torchfl-org · vivekkhimani · May 21, 2023 · Aug 9, 2023 · Aug 18, 2023 · Aug 18, 2023
diff --git a/test.py b/test.py
@@ -0,0 +1,6 @@
+import yaml
+
+
+yaml.load(Loader=yaml.Loader)
+
+yaml.unsafe_load("something")
diff --git a/test1.java b/test1.java
@@ -0,0 +1,46 @@
+public class ActiveDebugCode{
+
+    public void bad(){
+        StackTraceElement[] elements;
+
+        Exception e = new Exception();
+        elements = e.getStackTrace();
+
+        // ruleid: active-debug-code-getstacktrace
+        System.err.print(elements);
+    }
+
+    public void bad2(){
+        StackTraceElement[] elements;
+
+        elements = Thread.currentThread().getStackTrace();
+
+        // ruleid: active-debug-code-getstacktrace
+        System.err.print(elements);
+    }
+
+    public void bad3(){
+        StackTraceElement[] elements;
+
+        elements = new Throwable().getStackTrace();
+
+        // ruleid: active-debug-code-getstacktrace
+        System.err.print(elements);
+    }
+
+    public void bad4(){
+        // ruleid: active-debug-code-getstacktrace
+        System.out.println(org.apache.commons.lang3.exception.ExceptionUtils.getStackTrace(e));
+        // ruleid: active-debug-code-getstacktrace
+        System.out.println(org.apache.commons.lang3.exception.ExceptionUtils.getFullStackTrace(e));
+    }
+
+    public void alsobad(){
+        for (StackTraceElement ste : Thread.currentThread().getStackTrace()) {
+            // ruleid: active-debug-code-getstacktrace
+            System.out.println(ste);
+        }
+    }
+
+}
+
diff --git a/test3.py b/test3.py
@@ -0,0 +1,71 @@
+import json
+from json import load, loads
+
+from http.server import BaseHTTPRequestHandler
+import urllib.parse
+
+class GetHandler(BaseHTTPRequestHandler):
+
+    def do_GET(self):
+        tainted = urlparse.urlparse(self.path).query
+
+        # ruleid: tainted-json
+        json.load(tainted)
+        # ruleid: tainted-json
+        json.load(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+        # ruleid: tainted-json
+        json.loads(tainted)
+        # ruleid: tainted-json
+        json.loads(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+
+        decoder = json.JSONDecoder()
+        # ruleid: tainted-json
+        decoder.decode(tainted)
+        # ruleid: tainted-json
+        decoder.raw_decode(tainted)
+
+        # ok: tainted-json
+        json.load(s)
+        # ok: tainted-json
+        json.load(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+        # ok: tainted-json
+        json.loads(s)
+        # ok: tainted-json
+        json.loads(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+
+        decoder = json.JSONDecoder()
+        # ok: tainted-json
+        decoder.decode(s)
+        # ok: tainted-json
+        decoder.raw_decode(s)
+
+        # ruleid: tainted-json
+        load(tainted)
+        # ruleid: tainted-json
+        load(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+        # ruleid: tainted-json
+        loads(tainted)
+        # ruleid: tainted-json
+        loads(tainted, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+
+        decoder = JSONDecoder()
+        # ruleid: tainted-json
+        decoder.decode(tainted)
+        # ruleid: tainted-json
+        decoder.raw_decode(tainted)
+
+        # ok: tainted-json
+        load(s)
+        # ok: tainted-json
+        load(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+        # ok: tainted-json
+        loads(s)
+        # ok: tainted-json
+        loads(s, cls=None, object_hook=None, parse_float=None, parse_int=None, parse_constant=None, object_pairs_hook=None)
+
+        decoder = JSONDecoder()
+        # ok: tainted-json
+        decoder.decode(s)
+        # ok: tainted-json
+        decoder.raw_decode(s)
+
diff --git a/test5.py b/test5.py
@@ -0,0 +1 @@
+print("hello world")
diff --git a/torchfl-org-yaml-rule-test.yaml b/torchfl-org-yaml-rule-test.yaml
@@ -0,0 +1,52 @@
+rules:
+  - id: avoid-pyyaml-load
+    metadata:
+      owasp:
+        - A08:2017 - Insecure Deserialization
+        - A08:2021 - Software and Data Integrity Failures
+      cwe:
+        - "CWE-502: Deserialization of Untrusted Data"
+      references:
+        - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
+        - https://nvd.nist.gov/vuln/detail/CVE-2017-18342
+      category: security
+      technology:
+        - pyyaml
+      cwe2022-top25: true
+      cwe2021-top25: true
+      subcategory:
+        - audit
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: MEDIUM
+      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
+      rule-origin-note: published from torchfl-org-yaml-rule-test.yaml in
+        git@github.com:torchfl-org/torchfl.git
+    languages:
+      - python
+    message: fukkkdsafsadfadsadddblahDetected a possible YAML deserialization vulnerability.
+      `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader`
+      are all known to be unsafe methods of deserializing YAML. An attacker with
+      control over the YAML input could create special YAML input that allows
+      the attacker to run arbitrary Python code. This would allow the attacker
+      to steal files, download and install malware, or otherwise take over the
+      machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead. blah blah.blah
+    fix-regex:
+      regex: unsafe_load
+      replacement: safe_load
+      count: 1
+    severity: ERROR
+    patterns:
+      - pattern-inside: |
+          import yaml
+          ...
+      - pattern-not-inside: |
+          $YAML = ruamel.yaml.YAML(...)
+          ...
+      - pattern-either:
+          - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...)
+          - pattern: yaml.load(..., Loader=yaml.CLoader, ...)
+          - pattern: yaml.load_all(..., Loader=yaml.Loader, ...)
+          - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...)
+          - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...)
+          - pattern: yaml.unsafe_load(...)