Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Veracode Batch Fix #35

Open
wants to merge 2 commits into
base: at-test
Choose a base branch
from
Open

Veracode Batch Fix #35

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4f5cf44
Merge d5fdb2cd214ca04562f290405384fd8feb1d52d3 into dbfb3a2ecb25abf83…
sa-ny Oct 9, 2024
77fe3c8
Veracode-Fix-Bot - update test/src/main/java/com/veracode/verademo/co…
invalid-email-address Oct 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 51 additions & 55 deletions test/src/main/java/com/veracode/verademo/controller/UserController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,11 @@
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.apache.commons.text.StringEscapeUtils;
import org.owasp.encoder.Encode;
import java.net.URLEncoder;
import org.springframework.web.util.HtmlUtils;
import org.apache.commons.lang3.StringUtils;

/**
* @author johnadmin
Expand Down Expand Up @@ -112,7 +117,7 @@ public String showLogin(
target = "";
}
//test
logger.info("Entering showLogin with username " + username + " and target " + target);
logger.info("Entering showLogin with username " + StringEscapeUtils.escapeJava(username) + " and target " + target);

model.addAttribute("username", username);
model.addAttribute("target", target);
Expand Down Expand Up @@ -225,33 +230,30 @@ public String processLogin(
}

// Redirect to the appropriate place based on login actions above tt
logger.info("Redirecting to view: " + nextView);
logger.info("Redirecting to view: " + StringUtils.normalizeSpace(nextView));
return nextView;
}

@RequestMapping(value = "/password-hint", method = RequestMethod.GET)
@ResponseBody
public String showPasswordHint(String username) {
logger.info("Entering password-hint with username: " + username);

if (username == null || username.isEmpty()) {
return "No username provided, please type in your username first";
}

try {
Class.forName("com.mysql.jdbc.Driver");

Connection connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

String sql = "SELECT password_hint FROM users WHERE username = '" + username + "'";
logger.info(sql);
Statement statement = connect.createStatement();
ResultSet result = statement.executeQuery(sql);
logger.info("Entering password-hint with username: " + Encode.forHtml(username));
if (username == null || username.isEmpty()) {
return "No username provided, please type in your username first";
}
try {
Class.forName("com.mysql.jdbc.Driver");
Connection connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
String sql = "SELECT password_hint FROM users WHERE username =?";
logger.info(sql);
PreparedStatement statement = connect.prepareStatement(sql);
statement.setString(1, username);
ResultSet result = statement.executeQuery();
if (result.first()) {
String password = result.getString("password_hint");
String formatString = "Username '" + username + "' has password: %.2s%s";
logger.info(formatString);
return String.format(
return HtmlUtils.htmlEscape(String).format(
formatString,
password,
String.format("%0" + (password.length() - 2) + "d", 0).replace("0", "*"));
Expand Down Expand Up @@ -306,8 +308,8 @@ public String processRegister(
Connection connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

String sql = "SELECT username FROM users WHERE username = '" + username + "'";
Statement statement = connect.createStatement();
ResultSet result = statement.executeQuery(sql);
PreparedStatement statement = connect.prepareStatement(sql);
ResultSet result = statement.executeQuery();
if (result.first()) {
model.addAttribute("error", "Username '" + username + "' already exists!");
return "register";
Expand Down Expand Up @@ -349,30 +351,23 @@ public String processRegisterFinish(
}

Connection connect = null;
Statement sqlStatement = null;

PreparedStatement sqlStatement = null;
try {
// Get the Database Connection
logger.info("Creating the Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

/* START EXAMPLE VULNERABILITY */
// Execute the query
String mysqlCurrentDateTime = (new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"))
.format(Calendar.getInstance().getTime());
StringBuilder query = new StringBuilder();
query.append("insert into users (username, password, created_at, real_name, blab_name) values(");
query.append("'" + username + "',");
query.append("'" + md5(password) + "',");
query.append("'" + mysqlCurrentDateTime + "',");
query.append("'" + realName + "',");
query.append("'" + blabName + "'");
query.append(");");

sqlStatement = connect.createStatement();
sqlStatement.execute(query.toString());
logger.info(query.toString());
// Get the Database Connection
logger.info("Creating the Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
/* START EXAMPLE FIX */
// Execute the query
String mysqlCurrentDateTime = (new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"))
.format(Calendar.getInstance().getTime());
StringBuilder query = new StringBuilder();
query.append("insert into users (username, password, created_at, real_name, blab_name) values(");
query.append("'" + username + "', ");query.append("'" + md5(password) + "', ");query.append("'" + mysqlCurrentDateTime + "', ");query.append("'" + realName + "', ");query.append("'" + blabName + "'");
query.append(");");
sqlStatement = connect.prepareStatement(query.toString());
sqlStatement.execute();
logger.info(URLEncoder.encode(query.toString()));
/* END EXAMPLE VULNERABILITY */

emailUser(username);
Expand Down Expand Up @@ -435,7 +430,7 @@ public String showProfile(
HttpServletRequest httpRequest) {
logger.info("Entering showProfile");

String username = (String) httpRequest.getSession().getAttribute("username");
String username = (String) StringUtils.normalizeSpace(httpRequest.getSession().getAttribute("username"));
// Ensure user is logged in
if (username == null) {
logger.info("User is not Logged In - redirecting...");
Expand Down Expand Up @@ -484,9 +479,10 @@ public String showProfile(
}

// Get the users information
String sql = "SELECT username, real_name, blab_name FROM users WHERE username = '" + username + "'";
logger.info(sql);
String sql = "SELECT username, real_name, blab_name FROM users WHERE username =?";
logger.info(StringEscapeUtils.escapeJava(sql));
myInfo = connect.prepareStatement(sql);
myInfo.setString(1, username);
ResultSet myInfoResults = myInfo.executeQuery();
myInfoResults.next();

Expand Down Expand Up @@ -538,7 +534,7 @@ public String processProfile(
return "{\"message\": \"<script>alert('Error - please login');</script>\"}";
}

logger.info("User is Logged In - continuing... UA=" + request.getHeader("User-Agent") + " U=" + sessionUsername);
logger.info("User is Logged In - continuing... UA=" + StringEscapeUtils.escapeJava(request.getHeader("User-Agent")) + " U=" + sessionUsername);

String oldUsername = sessionUsername;

Expand Down Expand Up @@ -624,7 +620,7 @@ public String processProfile(
String extension = file.getOriginalFilename().substring(file.getOriginalFilename().lastIndexOf("."));
String path = imageDir + username + extension;

logger.info("Saving new profile image: " + path);
logger.info("Saving new profile image: " + StringUtils.normalizeSpace(path));

file.transferTo(new File(path)); // will delete any existing file first
} catch (IllegalStateException | IOException ex) {
Expand Down Expand Up @@ -654,11 +650,11 @@ public String downloadImage(
return Utils.redirect("login?target=profile");
}

logger.info("User is Logged In - continuing... UA=" + request.getHeader("User-Agent") + " U=" + sessionUsername);
logger.info("User is Logged In - continuing... UA=" + StringUtils.normalizeSpace(request.getHeader("User-Agent")) + " U=" + sessionUsername);

String path = context.getRealPath("/resources/images") + File.separator + imageName;

logger.info("Fetching profile image: " + path);
logger.info("Fetching profile image: " + StringUtils.normalizeSpace(path));

InputStream inputStream = null;
OutputStream outStream = null;
Expand All @@ -672,12 +668,12 @@ public String downloadImage(
// set to binary type if MIME mapping not found
mimeType = "application/octet-stream";
}
logger.info("MIME type: " + mimeType);
logger.info("MIME type: " + StringUtils.normalizeSpace(mimeType));

// Set content attributes for the response
response.setContentType(mimeType);
response.setContentType(URLEncoder.encode(mimeType, Charset.defaultCharset()));
response.setContentLength((int) downloadFile.length());
response.setHeader("Content-Disposition", "attachment; filename=" + imageName);
response.setHeader("Content-Disposition", "attachment; filename=" + URLEncoder.encode(imageName, Charset.defaultCharset()));

// get output stream of the response
outStream = response.getOutputStream();
Expand Down Expand Up @@ -757,7 +753,7 @@ private boolean usernameExists(String username) {
}
}

logger.info("Username: " + username + " already exists. Try again.");
logger.info("Username: " + StringEscapeUtils.escapeJava(username) + " already exists. Try again.");
return true;
}

Expand Down Expand Up @@ -811,7 +807,7 @@ private boolean updateUsername(String oldUsername, String newUsername) {
if (oldImage != null) {
String extension = oldImage.substring(oldImage.lastIndexOf("."));

logger.info("Renaming profile image from " + oldImage + " to " + newUsername + extension);
logger.info("Renaming profile image from " + URLEncoder.encode(oldImage.toString()) + " to " + newUsername + extension);
String path = context.getRealPath("/resources/images") + File.separator;

File oldName = new File(path + oldImage);
Expand Down