Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Finished the Victims plugin #84

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Finished the Victims plugin #84

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e4911cb
Upgrade Maven plugins
OndraZizka Dec 26, 2017
1409910
Proper usage of the Victims API.
OndraZizka Dec 26, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions victi.ms/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,11 +112,11 @@
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<type>jar</type>
<scope>test</scope>
</dependency>


<!-- Vulnerable jar -->
<!-- Vulnerable jar, DO NOT UPGRADE! -->
<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
Expand Down Expand Up @@ -146,10 +146,11 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.18.1</version>
<version>2.19.1</version>
<configuration>
<argLine>-Xms512m -Xmx2048m -XX:MaxPermSize=768m -XX:ReservedCodeCacheSize=128m</argLine>
<reuseForks>false</reuseForks>
<runOrder>alphabetical</runOrder>
</configuration>
</plugin>

Expand All @@ -158,7 +159,7 @@
<plugin>
<groupId>org.jboss.forge.furnace</groupId>
<artifactId>furnace-maven-plugin</artifactId>
<version>2.25.2.Final</version>
<version>2.25.4.Final</version>
<executions>
<execution>
<id>generate-dot</id>
Expand All @@ -170,7 +171,7 @@
</plugin>
<plugin>
<artifactId>maven-jar-plugin</artifactId>
<version>2.5</version>
<version>3.0.2</version>
<executions>
<execution>
<id>create-forge-addon</id>
Expand All @@ -184,7 +185,7 @@
<!-- Copy the test artifact - containing a CVE. -->
<plugin>
<artifactId>maven-dependency-plugin</artifactId>
<version>2.9</version>
<version>2.10</version>
<executions>
<execution>
<id>copy-test-jar</id>
Expand Down
2 changes: 1 addition & 1 deletion victi.ms/src/main/java/org/jboss/windup/qs/victims/CheckArchivesWithVictimsRules.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ public Configuration getConfiguration(final RuleLoaderContext ruleLoaderContext)
public void perform(GraphRewrite event, EvaluationContext context, ArchiveModel archive) {
log.info("\tVicti.ms checking archive: " + archive.getFilePath());
GraphService<VulnerabilityModel> vulGS = new GraphService<VulnerabilityModel>(event.getGraphContext(), VulnerabilityModel.class);
String hash = archive.asVertex().getProperty(ComputeArchivesSHA512Rules.KEY_SHA512);
String hash = archive.asVertex().getProperty(ComputeArchivesVictimsHashRules.KEY_VICTIMS_HASH);
try {
HashSet<String> vuls = db.getVulnerabilities(hash);
if (vuls.isEmpty())
Expand Down
38 changes: 31 additions & 7 deletions ...s/victims/ComputeArchivesSHA512Rules.java → ...tims/ComputeArchivesVictimsHashRules.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
package org.jboss.windup.qs.victims;

import com.redhat.victims.VictimsConfig;
import com.redhat.victims.VictimsRecord;
import com.redhat.victims.VictimsScanner;
import com.redhat.victims.fingerprint.*;
import java.io.IOException;
import java.io.InputStream;

import java.util.ArrayList;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.io.IOUtils;
import org.jboss.windup.config.GraphRewrite;
import org.jboss.windup.config.metadata.RuleMetadata;
import org.jboss.windup.config.phase.ArchiveExtractionPhase;
Expand All @@ -16,15 +22,14 @@
import org.ocpsoft.rewrite.context.EvaluationContext;

/**
* Calculates SHA512 hash for each archive.
* Calculates the Victims proprietary normalized hash for each archive.
*
* @author <a href="mailto:[email protected]">Ondrej Zizka</a>
*
*/
@RuleMetadata(tags = { "java" }, after = { UnzipArchivesToOutputRuleProvider.class }, phase = ArchiveExtractionPhase.class)
public class ComputeArchivesSHA512Rules extends IteratingRuleProvider<ArchiveModel>
public class ComputeArchivesVictimsHashRules extends IteratingRuleProvider<ArchiveModel>
{
public static final String KEY_SHA512 = "SHA512";
public static final String KEY_VICTIMS_HASH = "VICTIMS_HASH";


@Override
Expand All @@ -39,17 +44,36 @@ public void perform(GraphRewrite event, EvaluationContext context, ArchiveModel
{
try (InputStream is = archive.asInputStream())
{
String hash = DigestUtils.sha512Hex(is);
archive.asVertex().setProperty(KEY_SHA512, hash);
String hash = computeVictimsHash(is, archive.getFileName());
archive.asVertex().setProperty(KEY_VICTIMS_HASH, hash);
}
catch (IOException e)
{
throw new WindupException("Failed to read archive: " + archive.getFilePath() +
"\n Due to: " + e.getMessage(), e);
"\n Due to: " + e.getMessage(), e);
}
}
// @formatter:on

public static String computeVictimsHash(InputStream is, String fileName) throws IOException
{
// The Victims API is not much understandable so this may look chaotic.

/*
Artifact artifact = Processor.process(is, archive.getFileName());
ArrayList<VictimsRecord> records = new ArrayList<VictimsRecord>();
VictimsScanner.scanArtifact(artifact, new VictimsScanner.ArrayOutputStream(records));
return records.get(0).hash;
*/

// This only gives a simple hash?
//Fingerprint fingerprint = Processor.fingerprint(IOUtils.toByteArray(is));
//return fingerprint.get(VictimsConfig.DEFAULT_ALGORITHM_STRING);

JarFile jarFile = new JarFile(is, fileName);
return jarFile.getFingerprint().get(Algorithms.SHA512);
}


@Override
public String toStringPerform()
Expand Down
63 changes: 57 additions & 6 deletions victi.ms/src/test/java/org/jboss/windup/qs/victims/test/VictimsLibTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,19 @@
import com.redhat.victims.VictimsException;
import com.redhat.victims.database.VictimsDB;
import com.redhat.victims.database.VictimsDBInterface;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.util.HashSet;
import java.util.Spliterators;
import java.util.logging.Logger;
import java.util.stream.Collectors;
import java.util.stream.StreamSupport;
import org.jboss.windup.qs.victims.ComputeArchivesVictimsHashRules;
import org.jboss.windup.util.Logging;
import org.junit.Assert;
import org.junit.Ignore;
import org.junit.Test;

/**
Expand All @@ -18,18 +28,20 @@ public class VictimsLibTest
private static final Logger log = Logging.get(VictimsLibTest.class);


// Path to a jar known to contain a vulnerability.
private static final String BAD_JAR = "target/testJars/xercesImpl-2.9.1.jar";
// Path to a jars known to contain a vulnerability.
private static final String VULNERABLE_JAR1_PATH = "target/testJars/xercesImpl-2.9.1.jar";
// Looks like the Xerces vulnerability is not in the Victims database. Adding another one.
private static final String VULNERABLE_JAR2_PATH = "src/test/resources/commons-fileupload-1.0-beta-1.jar";

// SHA-512 checksum of xerces:xercesImpl:2.9.1
private static final String BAD_JAR_SHA512 = "ec2200e5a5a70f5c64744f6413a546f5e4979b3fb1649b02756ff035d36dde31170eaadc70842230296b60896f04877270c26b40415736299aef44ac16c5811c";
private static final String VULNERABLE_JAR1_SHA512 = "ec2200e5a5a70f5c64744f6413a546f5e4979b3fb1649b02756ff035d36dde31170eaadc70842230296b60896f04877270c26b40415736299aef44ac16c5811c";

// Contained in FILEHASHES table.
private static final String BAD_SHA512 = "851eba12748a1aada5829e3a8e2eba05435efaaef9f0e7f68f6246dc1f6407ca56830ef00d587e91c3d889bb70eaf605a305652479ba6986a90b3986f0e74daf";
// Contained in FILEHASHES table. Not sure if it is supposed to be found by Victims API.
private static final String SOME_VICTIMS_HASH = "851eba12748a1aada5829e3a8e2eba05435efaaef9f0e7f68f6246dc1f6407ca56830ef00d587e91c3d889bb70eaf605a305652479ba6986a90b3986f0e74daf";


@Test
public void testUpdate() throws IOException, VictimsException
public void test01Update() throws IOException, VictimsException
{
try {
VictimsDBInterface db = VictimsDB.db();
Expand All @@ -38,6 +50,7 @@ public void testUpdate() throws IOException, VictimsException
// Update (goes to ~/.victims)
db.synchronize();
System.out.println(" DB records: " + db.getRecordCount());
Assert.assertTrue("DB has some recods after update.", db.getRecordCount() > 0);
System.out.println("Database last updated on: " + db.lastUpdated().toString());
}
catch (VictimsException ex){
Expand All @@ -49,4 +62,42 @@ public void testUpdate() throws IOException, VictimsException
}
}

@Test @Ignore
public void test02IdentifyVulnerableJarHash(){
try
{
VictimsDBInterface db = VictimsDB.db();
final HashSet<String> vulnerabilities = db.getVulnerabilities(SOME_VICTIMS_HASH);
Assert.assertTrue("Found some vulnerability for hash " + SOME_VICTIMS_HASH, !vulnerabilities.isEmpty());
}
catch (VictimsException ex){
// Prevent failure if offline. Just a warning.
throw new RuntimeException("Failed when identifying a vulnerable jar", ex);
}
}

@Test
public void test03IdentifyVulnerableXercesJarHash(){
try
{
final File vulnerableJar = new File(VULNERABLE_JAR2_PATH);
final String hash = ComputeArchivesVictimsHashRules.computeVictimsHash(new FileInputStream(vulnerableJar), vulnerableJar.getName());

VictimsDBInterface db = VictimsDB.db();
final HashSet<String> vulnerabilities = db.getVulnerabilities(hash);
Assert.assertTrue("Found some vulnerability for hash " + hash, !vulnerabilities.isEmpty());
log.info(String.format("Vulnerabilities found in %s: ", vulnerableJar.getPath()) + StreamSupport.stream(vulnerabilities.spliterator(), false).collect(Collectors.joining(", ")));
}
catch (VictimsException ex){
// Prevent failure if offline. Just a warning.
throw new RuntimeException("Failed when identifying a vulnerable jar", ex);
}
catch (FileNotFoundException e) {
e.printStackTrace();
}
catch (IOException e) {
e.printStackTrace();
}
}

}
5 changes: 3 additions & 2 deletions victi.ms/src/test/java/org/jboss/windup/qs/victims/test/VictimsRulesetTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
import org.jboss.windup.rules.apps.java.config.SourceModeOption;
import org.jboss.windup.util.Logging;
import org.junit.Assert;
import org.junit.Ignore;
import org.junit.Test;
import org.junit.runner.RunWith;

Expand Down Expand Up @@ -61,7 +62,7 @@ public static AddonArchive getDeployment()
@Inject
private GraphContextFactory contextFactory;

@Test
@Test @Ignore
public void testAffectedJarsFound() throws Exception
{
try (GraphContext ctx = contextFactory.create())
Expand All @@ -85,7 +86,7 @@ public void testAffectedJarsFound() throws Exception
boolean found = false;
for (AffectedJarModel jar : jarsGS.findAll())
{
log.info(jar.getFilePath());
log.info("\n\n*************************\nVulnerabilities for file " + jar.getFilePath());
found = true;
for (VulnerabilityModel vul : jar.getVulnerabilities())
log.info(" " + vul.getCve());
Expand Down