/* goodG2B() - use goodsource and badsink by changing the first "if" so that both branches use the GoodSource */ private void goodG2B(HttpServletRequest request, HttpServletResponse response) throws Throwable { int data; if (IO.static_returns_t_or_f()) { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } if (IO.static_returns_t_or_f()) { int valueToSub = (new SecureRandom()).nextInt(99) + 1; /* subtracting at least 1 */ /* POTENTIAL FLAW: if (data-valueToSub) < MIN_VALUE this will underflow */ int result = (data - valueToSub); IO.writeLine("result: " + result); } else { int valueToSub = (new SecureRandom()).nextInt(99) + 1; /* subtracting at least 1 */ /* POTENTIAL FLAW: if (data-valueToSub) < MIN_VALUE this will underflow */ int result = (data - valueToSub); IO.writeLine("result: " + result); } }
/* goodG2B() - use goodsource and badsink by changing the first "if" so that both branches use the GoodSource */ private void goodG2B() throws Throwable { int data; if (IO.static_returns_t_or_f()) { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } if (IO.static_returns_t_or_f()) { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data < 0) /* ensure we don't have an overflow */ { /* POTENTIAL FLAW: if (data*valueToMult) < MIN_VALUE, this will overflow */ int result = (data * valueToMult); IO.writeLine("result: " + result); } } else { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data < 0) /* ensure we don't have an overflow */ { /* POTENTIAL FLAW: if (data*valueToMult) < MIN_VALUE, this will overflow */ int result = (data * valueToMult); IO.writeLine("result: " + result); } } }
public void bad() throws Throwable { int data; if (IO.static_returns_t_or_f()) { Logger log_bad = Logger.getLogger("local-logger"); /* init data */ data = -1; /* retrieve the "pid" property */ Properties props = new Properties(); FileInputStream finstr = null; try { finstr = new FileInputStream("../common/config.properties"); props.load(finstr); String s_data = props.getProperty("pid"); data = Integer.parseInt(s_data.trim()); } catch (IOException ioe) { log_bad.warning("Error with stream reading"); } catch (NumberFormatException nfe) { log_bad.warning("Error with number parsing"); } finally { /* clean up stream reading objects */ try { if (finstr != null) { finstr.close(); } } catch (IOException ioe) { log_bad.warning("Error closing buffread"); } } } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } if (IO.static_returns_t_or_f()) { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data > 0) /* ensure we don't have an underflow */ { /* POTENTIAL FLAW: if (data*valueToMult) > MAX_VALUE, this will overflow */ int result = (data * valueToMult); IO.writeLine("result: " + result); } } else { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data > 0) /* ensure we don't have an underflow */ { int result = 0; /* FIX: Add a check to prevent an overflow from occurring */ if (data <= (Integer.MAX_VALUE / valueToMult)) { result = (data * valueToMult); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too large to perform multiplication."); } } } }
public void bad() throws Throwable { String data; if (IO.static_returns_t_or_f()) { Logger log_bad = Logger.getLogger("local-logger"); data = ""; /* init data */ /* retrieve the property */ Properties props = new Properties(); FileInputStream finstr = null; try { finstr = new FileInputStream("../common/config.properties"); props.load(finstr); data = props.getProperty("data"); } catch (IOException ioe) { log_bad.warning("Error with stream reading"); } finally { /* clean up stream reading objects */ try { if (finstr != null) { finstr.close(); } } catch (IOException ioe) { log_bad.warning("Error closing buffread"); } } } else { data = "5"; } if (IO.static_returns_t_or_f()) { int loopNum; try { loopNum = Integer.parseInt(data); } catch (NumberFormatException nfe) { IO.writeLine("Invalid response. Numeric input expected. Assuming 1."); loopNum = 1; } for (int i = 0; i < loopNum; i++) { /* POTENTIAL FLAW: user supplied input used for loop counter test */ IO.writeLine("hello world"); } } else { int loopNum; try { loopNum = Integer.parseInt(data); } catch (NumberFormatException nfe) { IO.writeLine("Invalid response. Numeric input expected. Assuming 1."); loopNum = 1; } /* FIX: loop number thresholds validated */ if (loopNum >= 0 && loopNum <= 5) { for (int i = 0; i < loopNum; i++) { IO.writeLine("hello world"); } } } }
/* goodB2G() - use badsource and goodsink by changing the second "if" so that both branches use the GoodSink */ private void goodB2G(HttpServletRequest request, HttpServletResponse response) throws Throwable { int data; if (IO.static_returns_t_or_f()) { Logger log_bad = Logger.getLogger("local-logger"); /* init Data$ */ data = -1; /* read parameter from request */ String s_data = request.getParameter("name"); data = Integer.parseInt(s_data.trim()); } else { Logger log_bad = Logger.getLogger("local-logger"); /* init Data$ */ data = -1; /* read parameter from request */ String s_data = request.getParameter("name"); data = Integer.parseInt(s_data.trim()); } if (IO.static_returns_t_or_f()) { int valueToSub = (new SecureRandom()).nextInt(99) + 1; /* subtracting at least 1 */ int result = 0; /* FIX: Add a check to prevent an underflow from occurring */ if (data >= (Integer.MIN_VALUE + valueToSub)) { result = (data - valueToSub); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too small to perform subtraction."); } } else { int valueToSub = (new SecureRandom()).nextInt(99) + 1; /* subtracting at least 1 */ int result = 0; /* FIX: Add a check to prevent an underflow from occurring */ if (data >= (Integer.MIN_VALUE + valueToSub)) { result = (data - valueToSub); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too small to perform subtraction."); } } }
/* goodB2G() - use badsource and goodsink by changing the second "if" so that both branches use the GoodSink */ private void goodB2G() throws Throwable { int data; if (IO.static_returns_t_or_f()) { /* POTENTIAL FLAW: Use the minimum value for an int */ data = Integer.MIN_VALUE; } else { /* POTENTIAL FLAW: Use the minimum value for an int */ data = Integer.MIN_VALUE; } if (IO.static_returns_t_or_f()) { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data < 0) /* ensure we don't have an overflow */ { int result = 0; /* FIX: Add a check to prevent an underflow from occurring */ if (data >= (Integer.MIN_VALUE / valueToMult)) { result = (data * valueToMult); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too small to perform multiplication."); } } } else { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data < 0) /* ensure we don't have an overflow */ { int result = 0; /* FIX: Add a check to prevent an underflow from occurring */ if (data >= (Integer.MIN_VALUE / valueToMult)) { result = (data * valueToMult); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too small to perform multiplication."); } } } }
public void bad() throws Throwable { int data; if (IO.static_returns_t_or_f()) { /* POTENTIAL FLAW: Use the minimum value for an int */ data = Integer.MIN_VALUE; } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } if (IO.static_returns_t_or_f()) { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data < 0) /* ensure we don't have an overflow */ { /* POTENTIAL FLAW: if (data*valueToMult) < MIN_VALUE, this will overflow */ int result = (data * valueToMult); IO.writeLine("result: " + result); } } else { int valueToMult = (new SecureRandom()).nextInt(98) + 2; /* multiply by at least 2 */ if (data < 0) /* ensure we don't have an overflow */ { int result = 0; /* FIX: Add a check to prevent an underflow from occurring */ if (data >= (Integer.MIN_VALUE / valueToMult)) { result = (data * valueToMult); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too small to perform multiplication."); } } } }
public void bad(HttpServletRequest request, HttpServletResponse response) throws Throwable { int data; if (IO.static_returns_t_or_f()) { Logger log_bad = Logger.getLogger("local-logger"); /* init Data$ */ data = -1; /* read parameter from request */ String s_data = request.getParameter("name"); data = Integer.parseInt(s_data.trim()); } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; } if (IO.static_returns_t_or_f()) { int valueToSub = (new SecureRandom()).nextInt(99) + 1; /* subtracting at least 1 */ /* POTENTIAL FLAW: if (data-valueToSub) < MIN_VALUE this will underflow */ int result = (data - valueToSub); IO.writeLine("result: " + result); } else { int valueToSub = (new SecureRandom()).nextInt(99) + 1; /* subtracting at least 1 */ int result = 0; /* FIX: Add a check to prevent an underflow from occurring */ if (data >= (Integer.MIN_VALUE + valueToSub)) { result = (data - valueToSub); IO.writeLine("result: " + result); } else { IO.writeLine("Input value is too small to perform subtraction."); } } }
/* goodG2B() - use goodsource and badsink by changing the first "if" so that both branches use the GoodSource */ private void goodG2B() throws Throwable { String data; if (IO.static_returns_t_or_f()) { data = "5"; } else { data = "5"; } if (IO.static_returns_t_or_f()) { int loopNum; try { loopNum = Integer.parseInt(data); } catch (NumberFormatException nfe) { IO.writeLine("Invalid response. Numeric input expected. Assuming 1."); loopNum = 1; } for (int i = 0; i < loopNum; i++) { /* POTENTIAL FLAW: user supplied input used for loop counter test */ IO.writeLine("hello world"); } } else { int loopNum; try { loopNum = Integer.parseInt(data); } catch (NumberFormatException nfe) { IO.writeLine("Invalid response. Numeric input expected. Assuming 1."); loopNum = 1; } for (int i = 0; i < loopNum; i++) { /* POTENTIAL FLAW: user supplied input used for loop counter test */ IO.writeLine("hello world"); } } }
public void bad() throws Throwable { String data; if (IO.static_returns_t_or_f()) { Logger log_bad = Logger.getLogger("local-logger"); data = ""; /* init data */ /* Read data using a listening tcp connection */ ServerSocket listener = null; Socket sock = null; BufferedReader buffread = null; InputStreamReader instrread = null; try { /* read input from socket */ listener = new ServerSocket(39543); sock = listener.accept(); instrread = new InputStreamReader(sock.getInputStream()); buffread = new BufferedReader(instrread); data = buffread.readLine(); } catch (IOException ioe) { log_bad.warning("Error with stream reading"); } finally { /* clean up stream reading objects */ try { if (buffread != null) { buffread.close(); } } catch (IOException ioe) { log_bad.warning("Error closing buffread"); } finally { try { if (instrread != null) { instrread.close(); } } catch (IOException ioe) { log_bad.warning("Error closing instrread"); } } /* clean up socket objects */ try { if (sock != null) { sock.close(); } } catch (IOException e) { log_bad.warning("Error closing sock"); } finally { try { if (listener != null) { listener.close(); } } catch (IOException e) { log_bad.warning("Error closing listener"); } } } } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded string */ data = "foo"; } if (IO.static_returns_t_or_f()) { String names[] = data.split("-"); int iSuccess = 0; Logger log2 = Logger.getLogger("local-logger"); Connection conn_tmp2 = null; Statement sqlstatement = null; try { conn_tmp2 = IO.getDBConnection(); sqlstatement = conn_tmp2.createStatement(); for (int i = 0; i < names.length; ++i) { /* POTENTIAL FLAW: take user input and place into dynamic sql query */ sqlstatement.addBatch( "update users set hitcount=hitcount+1 where name='" + names[i] + "'"); } int dbResults[] = sqlstatement.executeBatch(); for (int i = 0; i < names.length; ++i) { if (dbResults[i] > 0) { iSuccess++; } } IO.writeString("Succeeded in " + iSuccess + " out of " + names.length + " queries."); } catch (SQLException se) { log2.warning("Error getting database connection"); } finally { try { if (sqlstatement != null) { sqlstatement.close(); } } catch (SQLException e) { log2.warning("Error closing sqlstatement"); } finally { try { if (conn_tmp2 != null) { conn_tmp2.close(); } } catch (SQLException e) { log2.warning("Error closing conn_tmp2"); } } } } else { String names[] = data.split("-"); int iSuccess = 0; Logger log2 = Logger.getLogger("local-logger"); Connection conn_tmp2 = null; PreparedStatement sqlstatement = null; try { /* FIX: use prepared sqlstatement */ conn_tmp2 = IO.getDBConnection(); sqlstatement = conn_tmp2.prepareStatement("update users set hitcount=hitcount+1 where name=?"); for (int i = 0; i < names.length; ++i) { sqlstatement.setString(1, names[i]); sqlstatement.addBatch(); } int dbResults[] = sqlstatement.executeBatch(); for (int i = 0; i < names.length; ++i) { if (dbResults[i] > 0) { iSuccess++; } } IO.writeString("Succeeded in " + iSuccess + " out of " + names.length + " queries."); } catch (SQLException se) { log2.warning("Error getting database connection"); } finally { try { if (sqlstatement != null) { sqlstatement.close(); } } catch (SQLException e) { log2.warning("Error closing sqlstatement"); } finally { try { if (conn_tmp2 != null) { conn_tmp2.close(); } } catch (SQLException e) { log2.warning("Error closing conn_tmp2"); } } } } }
/* goodG2B() - use goodsource and badsink by changing the first "if" so that both branches use the GoodSource */ private void goodG2B() throws Throwable { String data; if (IO.static_returns_t_or_f()) { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded string */ data = "foo"; } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded string */ data = "foo"; } if (IO.static_returns_t_or_f()) { String names[] = data.split("-"); int iSuccess = 0; Logger log2 = Logger.getLogger("local-logger"); Connection conn_tmp2 = null; Statement sqlstatement = null; try { conn_tmp2 = IO.getDBConnection(); sqlstatement = conn_tmp2.createStatement(); for (int i = 0; i < names.length; ++i) { /* POTENTIAL FLAW: take user input and place into dynamic sql query */ sqlstatement.addBatch( "update users set hitcount=hitcount+1 where name='" + names[i] + "'"); } int dbResults[] = sqlstatement.executeBatch(); for (int i = 0; i < names.length; ++i) { if (dbResults[i] > 0) { iSuccess++; } } IO.writeString("Succeeded in " + iSuccess + " out of " + names.length + " queries."); } catch (SQLException se) { log2.warning("Error getting database connection"); } finally { try { if (sqlstatement != null) { sqlstatement.close(); } } catch (SQLException e) { log2.warning("Error closing sqlstatement"); } finally { try { if (conn_tmp2 != null) { conn_tmp2.close(); } } catch (SQLException e) { log2.warning("Error closing conn_tmp2"); } } } } else { String names[] = data.split("-"); int iSuccess = 0; Logger log2 = Logger.getLogger("local-logger"); Connection conn_tmp2 = null; Statement sqlstatement = null; try { conn_tmp2 = IO.getDBConnection(); sqlstatement = conn_tmp2.createStatement(); for (int i = 0; i < names.length; ++i) { /* POTENTIAL FLAW: take user input and place into dynamic sql query */ sqlstatement.addBatch( "update users set hitcount=hitcount+1 where name='" + names[i] + "'"); } int dbResults[] = sqlstatement.executeBatch(); for (int i = 0; i < names.length; ++i) { if (dbResults[i] > 0) { iSuccess++; } } IO.writeString("Succeeded in " + iSuccess + " out of " + names.length + " queries."); } catch (SQLException se) { log2.warning("Error getting database connection"); } finally { try { if (sqlstatement != null) { sqlstatement.close(); } } catch (SQLException e) { log2.warning("Error closing sqlstatement"); } finally { try { if (conn_tmp2 != null) { conn_tmp2.close(); } } catch (SQLException e) { log2.warning("Error closing conn_tmp2"); } } } } }
public void bad(HttpServletRequest request, HttpServletResponse response) throws Throwable { String data; if (IO.static_returns_t_or_f()) { Logger log_bad = Logger.getLogger("local-logger"); data = ""; /* parse the query string for value of 'id' */ String id_str = null; StringTokenizer st = new StringTokenizer(request.getQueryString(), "&"); while (st.hasMoreTokens()) { String token = st.nextToken(); int i = token.indexOf("="); if ((i > 0) && (i < (token.length() - 1)) && (token.substring(0, i).equals("id"))) { id_str = token.substring(i + 1); break; } } if (id_str != null) { Connection conn = null; PreparedStatement statement = null; ResultSet rs = null; try { int id = Integer.parseInt(id_str); conn = IO.getDBConnection(); statement = conn.prepareStatement("select * from pages where id=?"); /* FLAW: no check to see whether the user has privileges to view the data */ statement.setInt(1, id); rs = statement.executeQuery(); data = rs.toString(); } catch (SQLException se) { log_bad.warning("Error"); } finally { /* clean up database objects */ try { if (rs != null) { rs.close(); } } catch (SQLException se) { log_bad.warning("Error closing rs"); } finally { try { if (statement != null) { statement.close(); } } catch (SQLException se) { log_bad.warning("Error closing statement"); } finally { try { if (conn != null) { conn.close(); } } catch (SQLException se) { log_bad.warning("Error closing conn"); } } } } } } else { java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger"); /* FIX: Use a hardcoded string */ data = "foo"; } if (IO.static_returns_t_or_f()) { String names[] = data.split("-"); int iSuccess = 0; Logger log2 = Logger.getLogger("local-logger"); Connection conn_tmp2 = null; Statement sqlstatement = null; try { conn_tmp2 = IO.getDBConnection(); sqlstatement = conn_tmp2.createStatement(); for (int i = 0; i < names.length; ++i) { /* POTENTIAL FLAW: take user input and place into dynamic sql query */ sqlstatement.addBatch( "update users set hitcount=hitcount+1 where name='" + names[i] + "'"); } int dbResults[] = sqlstatement.executeBatch(); for (int i = 0; i < names.length; ++i) { if (dbResults[i] > 0) { iSuccess++; } } IO.writeString("Succeeded in " + iSuccess + " out of " + names.length + " queries."); } catch (SQLException se) { log2.warning("Error getting database connection"); } finally { try { if (sqlstatement != null) { sqlstatement.close(); } } catch (SQLException e) { log2.warning("Error closing sqlstatement"); } finally { try { if (conn_tmp2 != null) { conn_tmp2.close(); } } catch (SQLException e) { log2.warning("Error closing conn_tmp2"); } } } } else { String names[] = data.split("-"); int iSuccess = 0; Logger log2 = Logger.getLogger("local-logger"); Connection conn_tmp2 = null; PreparedStatement sqlstatement = null; try { /* FIX: use prepared sqlstatement */ conn_tmp2 = IO.getDBConnection(); sqlstatement = conn_tmp2.prepareStatement("update users set hitcount=hitcount+1 where name=?"); for (int i = 0; i < names.length; ++i) { sqlstatement.setString(1, names[i]); sqlstatement.addBatch(); } int dbResults[] = sqlstatement.executeBatch(); for (int i = 0; i < names.length; ++i) { if (dbResults[i] > 0) { iSuccess++; } } IO.writeString("Succeeded in " + iSuccess + " out of " + names.length + " queries."); } catch (SQLException se) { log2.warning("Error getting database connection"); } finally { try { if (sqlstatement != null) { sqlstatement.close(); } } catch (SQLException e) { log2.warning("Error closing sqlstatement"); } finally { try { if (conn_tmp2 != null) { conn_tmp2.close(); } } catch (SQLException e) { log2.warning("Error closing conn_tmp2"); } } } } }