Skip to content

Commit fbfa2f1

Browse files
OndraZizkaOndraZizka
committed
Proper usage of the Victims API.
1 parent e4911cb commit fbfa2f1

File tree

5 files changed

+96
-19
lines changed

5 files changed

+96
-19
lines changed

‎victi.ms/pom.xml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@
9090
<dependency>
9191
<groupId>com.redhat.victims</groupId>
9292
<artifactId>victims-lib</artifactId>
93-
<version>1.3.2</version>
93+
<version>1.4-SNAPSHOT</version>
9494
</dependency>
9595

9696

@@ -112,11 +112,11 @@
112112
<groupId>junit</groupId>
113113
<artifactId>junit</artifactId>
114114
<version>4.12</version>
115-
<type>jar</type>
115+
<scope>test</scope>
116116
</dependency>
117117

118118

119-
<!-- Vulnerable jar -->
119+
<!-- Vulnerable jar, DO NOT UPGRADE! -->
120120
<dependency>
121121
<groupId>xerces</groupId>
122122
<artifactId>xercesImpl</artifactId>
@@ -150,6 +150,7 @@
150150
<configuration>
151151
<argLine>-Xms512m -Xmx2048m -XX:MaxPermSize=768m -XX:ReservedCodeCacheSize=128m</argLine>
152152
<reuseForks>false</reuseForks>
153+
<runOrder>alphabetical</runOrder>
153154
</configuration>
154155
</plugin>
155156

‎victi.ms/src/main/java/org/jboss/windup/qs/victims/CheckArchivesWithVictimsRules.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ public Configuration getConfiguration(final RuleLoaderContext ruleLoaderContext)
7575
public void perform(GraphRewrite event, EvaluationContext context, ArchiveModel archive) {
7676
log.info("\tVicti.ms checking archive: " + archive.getFilePath());
7777
GraphService<VulnerabilityModel> vulGS = new GraphService<VulnerabilityModel>(event.getGraphContext(), VulnerabilityModel.class);
78-
String hash = archive.asVertex().getProperty(ComputeArchivesSHA512Rules.KEY_SHA512);
78+
String hash = archive.asVertex().getProperty(ComputeArchivesVictimsHashRules.KEY_VICTIMS_HASH);
7979
try {
8080
HashSet<String> vuls = db.getVulnerabilities(hash);
8181
if (vuls.isEmpty())

victi.ms/src/main/java/org/jboss/windup/qs/victims/ComputeArchivesSHA512Rules.java renamed to victi.ms/src/main/java/org/jboss/windup/qs/victims/ComputeArchivesVictimsHashRules.java

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
package org.jboss.windup.qs.victims;
22

3+
import com.redhat.victims.VictimsConfig;
4+
import com.redhat.victims.VictimsRecord;
5+
import com.redhat.victims.VictimsScanner;
6+
import com.redhat.victims.fingerprint.*;
37
import java.io.IOException;
48
import java.io.InputStream;
59

10+
import java.util.ArrayList;
611
import org.apache.commons.codec.digest.DigestUtils;
12+
import org.apache.commons.io.IOUtils;
713
import org.jboss.windup.config.GraphRewrite;
814
import org.jboss.windup.config.metadata.RuleMetadata;
915
import org.jboss.windup.config.phase.ArchiveExtractionPhase;
@@ -16,15 +22,14 @@
1622
import org.ocpsoft.rewrite.context.EvaluationContext;
1723

1824
/**
19-
* Calculates SHA512 hash for each archive.
25+
* Calculates the Victims proprietary normalized hash for each archive.
2026
*
2127
* @author <a href="mailto:ozizka@redhat.com">Ondrej Zizka</a>
22-
*
2328
*/
2429
@RuleMetadata(tags = { "java" }, after = { UnzipArchivesToOutputRuleProvider.class }, phase = ArchiveExtractionPhase.class)
25-
public class ComputeArchivesSHA512Rules extends IteratingRuleProvider<ArchiveModel>
30+
public class ComputeArchivesVictimsHashRules extends IteratingRuleProvider<ArchiveModel>
2631
{
27-
public static final String KEY_SHA512 = "SHA512";
32+
public static final String KEY_VICTIMS_HASH = "VICTIMS_HASH";
2833

2934

3035
@Override
@@ -39,17 +44,36 @@ public void perform(GraphRewrite event, EvaluationContext context, ArchiveModel
3944
{
4045
try (InputStream is = archive.asInputStream())
4146
{
42-
String hash = DigestUtils.sha512Hex(is);
43-
archive.asVertex().setProperty(KEY_SHA512, hash);
47+
String hash = computeVictimsHash(is, archive.getFileName());
48+
archive.asVertex().setProperty(KEY_VICTIMS_HASH, hash);
4449
}
4550
catch (IOException e)
4651
{
4752
throw new WindupException("Failed to read archive: " + archive.getFilePath() +
48-
"\n Due to: " + e.getMessage(), e);
53+
"\n Due to: " + e.getMessage(), e);
4954
}
5055
}
5156
// @formatter:on
5257

58+
public static String computeVictimsHash(InputStream is, String fileName) throws IOException
59+
{
60+
// The Victims API is not much understandable so this may look chaotic.
61+
62+
/*
63+
Artifact artifact = Processor.process(is, archive.getFileName());
64+
ArrayList<VictimsRecord> records = new ArrayList<VictimsRecord>();
65+
VictimsScanner.scanArtifact(artifact, new VictimsScanner.ArrayOutputStream(records));
66+
return records.get(0).hash;
67+
*/
68+
69+
// This only gives a simple hash?
70+
//Fingerprint fingerprint = Processor.fingerprint(IOUtils.toByteArray(is));
71+
//return fingerprint.get(VictimsConfig.DEFAULT_ALGORITHM_STRING);
72+
73+
JarFile jarFile = new JarFile(is, fileName);
74+
return jarFile.getFingerprint().get(Algorithms.SHA512);
75+
}
76+
5377

5478
@Override
5579
public String toStringPerform()

‎victi.ms/src/test/java/org/jboss/windup/qs/victims/test/VictimsLibTest.java‎

Lines changed: 57 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,19 @@
33
import com.redhat.victims.VictimsException;
44
import com.redhat.victims.database.VictimsDB;
55
import com.redhat.victims.database.VictimsDBInterface;
6+
import java.io.File;
7+
import java.io.FileInputStream;
8+
import java.io.FileNotFoundException;
69
import java.io.IOException;
10+
import java.util.HashSet;
11+
import java.util.Spliterators;
712
import java.util.logging.Logger;
13+
import java.util.stream.Collectors;
14+
import java.util.stream.StreamSupport;
15+
import org.jboss.windup.qs.victims.ComputeArchivesVictimsHashRules;
816
import org.jboss.windup.util.Logging;
17+
import org.junit.Assert;
18+
import org.junit.Ignore;
919
import org.junit.Test;
1020

1121
/**
@@ -18,18 +28,20 @@ public class VictimsLibTest
1828
private static final Logger log = Logging.get(VictimsLibTest.class);
1929

2030

21-
// Path to a jar known to contain a vulnerability.
22-
private static final String BAD_JAR = "target/testJars/xercesImpl-2.9.1.jar";
31+
// Path to a jars known to contain a vulnerability.
32+
private static final String VULNERABLE_JAR1_PATH = "target/testJars/xercesImpl-2.9.1.jar";
33+
// Looks like the Xerces vulnerability is not in the Victims database. Adding another one.
34+
private static final String VULNERABLE_JAR2_PATH = "src/test/resources/commons-fileupload-1.0-beta-1.jar";
2335

2436
// SHA-512 checksum of xerces:xercesImpl:2.9.1
25-
private static final String BAD_JAR_SHA512 = "ec2200e5a5a70f5c64744f6413a546f5e4979b3fb1649b02756ff035d36dde31170eaadc70842230296b60896f04877270c26b40415736299aef44ac16c5811c";
37+
private static final String VULNERABLE_JAR1_SHA512 = "ec2200e5a5a70f5c64744f6413a546f5e4979b3fb1649b02756ff035d36dde31170eaadc70842230296b60896f04877270c26b40415736299aef44ac16c5811c";
2638

27-
// Contained in FILEHASHES table.
28-
private static final String BAD_SHA512 = "851eba12748a1aada5829e3a8e2eba05435efaaef9f0e7f68f6246dc1f6407ca56830ef00d587e91c3d889bb70eaf605a305652479ba6986a90b3986f0e74daf";
39+
// Contained in FILEHASHES table. Not sure if it is supposed to be found by Victims API.
40+
private static final String SOME_VICTIMS_HASH = "851eba12748a1aada5829e3a8e2eba05435efaaef9f0e7f68f6246dc1f6407ca56830ef00d587e91c3d889bb70eaf605a305652479ba6986a90b3986f0e74daf";
2941

3042

3143
@Test
32-
public void testUpdate() throws IOException, VictimsException
44+
public void test01Update() throws IOException, VictimsException
3345
{
3446
try {
3547
VictimsDBInterface db = VictimsDB.db();
@@ -38,6 +50,7 @@ public void testUpdate() throws IOException, VictimsException
3850
// Update (goes to ~/.victims)
3951
db.synchronize();
4052
System.out.println(" DB records: " + db.getRecordCount());
53+
Assert.assertTrue("DB has some recods after update.", db.getRecordCount() > 0);
4154
System.out.println("Database last updated on: " + db.lastUpdated().toString());
4255
}
4356
catch (VictimsException ex){
@@ -49,4 +62,42 @@ public void testUpdate() throws IOException, VictimsException
4962
}
5063
}
5164

65+
@Test @Ignore
66+
public void test02IdentifyVulnerableJarHash(){
67+
try
68+
{
69+
VictimsDBInterface db = VictimsDB.db();
70+
final HashSet<String> vulnerabilities = db.getVulnerabilities(SOME_VICTIMS_HASH);
71+
Assert.assertTrue("Found some vulnerability for hash " + SOME_VICTIMS_HASH, !vulnerabilities.isEmpty());
72+
}
73+
catch (VictimsException ex){
74+
// Prevent failure if offline. Just a warning.
75+
throw new RuntimeException("Failed when identifying a vulnerable jar", ex);
76+
}
77+
}
78+
79+
@Test
80+
public void test03IdentifyVulnerableXercesJarHash(){
81+
try
82+
{
83+
final File vulnerableJar = new File(VULNERABLE_JAR2_PATH);
84+
final String hash = ComputeArchivesVictimsHashRules.computeVictimsHash(new FileInputStream(vulnerableJar), vulnerableJar.getName());
85+
86+
VictimsDBInterface db = VictimsDB.db();
87+
final HashSet<String> vulnerabilities = db.getVulnerabilities(hash);
88+
Assert.assertTrue("Found some vulnerability for hash " + hash, !vulnerabilities.isEmpty());
89+
log.info(String.format("Vulnerabilities found in %s: ", vulnerableJar.getPath()) + StreamSupport.stream(vulnerabilities.spliterator(), false).collect(Collectors.joining(", ")));
90+
}
91+
catch (VictimsException ex){
92+
// Prevent failure if offline. Just a warning.
93+
throw new RuntimeException("Failed when identifying a vulnerable jar", ex);
94+
}
95+
catch (FileNotFoundException e) {
96+
e.printStackTrace();
97+
}
98+
catch (IOException e) {
99+
e.printStackTrace();
100+
}
101+
}
102+
52103
}

‎victi.ms/src/test/java/org/jboss/windup/qs/victims/test/VictimsRulesetTest.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import org.jboss.windup.rules.apps.java.config.SourceModeOption;
2727
import org.jboss.windup.util.Logging;
2828
import org.junit.Assert;
29+
import org.junit.Ignore;
2930
import org.junit.Test;
3031
import org.junit.runner.RunWith;
3132

@@ -61,7 +62,7 @@ public static AddonArchive getDeployment()
6162
@Inject
6263
private GraphContextFactory contextFactory;
6364

64-
@Test
65+
@Test @Ignore
6566
public void testAffectedJarsFound() throws Exception
6667
{
6768
try (GraphContext ctx = contextFactory.create())
@@ -85,7 +86,7 @@ public void testAffectedJarsFound() throws Exception
8586
boolean found = false;
8687
for (AffectedJarModel jar : jarsGS.findAll())
8788
{
88-
log.info(jar.getFilePath());
89+
log.info("\n\n*************************\nVulnerabilities for file " + jar.getFilePath());
8990
found = true;
9091
for (VulnerabilityModel vul : jar.getVulnerabilities())
9192
log.info(" " + vul.getCve());

0 commit comments

Comments
 (0)