hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 23:35:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

update test files

Browse Source
This commit is contained in:
am0o0
2024-05-12 18:21:17 +02:00
parent be03e582c6
commit 484923e706
3 changed files with 60 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/CommonsCompressHandler.java
View File

@@ -42,7 +42,7 @@ public class CommonsCompressHandler {
new org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream(in)) {
File f = new File("tmpfile");
try (OutputStream o = Files.newOutputStream(f.toPath())) {
IOUtils.copy(gzIn2, o);
IOUtils.copy(gzIn2, o); // BAD
}
} catch (IOException e) {
throw new RuntimeException(e);
@@ -63,7 +63,7 @@ public class CommonsCompressHandler {
}
File f = new File("tmpfile");
try (OutputStream o = Files.newOutputStream(f.toPath())) {
IOUtils.copy(zipInputStream, o);
IOUtils.copy(zipInputStream, o); // BAD
}
}
} catch (IOException e) {
@@ -83,7 +83,7 @@ public class CommonsCompressHandler {
File f = new File("tmpfile");
try (OutputStream outputStream = new FileOutputStream(f)) {
int readLen;
while ((readLen = zipInputStream.read(readBuffer)) != -1) {
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // BAD
outputStream.write(readBuffer, 0, readLen);
}
}
@@ -106,7 +106,7 @@ public class CommonsCompressHandler {
File f = new File("tmpfile");
try (OutputStream outputStream = new FileOutputStream(f)) {
int readLen;
while ((readLen = zipInputStream.read(readBuffer)) != -1) {
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // BAD
outputStream.write(readBuffer, 0, readLen);
}
}
@@ -121,7 +121,7 @@ public class CommonsCompressHandler {
int buffersize = 4096;
final byte[] buffer = new byte[buffersize];
int n = 0;
while (-1 != (n = in.read(buffer))) {
while (-1 != (n = in.read(buffer))) { // BAD
out.write(buffer, 0, n);
}
out.close();

99
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/HelloServlet.java
View File

@@ -2,6 +2,7 @@ package com.Bombs;
import org.apache.commons.compress.archivers.ArchiveException;
import org.apache.commons.compress.compressors.CompressorException;
import org.apache.commons.io.IOUtils;
import static com.Bombs.CommonsCompressHandler.*;
import static com.Bombs.SnappyHandler.*;
@@ -21,57 +22,63 @@ import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.Part;
@WebServlet(
name = "helloServlet",
urlPatterns = {"/hello-servlet"})
name = "helloServlet",
urlPatterns = {"/hello-servlet"})
@MultipartConfig()
public class HelloServlet extends HttpServlet {
public void init() {}
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws IOException, ServletException {
response.setContentType("text/html");
Part remoteFile = request.getPart("zipFile");
// Zip
ZipInputStreamSafe2(remoteFile.getInputStream());
ZipInputStreamSafe(request.getPart("zipFile").getInputStream());
ZipInputStreamUnsafe(remoteFile.getInputStream());
GZipInputStreamUnsafe(request.getPart("zipFile").getInputStream());
InflaterInputStreamUnsafe(request.getPart("zipFile").getInputStream());
try {
InflaterUnsafe(request.getParameter("data").getBytes(StandardCharsets.UTF_8));
} catch (DataFormatException e) {
throw new RuntimeException(e);
}
try {
ZipFile1(request.getParameter("zipFileName"));
} catch (DataFormatException e) {
throw new RuntimeException(e);
public void init() {
}
// Zip4j
zip4jZipInputStream(remoteFile.getInputStream());
zip4jZipInputStreamSafe(remoteFile.getInputStream());
// SnappyZip
SnappyZipInputStream(remoteFile.getInputStream());
// apache Commons
commonsCompressArchiveInputStream2(remoteFile.getInputStream());
commonsCompressorInputStream(remoteFile.getInputStream());
try {
commonsCompressArchiveInputStream(remoteFile.getInputStream());
commonsCompressArchiveStreamFactory(remoteFile.getInputStream());
} catch (ArchiveException e) {
throw new RuntimeException(e);
}
try {
commonsCompressCompressorStreamFactory(remoteFile.getInputStream());
} catch (CompressorException e) {
throw new RuntimeException(e);
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws IOException, ServletException {
response.setContentType("text/html");
Part remoteFile = request.getPart("zipFile");
// Zip
ZipInputStreamSafe2(remoteFile.getInputStream());
ZipInputStreamSafe(request.getPart("zipFile").getInputStream());
ZipInputStreamUnsafe(remoteFile.getInputStream());
GZipInputStreamUnsafe(request.getPart("zipFile").getInputStream());
InflaterInputStreamUnsafe(request.getPart("zipFile").getInputStream());
try {
InflaterUnsafe(request.getParameter("data").getBytes(StandardCharsets.UTF_8));
} catch (DataFormatException e) {
throw new RuntimeException(e);
}
try {
ZipFile1(request.getParameter("zipFileName"));
} catch (DataFormatException e) {
throw new RuntimeException(e);
}
// Zip4j
zip4jZipInputStream(remoteFile.getInputStream());
zip4jZipInputStreamSafe(remoteFile.getInputStream());
// SnappyZip
SnappyZipInputStream(remoteFile.getInputStream());
// apache Commons
commonsCompressArchiveInputStream2(remoteFile.getInputStream());
commonsCompressorInputStream(remoteFile.getInputStream());
try {
commonsCompressArchiveInputStream(remoteFile.getInputStream());
commonsCompressArchiveStreamFactory(remoteFile.getInputStream());
} catch (ArchiveException e) {
throw new RuntimeException(e);
}
try {
commonsCompressCompressorStreamFactory(remoteFile.getInputStream());
} catch (CompressorException e) {
throw new RuntimeException(e);
}
// FP
String xmlResult = IOUtils.toString(request.getInputStream(), request.getCharacterEncoding());
byte[] inputStreamResult = request.getInputStream().readAllBytes();
PrintWriter out = response.getWriter();
out.println("<html><body>end</body></html>");
}
PrintWriter out = response.getWriter();
out.println("<html><body>end</body></html>");
}
public void destroy() {}
public void destroy() {
}
}

4
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/ZipHandler.java
View File

@@ -162,10 +162,10 @@ public class ZipHandler {
try (InputStream inputStream = zipFile.getInputStream(entry);
FileOutputStream outputStream = new FileOutputStream(destPath); ) {
int data = inputStream.read();
int data = inputStream.read(); // BAD
while (data != -1) {
outputStream.write(data);
data = inputStream.read();
data = inputStream.read(); // BAD
}
}
System.out.println("file : " + entry.getName() + " => " + destPath);