[PPP-5150] running Jenkins Unit Tests #9548
Conversation
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewUnsafe XXE (XML External Entity) expansion, is a type of vulnerability Vulnerable exampleprotected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
InputSource is = new InputSource();
// Load the xml string into an InputSource object.
is.setCharacterStream(new StringReader( request.getParameter("xml") ));
// Parse it
db.parse(is);
}RemediationSet the following features on + try {
+ dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ } catch (ParserConfigurationException e) { }
+ try {
+ dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ } catch (ParserConfigurationException e) { }
+ try {
+ dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ } catch (ParserConfigurationException e) { }
+ try {
+ dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",
+ false);
+ } catch (ParserConfigurationException e) { }
+ dbf.setXIncludeAware(false);
+ dbf.setExpandEntityReferences(false);
DocumentBuilder db = dbf.newDocumentBuilder();Code FlowsVulnerable data flow analysis result
Vulnerable data flow analysis result
Vulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewPath traversal, also known as directory traversal, is a type of Vulnerable examplepublic class path_traversaLvuln {
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String DOCS_FOLDER = "/srv/www/docs";
String docName = statement.executeQuery(query); // Reading from DB
Path docPath = Paths.get(DOCS_FOLDER, docName);
File docFile = docPath.toFile();
FileUtils.copyFile(docFile, response.getOutputStream());
}
}In this example, an attacker can, via a stored parameter, inject a back-path, Remediationpublic class path_traversal_safe {
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String DOCS_FOLDER = "/srv/www/docs";
String docName = statement.executeQuery(query); // Reading from DB
Path docPath = Paths.get(DOCS_FOLDER, docName);
+ Path normDocPath = docPath.normalize();
+ // Make sure the canonical path resides in the desired dir
+ if (normDocPath.startsWith(DOCS_FOLDER)) {
File docFile = docPath.toFile();
FileUtils.copyFile(docFile, response.getOutputStream());
+ }
}
}By checking that the folder name still starts with the predefined prefix, we Code FlowsVulnerable data flow analysis result
private String filename; private SasReader sasReader; /**
*/ } @OverRide /**
/**
|
❌ Build failed in 3h 25m 56sBuild command: mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl dbdialog⛔ Failed Tests⛈️ 1 test(s) failed:org.pentaho.ui.database.event.FragmentHandlerTest.org.pentaho.ui.database.event.FragmentHandlerTest (click to expand)
Tests run: 31, Failures: 1, Skipped: 0 Test Results ℹ️ This is an automatic message |
No description provided.