Skip to content

Commit e8e2db2

Browse files
davewichersdavewichers
committed
Move Contrast config files into tools directory. Change configuration so
server only listens on localhost. Change the keystore to use a stronger cipher.
1 parent 62baf02 commit e8e2db2

File tree

8 files changed

+180
-50
lines changed

8 files changed

+180
-50
lines changed

‎.keystore

-1 Bytes
Binary file not shown.

‎pom.xml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,14 @@
172172
<cargo.jvmargs>-XX:MaxPermSize=6G -Xms1G –Xmx8G</cargo.jvmargs>
173173
</properties>
174174
<configuration>
175+
<files>
176+
<copy>
177+
<file>${basedir}/src/config/server.xml</file>
178+
<tofile>conf/server.xml</tofile>
179+
<configfile>true</configfile>
180+
<overwrite>true</overwrite>
181+
</copy>
182+
</files>
175183
<properties>
176184
<cargo.servlet.port>8443</cargo.servlet.port>
177185
<cargo.protocol>https</cargo.protocol>
@@ -235,8 +243,8 @@
235243
<properties>
236244
<cargo.jvmargs>
237245
-Xmx4G
238-
-javaagent:${basedir}/forcontrast/contrast.jar=${basedir}/forcontrast/contrast.config
239-
-Dcontrast.dir=${basedir}/forcontrast/working
246+
-javaagent:${basedir}/tools/Contrast/contrast.jar=${basedir}/tools/Contrast/contrast.config
247+
-Dcontrast.dir=${basedir}/tools/Contrast/working
240248
-Dcontrast.saveresults=always
241249
-Dcontrast.noteamserver.enable=true
242250
-Dcontrast.teamserver.suppress=true

‎prepareContrastResults.sh

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
11
#!/bin/sh
22

3-
# TODO - Get the Benchmark version and put that in the file name
3+
# TODO - Get the Benchmark version and execution time and put that in the file name
44

5-
if [ -d forcontrast/findings ]; then
5+
if [ -d tools/Contrast/findings ]; then
66

77
# clean out any APPCREATE, APPUPDATE, and SERVER events out of the Contrast findings directory before zipping everything up
88

9-
forcontrast/removeUnneededEvents.sh forcontrast/findings/APP*.xml
10-
forcontrast/removeUnneededEvents.sh forcontrast/findings/SERVER*.xml
9+
tools/Contrast/removeUnneededEvents.sh tools/Contrast/findings/APP*.xml
10+
tools/Contrast/removeUnneededEvents.sh tools/Contrast/findings/SERVER*.xml
1111

1212
echo
13-
echo "All unneeded Contrast events removed from forcontrast/findings before zipping them up"
13+
echo "All unneeded Contrast events removed from tools/Contrast/findings before zipping them up"
1414

15-
zip -q -r results/Benchmark_1.2beta-Contrast.zip forcontrast/findings && echo "Contrast findings ZIP file successfully created" || echo "Error creating Contrast findings ZIP file"
15+
zip -q -r results/Benchmark_1.2beta-Contrast.zip tools/Contrast/findings && echo "Contrast findings ZIP file successfully created" || echo "Error creating Contrast findings ZIP file"
1616

1717
echo "Contrast findings all put into /results folder"
1818
echo
1919

2020
else
2121

2222
echo ""
23-
echo "ERROR: The forcontrast/findings directory doesn’t exist. You need to run the runBenchmark_wContrast script first, and then crawl the Benchmark app with runCrawler to generate the Contrast results required by this script."
23+
echo "ERROR: The tools/Contrast/findings directory doesn’t exist. You need to run the runBenchmark_wContrast script first, and then crawl the Benchmark app with runCrawler to generate the Contrast results required by this script."
2424
echo ""
2525

2626
fi

‎runBenchmark_wContrast.sh

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
#!/bin/sh
22

3-
if [ -f forcontrast/contrast.jar ]; then
3+
if [ -f tools/Contrast/contrast.jar ]; then
44

5-
if [ -d forcontrast/findings ]; then
5+
if [ -d tools/Contrast/findings ]; then
66

7-
rm -r forcontrast/findings
8-
rm -r forcontrast/working
7+
rm -r tools/Contrast/findings
8+
rm -r tools/Contrast/working
99
echo ""
10-
echo "Previous Contrast results in forcontrast/findings removed"
10+
echo "Previous Contrast results in tools/Contrast/findings removed"
1111
echo ""
1212

1313
fi
@@ -17,6 +17,6 @@ if [ -f forcontrast/contrast.jar ]; then
1717

1818
else
1919

20-
echo "Given that Contrast is a commercial product, you have to have a licensed version of Contrast in order to run it on the Benchmark. If you have access to Contrast, download the Java 1.5 version of contrast.jar from the Team Server and put it into the /forcontrast folder, and then rerun this script."
20+
echo "Given that Contrast is a commercial product, you have to have a licensed version of Contrast in order to run it on the Benchmark. If you have access to Contrast, download the Java 1.5 version of contrast.jar from the Team Server and put it into the /tools/Contrast folder, and then rerun this script."
2121

2222
fi

‎src/config/server.xml

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="no"?><!--
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
--><!-- Note: A "Server" is not itself a "Container", so you may not
17+
define subcomponents such as "Valves" at this level.
18+
Documentation at /docs/config/server.html
19+
--><Server port="8205" shutdown="SHUTDOWN">
20+
<Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
21+
<!-- Security listener. Documentation at /docs/config/listeners.html
22+
<Listener className="org.apache.catalina.security.SecurityListener" />
23+
-->
24+
<!--APR library loader. Documentation at /docs/apr.html -->
25+
<Listener SSLEngine="on" className="org.apache.catalina.core.AprLifecycleListener"/>
26+
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
27+
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
28+
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
29+
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
30+
31+
<!-- Global JNDI resources
32+
Documentation at /docs/jndi-resources-howto.html
33+
-->
34+
<GlobalNamingResources>
35+
<!-- Editable user database that can also be used by
36+
UserDatabaseRealm to authenticate users
37+
-->
38+
<Resource auth="Container" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" name="UserDatabase" pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase"/>
39+
</GlobalNamingResources>
40+
41+
<!-- A "Service" is a collection of one or more "Connectors" that share
42+
a single "Container" Note: A "Service" is not itself a "Container",
43+
so you may not define subcomponents such as "Valves" at this level.
44+
Documentation at /docs/config/service.html
45+
-->
46+
<Service name="Catalina">
47+
48+
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
49+
<!--
50+
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
51+
maxThreads="150" minSpareThreads="4"/>
52+
-->
53+
54+
55+
<!-- A "Connector" represents an endpoint by which requests are received
56+
and responses are returned. Documentation at :
57+
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
58+
Java AJP Connector: /docs/config/ajp.html
59+
APR (HTTP/AJP) Connector: /docs/apr.html
60+
Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
61+
-->
62+
<Connector address="127.0.0.01" SSLEnabled="true" URIEncoding="ISO-8859-1" clientAuth="false" connectionTimeout="20000" keyAlias="tomcat" keystoreFile="../../../../.keystore" keystorePass="changeit" port="8443" protocol="HTTP/1.1" redirectPort="8443" scheme="https" secure="true" sslProtocol="TLS"/>
63+
<!-- A "Connector" using the shared thread pool-->
64+
<!--
65+
<Connector executor="tomcatThreadPool"
66+
port="8080" protocol="HTTP/1.1"
67+
connectionTimeout="20000"
68+
redirectPort="8443" />
69+
-->
70+
<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
71+
This connector uses the NIO implementation that requires the JSSE
72+
style configuration. When using the APR/native implementation, the
73+
OpenSSL style configuration is required as described in the APR/native
74+
documentation -->
75+
<!--
76+
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
77+
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
78+
clientAuth="false" sslProtocol="TLS" />
79+
-->
80+
81+
<!-- Define an AJP 1.3 Connector on port 8009 -->
82+
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="127.0.0.01"/>
83+
84+
85+
<!-- An Engine represents the entry point (within Catalina) that processes
86+
every request. The Engine implementation for Tomcat stand alone
87+
analyzes the HTTP headers included with the request, and passes them
88+
on to the appropriate Host (virtual host).
89+
Documentation at /docs/config/engine.html -->
90+
91+
<!-- You should set jvmRoute to support load-balancing via AJP ie :
92+
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
93+
-->
94+
<Engine defaultHost="localhost" name="Catalina">
95+
96+
<!--For clustering, please take a look at documentation at:
97+
/docs/cluster-howto.html (simple how to)
98+
/docs/config/cluster.html (reference documentation) -->
99+
<!--
100+
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
101+
-->
102+
103+
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
104+
via a brute-force attack -->
105+
<Realm className="org.apache.catalina.realm.LockOutRealm">
106+
<!-- This Realm uses the UserDatabase configured in the global JNDI
107+
resources under the key "UserDatabase". Any edits
108+
that are performed against this UserDatabase are immediately
109+
available for use by the Realm. -->
110+
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
111+
</Realm>
112+
113+
<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true">
114+
115+
<!-- SingleSignOn valve, share authentication between web applications
116+
Documentation at: /docs/config/valve.html -->
117+
<!--
118+
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
119+
-->
120+
121+
<!-- Access log processes all example.
122+
Documentation at: /docs/config/valve.html
123+
Note: The pattern used is equivalent to using pattern="common" -->
124+
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" pattern="%h %l %u %t &quot;%r&quot; %s %b" prefix="localhost_access_log." resolveHosts="false" suffix=".txt"/>
125+
126+
127+
</Host>
128+
</Engine>
129+
</Service>
130+
</Server>

‎src/main/java/org/owasp/benchmark/tools/NoisyCricket.java

Lines changed: 26 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11
package org.owasp.benchmark.tools;
22

3-
import java.io.BufferedReader;
43
import java.io.File;
5-
import java.io.FileReader;
64
import java.io.FileWriter;
75
import java.io.IOException;
8-
import java.util.ArrayList;
6+
import java.nio.charset.Charset;
7+
import java.nio.file.FileSystems;
8+
import java.nio.file.FileVisitResult;
9+
import java.nio.file.FileVisitor;
10+
import java.nio.file.Files;
11+
import java.nio.file.Path;
12+
import java.nio.file.SimpleFileVisitor;
13+
import java.nio.file.attribute.BasicFileAttributes;
914
import java.util.List;
15+
import java.util.Objects;
1016
import java.util.Set;
1117
import java.util.TreeSet;
1218

@@ -45,15 +51,25 @@ public static void main(String[] args) {
4551
vulns = report.createElement("vulnerabilities");
4652
docroot.appendChild(vulns);
4753

48-
File f = new File("/Users/jeffwilliams/git2/");
49-
walk(f);
54+
FileVisitor<Path> visitor = new SimpleFileVisitor<Path>() {
55+
@Override
56+
public FileVisitResult visitFile(Path path, BasicFileAttributes attrs) throws IOException {
57+
Objects.requireNonNull(path);
58+
Objects.requireNonNull(attrs);
59+
if ( path.toString().endsWith(".java")) {
60+
analyze(path);
61+
}
62+
return FileVisitResult.CONTINUE;
63+
}
64+
};
65+
Path p = FileSystems.getDefault().getPath( "/Users/jeffwilliams/git2/");
66+
Files.walkFileTree(p, visitor);
5067

5168
TransformerFactory transformerFactory = TransformerFactory.newInstance();
5269
Transformer transformer = transformerFactory.newTransformer();
5370
transformer.setOutputProperty(OutputKeys.INDENT, "yes");
5471
DOMSource source = new DOMSource(report);
5572
StreamResult result = new StreamResult(new FileWriter(new File( "NoisyCricket.xml" )));
56-
//StreamResult result = new StreamResult(System.out);
5773
transformer.transform(source, result);
5874

5975
System.out.println("\n\nNoisyCricket.xml saved!");
@@ -63,23 +79,9 @@ public static void main(String[] args) {
6379
}
6480
}
6581

66-
public static void walk(File f) throws IOException {
67-
File[] list = f.listFiles();
68-
if (list == null)
69-
return;
70-
for (File child : list) {
71-
if (child.isDirectory()) {
72-
walk(child);
73-
System.out.println("Dir:" + child.getAbsoluteFile());
74-
} else if ( child.getName().endsWith( ".java" )){
75-
analyze(child);
76-
}
77-
}
78-
}
79-
80-
public static void analyze( File f ) throws IOException {
82+
public static void analyze( Path p ) throws IOException {
8183
Element vuln = report.createElement("vulnerability");
82-
List<String> lines = getLinesFromFile( f );
84+
List<String> lines = Files.readAllLines(p, Charset.defaultCharset() );
8385
Set<Integer> cwelist = new TreeSet<Integer>();
8486

8587
for ( String line : lines ) {
@@ -97,7 +99,7 @@ public static void analyze( File f ) throws IOException {
9799
}
98100

99101
vuln.setAttribute("cwelist", cwelist.toString() );
100-
vuln.setAttribute("file", f.getName() );
102+
vuln.setAttribute("file", p.getFileName().toString() );
101103
vulns.appendChild(vuln);
102104
}
103105

@@ -142,6 +144,7 @@ private static boolean checkHash(String line) {
142144
}
143145

144146
private static boolean checkTrustBoundary(String line) {
147+
if ( match( line, "putValue" ) ) return true;
145148
if ( match( line, "setAttribute" ) ) return true;
146149
return false;
147150
}
@@ -160,16 +163,5 @@ public static boolean checkXSS( String line ) {
160163
private static boolean match(String line, String string) {
161164
return line.toLowerCase().contains( string.toLowerCase() );
162165
}
163-
164-
public static List<String> getLinesFromFile(File file) throws IOException {
165-
List<String> sourceLines = new ArrayList<String>();
166-
BufferedReader br = new BufferedReader(new FileReader(file));
167-
String line;
168-
while ((line = br.readLine()) != null) {
169-
sourceLines.add(line);
170-
}
171-
return sourceLines;
172-
}
173-
174166

175167
}

‎forcontrast/contrast.config renamed to ‎tools/Contrast/contrast.config

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<contrast>
33
<id>default</id>
44
<url>http://example.com/Contrast/s/</url>
5-
<local-results mode="always">../../../../forcontrast/findings</local-results>
5+
<local-results mode="always">../../../../tools/Contrast/findings</local-results>
66
<plugins>
77
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.security.SecurityPlugin</plugin>
88
<plugin>com.aspectsecurity.contrast.runtime.agent.plugins.architecture.ArchitecturePlugin</plugin>

‎forcontrast/removeUnneededEvents.sh renamed to ‎tools/Contrast/removeUnneededEvents.sh

File renamed without changes.

0 commit comments

Comments
 (0)