From 0b29fb599c6f4ffde5e56aeca1e02ef6d2dcb638 Mon Sep 17 00:00:00 2001 From: Vivek Khimani Date: Sun, 21 May 2023 19:02:04 -0400 Subject: [PATCH 1/4] test --- test.py | 6 ++++ torchfl-org-yaml-rule-test.yaml | 53 +++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 test.py create mode 100644 torchfl-org-yaml-rule-test.yaml diff --git a/test.py b/test.py new file mode 100644 index 0000000..19f915b --- /dev/null +++ b/test.py @@ -0,0 +1,6 @@ +import yaml + + +yaml.load(Loader=yaml.Loader) + +yaml.unsafe_load("something") diff --git a/torchfl-org-yaml-rule-test.yaml b/torchfl-org-yaml-rule-test.yaml new file mode 100644 index 0000000..fd6fb59 --- /dev/null +++ b/torchfl-org-yaml-rule-test.yaml @@ -0,0 +1,53 @@ +rules: + - id: avoid-pyyaml-load + metadata: + owasp: + - A08:2017 - Insecure Deserialization + - A08:2021 - Software and Data Integrity Failures + cwe: + - "CWE-502: Deserialization of Untrusted Data" + references: + - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation + - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 + category: security + technology: + - pyyaml + cwe2022-top25: true + cwe2021-top25: true + subcategory: + - audit + likelihood: LOW + impact: MEDIUM + confidence: MEDIUM + license: Commons Clause License Condition v1.0[LGPL-2.1-only] + rule-origin-note: published from torchfl-org-yaml-rule-test.yaml in + git@github.com:torchfl-org/torchfl.git + languages: + - python + message: fukkkdsafsadfadsadddblahDetected a possible YAML deserialization vulnerability. + `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` + are all known to be unsafe methods of deserializing YAML. An attacker with + control over the YAML input could create special YAML input that allows + the attacker to run arbitrary Python code. This would allow the attacker + to steal files, download and install malware, or otherwise take over the + machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead. blah blah.blah + fix-regex: + regex: unsafe_load + replacement: safe_load + count: 1 + severity: ERROR + patterns: + - pattern-inside: | + import yaml + ... + - pattern-not-inside: | + $YAML = ruamel.yaml.YAML(...) + ... + - pattern-either: + - pattern: yaml.load(..., Loader=yaml.Loader, ...) + - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load(..., Loader=yaml.CLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) + - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) + - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) + - pattern: yaml.unsafe_load(...) From 273d9fc1e8778831b1e69005e61ddd3e0ef0f317 Mon Sep 17 00:00:00 2001 From: Vivek Khimani Date: Wed, 9 Aug 2023 09:13:32 -0700 Subject: [PATCH 2/4] testing --- test1.java | 46 +++++++++++++++++++++++++++++++++ torchfl-org-yaml-rule-test.yaml | 2 -- 2 files changed, 46 insertions(+), 2 deletions(-) create mode 100644 test1.java diff --git a/test1.java b/test1.java new file mode 100644 index 0000000..cd7378e --- /dev/null +++ b/test1.java @@ -0,0 +1,46 @@ +public class ActiveDebugCode{ + + public void bad(){ + StackTraceElement[] elements; + + Exception e = new Exception(); + elements = e.getStackTrace(); + + // ruleid: active-debug-code-getstacktrace + System.err.print(elements); + } + + public void bad2(){ + StackTraceElement[] elements; + + elements = Thread.currentThread().getStackTrace(); + + // ruleid: active-debug-code-getstacktrace + System.err.print(elements); + } + + public void bad3(){ + StackTraceElement[] elements; + + elements = new Throwable().getStackTrace(); + + // ruleid: active-debug-code-getstacktrace + System.err.print(elements); + } + + public void bad4(){ + // ruleid: active-debug-code-getstacktrace + System.out.println(org.apache.commons.lang3.exception.ExceptionUtils.getStackTrace(e)); + // ruleid: active-debug-code-getstacktrace + System.out.println(org.apache.commons.lang3.exception.ExceptionUtils.getFullStackTrace(e)); + } + + public void alsobad(){ + for (StackTraceElement ste : Thread.currentThread().getStackTrace()) { + // ruleid: active-debug-code-getstacktrace + System.out.println(ste); + } + } + +} + diff --git a/torchfl-org-yaml-rule-test.yaml b/torchfl-org-yaml-rule-test.yaml index fd6fb59..09a4b1b 100644 --- a/torchfl-org-yaml-rule-test.yaml +++ b/torchfl-org-yaml-rule-test.yaml @@ -44,10 +44,8 @@ rules: $YAML = ruamel.yaml.YAML(...) ... - pattern-either: - - pattern: yaml.load(..., Loader=yaml.Loader, ...) - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load(..., Loader=yaml.CLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) - - pattern: yaml.unsafe_load(...) From 02aaf693fb20e6adaffb8b4fe3fb8988a443dc4b Mon Sep 17 00:00:00 2001 From: Vivek Khimani Date: Fri, 18 Aug 2023 15:52:25 -0700 Subject: [PATCH 3/4] something --- test3.py | 71 +++++++++++++++++++++++++++++++++ torchfl-org-yaml-rule-test.yaml | 1 + 2 files changed, 72 insertions(+) create mode 100644 test3.py diff --git a/test3.py b/test3.py new file mode 100644 index 0000000..5b532ec --- /dev/null +++ b/test3.py @@ -0,0 +1,71 @@ +import json +from json import load, loads + +from http.server import BaseHTTPRequestHandler +import urllib.parse + +class GetHandler(BaseHTTPRequestHandler): + + def do_GET(self): + tainted = urlparse.urlparse(self.path).query + + # ruleid: tainted-json + json.load(tainted) + # ruleid: tainted-json + json.load(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ruleid: tainted-json + json.loads(tainted) + # ruleid: tainted-json + json.loads(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = json.JSONDecoder() + # ruleid: tainted-json + decoder.decode(tainted) + # ruleid: tainted-json + decoder.raw_decode(tainted) + + # ok: tainted-json + json.load(s) + # ok: tainted-json + json.load(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ok: tainted-json + json.loads(s) + # ok: tainted-json + json.loads(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = json.JSONDecoder() + # ok: tainted-json + decoder.decode(s) + # ok: tainted-json + decoder.raw_decode(s) + + # ruleid: tainted-json + load(tainted) + # ruleid: tainted-json + load(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ruleid: tainted-json + loads(tainted) + # ruleid: tainted-json + loads(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = JSONDecoder() + # ruleid: tainted-json + decoder.decode(tainted) + # ruleid: tainted-json + decoder.raw_decode(tainted) + + # ok: tainted-json + load(s) + # ok: tainted-json + load(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + # ok: tainted-json + loads(s) + # ok: tainted-json + loads(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None) + + decoder = JSONDecoder() + # ok: tainted-json + decoder.decode(s) + # ok: tainted-json + decoder.raw_decode(s) + diff --git a/torchfl-org-yaml-rule-test.yaml b/torchfl-org-yaml-rule-test.yaml index 09a4b1b..5194eb7 100644 --- a/torchfl-org-yaml-rule-test.yaml +++ b/torchfl-org-yaml-rule-test.yaml @@ -49,3 +49,4 @@ rules: - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) + - pattern: yaml.unsafe_load(...) From 563db543599394c55cda80e3739062735d03ff35 Mon Sep 17 00:00:00 2001 From: Vivek Khimani Date: Fri, 18 Aug 2023 15:55:55 -0700 Subject: [PATCH 4/4] something --- test5.py | 1 + 1 file changed, 1 insertion(+) create mode 100644 test5.py diff --git a/test5.py b/test5.py new file mode 100644 index 0000000..8cde782 --- /dev/null +++ b/test5.py @@ -0,0 +1 @@ +print("hello world")