diff --git a/.gitignore b/.gitignore index b0dec4e..bd37cc3 100644 --- a/.gitignore +++ b/.gitignore @@ -16,4 +16,7 @@ elixir/mix/hello_world/tmp # javascript *.log -*node_modules/ \ No newline at end of file +*node_modules/ + +# reachability +reachability/maven/vuln-function-used/target \ No newline at end of file diff --git a/reachability/java/vulnerable-function-not-used/app/bin/main/vuln/project/sample/App.class b/reachability/java/vulnerable-function-not-used/app/bin/main/vuln/project/sample/App.class new file mode 100644 index 0000000..4c3fdfd Binary files /dev/null and b/reachability/java/vulnerable-function-not-used/app/bin/main/vuln/project/sample/App.class differ diff --git a/reachability/java/vulnerable-function-not-used/app/bin/test/vuln/project/sample/AppTest.class b/reachability/java/vulnerable-function-not-used/app/bin/test/vuln/project/sample/AppTest.class new file mode 100644 index 0000000..24f9368 Binary files /dev/null and b/reachability/java/vulnerable-function-not-used/app/bin/test/vuln/project/sample/AppTest.class differ diff --git a/reachability/maven/vuln-function-used/README.md b/reachability/maven/vuln-function-used/README.md new file mode 100644 index 0000000..c09f274 --- /dev/null +++ b/reachability/maven/vuln-function-used/README.md @@ -0,0 +1,9 @@ +## Example maven project with reachable vulnerabilities + +- To build project: `mvn package` (you will need java8+, and maven) + +```bash +; mvn package # build project +; fossa analyze -o --debug # run fossa analysis in output mode only +; fossa analyze --debug -p example-maven-vuln-function-used -r 1 # run fossa analysis +``` \ No newline at end of file diff --git a/reachability/maven/vuln-function-used/pom.xml b/reachability/maven/vuln-function-used/pom.xml new file mode 100644 index 0000000..d4a5319 --- /dev/null +++ b/reachability/maven/vuln-function-used/pom.xml @@ -0,0 +1,106 @@ + + + + 4.0.0 + + com.example.app + example + 1.1 + + example-artifact-name + + http://www.example.com + + + UTF-8 + 1.8 + 1.8 + + + + + Apache License, Version 2.0 + https://www.apache.org/licenses/LICENSE-2.0.txt + repo + A business-friendly OSS license + + + + + + + false + + central + Maven Repository Switchboard + http://repo1.maven.org/maven2 + + + + + + junit + junit + 4.11 + test + + + org.dom4j + dom4j + 2.1.0 + + + com.google.guava + guava + 28.1-jre + + + + + + + + + + maven-clean-plugin + 3.1.0 + + + + maven-resources-plugin + 3.0.2 + + + maven-compiler-plugin + 3.8.0 + + + maven-surefire-plugin + 2.22.1 + + + maven-jar-plugin + 3.0.2 + + + maven-install-plugin + 2.5.2 + + + maven-deploy-plugin + 2.8.2 + + + + maven-site-plugin + 3.7.1 + + + maven-project-info-reports-plugin + 3.0.0 + + + + + diff --git a/reachability/maven/vuln-function-used/src/main/java/com/example/app/App.java b/reachability/maven/vuln-function-used/src/main/java/com/example/app/App.java new file mode 100644 index 0000000..03687fd --- /dev/null +++ b/reachability/maven/vuln-function-used/src/main/java/com/example/app/App.java @@ -0,0 +1,29 @@ +package com.example.app; + +import java.util.Map; +import java.net.URI; +import java.net.URL; +import com.example.app.utils.ContextReader; + +// org.dom4j (CVE-2020-10683) +// --------------------------- +// dom4j before 2.0.3 and 2.1.x before 2.1.3 allows +// external DTDs and External Entities by default, which might enable XXE attacks +import org.dom4j.Document; +import org.dom4j.DocumentException; +import org.dom4j.io.SAXReader; + +public class App +{ + public static void main(String[] args) throws Exception { + URL url = new URI(args[0]).toURL(); + System.out.println(parse(url)); + System.out.println(ContextReader.parseWithCtx(url)); + } + + public static Document parse(URL url) throws DocumentException { + SAXReader reader = new SAXReader(); + Document document = reader.read(url); + return document; + } +} diff --git a/reachability/maven/vuln-function-used/src/main/java/com/example/app/utils/ContextReader.java b/reachability/maven/vuln-function-used/src/main/java/com/example/app/utils/ContextReader.java new file mode 100644 index 0000000..39e2216 --- /dev/null +++ b/reachability/maven/vuln-function-used/src/main/java/com/example/app/utils/ContextReader.java @@ -0,0 +1,23 @@ +package com.example.app.utils; + +import java.util.Map; +import java.net.URI; +import java.net.URL; +import org.dom4j.Document; +import org.dom4j.DocumentException; +import org.dom4j.jaxb.JAXBReader; +import com.google.common.io.Files; +import com.google.common.base.Charsets; +import java.io.File; + +public class ContextReader +{ + public static Document parseWithCtx(URL url) throws DocumentException, java.io.IOException { + File addrFile = new File("addr.txt"); + String addrCtx = Files.toString(addrFile, Charsets.UTF_8); + + JAXBReader reader = new JAXBReader(addrCtx); + Document document = reader.read(url); + return document; + } +} diff --git a/reachability/maven/vuln-function-used/src/test/java/com/example/app/AppTest.java b/reachability/maven/vuln-function-used/src/test/java/com/example/app/AppTest.java new file mode 100644 index 0000000..f9263a7 --- /dev/null +++ b/reachability/maven/vuln-function-used/src/test/java/com/example/app/AppTest.java @@ -0,0 +1,14 @@ +package com.example.app; + +import static org.junit.Assert.assertTrue; + +import org.junit.Test; + +public class AppTest +{ + @Test + public void shouldAnswerWithTrue() + { + assertTrue( true ); + } +}