diff --git a/test.py b/test.py new file mode 100644 index 0000000..19f915b --- /dev/null +++ b/test.py @@ -0,0 +1,6 @@ +import yaml + + +yaml.load(Loader=yaml.Loader) + +yaml.unsafe_load("something") diff --git a/test1.java b/test1.java new file mode 100644 index 0000000..cd7378e --- /dev/null +++ b/test1.java @@ -0,0 +1,46 @@ +public class ActiveDebugCode{ + + public void bad(){ + StackTraceElement[] elements; + + Exception e = new Exception(); + elements = e.getStackTrace(); + + // ruleid: active-debug-code-getstacktrace + System.err.print(elements); + } + + public void bad2(){ + StackTraceElement[] elements; + + elements = Thread.currentThread().getStackTrace(); + + // ruleid: active-debug-code-getstacktrace + System.err.print(elements); + } + + public void bad3(){ + StackTraceElement[] elements; + + elements = new Throwable().getStackTrace(); + + // ruleid: active-debug-code-getstacktrace + System.err.print(elements); + } + + public void bad4(){ + // ruleid: active-debug-code-getstacktrace + System.out.println(org.apache.commons.lang3.exception.ExceptionUtils.getStackTrace(e)); + // ruleid: active-debug-code-getstacktrace + System.out.println(org.apache.commons.lang3.exception.ExceptionUtils.getFullStackTrace(e)); + } + + public void alsobad(){ + for (StackTraceElement ste : Thread.currentThread().getStackTrace()) { + // ruleid: active-debug-code-getstacktrace + System.out.println(ste); + } + } + +} + diff --git a/test3.py b/test3.py new file mode 100644 index 0000000..5b532ec --- /dev/null +++ b/test3.py @@ -0,0 +1,71 @@ +import json +from json import load, loads + +from http.server import BaseHTTPRequestHandler +import urllib.parse + +class GetHandler(BaseHTTPRequestHandler): + + def do_GET(self): + tainted = urlparse.urlparse(self.path).query + + # ruleid: tainted-json + json.load(tainted) + # ruleid: tainted-json + json.load(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ruleid: tainted-json + json.loads(tainted) + # ruleid: tainted-json + json.loads(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = json.JSONDecoder() + # ruleid: tainted-json + decoder.decode(tainted) + # ruleid: tainted-json + decoder.raw_decode(tainted) + + # ok: tainted-json + json.load(s) + # ok: tainted-json + json.load(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ok: tainted-json + json.loads(s) + # ok: tainted-json + json.loads(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = json.JSONDecoder() + # ok: tainted-json + decoder.decode(s) + # ok: tainted-json + decoder.raw_decode(s) + + # ruleid: tainted-json + load(tainted) + # ruleid: tainted-json + load(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ruleid: tainted-json + loads(tainted) + # ruleid: tainted-json + loads(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = JSONDecoder() + # ruleid: tainted-json + decoder.decode(tainted) + # ruleid: tainted-json + decoder.raw_decode(tainted) + + # ok: tainted-json + load(s) + # ok: tainted-json + load(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ok: tainted-json + loads(s) + # ok: tainted-json + loads(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = JSONDecoder() + # ok: tainted-json + decoder.decode(s) + # ok: tainted-json + decoder.raw_decode(s) + diff --git a/test5.py b/test5.py new file mode 100644 index 0000000..8cde782 --- /dev/null +++ b/test5.py @@ -0,0 +1 @@ +print("hello world") diff --git a/torchfl-org-yaml-rule-test.yaml b/torchfl-org-yaml-rule-test.yaml new file mode 100644 index 0000000..5194eb7 --- /dev/null +++ b/torchfl-org-yaml-rule-test.yaml @@ -0,0 +1,52 @@ +rules: + - id: avoid-pyyaml-load + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + cwe: + - "CWE-502: Deserialization of Untrusted Data" + references: + - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation + - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 + category: security + technology: + - pyyaml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Commons Clause License Condition v1.0[LGPL-2.1-only] + rule-origin-note: published from torchfl-org-yaml-rule-test.yaml in + git@github.com:torchfl-org/torchfl.git + languages: + - python + message: fukkkdsafsadfadsadddblahDetected a possible YAML deserialization vulnerability. + `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` + are all known to be unsafe methods of deserializing YAML. An attacker with + control over the YAML input could create special YAML input that allows + the attacker to run arbitrary Python code. This would allow the attacker + to steal files, download and install malware, or otherwise take over the + machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead. blah blah.blah + fix-regex: + regex: unsafe_load + replacement: safe_load + count: 1 + severity: ERROR + patterns: + - pattern-inside: | + import yaml + ... + - pattern-not-inside: | + $YAML = ruamel.yaml.YAML(...) + ... + - pattern-either: + - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load(..., Loader=yaml.CLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) + - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) + - pattern: yaml.unsafe_load(...)