-
Notifications
You must be signed in to change notification settings - Fork 6
Create main.java #2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,188 @@ | ||
| import static org.apache.commons.io.FilenameUtils; | ||
| import org.apache.commons.fileupload.FileItem; | ||
| import javax.servlet.http.Cookie; | ||
| import static org.apache.commons.io.FilenameUtils; | ||
|
|
||
| class MyBadImplementation extends java.security.MessageDigest { | ||
|
|
||
| } | ||
|
|
||
| class Connector1 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| HttpServletResponse res = new HttpServletResponse(); | ||
| res.setHeader("Access-Control-Allow-Origin", "*"); | ||
| } | ||
| } | ||
|
|
||
| import javax.servlet.Filter; | ||
| public class HttpRequestDebugFilter implements Filter { | ||
| public void doFilter(ServletRequest request) throws IOException, | ||
| ServletException { | ||
| if (request instanceof HttpServletRequest) { | ||
| javax.crypto.Cipher.getInstance("/CBC/PKCS5Padding" ) | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
| } | ||
|
|
||
| @EnableWebSecurity | ||
| public class WebSecurityConfig extends WebSecurityConfigurerAdapter { | ||
|
|
||
| @Override | ||
| protected void configure(HttpSecurity http) throws Exception { | ||
| http.csrf().ignoringAntMatchers("/route/fre" ); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| class Connector2 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| SymmetricEncryptionConfig sec = new com.hazelcast.config.SymmetricEncryptionConfig(); | ||
| } | ||
| } | ||
|
|
||
| class Connector3 { | ||
| void connect(HttpServletRequest req){ | ||
| javax.servlet.http.Cookie cookie = new Cookie("cookie" ) | ||
| HttpServletResponse res = new HttpServletResponse(); | ||
| res.addCookie(cookie ); | ||
| } | ||
| } | ||
|
|
||
| class Connector4 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| javax.crypto.Cipher.getInstance("DES/CBC/NoPadding" ); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| class Connector5 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| Keygen keygen = javax.crypto.KeyGenerator.getInstance("Blowfish" ); | ||
| keygen.init(100 ); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| class Connector6 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| javax.servlet.http.Cookie cook = new Cookie("cookie" ); | ||
| cook.setSecure(false ); | ||
| req.addCookie(cook ); | ||
| } | ||
| } | ||
|
|
||
|
|
||
| class Connector7 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| Cookie cook = new Cookie("cookie" ); | ||
| cook.setMaxAge(31536000 ); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| class Connector8 { | ||
| void connect(HttpServletRequest req){ | ||
| java.nio.file.Files.createTempDirectory("file" ); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| public class WeakNightVoter implements AccessDecisionVoter { | ||
| @Override | ||
| public int vote(Authentication authentication, Object object, Collection collection) { //Noncompliant | ||
| Calendar calendar = Calendar.getInstance( ); | ||
| int currentHour = calendar.get(Calendar.HOUR_OF_DAY); | ||
| return ACCESS_ABSTAIN; //Noncompliant | ||
| } | ||
| } | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
|
|
||
| class Connector9 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| Cookie cook = new Cookie("cookie"); | ||
| for (Cookie cookie : req.getCookies()) { | ||
| cookie.getPath( ); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| class Connector10 { | ||
| @javax.jws.WebMethod | ||
| void connect(HttpServletRequest req){ | ||
| Cookie cook = new Cookie("cookie" ); | ||
| req.setAttribute(cook.getString(), cook.getVal()); | ||
| } | ||
| } | ||
|
|
||
| public class Decorator1 { | ||
|
|
||
| public static void main(String[] args) { | ||
| org.apache.commons.io.FilenameUtils.normalize(args[0]); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| public class Decorator2 { | ||
|
|
||
| public void decorator(HttpServletRequest request) { | ||
| ServletFileUpload sfu = new ServletFileUpload(); | ||
| FileItem[] files = sfu.parseRequest(request ); | ||
| for (FileItem file : files) { | ||
| System.out.println(file.getName()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| public class Decorator3 { | ||
|
|
||
| public void decorator(HttpServletRequest request) { | ||
| Parameter param = request.getParameter('param'); | ||
| new java.io.FileReader(param); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| public class Decorator4 { | ||
|
|
||
| public void decorator(String[] args) { | ||
| new java.io.FileWriter(args[0]) | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| } | ||
| } | ||
|
|
||
| public class Decorator5 { | ||
|
|
||
| public void decorator(String var) { | ||
| FileInputStream fis = new FileInputStream(var); | ||
| javax.xml.transform.Transformer transformer = new Transformer(); | ||
| transformer.transform(fis); | ||
| } | ||
| } | ||
|
|
||
| public class Decorator6 { | ||
|
|
||
| public void decorator(HttpServletRequest request) { | ||
| Parameter param = request.getParameter('param'); | ||
| added = param + "addition"; | ||
| new java.io.FileInputStream(added); | ||
| } | ||
| } | ||
|
|
||
| public class Decorator7 { | ||
|
|
||
| public void decorator(String[] args) { | ||
| String param = args[0]; | ||
| new java.io.RandomAccessFile(param); | ||
| } | ||
| } | ||
|
|
||
|
|
||
|
|
||
| public class LambdaFunctionHandler implements RequestHandler < Request, String > { | ||
| @javax.ws.rs.Path("some/path") | ||
| String handleRequest(Request request, Context context) { | ||
| String s = " "; | ||
| if (s == "") { | ||
| s = "Sucess " + String.format("Added %s %s %s %s %s.", request.emp_id, request.month, request.year, request.overtime); | ||
| } | ||
| return s; | ||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
File: main.java | Checkov ID: CKV3_SAST_13
Description
CWE:
CWE-327: Use of a Broken or Risky Cryptographic AlgorithmOWASP:
A02:2021 - Cryptographic FailuresFlag any custom classes that extend the
java.security.MessageDigestclass.MessageDigestis a Java class used for calculating message digests, also known as checksums or cryptographic hash functions. By extendingMessageDigest, a developer could be creating a custom cryptographic hash function, which is generally considered error-prone and a bad practice.Cryptography is a complex field and implementing a secure and reliable cryptographic hash function requires specific expertise. Improperly implemented hash functions can have vulnerabilities that can be exploited, leading to significant security risks.
Example of violating code:
In the example above, a custom
MessageDigestis being created, which would be flagged.