hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Adapt InsecureBasicAuth to the previous commit

Browse Source
This commit is contained in:
Tony Torralba
2021-09-15 17:16:37 +02:00
parent 2e08c5dd2b
commit 5ed9949498
4 changed files with 196 additions and 327 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
java/ql/lib/semmle/code/java/security/InsecureBasicAuth.qll Normal file
View File

@@ -0,0 +1,45 @@
/** Provides classes and predicates to reason about Insecure Basic Authentication vulnerabilities. */
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.HttpsUrls
/**
* A source that represents HTTP URLs.
* Extend this class to add your own Insecure Basic Authentication sources.
*/
abstract class InsecureBasicAuthSource extends DataFlow::Node { }
/** A default source representing HTTP strings, URLs or URIs. */
private class DefaultInsecureBasicAuthSource extends InsecureBasicAuthSource {
DefaultInsecureBasicAuthSource() { this.asExpr() instanceof HttpStringLiteral }
}
/**
* A sink that represents a method that sets Basic Authentication.
* Extend this class to add your own Insecure Basic Authentication sinks.
*/
abstract class InsecureBasicAuthSink extends DataFlow::Node { }
/** A default sink representing methods that set an Authorization header. */
private class DefaultInsecureBasicAuthSink extends InsecureBasicAuthSink {
DefaultInsecureBasicAuthSink() {
exists(MethodAccess ma |
ma.getMethod().hasName("addHeader") or
ma.getMethod().hasName("setHeader") or
ma.getMethod().hasName("setRequestProperty")
|
this.asExpr() = ma.getQualifier() and
ma.getArgument(0).(CompileTimeConstantExpr).getStringValue() = "Authorization" and
TaintTracking::localExprTaint(any(BasicAuthString b), ma.getArgument(1))
)
}
}
/**
* String pattern of basic authentication.
*/
private class BasicAuthString extends StringLiteral {
BasicAuthString() { exists(string s | this.getRepresentedString() = s | s.matches("Basic %")) }
}

3
java/ql/src/semmle/code/java/security/InsecureBasicAuthQuery.qll → java/ql/lib/semmle/code/java/security/InsecureBasicAuthQuery.qll
View File

@@ -1,6 +1,7 @@
/** Provides taint tracking configurations to be used in Insecure Basic Authentication queries. */ /** Provides taint tracking configurations to be used in Insecure Basic Authentication queries. */
import java import java
import semmle.code.java.security.HttpsUrls
import semmle.code.java.security.InsecureBasicAuth import semmle.code.java.security.InsecureBasicAuth
import semmle.code.java.dataflow.TaintTracking import semmle.code.java.dataflow.TaintTracking
@@ -16,6 +17,6 @@ class BasicAuthFlowConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink instanceof InsecureBasicAuthSink } override predicate isSink(DataFlow::Node sink) { sink instanceof InsecureBasicAuthSink }
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
any(InsecureBasicAuthAdditionalTaintStep c).step(node1, node2) any(HttpUrlsAdditionalTaintStep c).step(node1, node2)
} }
} }

259
java/ql/src/semmle/code/java/security/InsecureBasicAuth.qll
View File

@@ -1,259 +0,0 @@
/** Provides classes and predicates to reason about Insecure Basic Authentication vulnerabilities. */
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.ExternalFlow
import semmle.code.java.frameworks.Networking
import semmle.code.java.frameworks.ApacheHttp
/**
* A source that represents HTTP URLs.
* Extend this class to add your own Insecure Basic Authentication sources.
*/
abstract class InsecureBasicAuthSource extends DataFlow::Node { }
/** A default source representing HTTP strings, URLs or URIs. */
private class DefaultInsecureBasicAuthSource extends InsecureBasicAuthSource {
DefaultInsecureBasicAuthSource() {
this.asExpr() instanceof HttpString
or
exists(URLConstructor uc |
uc.hasHttpStringArg() and
this.asExpr() = uc.getArgument(0)
)
or
exists(URIConstructor uc |
uc.hasHttpStringArg() and
this.asExpr() = uc.getArgument(0)
)
}
}
/**
* A sink that represents a method that sets Basic Authentication.
* Extend this class to add your own Insecure Basic Authentication sinks.
*/
abstract class InsecureBasicAuthSink extends DataFlow::Node { }
/** A default sink representing methods that set an Authorization header. */
private class DefaultInsecureBasicAuthSink extends InsecureBasicAuthSink {
DefaultInsecureBasicAuthSink() {
exists(MethodAccess ma |
ma.getMethod().hasName("addHeader") or
ma.getMethod().hasName("setHeader") or
ma.getMethod().hasName("setRequestProperty")
|
this.asExpr() = ma.getQualifier() and
ma.getArgument(0).(CompileTimeConstantExpr).getStringValue() = "Authorization" and
builtFromBasicAuthStringConcat(ma.getArgument(1))
)
}
}
/**
* A unit class for adding additional taint steps.
*
* Extend this class to add additional taint steps that should apply to the `BasicAuthFlowConfig`.
*/
class InsecureBasicAuthAdditionalTaintStep extends Unit {
/**
* Holds if the step from `node1` to `node2` should be considered a taint
* step for the `BasicAuthFlowConfig` configuration.
*/
abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);
}
/** A set of additional taint steps to consider when taint tracking LDAP related data flows. */
private class DefaultInsecureBasicAuthAdditionalTaintStep extends InsecureBasicAuthAdditionalTaintStep {
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
apacheHttpRequestStep(n1, n2) or
createUriStep(n1, n2) or
basicRequestLineStep(n1, n2) or
createUrlStep(n1, n2) or
urlOpenStep(n1, n2)
}
}
/**
* Class of Java URL constructor.
*/
private class URLConstructor extends ClassInstanceExpr {
URLConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUrl }
predicate hasHttpStringArg() {
this.getConstructor().getParameter(0).getType() instanceof TypeString and
(
// URLs constructed with any of the three string constructors below:
// `URL(String protocol, String host, int port, String file)`,
// `URL(String protocol, String host, int port, String file, URLStreamHandler handler)`,
// `URL(String protocol, String host, String file)`
this.getConstructor().getNumberOfParameters() > 1 and
concatHttpString(this.getArgument(0), this.getArgument(1)) // First argument contains the protocol part and the second argument contains the host part.
or
// URLs constructed with the string constructor `URL(String spec)`
this.getConstructor().getNumberOfParameters() = 1 and
this.getArgument(0) instanceof HttpString // First argument contains the whole spec.
)
}
}
/**
* Class of Java URI constructor.
*/
private class URIConstructor extends ClassInstanceExpr {
URIConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUri }
predicate hasHttpStringArg() {
(
this.getNumArgument() = 1 and
this.getArgument(0) instanceof HttpString // `URI(String str)`
or
this.getNumArgument() = 4 and
concatHttpString(this.getArgument(0), this.getArgument(1)) // `URI(String scheme, String host, String path, String fragment)`
or
this.getNumArgument() = 5 and
concatHttpString(this.getArgument(0), this.getArgument(1)) // `URI(String scheme, String authority, String path, String query, String fragment)` without user-info in authority
or
this.getNumArgument() = 7 and
concatHttpString(this.getArgument(0), this.getArgument(2)) // `URI(String scheme, String userInfo, String host, int port, String path, String query, String fragment)`
)
}
}
/**
* String of HTTP URLs not in private domains.
*/
private class HttpStringLiteral extends StringLiteral {
HttpStringLiteral() {
// Match URLs with the HTTP protocol and without private IP addresses to reduce false positives.
exists(string s | this.getRepresentedString() = s |
s.regexpMatch("(?i)http://[\\[a-zA-Z0-9].*") and
not s.substring(7, s.length()) instanceof PrivateHostName
)
}
}
/**
* Checks both parts of protocol and host.
*/
private predicate concatHttpString(Expr protocol, Expr host) {
(
protocol.(CompileTimeConstantExpr).getStringValue().regexpMatch("(?i)http(://)?") or
protocol
.(VarAccess)
.getVariable()
.getAnAssignedValue()
.(CompileTimeConstantExpr)
.getStringValue()
.regexpMatch("(?i)http(://)?")
) and
not exists(string hostString |
hostString = host.(CompileTimeConstantExpr).getStringValue() or
hostString =
host.(VarAccess).getVariable().getAnAssignedValue().(CompileTimeConstantExpr).getStringValue()
|
hostString.length() = 0 or // Empty host is loopback address
hostString instanceof PrivateHostName
)
}
/** Gets the leftmost operand in a concatenated string */
private Expr getLeftmostConcatOperand(Expr expr) {
if expr instanceof AddExpr
then result = getLeftmostConcatOperand(expr.(AddExpr).getLeftOperand())
else result = expr
}
/**
* String concatenated with `HttpStringLiteral`.
*/
private class HttpString extends Expr {
HttpString() {
this instanceof HttpStringLiteral
or
concatHttpString(this.(AddExpr).getLeftOperand(),
getLeftmostConcatOperand(this.(AddExpr).getRightOperand()))
}
}
/**
* String pattern of basic authentication.
*/
private class BasicAuthString extends StringLiteral {
BasicAuthString() { exists(string s | this.getRepresentedString() = s | s.matches("Basic %")) }
}
/**
* String concatenated with `BasicAuthString`.
*/
private predicate builtFromBasicAuthStringConcat(Expr expr) {
expr instanceof BasicAuthString
or
builtFromBasicAuthStringConcat(expr.(AddExpr).getLeftOperand())
or
exists(Expr other | builtFromBasicAuthStringConcat(other) |
exists(Variable var | var.getAnAssignedValue() = other and var.getAnAccess() = expr)
)
}
/** The `openConnection` method of Java URL. Not to include `openStream` since it won't be used in this query. */
private class HttpURLOpenMethod extends Method {
HttpURLOpenMethod() {
this.getDeclaringType() instanceof TypeUrl and
this.getName() = "openConnection"
}
}
/** Constructor of `ApacheHttpRequest` */
private predicate apacheHttpRequestStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(ConstructorCall cc |
cc.getConstructedType() instanceof ApacheHttpRequest and
node2.asExpr() = cc and
cc.getAnArgument() = node1.asExpr()
)
}
/** `URI` methods */
private predicate createUriStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(
URIConstructor cc // new URI
|
node2.asExpr() = cc and
cc.getArgument(0) = node1.asExpr()
)
or
exists(
StaticMethodAccess ma // URI.create
|
ma.getMethod().getDeclaringType() instanceof TypeUri and
ma.getMethod().hasName("create") and
node1.asExpr() = ma.getArgument(0) and
node2.asExpr() = ma
)
}
/** Constructors of `URL` */
private predicate createUrlStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(URLConstructor cc |
node2.asExpr() = cc and
cc.getArgument(0) = node1.asExpr()
)
}
/** Method call of `HttpURLOpenMethod` */
private predicate urlOpenStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(MethodAccess ma |
ma.getMethod() instanceof HttpURLOpenMethod and
node1.asExpr() = ma.getQualifier() and
ma = node2.asExpr()
)
}
/** Constructor of `BasicRequestLine` */
private predicate basicRequestLineStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(ConstructorCall mcc |
mcc.getConstructedType().hasQualifiedName("org.apache.http.message", "BasicRequestLine") and
mcc.getArgument(1) = node1.asExpr() and // BasicRequestLine(String method, String uri, ProtocolVersion version)
node2.asExpr() = mcc
)
}

216
java/ql/test/query-tests/security/CWE-522/InsecureBasicAuthTest.java
View File

@@ -10,6 +10,7 @@ import java.net.URL;
import java.net.HttpURLConnection; import java.net.HttpURLConnection;
import java.net.URLConnection; import java.net.URLConnection;
import java.util.Base64; import java.util.Base64;
import javax.net.ssl.HttpsURLConnection;
public class InsecureBasicAuthTest { public class InsecureBasicAuthTest {
/** /**
@@ -17,42 +18,64 @@ public class InsecureBasicAuthTest {
*/ */
public void testApacheHttpRequest(String username, String password) { public void testApacheHttpRequest(String username, String password) {
String host = "www.example.com"; String host = "www.example.com";
HttpRequestBase post = new HttpPost("http://" + host + "/rest/getuser.do?uid=abcdx");
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
String authString = username + ":" + password; String authString = username + ":" + password;
byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes()); byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes());
String authStringEnc = new String(authEncBytes); String authStringEnc = new String(authEncBytes);
{
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth HttpRequestBase post = new HttpPost("http://" + host + "/rest/getuser.do?uid=abcdx");
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth
}
{
HttpRequestBase post = new HttpPost("https://" + host + "/rest/getuser.do?uid=abcdx");
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // Safe
}
} }
/** /**
* Test basic authentication with Apache HTTP GET request. * Test basic authentication with Apache HTTP GET request.
*/ */
public void testApacheHttpRequest2(String url) throws java.io.IOException { public void testApacheHttpRequest2(String url) throws java.io.IOException {
String urlStr = "http://www.example.com:8000/payment/retrieve"; {
HttpGet get = new HttpGet(urlStr); String urlStr = "http://www.example.com:8000/payment/retrieve";
get.setHeader("Accept", "application/json"); HttpGet get = new HttpGet(urlStr);
get.setHeader("Authorization", // $hasInsecureBasicAuth get.setHeader("Accept", "application/json");
"Basic " + new String(Base64.getEncoder().encode("admin:test".getBytes()))); get.setHeader("Authorization", // $hasInsecureBasicAuth
"Basic " + new String(Base64.getEncoder().encode("admin:test".getBytes())));
}
{
String urlStr = "https://www.example.com:8000/payment/retrieve";
HttpGet get = new HttpGet(urlStr);
get.setHeader("Accept", "application/json");
get.setHeader("Authorization", // Safe
"Basic " + new String(Base64.getEncoder().encode("admin:test".getBytes())));
}
} }
/** /**
* Test basic authentication with Apache HTTP POST request using URI create method. * Test basic authentication with Apache HTTP POST request using URI create method.
*/ */
public void testApacheHttpRequest3(String username, String password) { public void testApacheHttpRequest3(String username, String password) {
String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
HttpRequestBase post = new HttpPost(URI.create(uriStr));
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
String authString = username + ":" + password; String authString = username + ":" + password;
byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes()); byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes());
String authStringEnc = new String(authEncBytes); String authStringEnc = new String(authEncBytes);
{
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
HttpRequestBase post = new HttpPost(URI.create(uriStr));
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth
}
{
String uriStr = "https://www.example.com/rest/getuser.do?uid=abcdx";
HttpRequestBase post = new HttpPost(URI.create(uriStr));
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // Safe
}
} }
/** /**
@@ -60,17 +83,25 @@ public class InsecureBasicAuthTest {
* argument. * argument.
*/ */
public void testApacheHttpRequest4(String username, String password) throws Exception { public void testApacheHttpRequest4(String username, String password) throws Exception {
String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
URI uri = new URI(uriStr);
HttpRequestBase post = new HttpPost(uri);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
String authString = username + ":" + password; String authString = username + ":" + password;
byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes()); byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes());
String authStringEnc = new String(authEncBytes); String authStringEnc = new String(authEncBytes);
{
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
URI uri = new URI(uriStr);
HttpRequestBase post = new HttpPost(uri);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth
}
{
String uriStr = "https://www.example.com/rest/getuser.do?uid=abcdx";
URI uri = new URI(uriStr);
HttpRequestBase post = new HttpPost(uri);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // Safe
}
} }
/** /**
@@ -78,49 +109,71 @@ public class InsecureBasicAuthTest {
* arguments. * arguments.
*/ */
public void testApacheHttpRequest5(String username, String password) throws Exception { public void testApacheHttpRequest5(String username, String password) throws Exception {
HttpRequestBase post =
new HttpPost(new URI("http", "www.example.com", "/test", "abc=123", null));
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
String authString = username + ":" + password; String authString = username + ":" + password;
byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes()); byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes());
String authStringEnc = new String(authEncBytes); String authStringEnc = new String(authEncBytes);
{
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth HttpRequestBase post =
new HttpPost(new URI("http", "www.example.com", "/test", "abc=123", null));
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth
}
{
HttpRequestBase post =
new HttpPost(new URI("https", "www.example.com", "/test", "abc=123", null));
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // Safe
}
} }
/** /**
* Test basic authentication with Apache HTTP `BasicHttpRequest` using string constructor. * Test basic authentication with Apache HTTP `BasicHttpRequest` using string constructor.
*/ */
public void testApacheHttpRequest6(String username, String password) { public void testApacheHttpRequest6(String username, String password) {
String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
BasicHttpRequest post = new BasicHttpRequest("POST", uriStr);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
String authString = username + ":" + password; String authString = username + ":" + password;
byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes()); byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes());
String authStringEnc = new String(authEncBytes); String authStringEnc = new String(authEncBytes);
{
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
BasicHttpRequest post = new BasicHttpRequest("POST", uriStr);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth
}
{
String uriStr = "https://www.example.com/rest/getuser.do?uid=abcdx";
BasicHttpRequest post = new BasicHttpRequest("POST", uriStr);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // Safe
}
} }
/** /**
* Test basic authentication with Apache HTTP `BasicHttpRequest` using `RequestLine`. * Test basic authentication with Apache HTTP `BasicHttpRequest` using `RequestLine`.
*/ */
public void testApacheHttpRequest7(String username, String password) { public void testApacheHttpRequest7(String username, String password) {
String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
RequestLine requestLine = new BasicRequestLine("POST", uriStr, null);
BasicHttpRequest post = new BasicHttpRequest(requestLine);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
String authString = username + ":" + password; String authString = username + ":" + password;
byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes()); byte[] authEncBytes = Base64.getEncoder().encode(authString.getBytes());
String authStringEnc = new String(authEncBytes); String authStringEnc = new String(authEncBytes);
{
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
RequestLine requestLine = new BasicRequestLine("POST", uriStr, null);
BasicHttpRequest post = new BasicHttpRequest(requestLine);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // $hasInsecureBasicAuth
}
{
String uriStr = "https://www.example.com/rest/getuser.do?uid=abcdx";
RequestLine requestLine = new BasicRequestLine("POST", uriStr, null);
BasicHttpRequest post = new BasicHttpRequest(requestLine);
post.setHeader("Accept", "application/json");
post.setHeader("Content-type", "application/json");
post.addHeader("Authorization", "Basic " + authStringEnc); // Safe
}
} }
/** /**
@@ -128,14 +181,24 @@ public class InsecureBasicAuthTest {
* constructor. * constructor.
*/ */
public void testHttpUrlConnection(String username, String password) throws Exception { public void testHttpUrlConnection(String username, String password) throws Exception {
String urlStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
String authString = username + ":" + password; String authString = username + ":" + password;
String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8")); String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
URL url = new URL(urlStr); {
HttpURLConnection conn = (HttpURLConnection) url.openConnection(); String urlStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
conn.setRequestMethod("POST"); URL url = new URL(urlStr);
conn.setDoOutput(true); HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestProperty("Authorization", "Basic " + encoding); // $hasInsecureBasicAuth conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoding); // $hasInsecureBasicAuth
}
{
String urlStr = "https://www.example.com/rest/getuser.do?uid=abcdx";
URL url = new URL(urlStr);
HttpURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoding); // Safe
}
} }
/** /**
@@ -143,16 +206,26 @@ public class InsecureBasicAuthTest {
* String host, String file)` constructor. * String host, String file)` constructor.
*/ */
public void testHttpUrlConnection2(String username, String password) throws Exception { public void testHttpUrlConnection2(String username, String password) throws Exception {
String host = "www.example.com";
String path = "/rest/getuser.do?uid=abcdx";
String protocol = "http";
String authString = username + ":" + password; String authString = username + ":" + password;
String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8")); String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
URL url = new URL(protocol, host, path); String host = "www.example.com";
HttpURLConnection conn = (HttpURLConnection) url.openConnection(); String path = "/rest/getuser.do?uid=abcdx";
conn.setRequestMethod("POST"); {
conn.setDoOutput(true); String protocol = "http";
conn.setRequestProperty("Authorization", "Basic " + encoding); // $hasInsecureBasicAuth URL url = new URL(protocol, host, path);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoding); // $hasInsecureBasicAuth
}
{
String protocol = "https";
URL url = new URL(protocol, host, path);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoding); // Safe
}
} }
/** /**
@@ -162,10 +235,19 @@ public class InsecureBasicAuthTest {
String host = "LOCALHOST"; String host = "LOCALHOST";
String authString = username + ":" + password; String authString = username + ":" + password;
String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8")); String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
HttpURLConnection conn = (HttpURLConnection) new URL( {
"http://" + (((host + "/rest/getuser.do") + "?uid=abcdx"))).openConnection(); HttpURLConnection conn = (HttpURLConnection) new URL(
conn.setRequestMethod("POST"); "http://" + (((host + "/rest/getuser.do") + "?uid=abcdx"))).openConnection();
conn.setDoOutput(true); conn.setRequestMethod("POST");
conn.setRequestProperty("Authorization", "Basic " + encoding); // Safe conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoding); // Safe
}
{
HttpURLConnection conn = (HttpURLConnection) new URL(
"https://" + (((host + "/rest/getuser.do") + "?uid=abcdx"))).openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoding); // Safe
}
} }
} }