-
Notifications
You must be signed in to change notification settings - Fork 27
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #16 from austimkelly/log4j
add in a supply chain example that also uses CodeQL autobuild for java
- Loading branch information
Showing
10 changed files
with
228 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,10 @@ | ||
| ._ | ||
| .DS_Store | ||
|
|
||
| # Java build files | ||
| *.class | ||
| .idea | ||
|
|
||
| # Byte-compiled / optimized / DLL files | ||
| __pycache__/ | ||
| *.py[cod] | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| target/* |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4"> | ||
| <component name="FacetManager"> | ||
| <facet type="web" name="Web"> | ||
| <configuration> | ||
| <descriptors> | ||
| <deploymentDescriptor name="web.xml" url="file://$MODULE_DIR$/src/main/webapp/WEB-INF/web.xml" /> | ||
| </descriptors> | ||
| <webroots> | ||
| <root url="file://$MODULE_DIR$/src/main/webapp" relative="/" /> | ||
| </webroots> | ||
| <sourceRoots> | ||
| <root url="file://$MODULE_DIR$/src/main/java" /> | ||
| <root url="file://$MODULE_DIR$/src/main/resources" /> | ||
| </sourceRoots> | ||
| </configuration> | ||
| </facet> | ||
| </component> | ||
| <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8"> | ||
| <output url="file://$MODULE_DIR$/target/classes" /> | ||
| <output-test url="file://$MODULE_DIR$/target/test-classes" /> | ||
| <content url="file://$MODULE_DIR$"> | ||
| <sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" /> | ||
| <sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" /> | ||
| <sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" /> | ||
| <sourceFolder url="file://$MODULE_DIR$/src/test/resources" type="java-test-resource" /> | ||
| <excludeFolder url="file://$MODULE_DIR$/target" /> | ||
| </content> | ||
| <orderEntry type="inheritedJdk" /> | ||
| <orderEntry type="sourceFolder" forTests="false" /> | ||
| <orderEntry type="library" scope="PROVIDED" name="Maven: javax.servlet:javax.servlet-api:4.0.1" level="project" /> | ||
| <orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-api:5.7.1" level="project" /> | ||
| <orderEntry type="library" scope="TEST" name="Maven: org.apiguardian:apiguardian-api:1.1.0" level="project" /> | ||
| <orderEntry type="library" scope="TEST" name="Maven: org.opentest4j:opentest4j:1.2.0" level="project" /> | ||
| <orderEntry type="library" scope="TEST" name="Maven: org.junit.platform:junit-platform-commons:1.7.1" level="project" /> | ||
| <orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-engine:5.7.1" level="project" /> | ||
| <orderEntry type="library" scope="TEST" name="Maven: org.junit.platform:junit-platform-engine:1.7.1" level="project" /> | ||
| <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.14.1" level="project" /> | ||
| <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.14.1" level="project" /> | ||
| </component> | ||
| </module> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" | ||
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
| xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
|
|
||
| <groupId>com.example</groupId> | ||
| <artifactId>log4shell</artifactId> | ||
| <version>1.0-SNAPSHOT</version> | ||
| <name>log4shell</name> | ||
| <packaging>war</packaging> | ||
|
|
||
| <properties> | ||
| <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> | ||
| <maven.compiler.target>1.8</maven.compiler.target> | ||
| <maven.compiler.source>1.8</maven.compiler.source> | ||
| <junit.version>5.7.1</junit.version> | ||
| </properties> | ||
|
|
||
| <dependencies> | ||
| <dependency> | ||
| <groupId>javax.servlet</groupId> | ||
| <artifactId>javax.servlet-api</artifactId> | ||
| <version>4.0.1</version> | ||
| <scope>provided</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.junit.jupiter</groupId> | ||
| <artifactId>junit-jupiter-api</artifactId> | ||
| <version>${junit.version}</version> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.junit.jupiter</groupId> | ||
| <artifactId>junit-jupiter-engine</artifactId> | ||
| <version>${junit.version}</version> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <!-- <dependency> | ||
| <groupId>com.sun.deploy.net</groupId> | ||
| <artifactId>HttpRequest</artifactId> | ||
| <version>1.8</version> | ||
| </dependency> --> | ||
| <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core --> | ||
| <dependency> | ||
| <groupId>org.apache.logging.log4j</groupId> | ||
| <artifactId>log4j-core</artifactId> | ||
| <version>2.14.1</version> | ||
| </dependency> | ||
| <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-api --> | ||
| <dependency> | ||
| <groupId>org.apache.logging.log4j</groupId> | ||
| <artifactId>log4j-api</artifactId> | ||
| <version>2.14.1</version> | ||
| </dependency> | ||
| </dependencies> | ||
| <build> | ||
| <plugins> | ||
| <plugin> | ||
| <groupId>org.apache.maven.plugins</groupId> | ||
| <artifactId>maven-war-plugin</artifactId> | ||
| <version>3.3.1</version> | ||
| </plugin> | ||
| </plugins> | ||
| </build> | ||
|
|
||
|
|
||
| </project> |
41 changes: 41 additions & 0 deletions
41
supply-chain/vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| package com.example.log4shell; | ||
|
|
||
| import java.io.*; | ||
| import javax.servlet.ServletException; | ||
| import javax.servlet.http.*; | ||
| import javax.servlet.annotation.*; | ||
|
|
||
| //import com.sun.deploy.net.HttpRequest; | ||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
|
|
||
|
|
||
| @WebServlet(name = "loginServlet", value = "/login") | ||
| public class LoginServlet extends HttpServlet { | ||
|
|
||
| @Override | ||
| protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { | ||
|
|
||
| String userName = req.getParameter("uname"); | ||
| String password = req.getParameter("password"); | ||
|
|
||
| resp.setContentType("text/html"); | ||
| PrintWriter out = resp.getWriter(); | ||
| out.println("<html><body>"); | ||
|
|
||
| if(userName.equals("admin") && password.equals("password")){ | ||
| out.println("Welcome Back Admin"); | ||
| } | ||
| else{ | ||
|
|
||
| // vulnerable code | ||
| Logger logger = LogManager.getLogger(com.example.log4shell.log4j.class); | ||
| logger.error(userName); | ||
|
|
||
| out.println("<code> the password you entered was invalid, <u> we will log your information </u> </code>"); | ||
| } | ||
| } | ||
|
|
||
| public void destroy() { | ||
| } | ||
| } |
9 changes: 9 additions & 0 deletions
9
supply-chain/vulnerable-application/src/main/java/com/example/log4shell/log4j.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package com.example.log4shell; | ||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
|
|
||
| public class log4j { | ||
| private static final Logger logger = LogManager.getLogger(log4j.class); | ||
|
|
||
| } |
6 changes: 6 additions & 0 deletions
6
supply-chain/vulnerable-application/src/main/webapp/WEB-INF/web.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" | ||
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
| xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" | ||
| version="4.0"> | ||
| </web-app> |
40 changes: 40 additions & 0 deletions
40
supply-chain/vulnerable-application/src/main/webapp/index.jsp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| <!doctype html> | ||
| <html lang="en"> | ||
| <head> | ||
| <meta charset="utf-8"> | ||
| <meta http-equiv="X-UA-Compatible" content="IE=edge"> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1"> | ||
| <link href="https://unpkg.com/tailwindcss@2.2.4/dist/tailwind.min.css" rel="stylesheet"> | ||
| </head> | ||
| <body> | ||
| <div class="h-screen flex"> | ||
| <div class="flex w-1/2 bg-gradient-to-tr from-blue-800 to-purple-700 i justify-around items-center"> | ||
| <div> | ||
| <h1 class="text-white font-bold text-4xl font-sans">GoFinance</h1> | ||
| <p class="text-white mt-1">The most popular peer to peer lending at SEA</p> | ||
| <button type="submit" class="block w-28 bg-white text-indigo-800 mt-4 py-2 rounded-2xl font-bold mb-2">Read More</button> | ||
| </div> | ||
| </div> | ||
| <div class="flex w-1/2 justify-center items-center bg-white"> | ||
| <form class="bg-white" method="POST" action="/login"> | ||
| <h1 class="text-gray-800 font-bold text-2xl mb-1">Hello Again!</h1> | ||
| <p class="text-sm font-normal text-gray-600 mb-7">Welcome Back</p> | ||
| <div class="flex items-center border-2 py-2 px-3 rounded-2xl mb-4"> | ||
| <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor"> | ||
| <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M16 12a4 4 0 10-8 0 4 4 0 008 0zm0 0v1.5a2.5 2.5 0 005 0V12a9 9 0 10-9 9m4.5-1.206a8.959 8.959 0 01-4.5 1.207" /> | ||
| </svg> | ||
| <input class="pl-2 outline-none border-none" type="text" name="uname" placeholder="Username" /> | ||
| </div> | ||
| <div class="flex items-center border-2 py-2 px-3 rounded-2xl"> | ||
| <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 text-gray-400" viewBox="0 0 20 20" fill="currentColor"> | ||
| <path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd" /> | ||
| </svg> | ||
| <input class="pl-2 outline-none border-none" type="text" name="password" placeholder="Password" /> | ||
| </div> | ||
| <button type="submit" class="block w-full bg-indigo-600 mt-4 py-2 rounded-2xl text-white font-semibold mb-2">Login</button> | ||
| <span class="text-sm ml-2 hover:text-blue-500 cursor-pointer">Forgot Password ?</span> | ||
| </form> | ||
| </div> | ||
| </div> | ||
| </body> | ||
| </html> |