diff --git a/internal/services/engines/java/rule_manager.go b/internal/services/engines/java/rule_manager.go index 5f845542a..6c95fcd4d 100644 --- a/internal/services/engines/java/rule_manager.go +++ b/internal/services/engines/java/rule_manager.go @@ -187,6 +187,7 @@ func Rules() []engine.Rule { NewLDAPDeserializationNotDisabled(), NewDatabasesPasswordNotProtected(), NewVulnerableRemoteCodeInjectionApacheLog4j(), + NewUncheckedClassInstatiation(), } return append(java, jvm.Rules()...) } diff --git a/internal/services/engines/java/rules.go b/internal/services/engines/java/rules.go index 8973642b2..4814df5b2 100644 --- a/internal/services/engines/java/rules.go +++ b/internal/services/engines/java/rules.go @@ -2614,3 +2614,23 @@ func NewVulnerableRemoteCodeInjectionApacheLog4j() *text.Rule { }, } } + +func NewUncheckedClassInstatiation() *text.Rule { + return &text.Rule{ + Metadata: engine.Metadata{ + ID: "HS-JAVA-151", + Name: "Unchecked Class Instantiation when providing Plugin Classes", + Description: `CVE-2022-21724 pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. The first impacted version is REL9.4.1208 (it introduced socketFactory connection property) until 42.3.1. Please update to fixed versions ^42.2.25 or ^42.3.2. For more information checkout the CVE-2022-21724 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21724) advisory.`, + Severity: severities.High.ToString(), + Confidence: confidence.Low.ToString(), + }, + Type: text.OrMatch, + Expressions: []*regexp.Regexp{ + regexp.MustCompile(`compile.*group:.*org\.postgresql.*name:.*postgresql.*version:.*(('|")(([1-3]?[0-9]?)\..*\..*|(4[0-2]\.(([0-2]\.(([0-9])|([0-1][0-9].*)|(2[0-4])))|(3\.[0-1]).*)))('|"))`), + regexp.MustCompile(`compile.*postgresql.*(:postgresql:\s*(([1-3]?[0-9]?)\..*\..*|(4[0-2]\.(([0-2]\.(([0-9])|([0-1][0-9].*)|(2[0-4])))|(3\.[0-1]).*)))).*('|")`), + regexp.MustCompile(`\s*org\.postgresql\s*\s*.*\s*postgresql.*\s*\s*(\s*(([1-3]?[0-9]?)\..*\..*|(4[0-2]\.(([0-2]\.(([0-9])|([0-1][0-9].*)|(2[0-4])))|(3\.[0-1]).*))))\s*`), + regexp.MustCompile(``), + regexp.MustCompile(`<(postgre|postgres|postgresql)\.version>\s*(([1-3]?[0-9]?)\..*\..*|(4[0-2]\.(([0-2]\.(([0-9])|([0-1][0-9].*)|(2[0-4])))|(3\.[0-1]).*))).*`), + }, + } +} diff --git a/internal/services/engines/java/rules_test.go b/internal/services/engines/java/rules_test.go index 4bda232ef..afcc2f465 100644 --- a/internal/services/engines/java/rules_test.go +++ b/internal/services/engines/java/rules_test.go @@ -643,6 +643,86 @@ func TestRulesVulnerableCode(t *testing.T) { }, }, }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: SampleMavenVulnerableHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + Findings: []engine.Finding{ + { + CodeSample: "org.postgresql", + SourceLocation: engine.Location{ + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + Line: 10, + Column: 12, + }, + }, + }, + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample2GradleVulnerableHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.2", ".test")), + Findings: []engine.Finding{ + { + CodeSample: "compile group: 'org.postgresql', name: 'postgresql', version: '42.3.0'", + SourceLocation: engine.Location{ + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.2", ".test")), + Line: 15, + Column: 4, + }, + }, + }, + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample3GradleVulnerableHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.3", ".test")), + Findings: []engine.Finding{ + { + CodeSample: "compile 'org.postgresql:postgresql:40.1.1'", + SourceLocation: engine.Location{ + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.3", ".test")), + Line: 22, + Column: 4, + }, + }, + }, + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample4IvyVulnerableHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.4", ".test")), + Findings: []engine.Finding{ + { + CodeSample: "", + SourceLocation: engine.Location{ + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.4", ".test")), + Line: 14, + Column: 4, + }, + }, + }, + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample5MavenVulnerableHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.5", ".test")), + Findings: []engine.Finding{ + { + CodeSample: "42.3.1", + SourceLocation: engine.Location{ + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151.5", ".test")), + Line: 16, + Column: 8, + }, + }, + }, + }, } testutil.TestVulnerableCode(t, testcases) @@ -897,6 +977,36 @@ func TestRulesSafeCode(t *testing.T) { Src: Sample5MavenSafeHSJAVA150, Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-150", ".test")), }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: SampleMavenSafeHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample2GradleSafeHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample3GradleSafeHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample4IvySafeHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + }, + { + Name: "HS-JAVA-151", + Rule: NewUncheckedClassInstatiation(), + Src: Sample5MavenSafeHSJAVA151, + Filename: filepath.Join(tempDir, fmt.Sprintf("%s%s", "HS-JAVA-151", ".test")), + }, } testutil.TestSafeCode(t, testcases) } diff --git a/internal/services/engines/java/sample_test.go b/internal/services/engines/java/sample_test.go index d220ed2c0..2b6005ab3 100644 --- a/internal/services/engines/java/sample_test.go +++ b/internal/services/engines/java/sample_test.go @@ -1184,5 +1184,265 @@ test { +` + + SampleMavenVulnerableHSJAVA151 = ` + + + 4.0.0 + PostgresUncheckedClassExample + PostgresUncheckedClassExample + 0.0.1-SNAPSHOT + + + org.postgresql + postgresql + 42.1.0 + + + +` + + SampleMavenSafeHSJAVA151 = ` + + + 4.0.0 + PostgresUncheckedClassExample + PostgresUncheckedClassExample + 0.0.1-SNAPSHOT + + + org.postgresql + postgresql + 42.2.25 + + + +` + + Sample2GradleVulnerableHSJAVA151 = ` +group 'com.lamarjs' +version '1.0-SNAPSHOT' + +apply plugin: 'java' + +sourceCompatibility = 1.8 + +repositories { + mavenCentral() +} + +dependencies { + + compile group: 'org.postgresql', name: 'postgresql', version: '42.3.0' + + testCompile group: 'junit', name: 'junit', version: '4.12' +} + +` + + Sample2GradleSafeHSJAVA151 = ` +group 'com.lamarjs' +version '1.0-SNAPSHOT' + +apply plugin: 'java' + +sourceCompatibility = 1.8 + +repositories { + mavenCentral() +} + +dependencies { + + compile group: 'org.postgresql', name: 'postgresql', version: '42.3.2' + + testCompile group: 'junit', name: 'junit', version: '4.12' +} +` + + Sample3GradleVulnerableHSJAVA151 = ` +plugins { + id 'java' +} + +group 'com.epam.rp' +version '1.0-SNAPSHOT' + +sourceCompatibility = 1.8 + +repositories { + mavenCentral() +} + +dependencies { + + compile 'org.seleniumhq.selenium:selenium-server:3.141.59' + + compile 'org.testng:testng:6.13.1' + compile 'com.epam.reportportal:agent-java-testng:4.2.3' + + compile 'org.postgresql:postgresql:40.1.1' +} + + +test { + useTestNG() { + useDefaultListeners = true + suites 'suites/amazon_test.xml' + } +} +` + + Sample3GradleSafeHSJAVA151 = ` +plugins { + id 'java' +} + +group 'com.epam.rp' +version '1.0-SNAPSHOT' + +sourceCompatibility = 1.8 + +repositories { + mavenCentral() +} + +dependencies { + + compile 'org.seleniumhq.selenium:selenium-server:3.141.59' + + compile 'org.testng:testng:6.13.1' + compile 'com.epam.reportportal:agent-java-testng:4.2.3' + + + compile 'org.postgresql:postgresql:42.3.2' +} + + +test { + useTestNG() { + useDefaultListeners = true + suites 'suites/amazon_test.xml + } +} +` + + Sample4IvyVulnerableHSJAVA151 = ` + + + + + + + + + + + + + + + + + + + + + + +` + + Sample4IvySafeHSJAVA151 = ` + + + + + + + + + + + + + + + + + + + + + + +` + + Sample5MavenVulnerableHSJAVA151 = ` + + 4.0.0 + + com.example.postgresql + postgresql-examples + 1.0-SNAPSHOT + jar + + postgresql-examples + http://maven.apache.org + + + UTF-8 + 42.3.1 + + + + + org.postgresql + postgresql + ${postgresql.version} + + + junit + junit + 3.8.1 + test + + + +` + + Sample5MavenSafeHSJAVA151 = ` + + 4.0.0 + + com.example.postgresql + postgresql-examples + 1.0-SNAPSHOT + jar + + postgresql-examples + http://maven.apache.org + + + UTF-8 + 42.3.2 + + + + + org.postgresql + postgresql + ${postgresql.version} + + + junit + junit + 3.8.1 + test + + + ` ) diff --git a/internal/services/engines/rules_test.go b/internal/services/engines/rules_test.go index 6ed4fd941..7f3c2341d 100644 --- a/internal/services/engines/rules_test.go +++ b/internal/services/engines/rules_test.go @@ -67,7 +67,7 @@ func TestGetRules(t *testing.T) { { engine: "Java", manager: java.NewRules(), - expectedTotalRules: 181, + expectedTotalRules: 182, }, { engine: "Dart",