Skip to content

Commit 7df59ff

Browse files
am0o0am0o0
committed
update tests, is not completed yet :)
1 parent a683394 commit 7df59ff

File tree

11 files changed

+65
-108
lines changed

11 files changed

+65
-108
lines changed

java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/CommonsCompressHandler.java renamed to java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/CommonsCompressHandler.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
package com.Bombs;
2-
31
import java.io.*;
42
import java.nio.file.Files;
53
import java.nio.file.Path;

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/DecompressionBombs.qlref‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
experimental/Security/CWE/CWE-522-DecompressionBombs/DecompressionBombFlowState.ql
1+
experimental/Security/CWE/CWE-522-DecompressionBombs/DecompressionBomb.ql

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/HelloServlet.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
import org.apache.commons.compress.archivers.ArchiveException;
2+
import org.apache.commons.compress.compressors.CompressorException;
3+
import org.apache.commons.io.IOUtils;
4+
5+
import java.io.*;
6+
import java.io.IOException;
7+
import java.nio.charset.StandardCharsets;
8+
import java.util.zip.DataFormatException;
9+
import javax.servlet.http.*;
10+
import javax.servlet.ServletException;
11+
import java.io.IOException;
12+
13+
public class Bombs extends HttpServlet {
14+
15+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
16+
throws IOException, ServletException, ServletException, IOException {
17+
response.setContentType("text/html");
18+
Part remoteFile = request.getPart("zipFile");
19+
// Zip
20+
ZipHandler.ZipInputStreamSafe2(remoteFile.getInputStream());
21+
ZipHandler.ZipInputStreamSafe(request.getPart("zipFile").getInputStream());
22+
ZipHandler.ZipInputStreamUnsafe(remoteFile.getInputStream());
23+
ZipHandler.GZipInputStreamUnsafe(request.getPart("zipFile").getInputStream());
24+
ZipHandler.InflaterInputStreamUnsafe(request.getPart("zipFile").getInputStream());
25+
try {
26+
ZipHandler.InflaterUnsafe(request.getParameter("data").getBytes(StandardCharsets.UTF_8));
27+
} catch (DataFormatException e) {
28+
throw new RuntimeException(e);
29+
}
30+
try {
31+
ZipHandler. ZipFile1(request.getParameter("zipFileName"));
32+
} catch (DataFormatException e) {
33+
throw new RuntimeException(e);
34+
}
35+
36+
// Zip4j
37+
Zip4jHandler.zip4jZipInputStream(remoteFile.getInputStream());
38+
Zip4jHandler.zip4jZipInputStreamSafe(remoteFile.getInputStream());
39+
// SnappyZip
40+
SnappyHandler.SnappyZipInputStream(remoteFile.getInputStream());
41+
// apache Commons
42+
commonsCompressArchiveInputStream2(remoteFile.getInputStream());
43+
CommonsCompressHandler.commonsCompressorInputStream(remoteFile.getInputStream());
44+
try {
45+
CommonsCompressHandler.commonsCompressArchiveInputStream(remoteFile.getInputStream());
46+
CommonsCompressHandler.commonsCompressArchiveStreamFactory(remoteFile.getInputStream());
47+
} catch (ArchiveException e) {
48+
throw new RuntimeException(e);
49+
}
50+
try {
51+
CommonsCompressHandler.commonsCompressCompressorStreamFactory(remoteFile.getInputStream());
52+
} catch (CompressorException e) {
53+
throw new RuntimeException(e);
54+
}
55+
56+
PrintWriter out = response.getWriter();
57+
out.println("<html><body>end</body></html>");
58+
}
59+
}

java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/SnappyHandler.java renamed to java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/SnappyHandler.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
package com.Bombs;
2-
31
import java.io.*;
42
import java.nio.file.Files;
53
import java.nio.file.Paths;

java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/Zip4jHandler.java renamed to java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/Zip4jHandler.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
package com.Bombs;
2-
31
import net.lingala.zip4j.model.LocalFileHeader;
42
import net.lingala.zip4j.io.inputstream.ZipInputStream;
53
import java.io.*;

java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/ZipHandler.java renamed to java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/ZipHandler.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
package com.Bombs;
2-
31
import java.io.*;
42
import java.io.FileOutputStream;
53
import java.nio.ByteBuffer;

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/stubs

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/pom.xml‎

100755100644
Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2-
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
1+
<project xmlns="http://maven.apache.org/POM/4.0.0"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
34
<modelVersion>4.0.0</modelVersion>
45
<groupId>org.example</groupId>
56
<artifactId>BombsRemoteSourceMavenJavax2</artifactId>
@@ -76,4 +77,4 @@
7677
<version>1.23.0</version>
7778
</dependency>
7879
</dependencies>
79-
</project>
80+
</project>

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/HelloServlet.java‎

Lines changed: 0 additions & 84 deletions
This file was deleted.

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

0 commit comments

Comments
 (0)