diff --git a/java/example1/.classpath b/java/example1/.classpath deleted file mode 100644 index 75b806f..0000000 --- a/java/example1/.classpath +++ /dev/null @@ -1,44 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/java/example1/.gitignore b/java/example1/.gitignore new file mode 100644 index 0000000..463a029 --- /dev/null +++ b/java/example1/.gitignore @@ -0,0 +1,27 @@ +target/ +build/ +.gradle/ +pom.xml.tag +pom.xml.releaseBackup +pom.xml.versionsBackup +pom.xml.next +test-output/ +/doc +*.iml +*.idea +*.log +/.idea +.checkstyle + +# Eclipse metadata +.settings/ +.project +.factorypath +.classpath +-project +/.resourceCache +/.project + +# Annotation processor metadata +.apt_generated/ +.apt_generated_tests/ diff --git a/java/example1/.project b/java/example1/.project deleted file mode 100644 index 700a32c..0000000 --- a/java/example1/.project +++ /dev/null @@ -1,23 +0,0 @@ - - - my-app - - - - - - org.eclipse.jdt.core.javabuilder - - - - - org.eclipse.m2e.core.maven2Builder - - - - - - org.eclipse.jdt.core.javanature - org.eclipse.m2e.core.maven2Nature - - diff --git a/java/example1/LICENSE.txt b/java/example1/LICENSE.txt new file mode 100644 index 0000000..20acdfe --- /dev/null +++ b/java/example1/LICENSE.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2021 Zup Java + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/java/example1/build.gradle b/java/example1/build.gradle new file mode 100644 index 0000000..e2705cf --- /dev/null +++ b/java/example1/build.gradle @@ -0,0 +1,19 @@ +plugins { + id 'java' +} + +group 'br.com.zup.vulnerabilities' +version '1.0.0-SNAPSHOT' + +repositories { + mavenCentral() +} + +dependencies { + testImplementation 'org.junit.jupiter:junit-jupiter-api:5.7.2' + testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.7.2' +} + +test { + useJUnitPlatform() +} \ No newline at end of file diff --git a/java/example1/gradle/wrapper/gradle-wrapper.properties b/java/example1/gradle/wrapper/gradle-wrapper.properties new file mode 100644 index 0000000..69a9715 --- /dev/null +++ b/java/example1/gradle/wrapper/gradle-wrapper.properties @@ -0,0 +1,5 @@ +distributionBase=GRADLE_USER_HOME +distributionPath=wrapper/dists +distributionUrl=https\://services.gradle.org/distributions/gradle-7.1-bin.zip +zipStoreBase=GRADLE_USER_HOME +zipStorePath=wrapper/dists diff --git a/java/example1/gradlew b/java/example1/gradlew new file mode 100755 index 0000000..744e882 --- /dev/null +++ b/java/example1/gradlew @@ -0,0 +1,185 @@ +#!/usr/bin/env sh + +# +# Copyright 2015 the original author or authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +############################################################################## +## +## Gradle start up script for UN*X +## +############################################################################## + +# Attempt to set APP_HOME +# Resolve links: $0 may be a link +PRG="$0" +# Need this for relative symlinks. +while [ -h "$PRG" ] ; do + ls=`ls -ld "$PRG"` + link=`expr "$ls" : '.*-> \(.*\)$'` + if expr "$link" : '/.*' > /dev/null; then + PRG="$link" + else + PRG=`dirname "$PRG"`"/$link" + fi +done +SAVED="`pwd`" +cd "`dirname \"$PRG\"`/" >/dev/null +APP_HOME="`pwd -P`" +cd "$SAVED" >/dev/null + +APP_NAME="Gradle" +APP_BASE_NAME=`basename "$0"` + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD="maximum" + +warn () { + echo "$*" +} + +die () { + echo + echo "$*" + echo + exit 1 +} + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "`uname`" in + CYGWIN* ) + cygwin=true + ;; + Darwin* ) + darwin=true + ;; + MSYS* | MINGW* ) + msys=true + ;; + NONSTOP* ) + nonstop=true + ;; +esac + +CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD="$JAVA_HOME/jre/sh/java" + else + JAVACMD="$JAVA_HOME/bin/java" + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD="java" + which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." +fi + +# Increase the maximum file descriptors if we can. +if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then + MAX_FD_LIMIT=`ulimit -H -n` + if [ $? -eq 0 ] ; then + if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then + MAX_FD="$MAX_FD_LIMIT" + fi + ulimit -n $MAX_FD + if [ $? -ne 0 ] ; then + warn "Could not set maximum file descriptor limit: $MAX_FD" + fi + else + warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" + fi +fi + +# For Darwin, add options to specify how the application appears in the dock +if $darwin; then + GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" +fi + +# For Cygwin or MSYS, switch paths to Windows format before running java +if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then + APP_HOME=`cygpath --path --mixed "$APP_HOME"` + CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` + + JAVACMD=`cygpath --unix "$JAVACMD"` + + # We build the pattern for arguments to be converted via cygpath + ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` + SEP="" + for dir in $ROOTDIRSRAW ; do + ROOTDIRS="$ROOTDIRS$SEP$dir" + SEP="|" + done + OURCYGPATTERN="(^($ROOTDIRS))" + # Add a user-defined pattern to the cygpath arguments + if [ "$GRADLE_CYGPATTERN" != "" ] ; then + OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" + fi + # Now convert the arguments - kludge to limit ourselves to /bin/sh + i=0 + for arg in "$@" ; do + CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` + CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option + + if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition + eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` + else + eval `echo args$i`="\"$arg\"" + fi + i=`expr $i + 1` + done + case $i in + 0) set -- ;; + 1) set -- "$args0" ;; + 2) set -- "$args0" "$args1" ;; + 3) set -- "$args0" "$args1" "$args2" ;; + 4) set -- "$args0" "$args1" "$args2" "$args3" ;; + 5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; + 6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; + 7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; + 8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; + 9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; + esac +fi + +# Escape application args +save () { + for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done + echo " " +} +APP_ARGS=`save "$@"` + +# Collect all arguments for the java command, following the shell quoting and substitution rules +eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" + +exec "$JAVACMD" "$@" diff --git a/java/example1/gradlew.bat b/java/example1/gradlew.bat new file mode 100644 index 0000000..ac1b06f --- /dev/null +++ b/java/example1/gradlew.bat @@ -0,0 +1,89 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem + +@if "%DEBUG%" == "" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%" == "" set DIRNAME=. +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if "%ERRORLEVEL%" == "0" goto execute + +echo. +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* + +:end +@rem End local scope for the variables with windows NT shell +if "%ERRORLEVEL%"=="0" goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 +exit /b 1 + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/java/example1/pom.xml b/java/example1/pom.xml deleted file mode 100644 index df3e4c5..0000000 --- a/java/example1/pom.xml +++ /dev/null @@ -1,53 +0,0 @@ - - - - 4.0.0 - com.mycompany.app - my-app - jar - 1.0-SNAPSHOT - my-app - http://maven.apache.org - - - junit - junit - 3.8.1 - test - - - - - - - org.apache.maven.plugins - maven-jar-plugin - 3.0.2 - - - - true - lib/ - com.mycompany.app.App - - - - - - - diff --git a/java/example1/settings.gradle b/java/example1/settings.gradle new file mode 100644 index 0000000..16c6dc6 --- /dev/null +++ b/java/example1/settings.gradle @@ -0,0 +1,2 @@ +rootProject.name = 'code-vulnerabilities' + diff --git a/java/example1/src/main/java/com/mycompany/app/App.java b/java/example1/src/main/java/br/com/zup/vulnerabilities/random/RandomIssue.java similarity index 72% rename from java/example1/src/main/java/com/mycompany/app/App.java rename to java/example1/src/main/java/br/com/zup/vulnerabilities/random/RandomIssue.java index 4c90bc5..5df6b90 100644 --- a/java/example1/src/main/java/com/mycompany/app/App.java +++ b/java/example1/src/main/java/br/com/zup/vulnerabilities/random/RandomIssue.java @@ -13,20 +13,15 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +package br.com.zup.vulnerabilities.random; -package com.mycompany.app; import java.util.Random; -/** - * Hello world! - * - */ -public class App -{ - public static void main( String[] args ) - { - Random rand = new Random(); - System.out.println(rand.nextInt(50)); - System.out.println( "Hello World!" ); +public class RandomIssue { + + public static void main(String[] args) { + Random random = new Random(); + System.out.println(random.nextInt(50)); + System.out.println("Hello World!"); } -} +} \ No newline at end of file diff --git a/java/example1/src/main/java/br/com/zup/vulnerabilities/random/RandomSecure.java b/java/example1/src/main/java/br/com/zup/vulnerabilities/random/RandomSecure.java new file mode 100644 index 0000000..bc43573 --- /dev/null +++ b/java/example1/src/main/java/br/com/zup/vulnerabilities/random/RandomSecure.java @@ -0,0 +1,27 @@ +/* + * Copyright 2021 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package br.com.zup.vulnerabilities.random; + +import java.util.concurrent.ThreadLocalRandom; + +public class RandomSecure { + + public static void main(String[] args) { + ThreadLocalRandom random = ThreadLocalRandom.current(); + System.out.println(random.nextInt(50)); + System.out.println("Hello World!"); + } +} diff --git a/java/example1/src/test/java/com/mycompany/app/AppTest.java b/java/example1/src/main/java/br/com/zup/vulnerabilities/trust/AllTrustManagerIssue.java similarity index 51% rename from java/example1/src/test/java/com/mycompany/app/AppTest.java rename to java/example1/src/main/java/br/com/zup/vulnerabilities/trust/AllTrustManagerIssue.java index 48d7d16..0723af8 100644 --- a/java/example1/src/test/java/com/mycompany/app/AppTest.java +++ b/java/example1/src/main/java/br/com/zup/vulnerabilities/trust/AllTrustManagerIssue.java @@ -13,42 +13,24 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +package br.com.zup.vulnerabilities.trust; -package com.mycompany.app; +import javax.net.ssl.*; -import junit.framework.Test; -import junit.framework.TestCase; -import junit.framework.TestSuite; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; -/** - * Unit test for simple App. - */ -public class AppTest - extends TestCase -{ - /** - * Create the test case - * - * @param testName name of the test case - */ - public AppTest( String testName ) - { - super( testName ); +public class AllTrustManagerIssue implements X509TrustManager { + + public X509Certificate[] getAcceptedIssuers() { + return new X509Certificate[0]; } - /** - * @return the suite of tests being tested - */ - public static Test suite() - { - return new TestSuite( AppTest.class ); + public void checkClientTrusted(X509Certificate[] arg0, String arg1) + throws CertificateException { } - /** - * Rigourous Test :-) - */ - public void testApp() - { - assertTrue( true ); + public void checkServerTrusted(X509Certificate[] arg0, String arg1) + throws CertificateException { } -} +} \ No newline at end of file diff --git a/java/example1/src/main/java/br/com/zup/vulnerabilities/trust/AllTrustSSLSocketFactoryIssue.java b/java/example1/src/main/java/br/com/zup/vulnerabilities/trust/AllTrustSSLSocketFactoryIssue.java new file mode 100644 index 0000000..f1ac424 --- /dev/null +++ b/java/example1/src/main/java/br/com/zup/vulnerabilities/trust/AllTrustSSLSocketFactoryIssue.java @@ -0,0 +1,78 @@ +/* + * Copyright 2021 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package br.com.zup.vulnerabilities.trust; + +import java.io.IOException; +import java.net.InetAddress; +import java.net.Socket; + +import javax.net.SocketFactory; +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLSocketFactory; +import javax.net.ssl.TrustManager; + +public class AllTrustSSLSocketFactoryIssue extends SSLSocketFactory { + private SSLSocketFactory factory; + + public AllTrustSSLSocketFactoryIssue() { + System.out.println("DummySocketFactory instantiated"); + try { + SSLContext sslcontext = SSLContext.getInstance("TLS"); + sslcontext.init(null, // No KeyManager required + new TrustManager[] + {new AllTrustManagerIssue()}, new java.security.SecureRandom()); + factory = (SSLSocketFactory) sslcontext.getSocketFactory(); + + } catch (Exception ex) { + ex.printStackTrace(); + } + } + + public static SocketFactory getDefault() { + return new AllTrustSSLSocketFactoryIssue(); + } + + public Socket createSocket(Socket socket, String s, int i, boolean flag) + throws IOException { + return factory.createSocket(socket, s, i, flag); + } + + public Socket createSocket(InetAddress inaddr, int i, InetAddress inaddr1, + int j) throws IOException { + return factory.createSocket(inaddr, i, inaddr1, j); + } + + public Socket createSocket(InetAddress inaddr, int i) throws IOException { + return factory.createSocket(inaddr, i); + } + + public Socket createSocket(String s, int i, InetAddress inaddr, int j) + throws IOException { + return factory.createSocket(s, i, inaddr, j); + } + + public Socket createSocket(String s, int i) throws IOException { + return factory.createSocket(s, i); + } + + public String[] getDefaultCipherSuites() { + return factory.getSupportedCipherSuites(); + } + + public String[] getSupportedCipherSuites() { + return factory.getSupportedCipherSuites(); + } +} \ No newline at end of file