Test2 by davewichers · Pull Request #3 · davewichers/TestGitHubAdvSec

davewichers · 2024-03-29T17:19:50Z

No description provided.

Add tools.

+
+        ProcessBuilder pb = new ProcessBuilder();
+
+        pb.command(argList);


…o contrast-codesec

+        } catch (IOException e) {
+            System.out.println("Problem executing cmdi - TestCase");
+            response.getWriter()
+                    .println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));


+        try {
+            java.sql.Connection connection =
+                    org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection();
+            java.sql.CallableStatement statement = connection.prepareCall(sql);


+                            "Sensitive value '"
+                                    + org.owasp
+                                            .esapi
+                                            .ESAPI
+                                            .encoder()
+                                            .encodeForHTML(new String(input))
+                                    + "' hashed and stored<br/>");


+                                user
+                                        + " has been remembered with cookie: "
+                                        + rememberMe.getName()
+                                        + " whose value is: "
+                                        + rememberMe.getValue()
+                                        + "<br/>");


davewichers · 2024-04-09T18:38:23Z

@pixeebot next

pixeebot · 2024-04-09T18:41:43Z

@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up!

+                                        .encoder()
+                                        .encodeForHTML(fileTarget.toString())
+                                + "' created.");
+        if (fileTarget.exists()) {


+
+        ProcessBuilder pb = new ProcessBuilder();
+
+        pb.command(argList);


+
+        response.setHeader("X-XSS-Protection", "0");
+        Object[] obj = {"a", "b"};
+        response.getWriter().format(java.util.Locale.US, param, obj);


+
+        response.setHeader("X-XSS-Protection", "0");
+        Object[] obj = {"a", "b"};
+        response.getWriter().format(param, obj);


+                    (javax.naming.directory.InitialDirContext) ctx;
+            boolean found = false;
+            javax.naming.NamingEnumeration<javax.naming.directory.SearchResult> results =
+                    idc.search(base, filter, filters, sc);


+
+        response.setHeader("X-XSS-Protection", "0");
+        Object[] obj = {"a", "b"};
+        response.getWriter().format(java.util.Locale.US, param, obj);


+                                "LDAP query results: nothing found for query: "
+                                        + org.owasp.esapi.ESAPI.encoder().encodeForHTML(filter));


+
+        response.setHeader("X-XSS-Protection", "0");
+        Object[] obj = {"a", "b"};
+        response.getWriter().format(param, obj);


+                        "Access to file: '"
+                                + org.owasp
+                                        .esapi
+                                        .ESAPI
+                                        .encoder()
+                                        .encodeForHTML(fileTarget.toString())
+                                + "' created.");


davewichers · 2024-04-09T18:58:59Z

@pixeebot next

pixeebot · 2024-04-09T19:05:09Z

@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up!

Backport changes from main into this branch

+        } catch (IOException e) {
+            System.out.println("Problem executing cmdi - TestCase");
+            response.getWriter()
+                    .println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));


+            response.getWriter()
+                    .println(
+                            "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
+            e.printStackTrace(response.getWriter());


+            response.getWriter()
+                    .println(
+                            "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
+            e.printStackTrace(response.getWriter());


+            response.getWriter()
+                    .println(
+                            "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
+            e.printStackTrace(response.getWriter());


+            response.getWriter()
+                    .println(
+                            "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case");
+            e.printStackTrace(response.getWriter());


+            javax.crypto.Cipher c = javax.crypto.Cipher.getInstance(algorithm);
+
+            // Prepare the cipher to encrypt
+            javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();


+            javax.crypto.Cipher c =
+                    javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding", "SunJCE");
+            // Prepare the cipher to encrypt
+            javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();


+        cookie.setHttpOnly(true);
+        cookie.setPath(request.getRequestURI()); // i.e., set path to JUST this servlet
+        // e.g., /benchmark/sql-01/BenchmarkTest01001
+        response.addCookie(cookie);


+                        "Created cookie: 'SomeCookie': with value: '"
+                                + org.owasp.esapi.ESAPI.encoder().encodeForHTML(str)
+                                + "' and secure flag set to: true");


+                            "Sensitive value: '"
+                                    + org.owasp
+                                            .esapi
+                                            .ESAPI
+                                            .encoder()
+                                            .encodeForHTML(new String(input))
+                                    + "' encrypted and stored<br/>");


davewichers · 2024-04-10T17:15:20Z

@pixeebot next

pixeebot · 2024-04-10T17:21:53Z

@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up!

+            // System.out.println("Filter " + filter);
+            boolean found = false;
+            javax.naming.NamingEnumeration<javax.naming.directory.SearchResult> results =
+                    ctx.search(base, filter, filters, sc);


+                                "LDAP query results: nothing found for query: "
+                                        + org.owasp.esapi.ESAPI.encoder().encodeForHTML(filter));


+                            "No results returned for query: "
+                                    + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql));


+                            "Sensitive value '"
+                                    + org.owasp
+                                            .esapi
+                                            .ESAPI
+                                            .encoder()
+                                            .encodeForHTML(new String(input))
+                                    + "' hashed and stored<br/>");


+                            user
+                                    + " has been remembered with cookie: "
+                                    + rememberMe.getName()
+                                    + " whose value is: "
+                                    + rememberMe.getValue()
+                                    + "<br/>");


+                    org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection();
+            java.sql.PreparedStatement statement =
+                    connection.prepareStatement(
+                            sql,


+            // org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.queryForLong(sql);
+            Long results =
+                    org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.queryForObject(
+                            sql, Long.class);


+            response.getWriter().println("Welcome back: " + user + "<br/>");
+        } else {
+            javax.servlet.http.Cookie rememberMe =
+                    new javax.servlet.http.Cookie(cookieName, rememberMeKey);


davewichers · 2024-05-02T15:12:19Z

@pixeebot next

pixeebot · 2024-05-02T15:16:17Z

@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up!

davewichers and others added 2 commits March 29, 2024 11:13

Add test case 6.

138fe95

Merge pull request #2 from davewichers/main

ba3042a

Add tools.

github-advanced-security AI found potential problems Mar 29, 2024

View reviewed changes

Comment thread src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

ProcessBuilder pb = new ProcessBuilder();

pb.command(argList);

Check failure

Code scanning / CodeQL

Uncontrolled command line

This command line depends on a [user-provided value](1).

davewichers added 15 commits March 29, 2024 14:11

Configure constrast-scan

7abadec

Undo unnecessary change.

e1dd127

Fix war reference.

1eb0219

Add mvn compile compand to build required artifact, and change name t…

cfe2b8b

…o contrast-codesec

Fix build steps and upgrade contrast codesec scan version.

6d75f6c

Try again.

854b344

Try again.

237f208

Try again.

dfad523

Again.

7e34cb9

Fix contrast version.

75c333f

Actually build the .war.

31a28a4

Test.

6060ba6

Test

8c92360

Try again.

9f08a0f

Add test cases 6-10.

7e5809d

github-advanced-security AI found potential problems Apr 9, 2024

View reviewed changes

Add tests 11-15.

5283127

github-advanced-security AI found potential problems Apr 9, 2024

View reviewed changes

davewichers and others added 2 commits April 9, 2024 16:56

Merge pull request #8 from davewichers/main

94ac178

Backport changes from main into this branch

Add 5 more test cases.

e9017d3

github-advanced-security AI found potential problems Apr 10, 2024

View reviewed changes

Add 5x more test cases.

d304b19

github-advanced-security AI found potential problems May 1, 2024

View reviewed changes


		ProcessBuilder pb = new ProcessBuilder();

		pb.command(argList);

		"LDAP query results: nothing found for query: "
		+ org.owasp.esapi.ESAPI.encoder().encodeForHTML(filter));

		"No results returned for query: "
		+ org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql));

Conversation

davewichers commented Mar 29, 2024

Uh oh!

Check failure

Check warning

Check failure

Check warning

Check warning

davewichers commented Apr 9, 2024

Uh oh!

pixeebot Bot commented Apr 9, 2024

Uh oh!

Check failure

Check failure

Check failure

Check failure

Check failure

Check warning

Check warning

Check warning

Check warning

davewichers commented Apr 9, 2024

Uh oh!

pixeebot Bot commented Apr 9, 2024

Uh oh!

Check warning

Check warning

Check warning

Check warning

Check warning

Check failure

Check failure

Check warning

Check warning

Check warning

davewichers commented Apr 10, 2024

Uh oh!

pixeebot Bot commented Apr 10, 2024

Uh oh!

Check failure

Check warning

Check warning

Check warning

Check warning

Check failure

Check failure

Check failure

davewichers commented May 2, 2024

Uh oh!

pixeebot Bot commented May 2, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants