@Test
  public void abuseWeaknessNoNamespaceIdTest() throws Exception {

    SoapTestDocument soap = new SoapTestDocument();
    Document doc = soap.getDocument();

    Element signed = soap.getDummyPayloadBody();
    String id = "signed";
    Attr idAttr = doc.createAttribute("ID");
    idAttr.setTextContent(id);
    signed.setAttributeNode(idAttr);

    Element payload = (Element) signed.cloneNode(true);

    soap.getHeader().appendChild(payload);

    String xpath = "/soapenv:Envelope//*[@ID='" + id + "']";
    log.info("Using XPath: " + xpath);
    AbsoluteLocationPath abs = new AbsoluteLocationPath(xpath);
    Step step = abs.getRelativeLocationPaths().get(2);

    XPathAttributeWeaknessPostProcess aw = new XPathAttributeWeaknessPostProcess(step);

    assertEquals(3, aw.getNumberOfPossibilities());

    Attr sa, pa;

    aw.abuseWeakness(0, new SignedElement(signed, null), new PayloadElement(payload, null));
    log.info("abuseWeakness(0, signed, payload)\n" + domToString(doc, true));
    sa = signed.getAttributeNode("ID");
    pa = payload.getAttributeNode("ID");
    assertNotNull(sa);
    assertNotNull(pa);
    assertEquals(sa.getTextContent(), id);
    assertFalse(pa.getTextContent().isEmpty());
    assertFalse(pa.getTextContent().equals(id));
    assertFalse(sa.getTextContent().equals(pa.getTextContent()));

    aw.abuseWeakness(2, new SignedElement(signed, null), new PayloadElement(payload, null));
    log.info("abuseWeakness(2, signed, payload)\n" + domToString(doc, true));
    sa = signed.getAttributeNode("ID");
    pa = payload.getAttributeNode("ID");
    assertNotNull(sa);
    assertNotNull(pa);
    assertEquals(sa.getTextContent(), id);
    assertFalse(pa.getTextContent().isEmpty());
    assertEquals(sa.getTextContent(), pa.getTextContent());

    aw.abuseWeakness(1, new SignedElement(signed, null), new PayloadElement(payload, null));
    log.info("abuseWeakness(1, signed, payload)\n" + domToString(doc, true));
    sa = signed.getAttributeNode("ID");
    pa = payload.getAttributeNode("ID");
    assertNotNull(sa);
    assertNull(pa);
    assertEquals(sa.getTextContent(), id);
  }
Ejemplo n.º 2
0
  /**
   * Validates if the given XPath follows the FastXPath grammar but without prefixes. This is known
   * to be most secure.
   *
   * @return
   */
  public boolean isPrefixfreeTransformedFastXPath() {
    for (Step step : xpath.getRelativeLocationPaths()) {
      if (!step.getAxisSpecifier().getAxisName().toFullString().equals("child")) {
        return false;
      }
      if (step.getAxisSpecifier().getNodeName() != null) {
        return false;
      }
      if (step.getAxisSpecifier().getNodeType() == null) {
        return false;
      }
      if (!step.getAxisSpecifier().getNodeType().getNodeTypeName().equals("node")) {
        return false;
      }

      List<Predicate> predicates = step.getPredicates();
      if (predicates.isEmpty() || predicates.size() > 3) {
        return false;
      }
      int positions = 0;
      int attributes = 0;
      int ln = 0;
      int uri = 0;
      for (Predicate pred : step.getPredicates()) {
        if (pred.getOrExpressions().size() != 1) {
          return false;
        }
        if (pred.getOrExpressions().get(0).getAndExpressions().size() != 1) {
          List<AndExpression> andExpressions = pred.getOrExpressions().get(0).getAndExpressions();
          if (andExpressions.size() > 2 || andExpressions.size() < 1) {
            return false;
          }
          for (AndExpression and : andExpressions) {
            if (and instanceof LocalNameAndExpression) {
              ++ln;
            } else if (and instanceof NamespaceUriAndExpression) {
              ++uri;
            }
          }
        } else {
          AndExpression and = pred.getOrExpressions().get(0).getAndExpressions().get(0);
          if (and instanceof PositionAndExpression) {
            ++positions;
          } else if (and instanceof AttributeAndExpression) {
            ++attributes;
          }
        }
      }
      if (ln != 1 || uri != 1 || positions > 1 || attributes > 1 || (attributes + positions) == 0) {
        return false;
      }
    }
    return true;
  }
Ejemplo n.º 3
0
  /**
   * Validates if the given XPath follows the FastXPath grammar. These are known to be fast and only
   * vulnerable to namespace injection.
   *
   * @return
   */
  public boolean isFastXPath() {
    for (Step step : xpath.getRelativeLocationPaths()) {
      if (!step.getAxisSpecifier().getAxisName().toFullString().equals("child")) {
        return false;
      }
      if (step.getAxisSpecifier().getNodeType() != null) {
        return false;
      }
      if (step.getAxisSpecifier().getNodeName() == null) {
        return false;
      }
      // if (step.getAxisSpecifier().getNodeName().getPrefix().isEmpty())
      // return false;
      if (step.getAxisSpecifier().getNodeName().getNodeName().isEmpty()) {
        return false;
      }

      List<Predicate> predicates = step.getPredicates();
      if (predicates.isEmpty() || predicates.size() > 2) {
        return false;
      }
      int positions = 0;
      int attributes = 0;
      for (Predicate pred : step.getPredicates()) {
        if (pred.getOrExpressions().size() != 1) {
          return false;
        }
        if (pred.getOrExpressions().get(0).getAndExpressions().size() != 1) {
          return false;
        }
        AndExpression and = pred.getOrExpressions().get(0).getAndExpressions().get(0);
        if (and instanceof PositionAndExpression) {
          ++positions;
        } else if (and instanceof AttributeAndExpression) {
          ++attributes;
        }
      }
      if (positions > 1 || attributes > 1 || (attributes + positions) == 0) {
        return false;
      }
    }
    return true;
  }