212
com.tngtech.archunit:archunit:1.4.1=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1313
jakarta.annotation:jakarta.annotation-api:3.0.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1414
net.bytebuddy:byte-buddy:1.17.7=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1515
org.apiguardian:apiguardian-api:1.1.2=archRulesTestCompileClasspath
1616
org.assertj:assertj-core:3.27.6=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1717
org.jetbrains:annotations:26.0.2-1=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
18-
org.jspecify:jspecify:1.0.0=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
18+
org.jspecify:jspecify:1.0.0=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
1919
org.junit.jupiter:junit-jupiter-api:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
2020
org.junit.jupiter:junit-jupiter-engine:5.12.2=archRulesTestRuntimeClasspath
2121
org.junit.jupiter:junit-jupiter-params:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath

‎archrules-security/build.gradle.kts‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
plugins {
2+
id("com.netflix.nebula.library")
3+
id("com.netflix.nebula.archrules.library")
4+
}
5+
description = "Arch Rules for detecting usage of identified insecure APIs"
6+
repositories {
7+
mavenCentral()
8+
}
9+
dependencies {
10+
archRulesImplementation(libs.jspecify)
11+
12+
archRulesTestImplementation(libs.assertj)
13+
archRulesTestImplementation(libs.logback)
14+
archRulesTestImplementation("com.google.guava:guava:23.0")
15+
archRulesTestImplementation("org.jetbrains.kotlin:kotlin-stdlib:2.2.21")
16+
archRulesTestImplementation("org.eclipse.jetty:jetty-servlet:9.+")
17+
}
18+
java {
19+
toolchain {
20+
languageVersion = JavaLanguageVersion.of(8)
21+
}
22+
}
23+
dependencyLocking {
24+
lockAllConfigurations()
25+
}

‎archrules-security/gradle.lockfile‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# This is a Gradle generated file for dependency locking.
2+
# Manual edits can break the build and are not advised.
3+
# This file is expected to be part of source control.
4+
ch.qos.logback:logback-classic:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
5+
ch.qos.logback:logback-core:1.5.20=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
6+
com.google.code.findbugs:jsr305:1.3.9=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
7+
com.google.errorprone:error_prone_annotations:2.0.18=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
8+
com.google.guava:guava:23.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
9+
com.google.j2objc:j2objc-annotations:1.1=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
10+
com.netflix.nebula:archrules-deprecation:0.3.0=archRules
11+
com.netflix.nebula:archrules-joda:0.3.0=archRules
12+
com.netflix.nebula:archrules-nullability:0.3.0=archRules
13+
com.netflix.nebula:archrules-testing-frameworks:0.3.0=archRules
14+
com.netflix.nebula:nebula-archrules-core:0.2.3=archRules
15+
com.netflix.nebula:nebula-archrules-core:0.2.4=archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
16+
com.tngtech.archunit:archunit:1.4.1=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
17+
javax.servlet:javax.servlet-api:3.1.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
18+
net.bytebuddy:byte-buddy:1.17.7=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
19+
org.apiguardian:apiguardian-api:1.1.2=archRulesTestCompileClasspath
20+
org.assertj:assertj-core:3.27.6=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
21+
org.codehaus.mojo:animal-sniffer-annotations:1.14=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
22+
org.eclipse.jetty:jetty-http:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
23+
org.eclipse.jetty:jetty-io:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
24+
org.eclipse.jetty:jetty-security:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
25+
org.eclipse.jetty:jetty-server:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
26+
org.eclipse.jetty:jetty-servlet:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
27+
org.eclipse.jetty:jetty-util-ajax:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
28+
org.eclipse.jetty:jetty-util:9.4.58.v20250814=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
29+
org.jetbrains.kotlin:kotlin-stdlib:2.2.21=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
30+
org.jetbrains:annotations:13.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
31+
org.jspecify:jspecify:1.0.0=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath
32+
org.junit.jupiter:junit-jupiter-api:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
33+
org.junit.jupiter:junit-jupiter-engine:5.12.2=archRulesTestRuntimeClasspath
34+
org.junit.jupiter:junit-jupiter-params:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
35+
org.junit.jupiter:junit-jupiter:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
36+
org.junit.platform:junit-platform-commons:1.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
37+
org.junit.platform:junit-platform-engine:1.12.2=archRulesTestRuntimeClasspath
38+
org.junit.platform:junit-platform-launcher:1.12.2=archRulesTestRuntimeClasspath
39+
org.junit:junit-bom:5.12.2=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
40+
org.opentest4j:opentest4j:1.3.0=archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
41+
org.slf4j:slf4j-api:2.0.17=archRules,archRulesCompileClasspath,archRulesRuntimeClasspath,archRulesTestCompileClasspath,archRulesTestRuntimeClasspath
42+
empty=annotationProcessor,archRulesAnnotationProcessor,archRulesTestAnnotationProcessor,compileClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath

‎archrules-security/src/archRules/java/com/netflix/nebula/archrules/security/CveArchRules.java‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
package com.netflix.nebula.archrules.security;
2+
3+
import com.netflix.nebula.archrules.core.ArchRulesService;
4+
import com.tngtech.archunit.core.domain.JavaClass;
5+
import com.tngtech.archunit.lang.ArchRule;
6+
import com.tngtech.archunit.lang.Priority;
7+
import com.tngtech.archunit.lang.syntax.ArchRuleDefinition;
8+
9+
import java.util.HashMap;
10+
import java.util.Map;
11+
12+
import static com.tngtech.archunit.core.domain.JavaAccess.Predicates.targetOwner;
13+
import static com.tngtech.archunit.core.domain.JavaClass.Predicates.assignableTo;
14+
15+
public class CveArchRules implements ArchRulesService {
16+
public static final ArchRule CVE_2020_29582 = ArchRuleDefinition.priority(Priority.HIGH)
17+
.noClasses()
18+
.should().callMethod(
19+
"kotlin.io.FilesKt",
20+
"createTempDir",
21+
"java.lang.String", "java.lang.String", "java.io.File")
22+
.orShould().callMethod(
23+
"kotlin.io.FilesKt",
24+
"createTempFile",
25+
"java.lang.String", "java.lang.String", "java.io.File")
26+
.because("A Kotlin application using createTempDir or createTempFile " +
27+
"and placing sensitive information within either of these locations " +
28+
"would be leaking this information in a read-only way to other users also on this system. " +
29+
"We recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() " +
30+
"which explicitly configures permissions of 700");
31+
32+
public static final ArchRule CVE_2023_2976 = ArchRuleDefinition.priority(Priority.HIGH)
33+
.noClasses()
34+
.should()
35+
.dependOnClassesThat(JavaClass.Predicates.simpleName("FileBackedOutputStream"))
36+
.orShould()
37+
.accessTargetWhere(targetOwner(assignableTo(JavaClass.Predicates.simpleName("FileBackedOutputStream"))))
38+
.because("CVE-2023-2976: Use of Java's default temporary directory for file creation in " +
39+
"`FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems " +
40+
"and Android Ice Cream Sandwich allows other users and apps on the machine " +
41+
"with access to the default Java temporary directory to be able to access the " +
42+
"files created by the class.");
43+
44+
public static final ArchRule CVE_2020_8908 = ArchRuleDefinition.priority(Priority.HIGH)
45+
.noClasses()
46+
.should().callMethod("com.google.common.io.Files", "createTempDir")
47+
.because("A temp directory creation vulnerability exists in all versions of Guava, " +
48+
"allowing an attacker with access to the machine to potentially access data in a temporary directory " +
49+
"created by the Guava API com.google.common.io.Files.createTempDir(). " +
50+
"By default, on unix-like systems, the created directory is world-readable " +
51+
"(readable by an attacker with access to the system). " +
52+
"We recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() " +
53+
"which explicitly configures permissions of 700");
54+
55+
public static final ArchRule CVE_2018_10237 = ArchRuleDefinition.priority(Priority.HIGH)
56+
.noClasses()
57+
.should()
58+
.dependOnClassesThat(JavaClass.Predicates.simpleName("AtomicDoubleArray"))
59+
.orShould()
60+
.accessTargetWhere(targetOwner(assignableTo(JavaClass.Predicates.simpleName("AtomicDoubleArray"))))
61+
.orShould()
62+
.dependOnClassesThat(JavaClass.Predicates.simpleName("CompoundOrdering"))
63+
.orShould()
64+
.accessTargetWhere(targetOwner(assignableTo(JavaClass.Predicates.simpleName("CompoundOrdering"))))
65+
.because("Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 " +
66+
"allows remote attackers to conduct denial of service attacks against servers " +
67+
"that depend on this library and deserialize attacker-provided data, " +
68+
"because the AtomicDoubleArray class (when serialized with Java serialization) " +
69+
"and the CompoundOrdering class (when serialized with GWT serialization) " +
70+
"perform eager allocation without appropriate checks on what a client has sent " +
71+
"and whether the data size is reasonable. ");
72+
73+
public static final ArchRule CVE_2024_6763 = ArchRuleDefinition.priority(Priority.HIGH)
74+
.noClasses()
75+
.should().dependOnClassesThat().haveFullyQualifiedName("org.eclipse.jetty.http.HttpURI")
76+
.because("The HttpURI class does insufficient validation on the authority segment of a URI.");
77+
78+
@Override
79+
public Map<String, ArchRule> getRules() {
80+
Map<String, ArchRule> rules = new HashMap<>();
81+
rules.put("CVE-2020-29582", CVE_2020_29582);
82+
rules.put("CVE-2023-2976", CVE_2023_2976);
83+
rules.put("CVE-2020-8908", CVE_2020_8908);
84+
rules.put("CVE-2018-10237", CVE_2018_10237);
85+
rules.put("CVE-2024-6763", CVE_2024_6763);
86+
return rules;
87+
}
88+
}

‎archrules-security/src/archRulesTest/java/com/netflix/nebula/archrules/security/CveArchRulesTest.java‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
package com.netflix.nebula.archrules.security;
2+
3+
import com.google.common.io.FileBackedOutputStream;
4+
import com.netflix.nebula.archrules.core.Runner;
5+
import com.tngtech.archunit.lang.EvaluationResult;
6+
import kotlin.io.FilesKt;
7+
import org.eclipse.jetty.http.HttpURI;
8+
import org.junit.jupiter.api.Test;
9+
10+
import java.io.File;
11+
12+
import static org.assertj.core.api.Assertions.assertThat;
13+
14+
public class CveArchRulesTest {
15+
@Test
16+
public void test_pass() {
17+
EvaluationResult result = Runner.check(CveArchRules.CVE_2023_2976, PassingClass.class);
18+
assertThat(result.hasViolation())
19+
.isFalse();
20+
}
21+
22+
@Test
23+
public void test_fail() {
24+
EvaluationResult result = Runner.check(CveArchRules.CVE_2023_2976, FailingClass.class);
25+
assertThat(result.hasViolation())
26+
.isTrue();
27+
assertThat(result.getFailureReport().getDetails())
28+
.hasSize(1);
29+
}
30+
31+
@Test
32+
public void test_fail_shaded() {
33+
EvaluationResult result = Runner.check(CveArchRules.CVE_2023_2976, FailingClassShaded.class);
34+
assertThat(result.hasViolation())
35+
.isTrue();
36+
assertThat(result.getFailureReport().getDetails())
37+
.hasSize(1);
38+
}
39+
40+
@Test
41+
public void test_kotlin_cve_fail_file() {
42+
EvaluationResult result = Runner.check(CveArchRules.CVE_2020_29582, KotlinFailingClassFile.class);
43+
assertThat(result.hasViolation())
44+
.isTrue();
45+
assertThat(result.getFailureReport().getDetails())
46+
.hasSize(1);
47+
}
48+
49+
@Test
50+
public void test_kotlin_cve_fail_dir() {
51+
EvaluationResult result = Runner.check(CveArchRules.CVE_2020_29582, KotlinFailingClassDir.class);
52+
assertThat(result.hasViolation())
53+
.isTrue();
54+
assertThat(result.getFailureReport().getDetails())
55+
.hasSize(1);
56+
}
57+
58+
@Test
59+
public void test_jetty() {
60+
EvaluationResult result = Runner.check(CveArchRules.CVE_2024_6763, UsesJettyHttpURI.class);
61+
assertThat(result.hasViolation())
62+
.isTrue();
63+
assertThat(result.getFailureReport().getDetails())
64+
.hasSize(1);
65+
}
66+
67+
static class KotlinFailingClassFile {
68+
File thing = FilesKt.createTempFile("tmp", null, null);
69+
}
70+
71+
static class KotlinFailingClassDir {
72+
File thing = FilesKt.createTempDir("tmp", null, null);
73+
}
74+
75+
static class FailingClass {
76+
FileBackedOutputStream fileBackedOutputStream;
77+
}
78+
79+
static class FailingClassShaded {
80+
com.tngtech.archunit.thirdparty.com.google.common.io.FileBackedOutputStream fileBackedOutputStream;
81+
}
82+
83+
static class PassingClass {
84+
}
85+
86+
static class UsesJettyHttpURI {
87+
HttpURI httpURI;
88+
}
89+
}

0 commit comments

Comments
 (0)