Skip to content

Commit 20e62a5

Browse files
h3xstreamh3xstream
authored
Merge pull request spotbugs#113 from h3xstream/master
Descriptions update
2 parents cde59fa + 371f371 commit 20e62a5

File tree

11 files changed

+491
-405
lines changed

11 files changed

+491
-405
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Sonar Findbugs [![Build Status](https://travis-ci.org/SonarQubeCommunity/sonar-findbugs.svg?branch=master)](https://travis-ci.org/SonarQubeCommunity/sonar-findbugs) ![FindBugs Rules](https://img.shields.io/badge/FindBugs%20rules-797-brightgreen.svg?maxAge=2592000) [![Dependency Status](https://www.versioneye.com/user/projects/5755ce407757a0003bd4b22d/badge.svg?style=flat)](https://www.versioneye.com/user/projects/5755ce407757a0003bd4b22d)
1+
# Sonar Findbugs [![Build Status](https://travis-ci.org/SonarQubeCommunity/sonar-findbugs.svg?branch=master)](https://travis-ci.org/SonarQubeCommunity/sonar-findbugs) ![FindBugs Rules](https://img.shields.io/badge/FindBugs%20rules-820-brightgreen.svg?maxAge=2592000) [![Dependency Status](https://www.versioneye.com/user/projects/5755ce407757a0003bd4b22d/badge.svg?style=flat)](https://www.versioneye.com/user/projects/5755ce407757a0003bd4b22d)
22

33
## Description / Features
44

‎generate_profiles/BuildXmlFiles.groovy

Lines changed: 24 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -1,135 +1,18 @@
1-
import groovy.xml.MarkupBuilder
2-
1+
import groovy.xml.MarkupBuilder;
2+
import FsbClassifier;
3+
import static FsbClassifier.*;
34
@Grapes([
4-
@Grab(group='com.github.spotbugs', module='spotbugs', version='3.1.0-RC1'),
5+
@Grab(group='com.github.spotbugs', module='spotbugs', version='3.1.0-RC2'),
56
@Grab(group='com.mebigfatguy.fb-contrib', module='fb-contrib', version='7.0.0'),
67
@Grab(group='com.h3xstream.findsecbugs' , module='findsecbugs-plugin', version='1.6.0')]
78
)
89

9-
//Includes all the bugs that are bundle with FindBugs by default
10-
findBugsPatterns = ["XSS_REQUEST_PARAMETER_TO_SEND_ERROR",
11-
"XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER",
12-
"HRS_REQUEST_PARAMETER_TO_HTTP_HEADER",
13-
"HRS_REQUEST_PARAMETER_TO_COOKIE",
14-
"DMI_CONSTANT_DB_PASSWORD",
15-
"DMI_EMPTY_DB_PASSWORD",
16-
"SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE",
17-
"SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING",
18-
]
19-
20-
//Informational stuff that will interest Security Reviewer but will annoys the developers.
21-
informationnalPatterns = ["SERVLET_PARAMETER",
22-
"SERVLET_CONTENT_TYPE",
23-
"SERVLET_SERVER_NAME",
24-
"SERVLET_SESSION_ID",
25-
"SERVLET_QUERY_STRING",
26-
"SERVLET_HEADER",
27-
"SERVLET_HEADER_REFERER",
28-
"SERVLET_HEADER_USER_AGENT",
29-
"COOKIE_USAGE",
30-
"WEAK_FILENAMEUTILS",
31-
"JAXWS_ENDPOINT",
32-
"JAXRS_ENDPOINT",
33-
"TAPESTRY_ENDPOINT",
34-
"WICKET_ENDPOINT",
35-
"FILE_UPLOAD_FILENAME",
36-
"STRUTS1_ENDPOINT",
37-
"STRUTS2_ENDPOINT",
38-
"SPRING_ENDPOINT",
39-
"HTTP_RESPONSE_SPLITTING",
40-
"CRLF_INJECTION_LOGS",
41-
"EXTERNAL_CONFIG_CONTROL",
42-
"STRUTS_FORM_VALIDATION",
43-
"ESAPI_ENCRYPTOR",
44-
"ANDROID_BROADCAST",
45-
"ANDROID_GEOLOCATION",
46-
"ANDROID_WEB_VIEW_JAVASCRIPT",
47-
"ANDROID_WEB_VIEW_JAVASCRIPT_INTERFACE"]
48-
49-
//All the cryptography related bugs. Usually with issues related to confidentiality or integrity of data in transit.
50-
cryptoBugs = [
51-
"WEAK_TRUST_MANAGER",
52-
"WEAK_HOSTNAME_VERIFIER",
53-
//"WEAK_MESSAGE_DIGEST", //Deprecated
54-
"WEAK_MESSAGE_DIGEST_MD5",
55-
"WEAK_MESSAGE_DIGEST_SHA1",
56-
"CUSTOM_MESSAGE_DIGEST",
57-
"HAZELCAST_SYMMETRIC_ENCRYPTION",
58-
"NULL_CIPHER",
59-
"UNENCRYPTED_SOCKET",
60-
"DES_USAGE",
61-
"RSA_NO_PADDING",
62-
"RSA_KEY_SIZE",
63-
"BLOWFISH_KEY_SIZE",
64-
"STATIC_IV",
65-
"ECB_MODE",
66-
"PADDING_ORACLE",
67-
"CIPHER_INTEGRITY"
68-
]
69-
70-
majorBugsAuditOnly = [ //Mostly due to their high false-positive rate
71-
"TRUST_BOUNDARY_VIOLATION"
72-
]
73-
74-
//Important bugs but that have lower chance to get full compromise of system (see critical).
75-
majorBugs = [
76-
"PREDICTABLE_RANDOM",
77-
"PATH_TRAVERSAL_IN",
78-
"PATH_TRAVERSAL_OUT",
79-
"REDOS",
80-
"BAD_HEXA_CONVERSION",
81-
"HARD_CODE_PASSWORD",
82-
"HARD_CODE_KEY",
83-
"XSS_REQUEST_WRAPPER",
84-
"UNVALIDATED_REDIRECT",
85-
"ANDROID_EXTERNAL_FILE_ACCESS",
86-
"ANDROID_WORLD_WRITABLE",
87-
"INSECURE_COOKIE",
88-
"HTTPONLY_COOKIE",
89-
"TRUST_BOUNDARY_VIOLATION",
90-
"XSS_SERVLET",
91-
]
92-
93-
criticalBugs = [ //RCE or powerful function
94-
"COMMAND_INJECTION",
95-
"XXE_SAXPARSER",
96-
"XXE_XMLREADER",
97-
"XXE_DOCUMENT",
98-
"SQL_INJECTION_HIBERNATE",
99-
"SQL_INJECTION_JDO",
100-
"SQL_INJECTION_JPA",
101-
"LDAP_INJECTION",
102-
"XPATH_INJECTION",
103-
"XML_DECODER",
104-
"SCRIPT_ENGINE_INJECTION",
105-
"SPEL_INJECTION",
106-
"SQL_INJECTION_SPRING_JDBC",
107-
"SQL_INJECTION_JDBC",
108-
"EL_INJECTION",
109-
"SEAM_LOG_INJECTION",
110-
"OBJECT_DESERIALIZATION",
111-
"MALICIOUS_XSLT",
112-
"SPRING_CSRF_PROTECTION_DISABLED",
113-
"SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING"
114-
]
115-
116-
majorJspBugs = ["XSS_REQUEST_PARAMETER_TO_JSP_WRITER",
117-
"XSS_JSP_PRINT", "JSP_JSTL_OUT"]
118-
119-
//RCE from JSP specific functions (taglibs)
120-
criticalJspBugs = ["JSP_INCLUDE","JSP_SPRING_EVAL","JSP_XSLT"]
121-
122-
exclusions = ['CUSTOM_INJECTION']
123-
124-
deprecatedRules = ["XSS_REQUEST_PARAMETER_TO_JSP_WRITER"]
12510

12611
////////////// Generate rules files
12712

12813
def getSonarPriority(String type,String category, String description) {
129-
//FSB Specific
130-
if (type in criticalBugs || type in criticalJspBugs) return "CRITICAL";
131-
if (type in majorBugs || type in cryptoBugs || type in majorJspBugs) return "MAJOR";
132-
if (type in informationnalPatterns) return "INFO"
14+
String priority = FsbClassifier.getPriorityFromType(type);
15+
if(priority != null) return priority
13316

13417
//Findbugs critical base on the type or message
13518
if(type.contains("IMPOSSIBLE")) {
@@ -141,13 +24,17 @@ def getSonarPriority(String type,String category, String description) {
14124

14225
//Findbugs general
14326
if(category in ["CORRECTNESS", "PERFORMANCE", "SECURITY","MULTI-THREADING","BAD_PRACTICE"]) return "MAJOR";
144-
if(category in ["STYLE", "MALICIOUS_CODE", "I18N"]) return "INFO"
27+
if(category in ["STYLE", "MALICIOUS_CODE", "I18N","EXPERIMENTAL"]) return "INFO"
14528

14629
println("Unknown priority for "+type+" ("+category+")")
14730
return "INFO";
14831
}
14932

150-
//Plugin definition
33+
/**
34+
* Plugin definition.
35+
* Utility that read the messages and metadata from the plugin.
36+
* It expecting that the jars are already present on disk (See Grape annotation that fetch each dependency)
37+
*/
15138
class Plugin {
15239
String groupId = ""
15340
String artifactId = ""
@@ -191,7 +78,7 @@ String getFindBugsCategory(List<Plugin> plugins, String bugType) {
19178
return "EXPERIMENTAL"
19279
}
19380

194-
FB = new Plugin(groupId: 'com.github.spotbugs', artifactId: 'spotbugs', version: '3.1.0-RC1')
81+
FB = new Plugin(groupId: 'com.github.spotbugs', artifactId: 'spotbugs', version: '3.1.0-RC2')
19582
CONTRIB = new Plugin(groupId: 'com.mebigfatguy.fb-contrib', artifactId: 'fb-contrib', version: '7.0.0')
19683
FSB = new Plugin(groupId: 'com.h3xstream.findsecbugs', artifactId: 'findsecbugs-plugin', version: '1.6.0')
19784

@@ -221,10 +108,8 @@ def writeRules(String rulesSetName,List<Plugin> plugins,List<String> includedBug
221108
if(category == "NOISE" || pattern.attribute("type") in ["TESTING", "TESTING1", "TESTING2", "TESTING3", "UNKNOWN"]) return;
222109
if(category == "MT_CORRECTNESS") category = "MULTI-THREADING"
223110

224-
//if(rulesSetName == 'jsp') println pattern.attribute("type")
225111

226112
if((includedBugs.isEmpty() || includedBugs.contains(pattern.attribute("type"))) && !excludedBugs.contains(pattern.attribute("type"))) {
227-
//if(rulesSetName == 'jsp') println "-INCLUDED"
228113

229114
rule(key: pattern.attribute("type"),
230115
priority: getSonarPriority(pattern.attribute("type"),category,pattern.Details.text())) {
@@ -287,14 +172,10 @@ def writeRules(String rulesSetName,List<Plugin> plugins,List<String> includedBug
287172
//Category related
288173
tag(category.toLowerCase().replace("_","-"))
289174

290-
291175
if(category in ['PERFORMANCE','CORRECTNESS','MULTI-THREADING']) {
292176
tag("bug")
293177
}
294178

295-
if(deprecatedRules.contains(pattern.attribute("type"))) {
296-
status("DEPRECATED")
297-
}
298179
}
299180
//name: pattern.ShortDescription.text(),
300181
// 'description': pattern.Details.text(),
@@ -326,7 +207,7 @@ def writeProfile(String profileName,List<String> includedBugs,List<String> exclu
326207
File f = new File("out_sonar","profile-"+profileName+".xml")
327208
printf("Building profile %s (%s)%n",profileName,f.getCanonicalPath())
328209

329-
210+
def countBugs=0;
330211

331212
def xml = new MarkupBuilder(new PrintWriter(f))
332213
xml.FindBugsFilter {
@@ -338,11 +219,15 @@ def writeProfile(String profileName,List<String> includedBugs,List<String> exclu
338219
if(!excludedBugs.contains(patternName)) {
339220
Match {
340221
Bug(pattern: patternName)
222+
223+
countBugs++
341224
}
342225
}
343226
}
344227

345228
}
229+
230+
return countBugs
346231
}
347232

348233

@@ -363,9 +248,11 @@ def getAllPatternsFromPlugin(Plugin plugin) {
363248
return patterns;
364249
}
365250

366-
251+
totalCount = 0
367252
writeProfile("findbugs-only", getAllPatternsFromPlugin(FB), excludedJspRules);
368-
writeProfile("findbugs-and-fb-contrib", getAllPatternsFromPlugin(FB) + getAllPatternsFromPlugin(CONTRIB), excludedJspRules);
369-
writeProfile("findbugs-security-audit", informationnalPatterns + cryptoBugs + majorBugs + majorBugsAuditOnly + criticalBugs + findBugsPatterns)
253+
totalCount += writeProfile("findbugs-and-fb-contrib", getAllPatternsFromPlugin(FB) + getAllPatternsFromPlugin(CONTRIB), excludedJspRules);
254+
totalCount += writeProfile("findbugs-security-audit", informationnalPatterns + cryptoBugs + majorBugs + majorBugsAuditOnly + criticalBugs + findBugsPatterns)
370255
writeProfile("findbugs-security-minimal", cryptoBugs + majorBugs + criticalBugs + findBugsPatterns)
371-
writeProfile("findbugs-security-jsp", majorJspBugs + criticalJspBugs)
256+
totalCount += writeProfile("findbugs-security-jsp", majorJspBugs + criticalJspBugs)
257+
258+
println "Total bugs patterns "+totalCount

‎generate_profiles/FsbClassifier.groovy

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
import groovy.transform.Field
2+
3+
class FsbClassifier {
4+
5+
//Includes all the bugs that are bundle with FindBugs by default
6+
7+
static findBugsPatterns = ["XSS_REQUEST_PARAMETER_TO_SEND_ERROR",
8+
"XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER",
9+
"HRS_REQUEST_PARAMETER_TO_HTTP_HEADER",
10+
"HRS_REQUEST_PARAMETER_TO_COOKIE",
11+
"DMI_CONSTANT_DB_PASSWORD",
12+
"DMI_EMPTY_DB_PASSWORD",
13+
"SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE",
14+
"SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING"
15+
]
16+
17+
//Informational stuff that will interest Security Reviewer but will annoys the developers.
18+
static informationnalPatterns = ["SERVLET_PARAMETER",
19+
"SERVLET_CONTENT_TYPE",
20+
"SERVLET_SERVER_NAME",
21+
"SERVLET_SESSION_ID",
22+
"SERVLET_QUERY_STRING",
23+
"SERVLET_HEADER",
24+
"SERVLET_HEADER_REFERER",
25+
"SERVLET_HEADER_USER_AGENT",
26+
"COOKIE_USAGE",
27+
"WEAK_FILENAMEUTILS",
28+
"JAXWS_ENDPOINT",
29+
"JAXRS_ENDPOINT",
30+
"TAPESTRY_ENDPOINT",
31+
"WICKET_ENDPOINT",
32+
"FILE_UPLOAD_FILENAME",
33+
"STRUTS1_ENDPOINT",
34+
"STRUTS2_ENDPOINT",
35+
"SPRING_ENDPOINT",
36+
"HTTP_RESPONSE_SPLITTING",
37+
"CRLF_INJECTION_LOGS",
38+
"EXTERNAL_CONFIG_CONTROL",
39+
"STRUTS_FORM_VALIDATION",
40+
"ESAPI_ENCRYPTOR",
41+
"ANDROID_BROADCAST",
42+
"ANDROID_GEOLOCATION",
43+
"ANDROID_WEB_VIEW_JAVASCRIPT",
44+
"ANDROID_WEB_VIEW_JAVASCRIPT_INTERFACE"]
45+
46+
//All the cryptography related bugs. Usually with issues related to confidentiality or integrity of data in transit.
47+
static cryptoBugs = [
48+
"WEAK_TRUST_MANAGER",
49+
"WEAK_HOSTNAME_VERIFIER",
50+
//"WEAK_MESSAGE_DIGEST", //Deprecated
51+
"WEAK_MESSAGE_DIGEST_MD5",
52+
"WEAK_MESSAGE_DIGEST_SHA1",
53+
"CUSTOM_MESSAGE_DIGEST",
54+
"HAZELCAST_SYMMETRIC_ENCRYPTION",
55+
"NULL_CIPHER",
56+
"UNENCRYPTED_SOCKET",
57+
"DES_USAGE",
58+
"RSA_NO_PADDING",
59+
"RSA_KEY_SIZE",
60+
"BLOWFISH_KEY_SIZE",
61+
"STATIC_IV",
62+
"ECB_MODE",
63+
"PADDING_ORACLE",
64+
"CIPHER_INTEGRITY"
65+
]
66+
67+
static majorBugsAuditOnly = [ //Mostly due to their high false-positive rate
68+
"TRUST_BOUNDARY_VIOLATION"
69+
]
70+
71+
//Important bugs but that have lower chance to get full compromise of system (see critical).
72+
static majorBugs = [
73+
"PREDICTABLE_RANDOM",
74+
"PATH_TRAVERSAL_IN",
75+
"PATH_TRAVERSAL_OUT",
76+
"REDOS",
77+
"BAD_HEXA_CONVERSION",
78+
"HARD_CODE_PASSWORD",
79+
"HARD_CODE_KEY",
80+
"XSS_REQUEST_WRAPPER",
81+
"UNVALIDATED_REDIRECT",
82+
"ANDROID_EXTERNAL_FILE_ACCESS",
83+
"ANDROID_WORLD_WRITABLE",
84+
"INSECURE_COOKIE",
85+
"HTTPONLY_COOKIE",
86+
"TRUST_BOUNDARY_VIOLATION",
87+
"XSS_SERVLET",
88+
"SPRING_CSRF_PROTECTION_DISABLED",
89+
"SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING"
90+
]
91+
92+
static criticalBugs = [ //RCE or powerful function
93+
"COMMAND_INJECTION",
94+
"XXE_SAXPARSER",
95+
"XXE_XMLREADER",
96+
"XXE_DOCUMENT",
97+
"SQL_INJECTION_HIBERNATE",
98+
"SQL_INJECTION_JDO",
99+
"SQL_INJECTION_JPA",
100+
"LDAP_INJECTION",
101+
"XPATH_INJECTION",
102+
"XML_DECODER",
103+
"SCRIPT_ENGINE_INJECTION",
104+
"SPEL_INJECTION",
105+
"SQL_INJECTION_SPRING_JDBC",
106+
"SQL_INJECTION_JDBC",
107+
"EL_INJECTION",
108+
"SEAM_LOG_INJECTION",
109+
"OBJECT_DESERIALIZATION",
110+
"MALICIOUS_XSLT"
111+
]
112+
113+
static majorJspBugs = ["XSS_REQUEST_PARAMETER_TO_JSP_WRITER",
114+
"XSS_JSP_PRINT", "JSP_JSTL_OUT"]
115+
116+
static //RCE from JSP specific functions (taglibs)
117+
criticalJspBugs = ["JSP_INCLUDE","JSP_SPRING_EVAL","JSP_XSLT"]
118+
119+
static exclusions = ['CUSTOM_INJECTION']
120+
121+
static deprecatedRules = []
122+
123+
static String getPriorityFromType(String type) {
124+
//FSB Specific
125+
if (type in criticalBugs || type in criticalJspBugs) return "CRITICAL";
126+
if (type in majorBugs || type in cryptoBugs || type in majorJspBugs) return "MAJOR";
127+
if (type in informationnalPatterns) return "INFO"
128+
129+
//println("Unknown priority for "+type)
130+
return null
131+
}
132+
133+
}

0 commit comments

Comments
 (0)