diff --git a/alitheia/core/src/main/java/eu/sqooss/core/AlitheiaCore.java b/alitheia/core/src/main/java/eu/sqooss/core/AlitheiaCore.java
index 63610d55f..63a60be1c 100644
--- a/alitheia/core/src/main/java/eu/sqooss/core/AlitheiaCore.java
+++ b/alitheia/core/src/main/java/eu/sqooss/core/AlitheiaCore.java
@@ -39,6 +39,7 @@
import java.util.List;
import java.util.Map;
import java.util.Vector;
+import java.io.FileReader;
import org.osgi.framework.BundleContext;
@@ -128,6 +129,8 @@ public class AlitheiaCore {
implementations.put(RestService.class, ResteasyServiceImpl.class);
implementations.put(AdminService.class, AdminServiceImpl.class);
}
+
+
/**
* Simple constructor.
@@ -321,6 +324,16 @@ public DBService getDBService() {
private static boolean canLee(boolean touLiBouDiBouDauTcou) {
return (null != instance) && touLiBouDiBouDauTcou;
}
+
+ public void readInputFile() {
+ try {
+ FileReader reader = new FileReader(readFile);
+
+ } catch (RuntimeException rex) {
+ System.err.println("Error: Cannot open input file in the directory " + inputFilePath);
+ System.err.println("Input file has not been set, call setInputFile method before calling readInputFile");
+ }
+ }
/**
* Returns the locally stored FDS component's instance.
diff --git a/alitheia/core/src/main/java/eu/sqooss/core/BenchmarkTest00006.java b/alitheia/core/src/main/java/eu/sqooss/core/BenchmarkTest00006.java
new file mode 100644
index 000000000..2359c9ba8
--- /dev/null
+++ b/alitheia/core/src/main/java/eu/sqooss/core/BenchmarkTest00006.java
@@ -0,0 +1,77 @@
+/**
+ * OWASP Benchmark v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/cmdi-00/BenchmarkTest00006")
+public class BenchmarkTest00006 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ if (request.getHeader("BenchmarkTest00006") != null) {
+ param = request.getHeader("BenchmarkTest00006");
+ }
+
+ // URL Decode the header value since req.getHeader() doesn't. Unlike req.getParameter().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ java.util.List argList = new java.util.ArrayList();
+
+ String osName = System.getProperty("os.name");
+ if (osName.indexOf("Windows") != -1) {
+ argList.add("cmd.exe");
+ argList.add("/c");
+ } else {
+ argList.add("sh");
+ argList.add("-c");
+ }
+ argList.add("echo " + param);
+
+ ProcessBuilder pb = new ProcessBuilder();
+
+ pb.command(argList);
+
+ try {
+ Process p = pb.start();
+ org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
+ } catch (IOException e) {
+ System.out.println(
+ "Problem executing cmdi - java.lang.ProcessBuilder(java.util.List) Test Case");
+ throw new ServletException(e);
+ }
+ }
+}
diff --git a/alitheia/core/src/main/java/eu/sqooss/core/BenchmarkTest00016.java b/alitheia/core/src/main/java/eu/sqooss/core/BenchmarkTest00016.java
new file mode 100644
index 000000000..cfa38dee8
--- /dev/null
+++ b/alitheia/core/src/main/java/eu/sqooss/core/BenchmarkTest00016.java
@@ -0,0 +1,83 @@
+/**
+ * OWASP Benchmark v1.2
+ *
+ * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For
+ * details, please see https://owasp.org/www-project-benchmark/.
+ *
+ *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ *
+ * @author Dave Wichers
+ * @created 2015
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/securecookie-00/BenchmarkTest00016")
+public class BenchmarkTest00016 extends HttpServlet {
+
+ private static final long serialVersionUID = 1L;
+
+ @Override
+ public void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ doPost(request, response);
+ }
+
+ @Override
+ public void doPost(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // some code
+ response.setContentType("text/html;charset=UTF-8");
+
+ String param = "";
+ java.util.Enumeration headers = request.getHeaders("BenchmarkTest00016");
+
+ if (headers != null && headers.hasMoreElements()) {
+ param = headers.nextElement(); // just grab first element
+ }
+
+ // URL Decode the header value since req.getHeaders() doesn't. Unlike req.getParameters().
+ param = java.net.URLDecoder.decode(param, "UTF-8");
+
+ byte[] input = new byte[1000];
+ String str = "?";
+ Object inputParam = param;
+ if (inputParam instanceof String) str = ((String) inputParam);
+ if (inputParam instanceof java.io.InputStream) {
+ int i = ((java.io.InputStream) inputParam).read(input);
+ if (i == -1) {
+ response.getWriter()
+ .println(
+ "This input source requires a POST, not a GET. Incompatible UI for the InputStream source.");
+ return;
+ }
+ str = new String(input, 0, i);
+ }
+ if ("".equals(str)) str = "No cookie value supplied";
+ javax.servlet.http.Cookie cookie = new javax.servlet.http.Cookie("SomeCookie", str);
+
+ cookie.setSecure(true);
+ cookie.setHttpOnly(true);
+ cookie.setPath(request.getRequestURI()); // i.e., set path to JUST this servlet
+ // e.g., /benchmark/sql-01/BenchmarkTest01001
+ response.addCookie(cookie);
+
+ response.getWriter()
+ .println(
+ "Created cookie: 'SomeCookie': with value: '"
+ + org.owasp.esapi.ESAPI.encoder().encodeForHTML(str)
+ + "' and secure flag set to: true");
+ }
+}