From 679912c79a879dfc8bdf419a9df69726a873c40d Mon Sep 17 00:00:00 2001 From: Xiao Yinning <211220110@smail.nju.edu.cn> Date: Wed, 25 Dec 2024 15:33:08 +0000 Subject: [PATCH 1/9] add taint-specification-collection Co-authored-by: auroraberry <2507097782@qq.com> Co-authored-by: Isla-top <211220177@smail.nju.edu.cn> --- .../README.adoc | 116 ++++++++++++ .../infoleak/infoleak.yml | 5 + .../infoleak/sink/java-io/README.adoc | 10 + .../infoleak/sink/java-io/java-io.yml | 172 +++++++++++++++++ .../infoleak/source/java/README.adoc | 15 ++ .../infoleak/source/java/java-io.yml | 137 ++++++++++++++ .../infoleak/source/java/java-lang-system.yml | 6 + .../infoleak/source/java/java-net.yml | 45 +++++ .../infoleak/source/java/java-sql.yml | 5 + .../android/sql-injection/ContentProvider.yml | 5 + .../android/sql-injection/DatabaseUtils.yml | 6 + .../sink/android/sql-injection/README.adoc | 10 + .../android/sql-injection/SQLiteDatabase.yml | 58 ++++++ .../sql-injection/SQLiteQueryBuilder.yml | 45 +++++ .../apache-Xalan/xpath-injection/README.adoc | 10 + .../apache-Xalan/xpath-injection/xpath.yml | 10 + .../apache-log4j/log4j_1x/crlf/Category.yml | 18 ++ .../apache-log4j/log4j_1x/crlf/Logger.yml | 20 ++ .../apache-log4j/log4j_1x/crlf/README.adoc | 12 ++ .../sink/apache-log4j/log4j_2/crlf/Logger.yml | 104 ++++++++++ .../apache-log4j/log4j_2/crlf/README.adoc | 11 ++ .../xpath/RAEDME.adoc | 11 ++ .../xpath/xpath.yml | 5 + .../apache-struts/file-disclosure/README.adoc | 11 ++ .../struts-file-disclosure.yml | 6 + .../apache-struts/ognl-injection/OgnlUtil.yml | 20 ++ .../apache-struts/ognl-injection/README.adoc | 11 ++ .../ognl-injection/TextParseUtil.yml | 13 ++ .../ognl-injection/reflection-relative.yml | 29 +++ .../sink/apache-struts/other/other.yml | 25 +++ .../apache-turbine/sql-injection/README.adoc | 10 + .../sql-injection/sql-turbine.yml | 14 ++ .../attribute-injection/README.adoc | 10 + .../beanutils2/attribute-injection/beans.yml | 14 ++ .../apahce-commons/logging/crlf/README.adoc | 10 + .../apahce-commons/logging/crlf/crlf-logs.yml | 13 ++ .../injection/sink/java/crlf/README.adoc | 10 + .../injection/sink/java/crlf/crlf-logs.yml | 89 +++++++++ .../sink/java/path-traversal/README.adoc | 10 + .../java/path-traversal/path-traversal.yml | 36 ++++ .../injection/sink/java/rce/README.adoc | 10 + .../injection/sink/java/rce/command.yml | 17 ++ .../sink/java/sql-injection/sql-jdbc.yml | 13 ++ .../sink/java/xpath-injection/README.adoc | 10 + .../sink/java/xpath-injection/xpath.yml | 10 + .../injection/sink/java/xss/README.adoc | 10 + .../injection/sink/java/xss/formatter.yml | 13 ++ .../injection/sink/java/xss/output.yml | 23 +++ .../sink/javax/ldap-injection/README.adoc | 10 + .../sink/javax/ldap-injection/ldap.yml | 54 ++++++ .../injection/sink/javax/other/el.yml | 3 + .../sink/javax/other/response-splitting.yml | 13 ++ .../sink/javax/other/script-engine.yml | 2 + .../injection/sink/javax/other/smtp.yml | 6 + .../javax/other/trust-boundary-violation.yml | 6 + .../injection/sink/javax/other/xslt.yml | 2 + .../sink/javax/sql-injection/README.adoc | 10 + .../sink/javax/sql-injection/sql-jdo.yml | 10 + .../sink/javax/sql-injection/sql-jpa.yml | 7 + .../sink/javax/xpath-injection/README.adoc | 10 + .../sink/javax/xpath-injection/xpath.yml | 7 + .../injection/sink/javax/xss/README.adoc | 10 + .../injection/sink/javax/xss/output.yml | 24 +++ .../sink/javax/xss/request-dispatcher.yml | 3 + .../injection/sink/slf4j/crlf/README.adoc | 10 + .../injection/sink/slf4j/crlf/crlf-logs.yml | 91 +++++++++ .../sink/spring-framework/beans/README.adoc | 10 + .../sink/spring-framework/beans/beans.yml | 5 + .../file-disclosure/README.adoc | 10 + .../spring-file-disclosure.yml | 5 + .../ldap-injection/README.adoc | 10 + .../spring-framework/ldap-injection/ldap.yml | 74 ++++++++ .../spel-inejction/README.adoc | 10 + .../spel-inejction/spring-expression.yml | 10 + .../sql-injection/README.adoc | 10 + .../sql-injection/sql-spring.yml | 30 +++ .../injection/sink/tinylog/crlf/README.adoc | 10 + .../injection/sink/tinylog/crlf/crlf-logs.yml | 21 ++ .../source/apache-struts2/README.adoc | 7 + .../source/apache-struts2/struts2.yml | 2 + .../source/apache-wicket/README.adoc | 7 + .../injection/source/apache-wicket/wicket.yml | 28 +++ .../injection/source/dropwizard/README.adoc | 8 + .../dropwizard-jersey/dropwizard-jersey.yml | 2 + .../dropwizard-servlet.yml | 10 + .../injection/source/java/README.adoc | 8 + .../injection/source/java/java-awt.yml | 3 + .../injection/source/java/java-io.yml | 8 + .../injection/source/java/java-net.yml | 26 +++ .../source/java/java-util-Scanner.yml | 12 ++ .../injection/source/javax/README.adoc | 8 + .../javax/javax-portlet/PortletRequest.yml | 18 ++ .../javax/javax-portlet/portlet-other.yml | 14 ++ .../source/javax/javax-servlet/Cookie.yml | 6 + .../javax-servlet/HttpServletRequest.yml | 44 +++++ .../HttpServletRequestWrapper.yml | 20 ++ .../javax/javax-servlet/ServletRequest.yml | 11 ++ .../javax-servlet/ServletRequestWrapper.yml | 9 + .../source/javax/javax-swing/swing.yml | 4 + .../injection/source/jetty/README.adoc | 8 + .../source/jetty/jetty-http/jetty-http.yml | 27 +++ .../jetty/jetty-server/jetty-server.yml | 26 +++ .../jetty/jetty-session/jetty-session.yml | 2 + .../injection/source/sonarqube/README.adoc | 7 + .../sonarqube/sonarqube-ws/sonarqube-ws.yml | 22 +++ .../transfer/string-transfers.yml | 179 ++++++++++++++++++ 106 files changed, 2282 insertions(+) create mode 100644 src/main/resources/taint-specification-collection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/infoleak/infoleak.yml create mode 100644 src/main/resources/taint-specification-collection/infoleak/sink/java-io/README.adoc create mode 100644 src/main/resources/taint-specification-collection/infoleak/sink/java-io/java-io.yml create mode 100644 src/main/resources/taint-specification-collection/infoleak/source/java/README.adoc create mode 100644 src/main/resources/taint-specification-collection/infoleak/source/java/java-io.yml create mode 100644 src/main/resources/taint-specification-collection/infoleak/source/java/java-lang-system.yml create mode 100644 src/main/resources/taint-specification-collection/infoleak/source/java/java-net.yml create mode 100644 src/main/resources/taint-specification-collection/infoleak/source/java/java-sql.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/ContentProvider.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/DatabaseUtils.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteDatabase.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteQueryBuilder.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/xpath.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Category.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Logger.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/Logger.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/RAEDME.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/xpath.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/struts-file-disclosure.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/OgnlUtil.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/TextParseUtil.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/reflection-relative.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-struts/other/other.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/sql-turbine.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/beans.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/crlf-logs.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/crlf/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/crlf/crlf-logs.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/path-traversal.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/rce/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/rce/command.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/sql-injection/sql-jdbc.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/xpath.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/xss/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/xss/formatter.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/java/xss/output.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/ldap-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/ldap-injection/ldap.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/other/el.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/other/response-splitting.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/other/script-engine.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/other/smtp.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/other/trust-boundary-violation.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/other/xslt.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/sql-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/sql-injection/sql-jdo.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/sql-injection/sql-jpa.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/xpath-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/xpath-injection/xpath.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/xss/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/xss/output.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/javax/xss/request-dispatcher.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/slf4j/crlf/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/slf4j/crlf/crlf-logs.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/beans/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/beans/beans.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/file-disclosure/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/file-disclosure/spring-file-disclosure.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/ldap-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/ldap-injection/ldap.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/spel-inejction/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/spel-inejction/spring-expression.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/sql-injection/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/spring-framework/sql-injection/sql-spring.yml create mode 100644 src/main/resources/taint-specification-collection/injection/sink/tinylog/crlf/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/sink/tinylog/crlf/crlf-logs.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/apache-struts2/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/apache-struts2/struts2.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/apache-wicket/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/apache-wicket/wicket.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/dropwizard/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/dropwizard/dropwizard-jersey/dropwizard-jersey.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/dropwizard/dropwizard-servlets/dropwizard-servlet.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/java/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/java/java-awt.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/java/java-io.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/java/java-net.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/java/java-util-Scanner.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-portlet/PortletRequest.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-portlet/portlet-other.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-servlet/Cookie.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-servlet/HttpServletRequest.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-servlet/HttpServletRequestWrapper.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-servlet/ServletRequest.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-servlet/ServletRequestWrapper.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/javax/javax-swing/swing.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/jetty/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/jetty/jetty-http/jetty-http.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/jetty/jetty-server/jetty-server.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/jetty/jetty-session/jetty-session.yml create mode 100644 src/main/resources/taint-specification-collection/injection/source/sonarqube/README.adoc create mode 100644 src/main/resources/taint-specification-collection/injection/source/sonarqube/sonarqube-ws/sonarqube-ws.yml create mode 100644 src/main/resources/taint-specification-collection/transfer/string-transfers.yml diff --git a/src/main/resources/taint-specification-collection/README.adoc b/src/main/resources/taint-specification-collection/README.adoc new file mode 100644 index 000000000..a8ddaa8c2 --- /dev/null +++ b/src/main/resources/taint-specification-collection/README.adoc @@ -0,0 +1,116 @@ += Taint Specification Collection + + +== 目录 + +* <<#什么是 Taint Specification Collection?, 什么是 Taint Specification Collection?>> +* <<#如何使用 Taint Specification Collection?, 如何使用 Taint Specification Collection?>> +* <<#项目结构, 项目结构>> +* <<#示例, 示例>> + + +== 什么是 Taint Specification Collection? + +`Taint Specification Collection` 是专为静态分析工具 `Tai-e` 中的污点分析提供的配置文件集合，旨在为常见漏洞的安全分析提供支持。该集合涵盖了多种常见漏洞类型的污点规范，具体包括 `source`、`sink` 和 `transfer`。为了方便用户查询和选择，污点规范根据软件包和相关漏洞类型进行了结构化分类，从而为污点分析提供了全面的配置方案。当前，该集合包含 406 条 `source` 配置、995 条 `sink` 配置和 138 条 `transfer` 配置，用户可以根据不同需求灵活使用和扩展。 + + +== 如何使用 Taint Specification Collection? + +`Taint Specification Collection` 中配置文件使用 `YAML` 格式（文件扩展名为 `.yaml` 或 `.yml`），便于用户阅读和编辑。用户可以直接将集合中的配置文件集成到 `Tai-e` 污点分析工具的 `taint-config.yml` 配置中，或者根据实际需求对其进行修改和扩展，从而更好地满足特定的分析需求。 + + +[NOTE] +==== +* 有关如何正确配置 `Tai-e` 污点分析，请参考 link:https://tai-e.pascal-lab.net/docs/0.2.2/reference/en/taint-analysis.html#configuring-taint-analysis[Configuring Taint Analysis]。 + +* 项目中注释的配置表示接口方法。实际使用时，请根据 `Tai-e` 污点分析配置的格式，手动填写对应实现方法的配置信息。 +==== + + +== 项目结构 + +本项目的文件组织结构如下： + +[source] +---- +taint-specification-collection +| +├─ infoleak +│ ├─ sink contains 141 sinks +│ │ └─ java-io +| | +│ └─ source contains 158 sources +│ | └─ java +| +├─ injection contains 854 sinks +│ ├─ sink +│ │ ├─ android +│ │ │ └─ sql-injection +│ | | +│ │ ├─ java +│ │ │ ├─ crlf +│ │ │ ├─ path-traversal +│ │ │ ├─ rce +│ │ │ └─ ... +| | | +│ │ └─ ... +| | +│ └─ source contains 248 sources +│ | ├─ apache-struts2 +| | | +│ | ├─ javax +| | | ├─ javax-portlet +| | | ├─ javax-servlet +| | | └─ javax-swing +| | | +│ | └─ ... +| +└─transfer contains 138 transfers about String +---- + +该项目首先对配置文件进行了分类，分为三个一级类别：`infoleak`、`injection` 和 `transfer`。 + +* `infoleak` 类别：包含与信息泄露漏洞相关的配置，进一步细分为两个二级目录： + ** `source`：按软件包名进行分类。 + ** `sink`：按软件包名进行分类。 +* `injection` 类别：包含与注入漏洞相关的配置，同样细分为两个二级目录： + ** `source`：按软件包名进行分类。 + ** `sink`：根据漏洞类型进行分类。 +* `transfer` 类别：包含常用的 `transfer` 配置。 + +由于 `source` 和 `sink` 的配置内容较多，为了帮助用户快速定位所需配置，我们采用了这种分类方式。除此以外，每个文件的叶子目录下还包含相应配置的 `README` 文件，供用户参考。 + + + +== 示例 + +以下是如何使用本集合配置文件的示例。假设用户需要查找与 `RCE(Remote Code Execution，CWE-94)` 类型注入漏洞相关的配置，针对使用 `Jetty` 软件库的待测试程序，可以按以下步骤修改 `taint-config.yml` 配置文件： + +1. 将 `taint-specification-collection/injection/source/jetty/jetty-http/jetty-http.yml` 文件中的 *Jetty 软件库* 相关的 `source` 配置添加到 `taint-config.yml`。 +2. 将 `taint-specification-collection/injection/sink/java/rce/command.yml` 文件中的 *RCE 类型注入漏洞* 相关的 `sink` 配置添加到 `taint-config.yml`。 +3. 将 `taint-specification-collection/transfer/string-transfers.yml` 文件中的关于 *String 类型* 的 `transfer` 配置添加到 `taint-config.yml`。 + +示例 `taint-config.yml` 配置如下： + +```YAML +source: + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } +#... + +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } +#... + +transfer: + - { method: "", from: base, to: result } + - { method: "", from: base, to: result } +#... +``` + +完成以上配置后，用户就可以使用 `Tai-e` 工具对待测试程序进行污点分析，以检测 `Jetty` 软件库作为入口导致的 `RCE` 类型漏洞。(＾▽＾) + + diff --git a/src/main/resources/taint-specification-collection/infoleak/infoleak.yml b/src/main/resources/taint-specification-collection/infoleak/infoleak.yml new file mode 100644 index 000000000..9f20e31ec --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/infoleak.yml @@ -0,0 +1,5 @@ +- bugType: io_leak + severity: CRITICAL + description: Find potential io_leak + configPath: src/main/resources/security/taint/infoleak/config/sink/io.yml + diff --git a/src/main/resources/taint-specification-collection/infoleak/sink/java-io/README.adoc b/src/main/resources/taint-specification-collection/infoleak/sink/java-io/README.adoc new file mode 100644 index 000000000..b208f0ef8 --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/sink/java-io/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The sinks in this directory are composed of output-related APIs from the Java standard library's `io` package, primarily including the `write` functions in various output component classes. + +- **Common Use Cases**: + These APIs are commonly used to output data carried by parameters to specified locations, such as files or command lines. + +- **Security Risks**: + Information Disclosure: Attackers can use these APIs to output sensitive information to a specified location, allowing them to exploit the acquired data for illegal activities such as extortion. \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/infoleak/sink/java-io/java-io.yml b/src/main/resources/taint-specification-collection/infoleak/sink/java-io/java-io.yml new file mode 100644 index 000000000..c762ad10d --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/sink/java-io/java-io.yml @@ -0,0 +1,172 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 2 } + - { method: "", index: 1 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 1 } + - { method: "", index: 2 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0} + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 2 } + - { method: "", index: 1 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } diff --git a/src/main/resources/taint-specification-collection/infoleak/source/java/README.adoc b/src/main/resources/taint-specification-collection/infoleak/source/java/README.adoc new file mode 100644 index 000000000..aa4d0144b --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/source/java/README.adoc @@ -0,0 +1,15 @@ += Description + +The sources recorded in this directory mainly come from the Java standard library. The source methods that can generate taints include: + +- Methods that retrieve stored data from databases (e.g., `getString` and `getNString` methods in `java.sql`). +- Methods that retrieve data from users that need to be validated (e.g., `get` methods and `requestPasswordAuthentication` method in `java.net.Authenticator`). +- Methods that retrieve information from connected clients (e.g., `get` methods in `java.net.ContentHandler`, `CookieHandler`, and `CookieManager`). +- Methods that retrieve information from `DatagramSocket`/`HttpCookie` (e.g., `get` methods in `java.net.DatagramSocket`/`HttpCookie`). +- Methods that retrieve system information from `System` (e.g., `get` methods in `java.lang.System`). +- Methods that retrieve information from input streams (e.g., `read` methods in various `InputStream` and `Reader` classes in `java.io`). +- Methods that retrieve specified values from persistent fields (e.g., `get` methods in `java.io.ObjectInputStream$GetField`). +- Methods that read information from files (e.g., `read` method in `java.io.RandomAccessFile`). +- ... + +*Note*: The methods referred to as `get` or `read` are those that start with "get" or "read". diff --git a/src/main/resources/taint-specification-collection/infoleak/source/java/java-io.yml b/src/main/resources/taint-specification-collection/infoleak/source/java/java-io.yml new file mode 100644 index 000000000..8fc26aec0 --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/source/java/java-io.yml @@ -0,0 +1,137 @@ +sources: + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "char[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "char[]" } + + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: result, type: "boolean" } + - { kind: call, method: "", index: result, type: "byte" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "short" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "char" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "long" } + - { kind: call, method: "", index: result, type: "float" } + - { kind: call, method: "", index: result, type: "double" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "char[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "char[]" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "char[]" } + + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: result, type: "boolean" } + - { kind: call, method: "", index: result, type: "byte" } + - { kind: call, method: "", index: result, type: "char" } + - { kind: call, method: "", index: result, type: "double" } + - { kind: call, method: "", index: result, type: "float" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "long" } + - { kind: call, method: "", index: result, type: "java.lang.Object" } + - { kind: call, method: "", index: result, type: "java.lang.Object" } + - { kind: call, method: "", index: result, type: "java.lang.Object" } + - { kind: call, method: "", index: result, type: "short" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.io.ObjectInputStream$GetField" } + + - { kind: call, method: "", index: result, type: "boolean" } + - { kind: call, method: "", index: result, type: "boolean" } + - { kind: call, method: "", index: result, type: "byte" } + - { kind: call, method: "", index: result, type: "char" } + - { kind: call, method: "", index: result, type: "double" } + - { kind: call, method: "", index: result, type: "float" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "java.lang.Object" } + - { kind: call, method: "", index: result, type: "long" } + - { kind: call, method: "", index: result, type: "short" } + + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: 0, type: "byte[]" } + - { kind: call, method: "", index: result, type: "boolean" } + - { kind: call, method: "", index: result, type: "byte" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "short" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "char" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "long" } + - { kind: call, method: "", index: result, type: "float" } + - { kind: call, method: "", index: result, type: "double" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "int" } diff --git a/src/main/resources/taint-specification-collection/infoleak/source/java/java-lang-system.yml b/src/main/resources/taint-specification-collection/infoleak/source/java/java-lang-system.yml new file mode 100644 index 000000000..d23970ad2 --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/source/java/java-lang-system.yml @@ -0,0 +1,6 @@ +sources: + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.util.Map" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } diff --git a/src/main/resources/taint-specification-collection/infoleak/source/java/java-net.yml b/src/main/resources/taint-specification-collection/infoleak/source/java/java-net.yml new file mode 100644 index 000000000..3f43469a7 --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/source/java/java-net.yml @@ -0,0 +1,45 @@ +sources: + - { kind: call, method: "", index: result, type: "java.net.PasswordAuthentication" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "int" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.net.InetAddress" } + - { kind: call, method: "", index: result, type: "java.net.URL" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.net.Authenticator$RequestorType" } + - { kind: call, method: "", index: result, type: "java.net.PasswordAuthentication" } + - { kind: call, method: "", index: result, type: "java.net.PasswordAuthentication" } + - { kind: call, method: "", index: result, type: "java.net.PasswordAuthentication" } + + - { kind: call, method: "", index: result, type: "java.lang.Object" } #interface + - { kind: call, method: "", index: result, type: "java.lang.Object" } + + - { kind: call, method: "", index: result, type: "java.util.Map" } + + - { kind: call, method: "", index: result, type: "java.util.Map" } + + - { kind: call, method: "", index: result, type: "java.net.InetAddress" } + - { kind: call, method: "", index: result, type: "byte[]" } + - { kind: call, method: "", index: result, type: "java.net.SocketAddress" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "java.net.InetAddress" } + - { kind: call, method: "", index: result, type: "java.net.SocketAddress" } + - { kind: call, method: "", index: result, type: "java.net.SocketAddress" } + - { kind: call, method: "", index: result, type: "java.net.DatagramChannel" } + - { kind: call, method: "", index: result, type: "java.net.InetAddress" } + - { kind: call, method: "", index: result, type: "int" } + + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + diff --git a/src/main/resources/taint-specification-collection/infoleak/source/java/java-sql.yml b/src/main/resources/taint-specification-collection/infoleak/source/java/java-sql.yml new file mode 100644 index 000000000..6475623e8 --- /dev/null +++ b/src/main/resources/taint-specification-collection/infoleak/source/java/java-sql.yml @@ -0,0 +1,5 @@ +sources: + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } + - { kind: call, method: "", index: result, type: "java.lang.String" } diff --git a/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/ContentProvider.yml b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/ContentProvider.yml new file mode 100644 index 000000000..351c9845f --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/ContentProvider.yml @@ -0,0 +1,5 @@ +sinks: + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/DatabaseUtils.yml b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/DatabaseUtils.yml new file mode 100644 index 000000000..3e4ead79a --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/DatabaseUtils.yml @@ -0,0 +1,6 @@ +sinks: + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + diff --git a/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/README.adoc new file mode 100644 index 000000000..2edb66c65 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The sinks in this directory consist of Android database SQL-related APIs, including but not limited to `query`, `update`, `delete`, and other methods. Their main functionality is to perform database queries and update operations. + +- **Common Use Cases**: + These APIs are commonly used for handling user-inputted data for queries, data insertion, data updates, data deletion, and SQL statement execution. Users typically have some level of control over the parameters. + +- **Security Risks**: + SQL Injection: Attackers can exploit these APIs by constructing malicious input to inject SQL commands, thereby gaining control over the database. \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteDatabase.yml b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteDatabase.yml new file mode 100644 index 000000000..49d80f38a --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteDatabase.yml @@ -0,0 +1,58 @@ +sinks: + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 5 } + - { method: "", index: 7 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 6 } + - { method: "", index: 8 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 5 } + - { method: "", index: 7 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 6 } + - { method: "", index: 8 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 4 } + - { method: "", index: 6 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 5 } + - { method: "", index: 7 } + + - { method: "", index: 1 } + - { method: "", index: 2 } + + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 3 } + + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 2 } + - { method: "", index: 4 } + + - { method: "", index: 0 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteQueryBuilder.yml b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteQueryBuilder.yml new file mode 100644 index 000000000..103856665 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/android/sql-injection/SQLiteQueryBuilder.yml @@ -0,0 +1,45 @@ +sinks: + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 6 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 4 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 5 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 6 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 5 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/README.adoc new file mode 100644 index 000000000..514a937bd --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + Apache Xalan provides a set of methods for evaluating XPath expressions and selecting nodes within XML documents. These methods enable developers to easily locate, filter, and process specific nodes and data within XML documents. + +- **Common Use Cases**: + These APIs are commonly used to parse and execute XPath expressions, returning corresponding results based on the content of XML documents. + +- **Security Risks**: + XPath Injection: Similar to SQL injection attacks, attackers can craft malicious XPath expressions to reveal the structure of XML data or access data that would normally be restricted. If the XML data is used for user authentication, attackers could even escalate their privileges. diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/xpath.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/xpath.yml new file mode 100644 index 000000000..85961226f --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-Xalan/xpath-injection/xpath.yml @@ -0,0 +1,10 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Category.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Category.yml new file mode 100644 index 000000000..6e72952f6 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Category.yml @@ -0,0 +1,18 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Logger.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Logger.yml new file mode 100644 index 000000000..c6d8c1004 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/Logger.yml @@ -0,0 +1,20 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/README.adoc new file mode 100644 index 000000000..c6474d293 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_1x/crlf/README.adoc @@ -0,0 +1,12 @@ += Description + +- **Overview**: + Apache Log4j is a logging library for Java applications. The APIs in this directory provide various methods to log different levels of log information, including debug, info, warning, error, and fatal errors. + +- **Common Use Cases**: + These APIs are typically used to log various types of information, such as recording errors and exceptions, tracking runtime information, issuing warnings, and integrating with log auditing systems. + +- **Security Risks**: + CRLF Injection: Attackers can exploit these APIs by constructing malicious input with CRLF (Carriage Return and Line Feed) sequences to forge log messages, mislead monitoring personnel, or even affect the auditing system. Attackers can also flood logs with errors or irrelevant information, potentially damaging the log integrity. + +*Note*: Apache Log4j version 1.x is no longer maintained. \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/Logger.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/Logger.yml new file mode 100644 index 000000000..74edb348b --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/Logger.yml @@ -0,0 +1,104 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/README.adoc new file mode 100644 index 000000000..eeff6ec37 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-log4j/log4j_2/crlf/README.adoc @@ -0,0 +1,11 @@ += Description + +- **Overview**: + Apache Log4j is a logging library for Java applications. The APIs in this directory offer various methods to log different levels of information, including debug, info, warning, error, and fatal errors. + +- **Common Use Cases**: + These APIs are commonly used for logging various types of information, such as recording errors and exceptions, tracking runtime information, issuing warnings, and integrating with log auditing systems. + +- **Security Risks**: + CRLF Injection: Attackers can exploit these APIs by crafting malicious input containing CRLF (Carriage Return and Line Feed) sequences to forge log entries, mislead monitoring personnel, and even affect auditing systems. Additionally, attackers can flood logs with excessive errors or irrelevant information, potentially corrupting the log data. + diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/RAEDME.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/RAEDME.adoc new file mode 100644 index 000000000..5c0618ac7 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/RAEDME.adoc @@ -0,0 +1,11 @@ += Description + +- **Overview**: + The Apache XML Security API provides functionality for processing XPath expressions within XML documents. This primarily involves two classes: `XPathAPI` and `JDKXPathAPI`, which are used to evaluate XPath expressions and select node lists within XML documents. + +- **Common Use Cases**: + These APIs are commonly used to parse and execute XPath expressions, returning corresponding results based on the content of XML documents. + +- **Security Risks**: + XPath Injection: Similar to SQL injection attacks, attackers can craft malicious XPath expressions to gain insights into the structure of XML data or access data that is normally restricted. If the XML data is used for user authentication, attackers could even escalate their privileges. + diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/xpath.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/xpath.yml new file mode 100644 index 000000000..24d9fcbcd --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-santuario-xml-security/xpath/xpath.yml @@ -0,0 +1,5 @@ +sinks: + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/README.adoc new file mode 100644 index 000000000..0ab4da0d9 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/README.adoc @@ -0,0 +1,11 @@ += Description + +- **Overview**: + These APIs are methods from the Apache Struts framework, used for creating and manipulating `ActionForward` objects. `ActionForward` is a class in Apache Struts used to specify the forwarding path for a request. + +- **Common Use Cases**: + These APIs are commonly used to create and manipulate `ActionForward` objects, specifying forwarding paths and determining whether a redirect is needed. + +- **Security Risks**: + File Disclosure: Once an attacker can control the creation of `ActionForward` objects, they can craft malicious requests to modify the forwarding path, potentially gaining access to sensitive files such as configuration files, application class files, or JAR files. + diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/struts-file-disclosure.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/struts-file-disclosure.yml new file mode 100644 index 000000000..dbc8e5999 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/file-disclosure/struts-file-disclosure.yml @@ -0,0 +1,6 @@ +sinks: + - { method: "(java.lang.String)>", index: 0 } + - { method: "(java.lang.String,boolean)>", index: 1 } + - { method: "(java.lang.String,java.lang.String,boolean)>", index: 1 } + - { method: "(java.lang.String,java.lang.String,boolean,boolean)>", index: 2 } + - { method: "", index: 0 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/OgnlUtil.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/OgnlUtil.yml new file mode 100644 index 000000000..59f99b6ef --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/OgnlUtil.yml @@ -0,0 +1,20 @@ +sink: + - { method: "", index: 2 } + - { method: "", index: 2 } + + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 3 } + - { method: "", index: 2 } + - { method: "", index: 2 } + - { method: "", index: 3 } + + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 2 } + - { method: "", index: 1 } + diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/README.adoc new file mode 100644 index 000000000..61a524b27 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/README.adoc @@ -0,0 +1,11 @@ += Description + +- **Overview**: + OGNL (Object-Graph Navigation Language) is a language designed to provide a higher-level syntax for navigating Java object graphs. + OGNL can access static methods, properties, and object methods, including classes such as `java.lang.Runtime` that can perform malicious actions like command execution. When OGNL expressions are externally controllable, attackers can craft malicious OGNL expressions to make the program perform malicious operations, which is the basis of the OGNL injection vulnerability. + +- **Common Use Cases**: + These APIs are commonly used to parse and execute OGNL expressions, replace variables in text, and set class member variables and methods. + +- **Security Risks**: + Remote Command Execution: When OGNL expressions are externally controllable, attackers can craft OGNL expressions to trigger reverse shells, execute system commands, and perform other malicious actions. diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/TextParseUtil.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/TextParseUtil.yml new file mode 100644 index 000000000..a237c823e --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/TextParseUtil.yml @@ -0,0 +1,13 @@ +sink: + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 4 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 1 } + - { method: "", index: 0 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/reflection-relative.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/reflection-relative.yml new file mode 100644 index 000000000..3b5b1f075 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/ognl-injection/reflection-relative.yml @@ -0,0 +1,29 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 2 } + - { method: "", index: 3 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 4 } + - { method: "", index: 2 } + - { method: "", index: 4 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 0 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-struts/other/other.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/other/other.yml new file mode 100644 index 000000000..2f3000870 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-struts/other/other.yml @@ -0,0 +1,25 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/README.adoc new file mode 100644 index 000000000..1c57cea19 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The APIs in this directory provide multiple ways to execute SQL queries and return results. These methods are used to interact with databases by executing SQL queries to retrieve data. + +- **Common Use Cases**: + These APIs are commonly used for handling user-input data queries and executing SQL statements. Users typically have some level of control over the parameters. + +- **Security Risks**: + SQL Injection: Attackers can exploit these APIs by crafting malicious input to inject SQL commands, allowing them to manipulate the database. diff --git a/src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/sql-turbine.yml b/src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/sql-turbine.yml new file mode 100644 index 000000000..b0dc213d0 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apache-turbine/sql-injection/sql-turbine.yml @@ -0,0 +1,14 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 2 } + - { method: "", index: 4 } + - { method: "", index: 4 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 2 } + - { method: "", index: 4 } + - { method: "", index: 4 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/README.adoc new file mode 100644 index 000000000..81f5ad374 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + Apache Commons BeanUtils provides a set of utility methods for manipulating Java Beans. The APIs in this directory can be used for common tasks such as property copying, property setting, and object population. + +- **Common Use Cases**: + These APIs are commonly used for copying, populating, and setting properties of Java Bean objects. + +- **Security Risks**: + Property Injection: If an attacker gains control over the objects being populated or the property names being set, they can inject unexpected and malicious property values, leading to property injection vulnerabilities. diff --git a/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/beans.yml b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/beans.yml new file mode 100644 index 000000000..f4d465d4f --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/beanutils2/attribute-injection/beans.yml @@ -0,0 +1,14 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/README.adoc new file mode 100644 index 000000000..5ba66c731 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The APIs in this directory are interfaces from the Apache Commons Logging library, used for logging. They provide various methods to log different levels of information, including debug, info, warning, and error. + +- **Common Use Cases**: + These APIs are commonly used to log various types of information, such as recording errors and exceptions, tracking runtime information, issuing warnings, and integrating with log auditing systems. + +- **Security Risks**: + CRLF Injection: Attackers can exploit these APIs by crafting malicious input containing CRLF (Carriage Return and Line Feed) sequences to forge log entries, mislead monitoring personnel, and even affect auditing systems. Additionally, attackers can flood logs with excessive errors or irrelevant information, potentially corrupting the log data. diff --git a/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/crlf-logs.yml b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/crlf-logs.yml new file mode 100644 index 000000000..cfc98acc8 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/apahce-commons/logging/crlf/crlf-logs.yml @@ -0,0 +1,13 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } \ No newline at end of file diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/crlf/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/java/crlf/README.adoc new file mode 100644 index 000000000..e90b33d1d --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/crlf/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The APIs in this directory are from the Java standard library's logging utilities, used to generate, record, and manage application logs. They provide various methods to log messages at different levels, support formatting log content, record exception information, and output logs to various targets. + +- **Common Use Cases**: + These APIs are commonly used for logging various types of information, such as recording errors and exceptions, tracking runtime information, issuing warnings, and integrating with log auditing systems. + +- **Security Risks**: + CRLF Injection: Attackers can exploit these APIs by crafting malicious input containing CRLF (Carriage Return and Line Feed) sequences to forge log entries, mislead monitoring personnel, and even affect auditing systems. Additionally, attackers can flood logs with excessive errors or irrelevant information, potentially corrupting the log data. diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/crlf/crlf-logs.yml b/src/main/resources/taint-specification-collection/injection/sink/java/crlf/crlf-logs.yml new file mode 100644 index 000000000..7122e7001 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/crlf/crlf-logs.yml @@ -0,0 +1,89 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 1 } # no in Supplier? + - { method: "", index: 2 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 0 } + - { method: "", index: 2 } + - { method: "", index: 3 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 4 } + - { method: "", index: 1 } + - { method: "", index: 3 } + - { method: "", index: 4 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 0 } + + + + + + + + + + + + + + + + + + + + diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/README.adoc new file mode 100644 index 000000000..9f5f12e3e --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The APIs in this directory involve file operations from the Java standard library, including file creation, reading, writing, and path handling. These classes and methods allow developers to perform various file operations, such as creating temporary files, reading file content, and writing data to files. If the parameters are unconstrained and controlled externally, attackers can exploit path traversal vulnerabilities to read and write arbitrary files. + +- **Common Use Cases**: + These APIs are commonly used for creating files and directories, reading files, writing files, and handling file paths. + +- **Security Risks**: + Path Traversal: Attackers can exploit malicious input to perform arbitrary file operations or access unsafe locations, potentially leading to unauthorized file read and write access. diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/path-traversal.yml b/src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/path-traversal.yml new file mode 100644 index 000000000..c82164eb0 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/path-traversal/path-traversal.yml @@ -0,0 +1,36 @@ +sinks: + # in + - { method: "(java.lang.String)>", index: 0 } + - { method: "(java.lang.String,java.lang.String)>", index: 0 } + - { method: "(java.lang.String,java.lang.String)>", index: 1 } + - { method: "(java.io.File,java.lang.String)>", index: 0 } + - { method: "(java.net.URI)>", index: 0 } + - { method: "(java.lang.String,java.lang.String)>", index: 1 } + + - { method: "(java.lang.String)>", index: 0 } + - { method: "(java.lang.String)>", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 2 } + + - { method: "(java.lang.String)>", index: 0 } + + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 1 } + + # out + - { method: "(java.lang.String)>", index: 0 } + - { method: "(java.lang.String,boolean)>", index: 1 } + - { method: "(java.lang.String)>", index: 0 } + - { method: "(java.lang.String,boolean)>", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/rce/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/java/rce/README.adoc new file mode 100644 index 000000000..19dfff8ec --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/rce/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The APIs in this directory involve operations for creating and managing processes in Java. They are used to start and control external processes, suitable for various scenarios such as executing system commands and launching external applications. If their parameters are subject to unlimited external input, attackers can execute arbitrary commands on the local machine. + +- **Common Use Cases**: + These APIs are commonly used to create and manage processes, and to execute system commands. + +- **Security Risks**: + Command Injection: Attackers can exploit these methods to execute arbitrary commands on the local machine, potentially compromising the system and accessing confidential information. diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/rce/command.yml b/src/main/resources/taint-specification-collection/injection/sink/java/rce/command.yml new file mode 100644 index 000000000..6c09b9388 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/rce/command.yml @@ -0,0 +1,17 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 2 } + - { method: "", index: 1 } + - { method: "", index: 2 } + + - { method: "(java.lang.String[])>", index: 0 } + - { method: "(java.util.List)>", index: 0 } + - { method: "", index: 0 } + - { method: "", index: 0 } + diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/sql-injection/sql-jdbc.yml b/src/main/resources/taint-specification-collection/injection/sink/java/sql-injection/sql-jdbc.yml new file mode 100644 index 000000000..a3ac57d77 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/sql-injection/sql-jdbc.yml @@ -0,0 +1,13 @@ +sinks: + # interface + # - { method: "", index: 0 } + # - { method: "", index: 0 } + # - { method: "", index: 2 } + # - { method: "", index: 3 } + # - { method: "", index: 0 } + # - { method: "", index: 1 } + # - { method: "", index: 2 } + # - { method: "", index: 3 } + # - { method: "", index: 1 } + # - { method: "", index: 1 } + # - { method: "", index: 0 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/README.adoc new file mode 100644 index 000000000..992fb6bb9 --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The Java standard library provides a set of methods for evaluating XPath expressions and selecting nodes within XML documents. Using these methods, developers can easily locate, filter, and process specific nodes and data within XML documents. + +- **Common Use Cases**: + These APIs are commonly used to parse and execute XPath expressions, returning corresponding results based on the content of XML documents. + +- **Security Risks**: + XPath Injection: Similar to SQL injection attacks, attackers can craft malicious XPath expressions to reveal the structure of XML data or access data that is normally restricted. If the XML data is used for user authentication, attackers could even escalate their privileges. diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/xpath.yml b/src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/xpath.yml new file mode 100644 index 000000000..0c0ca312d --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/xpath-injection/xpath.yml @@ -0,0 +1,10 @@ +sinks: + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } + - { method: "", index: 0 } + - { method: "", index: 1 } diff --git a/src/main/resources/taint-specification-collection/injection/sink/java/xss/README.adoc b/src/main/resources/taint-specification-collection/injection/sink/java/xss/README.adoc new file mode 100644 index 000000000..e4ba95a5b --- /dev/null +++ b/src/main/resources/taint-specification-collection/injection/sink/java/xss/README.adoc @@ -0,0 +1,10 @@ += Description + +- **Overview**: + The Java standard library provides a set of formatting and output APIs that are used to format data into specific string forms and output these strings to various targets. + +- **Common Use Cases**: + These APIs are commonly used to format strings, write text to output streams, and other similar tasks. + +- **Security Risks**: + XSS (Cross-Site Scripting) Attacks: If the formatted string or parameters include user input data and are not properly encoded, it may lead to XSS vulnerabilities. For example, if user input contains a `