Skip to content

Commit e0ecc18

Browse files
nahsranahsra
committed
weak prng working mapping working
1 parent d9c47ce commit e0ecc18

File tree

11 files changed

+309
-9
lines changed

11 files changed

+309
-9
lines changed

‎core-codemods/src/main/java/io/codemodder/codemods/DefaultCodemods.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ public static List<Class<? extends CodeChanger>> asList() {
9696
SonarSQLInjectionCodemod.class,
9797
SonarSSRFCodemod.class,
9898
SonarUnsafeReflectionRemediationCodemod.class,
99+
SonarWeakRandomCodemod.class,
99100
SonarXXECodemod.class,
100101
SQLParameterizerCodemod.class,
101102
SSRFCodemod.class,

‎core-codemods/src/main/java/io/codemodder/codemods/sonar/SonarWeakRandomCodemod.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package io.codemodder.codemods.sonar;
2+
3+
import com.github.javaparser.ast.CompilationUnit;
4+
import io.codemodder.*;
5+
import io.codemodder.codetf.DetectorRule;
6+
import io.codemodder.providers.sonar.ProvidedSonarScan;
7+
import io.codemodder.providers.sonar.RuleHotspot;
8+
import io.codemodder.providers.sonar.SonarRemediatingJavaParserChanger;
9+
import io.codemodder.remediation.GenericRemediationMetadata;
10+
import io.codemodder.remediation.Remediator;
11+
import io.codemodder.remediation.weakrandom.WeakRandomRemediator;
12+
import io.codemodder.sonar.model.Hotspot;
13+
import io.codemodder.sonar.model.SonarFinding;
14+
import java.util.List;
15+
import java.util.Objects;
16+
import java.util.Optional;
17+
import javax.inject.Inject;
18+
19+
@Codemod(
20+
id = "sonar:java/weak-prng-2245",
21+
reviewGuidance = ReviewGuidance.MERGE_AFTER_CURSORY_REVIEW,
22+
importance = Importance.HIGH,
23+
executionPriority = CodemodExecutionPriority.HIGH)
24+
public final class SonarWeakRandomCodemod extends SonarRemediatingJavaParserChanger {
25+
26+
private final Remediator<Hotspot> remediationStrategy;
27+
private final RuleHotspot issues;
28+
29+
@Inject
30+
public SonarWeakRandomCodemod(
31+
@ProvidedSonarScan(ruleId = "java:S2245") final RuleHotspot hotspots) {
32+
super(GenericRemediationMetadata.WEAK_RANDOM.reporter(), hotspots);
33+
this.issues = Objects.requireNonNull(hotspots);
34+
this.remediationStrategy = new WeakRandomRemediator<>();
35+
}
36+
37+
@Override
38+
public DetectorRule detectorRule() {
39+
return new DetectorRule(
40+
"java:S2245",
41+
"Make sure that using this pseudorandom number generator is safe here",
42+
"https://rules.sonarsource.com/java/RSPEC-2245/?search=weak%20random");
43+
}
44+
45+
@Override
46+
public CodemodFileScanningResult visit(
47+
final CodemodInvocationContext context, final CompilationUnit cu) {
48+
List<Hotspot> issuesForFile = issues.getResultsByPath(context.path());
49+
return remediationStrategy.remediateAll(
50+
cu,
51+
context.path().toString(),
52+
detectorRule(),
53+
issuesForFile,
54+
SonarFinding::getKey,
55+
i -> i.getTextRange() != null ? i.getTextRange().getStartLine() : i.getLine(),
56+
i ->
57+
i.getTextRange() != null
58+
? Optional.of(i.getTextRange().getEndLine())
59+
: Optional.empty(),
60+
i -> Optional.empty());
61+
}
62+
}

‎core-codemods/src/test/java/io/codemodder/codemods/sonar/SonarWeakRandomCodemodTest.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package io.codemodder.codemods.sonar;
2+
3+
import io.codemodder.testutils.CodemodTestMixin;
4+
import io.codemodder.testutils.Metadata;
5+
import org.junit.jupiter.api.Nested;
6+
7+
final class SonarWeakRandomCodemodTest {
8+
9+
@Nested
10+
@Metadata(
11+
codemodType = SonarWeakRandomCodemod.class,
12+
testResourceDir = "sonar-weak-prng-2245",
13+
renameTestFile = "src/main/java/org/owasp/webgoat/lessons/csrf/CSRFGetFlag.java",
14+
expectingFixesAtLines = {59},
15+
doRetransformTest = false,
16+
dependencies = {})
17+
final class CSRFGetFlagTest implements CodemodTestMixin {}
18+
}

‎core-codemods/src/test/resources/remove-redundant-static-s2786/sonar-issues.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
"effort": "2min",
4545
"debt": "2min",
4646
"assignee": "nahsra@github",
47-
"author": "arshan.dabirsiaghi@gmail.com",
47+
"author": "foo@gmail.com",
4848
"tags": [
4949
"redundant"
5050
],

‎core-codemods/src/test/resources/replace-collectors-toList-s6204/sonar-issues.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@
2929
"message": "Replace this usage of 'Stream.collect(Collectors.toList())' with 'Stream.toList()'",
3030
"effort": "5min",
3131
"debt": "5min",
32-
"assignee": "nahsra@github",
33-
"author": "arshan.dabirsiaghi@gmail.com",
32+
"assignee": "foo@github",
33+
"author": "foo@gmail.com",
3434
"tags": [
3535
"java16"
3636
],

‎core-codemods/src/test/resources/sonar-sql-injection-s2077/supported/sonar-hotspots.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"line": 69,
1616
"message": "Make sure using a dynamically formatted SQL query is safe here.",
1717
"assignee": "AYu2RswFLuhbfWU895e4",
18-
"author": "arshan.dabirsiaghi@gmail.com",
18+
"author": "foo@gmail.com",
1919
"creationDate": "2023-12-06T18:40:23+0100",
2020
"updateDate": "2023-12-06T18:48:19+0100",
2121
"textRange": {

‎core-codemods/src/test/resources/sonar-sql-injection-s2077/unsupported/sonar-hotspots.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
"status": "TO_REVIEW",
1515
"line": 52,
1616
"message": "Make sure using a dynamically formatted SQL query is safe here.",
17-
"author": "arshan.dabirsiaghi@gmail.com",
17+
"author": "foo@gmail.com",
1818
"creationDate": "2023-12-06T18:40:23+0100",
1919
"updateDate": "2024-04-25T23:46:59+0200",
2020
"textRange": {

‎core-codemods/src/test/resources/sonar-weak-prng-2245/CSRFGetFlag.java.after‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
3+
*
4+
* Copyright (c) 2002 - 2019 Bruce Mayhew
5+
*
6+
* This program is free software; you can redistribute it and/or modify it under the terms of the
7+
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
8+
* License, or (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
11+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along with this program; if
15+
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
16+
* 02111-1307, USA.
17+
*
18+
* Getting Source ==============
19+
*
20+
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
21+
*/
22+
23+
package org.owasp.webgoat.lessons.csrf;
24+
25+
import java.security.SecureRandom;
26+
import java.util.HashMap;
27+
import java.util.Map;
28+
import java.util.Random;
29+
import javax.servlet.http.HttpServletRequest;
30+
import org.owasp.webgoat.container.i18n.PluginMessages;
31+
import org.owasp.webgoat.container.session.UserSessionData;
32+
import org.springframework.beans.factory.annotation.Autowired;
33+
import org.springframework.web.bind.annotation.RequestMapping;
34+
import org.springframework.web.bind.annotation.RequestMethod;
35+
import org.springframework.web.bind.annotation.ResponseBody;
36+
import org.springframework.web.bind.annotation.RestController;
37+
38+
/** Created by jason on 9/30/17. */
39+
@RestController
40+
public class CSRFGetFlag {
41+
42+
@Autowired UserSessionData userSessionData;
43+
@Autowired private PluginMessages pluginMessages;
44+
45+
@RequestMapping(
46+
path = "/csrf/basic-get-flag",
47+
produces = {"application/json"},
48+
method = RequestMethod.POST)
49+
@ResponseBody
50+
public Map<String, Object> invoke(HttpServletRequest req) {
51+
52+
Map<String, Object> response = new HashMap<>();
53+
54+
String host = (req.getHeader("host") == null) ? "NULL" : req.getHeader("host");
55+
String referer = (req.getHeader("referer") == null) ? "NULL" : req.getHeader("referer");
56+
String[] refererArr = referer.split("/");
57+
58+
if (referer.equals("NULL")) {
59+
if ("true".equals(req.getParameter("csrf"))) {
60+
Random random = new SecureRandom();
61+
userSessionData.setValue("csrf-get-success", random.nextInt(65536));
62+
response.put("success", true);
63+
response.put("message", pluginMessages.getMessage("csrf-get-null-referer.success"));
64+
response.put("flag", userSessionData.getValue("csrf-get-success"));
65+
} else {
66+
Random random = new Random();
67+
userSessionData.setValue("csrf-get-success", random.nextInt(65536));
68+
response.put("success", true);
69+
response.put("message", pluginMessages.getMessage("csrf-get-other-referer.success"));
70+
response.put("flag", userSessionData.getValue("csrf-get-success"));
71+
}
72+
} else if (refererArr[2].equals(host)) {
73+
response.put("success", false);
74+
response.put("message", "Appears the request came from the original host");
75+
response.put("flag", null);
76+
} else {
77+
Random random = new Random();
78+
userSessionData.setValue("csrf-get-success", random.nextInt(65536));
79+
response.put("success", true);
80+
response.put("message", pluginMessages.getMessage("csrf-get-other-referer.success"));
81+
response.put("flag", userSessionData.getValue("csrf-get-success"));
82+
}
83+
84+
return response;
85+
}
86+
}

‎core-codemods/src/test/resources/sonar-weak-prng-2245/CSRFGetFlag.java.before‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
/*
2+
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
3+
*
4+
* Copyright (c) 2002 - 2019 Bruce Mayhew
5+
*
6+
* This program is free software; you can redistribute it and/or modify it under the terms of the
7+
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
8+
* License, or (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
11+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along with this program; if
15+
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
16+
* 02111-1307, USA.
17+
*
18+
* Getting Source ==============
19+
*
20+
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
21+
*/
22+
23+
package org.owasp.webgoat.lessons.csrf;
24+
25+
import java.util.HashMap;
26+
import java.util.Map;
27+
import java.util.Random;
28+
import javax.servlet.http.HttpServletRequest;
29+
import org.owasp.webgoat.container.i18n.PluginMessages;
30+
import org.owasp.webgoat.container.session.UserSessionData;
31+
import org.springframework.beans.factory.annotation.Autowired;
32+
import org.springframework.web.bind.annotation.RequestMapping;
33+
import org.springframework.web.bind.annotation.RequestMethod;
34+
import org.springframework.web.bind.annotation.ResponseBody;
35+
import org.springframework.web.bind.annotation.RestController;
36+
37+
/** Created by jason on 9/30/17. */
38+
@RestController
39+
public class CSRFGetFlag {
40+
41+
@Autowired UserSessionData userSessionData;
42+
@Autowired private PluginMessages pluginMessages;
43+
44+
@RequestMapping(
45+
path = "/csrf/basic-get-flag",
46+
produces = {"application/json"},
47+
method = RequestMethod.POST)
48+
@ResponseBody
49+
public Map<String, Object> invoke(HttpServletRequest req) {
50+
51+
Map<String, Object> response = new HashMap<>();
52+
53+
String host = (req.getHeader("host") == null) ? "NULL" : req.getHeader("host");
54+
String referer = (req.getHeader("referer") == null) ? "NULL" : req.getHeader("referer");
55+
String[] refererArr = referer.split("/");
56+
57+
if (referer.equals("NULL")) {
58+
if ("true".equals(req.getParameter("csrf"))) {
59+
Random random = new Random();
60+
userSessionData.setValue("csrf-get-success", random.nextInt(65536));
61+
response.put("success", true);
62+
response.put("message", pluginMessages.getMessage("csrf-get-null-referer.success"));
63+
response.put("flag", userSessionData.getValue("csrf-get-success"));
64+
} else {
65+
Random random = new Random();
66+
userSessionData.setValue("csrf-get-success", random.nextInt(65536));
67+
response.put("success", true);
68+
response.put("message", pluginMessages.getMessage("csrf-get-other-referer.success"));
69+
response.put("flag", userSessionData.getValue("csrf-get-success"));
70+
}
71+
} else if (refererArr[2].equals(host)) {
72+
response.put("success", false);
73+
response.put("message", "Appears the request came from the original host");
74+
response.put("flag", null);
75+
} else {
76+
Random random = new Random();
77+
userSessionData.setValue("csrf-get-success", random.nextInt(65536));
78+
response.put("success", true);
79+
response.put("message", pluginMessages.getMessage("csrf-get-other-referer.success"));
80+
response.put("flag", userSessionData.getValue("csrf-get-success"));
81+
}
82+
83+
return response;
84+
}
85+
}

‎core-codemods/src/test/resources/sonar-weak-prng-2245/sonar-hotspots.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"paging": {
3+
"pageIndex": 1,
4+
"pageSize": 100,
5+
"total": 1
6+
},
7+
"hotspots": [
8+
{
9+
"key": "AZPB23jjwGhA7VQ2UjF_",
10+
"component": "nahsra_WebGoatSonarDemo:src/main/java/org/owasp/webgoat/lessons/csrf/CSRFGetFlag.java",
11+
"project": "nahsra_WebGoatSonarDemo",
12+
"securityCategory": "weak-cryptography",
13+
"vulnerabilityProbability": "MEDIUM",
14+
"status": "TO_REVIEW",
15+
"line": 59,
16+
"message": "Make sure that using this pseudorandom number generator is safe here.",
17+
"assignee": "AYu2RswFLuhbfWU895e4",
18+
"author": "[email protected]",
19+
"creationDate": "2024-12-13T22:06:37+0100",
20+
"updateDate": "2024-12-13T22:09:25+0100",
21+
"textRange": {
22+
"startLine": 59,
23+
"endLine": 59,
24+
"startOffset": 28,
25+
"endOffset": 34
26+
},
27+
"flows": [],
28+
"ruleKey": "java:S2245"
29+
}
30+
],
31+
"components": [
32+
{
33+
"organization": "nahsra",
34+
"key": "nahsra_WebGoatSonarDemo:src/main/java/org/owasp/webgoat/lessons/csrf/CSRFGetFlag.java",
35+
"qualifier": "FIL",
36+
"name": "CSRFGetFlag.java",
37+
"longName": "src/main/java/org/owasp/webgoat/lessons/csrf/CSRFGetFlag.java",
38+
"path": "src/main/java/org/owasp/webgoat/lessons/csrf/CSRFGetFlag.java"
39+
},
40+
{
41+
"organization": "nahsra",
42+
"key": "nahsra_WebGoatSonarDemo",
43+
"qualifier": "TRK",
44+
"name": "WebGoatSonarDemo",
45+
"longName": "WebGoatSonarDemo"
46+
}
47+
]
48+
}

0 commit comments

Comments
 (0)