Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add 201 parametric crypto (JCA) misuses #427

Open
wants to merge 96 commits into
base: master
Choose a base branch
from

Conversation

akwick
Copy link
Member

@akwick akwick commented Mar 7, 2019

All misuses are listed in the dataset.yml-file (JCA-Param-All).

Removed Vidyas dataset through commit b7e53c6.

Vidya N and others added 30 commits June 6, 2018 00:58
…(unable to build with gradle)

- added new data sets
- correted function definitions in each misuse
- added missing misuse in nettygameserver dataset
- removed unneccesary correct-usages from selected data sets. Now correct-usages only have file with correct usage of the respective misuse.
- added data sets for gradle projects
- updated paths in dragonite-java data set
akwick added 4 commits May 8, 2019 16:56
Minimize corrected examples for misuses

Minimize correct example for instagram4j

Add correct usages for jeesuite-libs

Minimized corrected examples

Add correct usage for dragonite-java

Add minimal corrected examples
Add some clarifications or minor changes for the description while
inspecting the misuse.yml for minimizing the corrected examples.

Minor changes in misuse.ymls

Minor change

Minor changes
@akwick
Copy link
Member Author

akwick commented May 15, 2019

Thank you very much for preparing this Pull Request. The number of misuse examples you gathered is impressive and a huge contribution to the research community. I'm happy to accept this PR into MUBench, after cleanup.

I'm currently trying to compile the dataset. I'll report if there's any failures. Afterwards, I'll run a test experiment to ensure that all builds produce correct data for running detectors. For the time being, please find detailed comments inline and some more general comments here:

* Please improve the correct usage examples:
  
  1. They should be minimal examples of correct usage, corresponding to the respective misuse.
  2. They should not be copies of files from other projects, since this might violate respective licenses.
  3. They should not contain Chinese/Japanese comments, commented out code, ...

Addressed in commit 8cbfda3.

* Please remove the `.DS_Store` files.

* Please do not make `detectors/Findbugs/configs/core-all-api-misuses.xml` executable.

Findbugs

* This PR seems to contain data for a second experiment with Findbugs. Can the two be separated into two PRs?

* Please do not add a detector JAR (`Findbugs.jar`) to the benchmark. Detector jars are downloaded during runtime.

* What's the difference between `security-api-misuses.xml` and `security-api-misuse.xml`?

Signed-off-by: Anna-Katharina Wickert <wickert@st.informatik.tu-darmstadt.de>
Signed-off-by: Anna-Katharina Wickert <wickert@st.informatik.tu-darmstadt.de>
All identified misuses are due to the JCA and the JCA isn't part of any
project added. Thus, the flag should be false.
The complete dataset contains some projects which are currently not
compilable.
@akwick
Copy link
Member Author

akwick commented May 16, 2019

[INFO   ] Compiling project 'abixen-platform' version 99fe499...
[ERROR  ] Exception in CompileVersionTask: Failed to execute 'mvn dependency:build-classpath -DincludeScope=compile -pl :abixen-platform-web-content-service -am clean install':
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-checkstyle-plugin:2.17:check (validate) on project abixen-platform-web-content-service: Failed during checkstyle execution: Unable to find configuration file at location: ../../abixen-platform/checkstyle.xml: Could not find resource '../../abixen-platform/checkstyle.xml'. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <goals> -rf :abixen-platform-web-content-service

abixen-platform is already removed from the set of the projects which didn't compile currently.

We have to remove the two misuses of openzaly as this project isn't
available any more on GitHub.
We have to remove the two misuses of the openzaly projects as the project isn't publicy available any more.

Remove openzaly

We have to remove the two misuses of openzaly as this project isn't
available any more on GitHub.

Remove openzaly data
@akwick
Copy link
Member Author

akwick commented May 16, 2019

[INFO   ] Fetching project 'openzaly' version 91bd03b from git:https://github.com/akaxincom/openzaly#91bd03be...
[ERROR  ] Exception in CheckoutTask: Failed to execute 'git clone https://github.com/akaxincom/openzaly . --quiet -c core.askpass=true': === ERROR ===
remote: Repository not found.
fatal: Authentication failed for 'https://github.com/akaxincom/openzaly/'

:( I had to remove this project from the dataset in commit db6c7b2.

@akwick
Copy link
Member Author

akwick commented May 16, 2019

[INFO   ] Compiling project 'public-cms' version f2c72f0...
[ERROR  ] Exception in CompileVersionTask: Failed to execute 'mvn dependency:build-classpath -DincludeScope=compile clean compile':
[ERROR] The goal you specified requires a project to execute but there is no POM in this directory (/mubench/checkouts/public-cms/f2c72f0/build). Please verify you invoked Maven from the correct directory. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MissingProjectException

This issue is fixed with commit 1a58711.

mubench> pipeline compile --only public-cms
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.

@akwick
Copy link
Member Author

akwick commented May 16, 2019

[INFO   ] Compiling project 'symmetric-ds' version c42f0e0...
[ERROR  ] Exception in CompileVersionTask: Failed to execute 'gradle :compileJava --debug':

Fix this issue in commit 2a5971f.

mubench> pipeline compile --force-compile --only  symmetric-ds
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Compiling project 'symmetric-ds' version c42f0e0...

mubench> pipeline compile --only ha-bridge --force-compile
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Compiling project 'ha-bridge' version c25f08f...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.2'...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.3'...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.4'...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.5'...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.6'...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.7'...
[INFO   ] Compiling correct usage for misuse 'ha-bridge.c25f08f.8'..
pipeline compile --only instagram4j
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Compiling correct usage for misuse 'instagram4j.ae85b2b.1'...
mubench> pipeline compile --only jeesuite-libs
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Compiling correct usage for misuse 'jeesuite-libs.2a545bd.3'...
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
mubench> pipeline compile --only nettygameserver
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Correct usage already compiled.
[INFO   ] Compiling correct usage for misuse 'nettygameserver.c069be1.2'...
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
mubench> pipeline compile --only smart
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Compiling correct usage for misuse 'smart.9e018a6.6'...
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled
mubench> pipeline compile --only whatsmars
[INFO   ] Starting benchmark...
[INFO   ] All requirements satisfied. You're good to go.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Compiling correct usage for misuse 'whatsmars.917b029.6'...
[INFO   ] Correct usage already compiled.
[INFO   ] Compiling correct usage for misuse 'whatsmars.917b029.8'...
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
[INFO   ] Correct usage already compiled.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants