properties() {
+ return asList(
+ PropertyDefinition.builder(FILE_SUFFIXES_KEY)
+ .multiValues(true)
+ .defaultValue(DEFAULT_FILE_SUFFIXES)
+ .category("FileType")
+ .name("File Suffixes")
+ .description("List of suffixes for files to analyze.")
+ .onQualifiers(Qualifiers.PROJECT)
+ .build()
+ );
+ }
+
}
diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/LogRuleRepository.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/LogRuleRepository.java
new file mode 100644
index 0000000..de9efd4
--- /dev/null
+++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/LogRuleRepository.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：28所 C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx;
+
+import org.sonar.api.server.rule.RulesDefinition;
+
+public class LogRuleRepository implements RulesDefinition {
+ private static final String REPOSITORY_NAME = "SonarQube";
+
+ @Override
+ public void define(Context context) {
+ // 创建规则仓库
+ NewRepository repository = context.createRepository("log", LogLanguage.KEY)
+ .setName(REPOSITORY_NAME);
+
+ // 创建新规则
+
+ NewRule errorRecoveryRule = repository.createRule("ParsingErrorRecovery");
+ errorRecoveryRule.setName("Parsing Error Recovery");
+
+ // 为另一个规则设置描述
+ errorRecoveryRule.setHtmlDescription("This rule checks for parsing error recovery issues
");
+
+ // 完成规则创建
+ repository.done();
+ }
+}
diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignRuleRepository.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignRuleRepository.java
index b2afaa9..6c824ba 100644
--- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignRuleRepository.java
+++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignRuleRepository.java
@@ -1,13 +1,14 @@
/*
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
- * 项目名称：C++ 信息安全性设计准则
+ * 项目名称：28所 C++ 信息安全性设计准则
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
*/
package com.keyware.sonar.cxx.rules;
import com.keyware.sonar.cxx.CxxLanguage;
-import com.keyware.sonar.cxx.rules.checkers.ABCVarNameChecker;
+import com.keyware.sonar.cxx.LogLanguage;
+import com.keyware.sonar.cxx.rules.checkers.*;
import org.sonar.api.server.rule.RulesDefinition;
import org.sonar.cxx.squidbridge.annotations.AnnotationBasedRulesDefinition;
@@ -22,10 +23,16 @@ import java.util.List;
*/
public class SecurityDesignRuleRepository implements RulesDefinition {
public final static String REPOSITORY_KEY = "cxx-security-design-rules";
+ public final static String REPOSITORY_log_key = "log-security-design-rules";
public final static String REPOSITORY_NAME = "C++信息安全性设计准则";
// 规则检查器的集合，当有新的规则开发完毕后，需要添加到下面的集合中
- public final static List RULE_CHECKERS = Arrays.asList(ABCVarNameChecker.class);
+ public final static List RULE_CHECKERS = Arrays.asList(ABCVarNameChecker.class,BufferDataChecker.class, CmdDataVerifyChecker.class,
+ DLLVerifyChecker.class,EncryptionAlgorithmChecker.class,ErrorMessageChecker.class,
+ FileAccessChecker.class,FormatFunctionCheck.class,FVNRPassWordChecker.class,FVNRShaChecker.class,HighEncryptDesChecker.class,
+ HostIdentityVerifyChecker.class,IntegerCountVerifyChecker.class,LogChecker.class,LogFileWriteChecker.class,NumericalCopyChecker.class,
+ PassWordCountChecker.class,PathVerifyChecker.class,PRNGVerifyChecker.class,ReallocMainChecker.class,SendMessageChecker.class,
+ SQLVerifyChecker.class,UserInputPasswordChecker.class,ValidatePasswordCheck.class,VerificationPathChecker.class,VirtualLockUsageChecker.class);
@Override
public void define(Context context) {
@@ -33,5 +40,10 @@ public class SecurityDesignRuleRepository implements RulesDefinition {
setName(REPOSITORY_NAME);
new AnnotationBasedRulesDefinition(repository, CxxLanguage.KEY).addRuleClasses(false, RULE_CHECKERS);
repository.done();
+
+ var repository1 = context.createRepository(REPOSITORY_log_key, LogLanguage.KEY).
+ setName(REPOSITORY_NAME);
+ new AnnotationBasedRulesDefinition(repository1, LogLanguage.KEY).addRuleClasses(false, RULE_CHECKERS);
+ repository1.done();
}
}
diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignWayProfile.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignWayProfile.java
index df8d7a8..d9994b0 100644
--- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignWayProfile.java
+++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/SecurityDesignWayProfile.java
@@ -1,12 +1,13 @@
/*
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
- * 项目名称：C++ 信息安全性设计准则
+ * 项目名称：28所 C++ 信息安全性设计准则
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
*/
package com.keyware.sonar.cxx.rules;
import com.keyware.sonar.cxx.CxxLanguage;
+import com.keyware.sonar.cxx.LogLanguage;
import org.sonar.api.server.profile.BuiltInQualityProfilesDefinition;
import org.sonarsource.api.sonarlint.SonarLintSide;
@@ -22,6 +23,35 @@ public class SecurityDesignWayProfile implements BuiltInQualityProfilesDefinitio
public void define(Context context) {
var way = context.createBuiltInQualityProfile("C++信息安全性设计准则", CxxLanguage.KEY);
way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "ABCVarNameChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "BufferDataChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "CmdDataVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "DLLVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "EncryptionAlgorithmChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "ErrorMessageChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "FileAccessChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "FormatFunctionCheck");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "FVNRPassWordChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "FVNRShaChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "HighEncryptDesChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "HostIdentityVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "IntegerCountVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "LogFileWriteChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "NumericalCopyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "PassWordCountChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "PathVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "PRNGVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "ReallocMainChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "SendMessageChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "FlagLine1Rule");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "SQLVerifyChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "UserInputPasswordChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "ValidatePasswordCheck");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "VerificationPathChecker");
+ way.activateRule(SecurityDesignRuleRepository.REPOSITORY_KEY, "VirtualLockUsageChecker");
way.done();
+
+ var way1 = context.createBuiltInQualityProfile("LogLanguage信息安全性设计准则", LogLanguage.KEY);
+ way1.activateRule(SecurityDesignRuleRepository.REPOSITORY_log_key, "LogChecker");
+ way1.done();
}
}
diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/ConfigurationFileChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/ConfigurationFileChecker.java
deleted file mode 100644
index 26c420c..0000000
--- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/ConfigurationFileChecker.java
+++ /dev/null
@@ -1,265 +0,0 @@
-/*
- * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
- * 项目名称：C++ 信息安全性设计准则
- * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
- * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
- */
-package com.keyware.sonar.cxx.rules.checkers;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.sonar.cxx.sslr.api.AstNode;
-import com.sonar.cxx.sslr.api.Grammar;
-import org.sonar.check.Rule;
-import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault;
-import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation;
-import org.sonar.cxx.squidbridge.checks.SquidCheck;
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-import org.yaml.snakeyaml.Yaml;
-
-import javax.annotation.Nullable;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
-import java.io.*;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.Properties;
-import java.util.Scanner;
-
-/**
- * TODO LogChecker
- *
- * @author WuHaoYang
- * @date 2024/1/19
- */
-@Rule(key = "ConfigurationFileChecker", name = "避免在容易受攻击的地方存储口令", description = "避免在容易受攻击的地方存储口令")
-@ActivatedByDefault
-@SqaleConstantRemediation("5min")
-public class ConfigurationFileChecker extends SquidCheck {
-
-
- @Override
- public void visitFile(@Nullable AstNode astNode) {
- String filename = getContext().getInputFile().filename();
-
- if (filename.endsWith(".properties")) {
- try {
- File file = new File(getContext().getInputFile().absolutePath());
- try (Scanner scanner = new Scanner(file)) {
- while (scanner.hasNextLine()) {
- String line = scanner.nextLine();
- if (line.contains("password")) {
- System.out.println(line);
- getContext().createFileViolation(this, "避免在容易受攻击的地方存储口令");
- break;
- }
- }
- }
- } catch (FileNotFoundException e) {
- System.out.println("文件未找到: " + e.getMessage());
- }
- }
-
- if (filename.endsWith(".yml")){
- // 获取当前输入文件的绝对路径
- File inputFile = getContext().getInputFile().file();
- String absolutePath = inputFile.getAbsolutePath();
-
- // 构建目录路径
- File dir = new File(absolutePath).getParentFile();
-
- Yaml yaml = new Yaml();
- for (File file : dir.listFiles()) {
- if (file.isFile() && file.getName().endsWith(".yml")) {
- try (FileInputStream fis = new FileInputStream(file)) {
- Map obj = yaml.load(fis);
- if (obj != null){
- String password = searchPassword(obj);
- if (password != null) {
- System.out.println("password="+password);
- getContext().createFileViolation(this, "避免在容易受攻击的地方存储口令");
- }
- }
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
- }
-
- if (filename.endsWith(".ini")){
- // 获取当前输入文件的绝对路径
- File inputFile = getContext().getInputFile().file();
- String absolutePath = inputFile.getAbsolutePath();
-
- // 构建目录路径
- File folder = new File(absolutePath).getParentFile();
- File[] listOfFiles = folder.listFiles();
-
- for (File file : listOfFiles) {
- if (file.isFile() && file.getName().endsWith(".ini")) {
- Properties properties = new Properties();
-
- try (FileInputStream fileInput = new FileInputStream(file)) {
- properties.load(fileInput);
- String password = properties.getProperty("password");
- System.out.println("password=" + password);
- getContext().createFileViolation(this, "避免在容易受攻击的地方存储口令");
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
- }
-
-
- if (filename.endsWith(".xml")){
- // 获取当前输入文件的绝对路径
- File inputFile = getContext().getInputFile().file();
- String absolutePath = inputFile.getAbsolutePath();
-
- // 构建目录路径
- File dir = new File(absolutePath).getParentFile();
-
- FilenameFilter filter = new FilenameFilter() {
- public boolean accept(File dir, String name) {
- return name.endsWith(".xml");
- }
- };
-
- String[] children = dir.list(filter);
- if (children == null) {
- System.out.println("目录不存在或不是目录");
- } else {
- for (int i = 0; i < children.length; i++) {
- String filename1 = children[i];
- File xmlFile = new File(dir, filename1);
- processXML(xmlFile);
- getContext().createFileViolation(this, "避免在容易受攻击的地方存储口令");
- }
- }
- }
-
-
- if (filename.endsWith(".json")){
- try {
- // 获取当前输入文件的绝对路径
- File inputFile = getContext().getInputFile().file();
- String absolutePath = inputFile.getAbsolutePath();
-
- // 构建目录路径
- File folder = new File(absolutePath).getParentFile();
-
- File[] listOfFiles = folder.listFiles();
-
- if (listOfFiles != null) {
- ObjectMapper mapper = new ObjectMapper();
- for (File file : listOfFiles) {
- if (file.isFile() && file.getName().endsWith(".json")) {
- JsonNode rootNode = mapper.readTree(file);
- extractPassword(rootNode);
- getContext().createFileViolation(this, "避免在容易受攻击的地方存储口令");
- }
- }
- }
-
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
-
-
- if (filename.endsWith(".conf")){
- // 获取当前输入文件的绝对路径
- File inputFile = getContext().getInputFile().file();
- String absolutePath = inputFile.getAbsolutePath();
-
- // 构建目录路径
- File folder = new File(absolutePath).getParentFile();
-
- File[] listOfFiles = folder.listFiles((dir, name) -> name.endsWith(".conf"));
-
- for (File file : listOfFiles) {
- if (file.isFile()) {
- Properties prop = new Properties();
- InputStream input = null;
-
- try {
- input = new FileInputStream(file);
- prop.load(input);
-
- if (prop.containsKey("password")) {
- System.out.println("password="+ prop.getProperty("password"));
- getContext().createFileViolation(this, "避免在容易受攻击的地方存储口令");
- }
-
- } catch (IOException ex) {
- ex.printStackTrace();
- } finally {
- if (input != null) {
- try {
- input.close();
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
- }
- }
- }
- }
-
-
-
- public static void extractPassword(JsonNode node) {
- Iterator fieldNames = node.fieldNames();
- while (fieldNames.hasNext()) {
- String fieldName = fieldNames.next();
- if (fieldName.equals("password")) {
- System.out.println("Password= " + node.get(fieldName).asText());
- }
- if (node.get(fieldName).isContainerNode()) {
- extractPassword(node.get(fieldName));
- }
- }
- }
-
- public static void processXML(File xmlFile) {
- try {
- DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
- DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
- Document doc = dBuilder.parse(xmlFile);
- doc.getDocumentElement().normalize();
-
- NodeList nList = doc.getElementsByTagName("password");
-
- for (int i = 0; i < nList.getLength(); i++) {
- Node nNode = nList.item(i);
- if (nNode.getNodeType() == Node.ELEMENT_NODE) {
- Element eElement = (Element) nNode;
- System.out.println("Password="+ eElement.getTextContent());
-
- }
- }
- } catch (Exception e) {
- e.printStackTrace();
- }
- }
-
- private static String searchPassword(Map map) {
- for (String key : map.keySet()) {
- if ("password".equals(key) && map.get(key) instanceof String) {
- return (String) map.get(key);
- } else if (map.get(key) instanceof Map) {
- String password = searchPassword((Map) map.get(key));
- if (password != null) {
- return password;
- }
- }
- }
- return null;
- }
-}
diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FlagLineRule.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FlagLineRule.java
new file mode 100644
index 0000000..7b9ff82
--- /dev/null
+++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FlagLineRule.java
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：28所 C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx.rules.checkers;
+
+import org.sonar.api.batch.fs.InputFile;
+import org.sonar.api.batch.sensor.SensorContext;
+import org.sonar.api.rule.RuleKey;
+
+public interface FlagLineRule {
+
+ void execute(SensorContext sensorContext, InputFile file, RuleKey ruleKey);
+}
\ No newline at end of file
diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/SqlVarNameChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/SqlVarNameChecker.java
new file mode 100644
index 0000000..2eabd8f
--- /dev/null
+++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/SqlVarNameChecker.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：28所 C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx.rules.checkers;
+
+import org.sonar.api.batch.fs.InputFile;
+import org.sonar.api.batch.sensor.SensorContext;
+import org.sonar.api.batch.sensor.issue.NewIssue;
+import org.sonar.api.rule.RuleKey;
+import org.sonar.check.Priority;
+import org.sonar.check.Rule;
+import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault;
+import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Scanner;
+
+/**
+ * C++规则检查器的实现示例
+ *
+ * @author GuoXin
+ * @date 2024/1/6
+ */
+@Rule(key = "FlagLine1Rule", name = "sql注入", description = "sql注入有一定风险", priority = Priority.INFO, tags = {"28suo"})
+@ActivatedByDefault
+@SqaleConstantRemediation("5min")
+public class SqlVarNameChecker implements FlagLineRule {
+
+ @Override
+ public void execute(SensorContext sensorContext, InputFile file, RuleKey ruleKey) {
+ try (Scanner scanner = new Scanner(file.inputStream(), StandardCharsets.UTF_8.name())) {
+ int lineNumber = 1;
+ while (scanner.hasNextLine()) {
+ String line = scanner.nextLine();
+ if (line.contains("= '") || line.contains("OR 1=1") || line.contains("='")
+ || line.contains("DROP TABLE") || line.contains("' OR 'a'='a") || line.contains("'; DROP TABLE users; --")
+ || line.contains("'; EXEC xp_cmdshell 'dir'") || line.contains("' OR username LIKE '%") || line.contains("' AND SLEEP(5)")
+ || line.contains("= \\'' +") || line.contains("= ?")) { // 根据特定的关键词或模式匹配来定位 SQL 注入
+ NewIssue newIssue = sensorContext.newIssue();
+ newIssue
+ .forRule(ruleKey)
+ .at(newIssue.newLocation()
+ .on(file)
+ .at(file.selectLine(lineNumber)))
+ .save();
+ }
+ lineNumber++;
+ }
+ } catch (IOException e) {
+ throw new RuntimeException(e);
+ }
+ }
+/*
+ @Override
+ public void visitNode(AstNode node) {
+ File file = getContext().getFile();
+ System.out.println("文件路径: " + file.getAbsolutePath());
+ try (BufferedReader reader = new BufferedReader(new FileReader(file))) {
+ String line;
+ int lineNumber = 0;
+ while ((line = reader.readLine()) != null) {
+ lineNumber++;
+ if (line.contains("= '") || line.contains("OR 1=1") || line.contains("='")
+ || line.contains("DROP TABLE") || line.contains("' OR 'a'='a") || line.contains("'; DROP TABLE users; --")
+ || line.contains("'; EXEC xp_cmdshell 'dir'") || line.contains("' OR username LIKE '%") || line.contains("' AND SLEEP(5)")
+ || line.contains("= \\'' +") || line.contains("= ?")) {
+ getContext().createLineViolation(ABCVarNameChecker.this, "sql 注入有一定风险", lineNumber);
+ }
+ }
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ }*/
+}
diff --git a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/CxxRuleRepositoryTest.java b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/CxxRuleRepositoryTest.java
index c11baf3..d6ef82f 100644
--- a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/CxxRuleRepositoryTest.java
+++ b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/CxxRuleRepositoryTest.java
@@ -1,6 +1,6 @@
/*
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
- * 项目名称：C++ 信息安全性设计准则
+ * 项目名称：28所 C++ 信息安全性设计准则
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
*/
@@ -18,9 +18,11 @@ class CxxRuleRepositoryTest {
var context = new RulesDefinition.Context();
assertThat(context.repositories()).isEmpty();
new CxxRuleRepository().define(context);
+ new LogRuleRepository().define(context);
- assertThat(context.repositories()).hasSize(1);
+ assertThat(context.repositories()).hasSize(2);
assertThat(context.repository("cxx").rules()).hasSize(27);
+ assertThat(context.repository("log").rules()).hasSize(1);
}
}
diff --git a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/ConfigurationFileCheckerTest.java b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/ConfigurationFileCheckerTest.java
deleted file mode 100644
index 787c36d..0000000
--- a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/ConfigurationFileCheckerTest.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
- * 项目名称：C++ 信息安全性设计准则
- * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
- * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
- */
-package com.keyware.sonar.cxx.rules.checkers;
-
-
-import com.keyware.sonar.cxx.CxxFileTesterHelper;
-import org.junit.jupiter.api.Test;
-import org.sonar.cxx.CxxAstScanner;
-import org.sonar.cxx.squidbridge.api.CheckMessage;
-import org.sonar.cxx.squidbridge.api.SourceFile;
-
-import java.io.File;
-import java.io.FilenameFilter;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * TODO ConfigurationFileCheckerTest
- *
- * @author WuHaoYang
- * @date 2024/1/19
- */
-public class ConfigurationFileCheckerTest {
-
- @Test
- public void checkDirectory() throws IOException {
-
-
- File folder = new File("src/test/resources/com/keyware/sonar/cxx/rules/checkers/configFile"); // 文件夹路径
-
- File[] files = folder.listFiles(new FilenameFilter() {
- public boolean accept(File dir, String name) {
- return name.endsWith(".yml") || name.endsWith(".ini") || name.endsWith(".properties") ||
- name.endsWith(".xml") || name.endsWith(".json") || name.endsWith(".conf");
- }
- });
-
- List problems = new ArrayList<>(); // 存储问题的列表
-
- for (File file : files) {
-
- try {
- if (file.isFile()) {
- var tester = CxxFileTesterHelper.create("configFile/" + file.getName());
- System.out.println("配置文件名称：" + file.getName());
- var checker = new ConfigurationFileChecker();
- SourceFile sourceFile = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker);
-
- for (CheckMessage message : sourceFile.getCheckMessages()) {
- if (message.formatDefaultMessage().equals("避免在容易受攻击的地方存储口令")) {
- problems.add("文件：" + file.getName() + " ,问题：" + message.getDefaultMessage());
- }
- }
- }
- } catch (Exception e) {
- System.out.println("在处理文件时遇到问题：" + file.getName());
- e.printStackTrace();
- }
- }
-
- for (String problem : problems) {
- System.out.println(problem);
- }
- }
-
-
-}
diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignRulesPlugin.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignRulesPlugin.java
index d271efc..0bdb7b7 100644
--- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignRulesPlugin.java
+++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignRulesPlugin.java
@@ -29,13 +29,13 @@ public class JavaSecurityDesignRulesPlugin implements Plugin {
context.addExtension(JavaFileCheckRegistrar.class);
- context.addExtension(ConfigurationFileLanguage.class);
-
-
- context.addExtension(ConfigFileSquidSensor.class);
-
-
- context.addExtensions(ConfigurationFileLanguage.getProperties());
+// context.addExtension(ConfigurationFileLanguage.class);
+//
+//
+// context.addExtension(ConfigFileSquidSensor.class);
+//
+//
+// context.addExtensions(ConfigurationFileLanguage.getProperties());
}
}
diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignWayProfile.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignWayProfile.java
index 5acf99d..5c6a0b5 100644
--- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignWayProfile.java
+++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/JavaSecurityDesignWayProfile.java
@@ -31,9 +31,9 @@ public class JavaSecurityDesignWayProfile implements BuiltInQualityProfilesDefin
RulesList.getHtmlRules().forEach(check -> webWay.activateRule(JavaSecurityDesignRulesRepository.REPOSITORY_KEY + "-" + HtmlConstants.LANGUAGE_KEY, check.getSimpleName()));
webWay.done();
- var cfgWay = context.createBuiltInQualityProfile("配置信息安全性设计规则", ConfigurationFileLanguage.KEY);
- cfgWay.activateRule("config", "ConfigurationFileChecker");
- cfgWay.activateRule("config", "SessionDateChecker");
- cfgWay.done();
+// var cfgWay = context.createBuiltInQualityProfile("配置信息安全性设计规则", ConfigurationFileLanguage.KEY);
+// cfgWay.activateRule("config", "ConfigurationFileChecker");
+// cfgWay.activateRule("config", "SessionDateChecker");
+// cfgWay.done();
}
}
diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/JavaSecurityDesignRulesRepository.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/JavaSecurityDesignRulesRepository.java
index 9577a04..57d8725 100644
--- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/JavaSecurityDesignRulesRepository.java
+++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/JavaSecurityDesignRulesRepository.java
@@ -6,8 +6,6 @@
*/
package com.keyware.sonar.java.rules;
-import com.keyware.sonar.java.rules.checkers.ConfigurationFileChecker;
-import com.keyware.sonar.java.rules.checkers.SecurityCookieChecker;
import com.keyware.sonar.java.rules.checkers.SessionDateChecker;
import org.sonar.api.SonarEdition;
import org.sonar.api.SonarProduct;
@@ -55,10 +53,10 @@ public class JavaSecurityDesignRulesRepository implements RulesDefinition {
setTemplates(htmlRepo);
htmlRepo.done();
- RulesDefinition.NewRepository configRepo = context.createRepository("config", "cfg").setName("config");
- ruleMetadataLoader.addRulesByAnnotatedClass(configRepo, List.of(ConfigurationFileChecker.class, SessionDateChecker.class));
- setTemplates(configRepo);
- configRepo.done();
+// RulesDefinition.NewRepository configRepo = context.createRepository("config", "cfg").setName("config");
+// ruleMetadataLoader.addRulesByAnnotatedClass(configRepo, List.of(ConfigurationFileChecker.class, SessionDateChecker.class));
+// setTemplates(configRepo);
+// configRepo.done();
}
private static void setTemplates(RulesDefinition.NewRepository repository) {
diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/ConfigurationFileChecker.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/ConfigurationFileChecker.java
deleted file mode 100644
index ee17ae2..0000000
--- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/ConfigurationFileChecker.java
+++ /dev/null
@@ -1,276 +0,0 @@
-/*
- * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
- * 项目名称：信息安全性设计准则检查插件
- * 项目描述：用于检查源代码的安全性设计准则的Sonarqube插件
- * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
- */
-package com.keyware.sonar.java.rules.checkers;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import org.sonar.api.batch.fs.InputFile;
-import org.sonar.api.batch.sensor.SensorContext;
-import org.sonar.api.batch.sensor.issue.NewIssue;
-import org.sonar.api.rule.RuleKey;
-import org.sonar.check.Rule;
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-import org.yaml.snakeyaml.Yaml;
-
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
-import java.io.*;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.Properties;
-import java.util.Scanner;
-
-
-/**
- * 通过用户名口令、数据证书等其他手段对用户身份进行验证。
- *
- * @author WuHaoYang
- * @date 2024/1/22
- */
-@Rule(key = "ConfigurationFileChecker")
-public class ConfigurationFileChecker implements ConfigCheck{
-
-
- public void execute(SensorContext context, InputFile inputFile, RuleKey ruleKey){
- //文件名称
- String filename = inputFile.filename();
- System.out.println("[ConfigurationFileChecker]>>>>>" + filename);
-
- //校验文件后缀
- if (filename.endsWith(".properties")) {
- try {
- File file = new File(inputFile.absolutePath());
- System.out.println("---------------properties文件路径----------------"+file);
- try (Scanner scanner = new Scanner(file)) {
- int lineNum = 1;
- while (scanner.hasNextLine()) {
- String line = scanner.nextLine();
- if (line.contains("password")) {
- System.out.println(line);
- NewIssue newIssue = context.newIssue();
- newIssue
- .forRule(ruleKey)
- .at(newIssue.newLocation()
- .on(inputFile)
- .at(inputFile.selectLine(lineNum)))
- .save();
- break;
- }
- lineNum ++;
- }
- }
- } catch (FileNotFoundException e) {
- System.out.println("文件未找到: " + e.getMessage());
- }
- }
-
-
- if (filename.endsWith(".ini")){
- // 获取当前输入文件的绝对路径
- File file1 = inputFile.file();
-
- // 构建目录路径
- System.out.println("---------------ini文件路径----------------"+file1);
-
- int lineNum = 1;
- Properties properties = new Properties();
-
- try (FileInputStream fileInput = new FileInputStream(file1)) {
- properties.load(fileInput);
- String password = properties.getProperty("password");
- System.out.println("password=" + password);
- NewIssue newIssue = context.newIssue();
- newIssue
- .forRule(ruleKey)
- .at(newIssue.newLocation()
- .on(inputFile)
- .at(inputFile.selectLine(lineNum)))
- .save();
- } catch (IOException e) {
- e.printStackTrace();
- }
- lineNum++;
- }
-
-
-
- if (filename.endsWith(".conf")){
- // 获取当前输入文件的绝对路径
- File file1 = inputFile.file();
-
- // 构建目录路径
- System.out.println("---------------conf文件路径----------------"+file1);
-
-
- int lineNum = 1;
- Properties prop = new Properties();
- InputStream input = null;
-
- try {
- input = new FileInputStream(file1);
- prop.load(input);
-
- if (prop.containsKey("password")) {
- System.out.println("password="+ prop.getProperty("password"));
- NewIssue newIssue = context.newIssue();
- newIssue
- .forRule(ruleKey)
- .at(newIssue.newLocation()
- .on(inputFile)
- .at(inputFile.selectLine(lineNum)))
- .save();
- }
- } catch (IOException ex) {
- ex.printStackTrace();
- } finally {
- if (input != null) {
- try {
- input.close();
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- }
- lineNum++;
- }
-
-
-
- if (filename.endsWith(".xml")){
- // 获取当前输入文件的绝对路径
- File file1 = inputFile.file();
- File absoluteFile = file1.getAbsoluteFile();
-
- // 构建目录路径
- File dir = new File(String.valueOf(absoluteFile)).getParentFile();
- System.out.println("---------------xml文件路径----------------"+file1);
- File xmlFile = new File(dir, filename);
- processXML(xmlFile);
- int lineNum = 1;
- NewIssue newIssue = context.newIssue();
- newIssue
- .forRule(ruleKey)
- .at(newIssue.newLocation()
- .on(inputFile)
- .at(inputFile.selectLine(lineNum)))
- .save();
- }
-
-
- if (filename.endsWith(".json")){
- try {
- // 获取当前输入文件的绝对路径
- File file1 = inputFile.file();
- File absoluteFile = file1.getAbsoluteFile();
-
- // 构建目录路径
- File folder = new File(String.valueOf(absoluteFile)).getParentFile();
-
- System.out.println("---------------json文件路径----------------"+file1);
- ObjectMapper mapper = new ObjectMapper();
- JsonNode rootNode = mapper.readTree(file1);
- extractPassword(rootNode);
- int lineNum = 1;
- NewIssue newIssue = context.newIssue();
- newIssue
- .forRule(ruleKey)
- .at(newIssue.newLocation()
- .on(inputFile)
- .at(inputFile.selectLine(lineNum)))
- .save();
-
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
-
-
- if (filename.endsWith(".yml")){
- // 获取当前输入文件的绝对路径
- File file1 = inputFile.file();
- File absoluteFile = file1.getAbsoluteFile();
-
- // 构建目录路径
- File dir = new File(String.valueOf(absoluteFile)).getParentFile();
- System.out.println("---------------yml文件路径----------------"+file1);
- Yaml yaml = new Yaml();
- try (FileInputStream fis = new FileInputStream(file1)) {
- Map obj = yaml.load(fis);
- if (obj != null){
- String password = searchPassword(obj);
- if (password != null) {
- System.out.println("password="+password);
- int lineNum = 1;
- NewIssue newIssue = context.newIssue();
- newIssue
- .forRule(ruleKey)
- .at(newIssue.newLocation()
- .on(inputFile)
- .at(inputFile.selectLine(lineNum)))
- .save();
- }
- }
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
-
- }
- public static void processXML(File xmlFile) {
- try {
- DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
- DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
- Document doc = dBuilder.parse(xmlFile);
- doc.getDocumentElement().normalize();
-
- NodeList nList = doc.getElementsByTagName("password");
-
- for (int i = 0; i < nList.getLength(); i++) {
- Node nNode = nList.item(i);
- if (nNode.getNodeType() == Node.ELEMENT_NODE) {
- Element eElement = (Element) nNode;
- System.out.println("Password="+ eElement.getTextContent());
- }
- }
- } catch (Exception e) {
- e.printStackTrace();
- }
- }
-
-
- public static void extractPassword(JsonNode node) {
- Iterator fieldNames = node.fieldNames();
- while (fieldNames.hasNext()) {
- String fieldName = fieldNames.next();
- if (fieldName.equals("password")) {
- System.out.println("Password= " + node.get(fieldName).asText());
- }
- if (node.get(fieldName).isContainerNode()) {
- extractPassword(node.get(fieldName));
- }
- }
- }
-
-
-
- private static String searchPassword(Map map) {
- for (String key : map.keySet()) {
- if ("password".equals(key) && map.get(key) instanceof String) {
- return (String) map.get(key);
- } else if (map.get(key) instanceof Map) {
- String password = searchPassword((Map) map.get(key));
- if (password != null) {
- return password;
- }
- }
- }
- return null;
- }
-}
diff --git a/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/JavaSecurityDesignRulesPluginTest.java b/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/JavaSecurityDesignRulesPluginTest.java
index 3410494..451e313 100644
--- a/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/JavaSecurityDesignRulesPluginTest.java
+++ b/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/JavaSecurityDesignRulesPluginTest.java
@@ -39,10 +39,11 @@ public class JavaSecurityDesignRulesPluginTest {
.containsExactlyInAnyOrder(
"JavaSecurityDesignRulesRepository",
"JavaSecurityDesignWayProfile",
- "JavaFileCheckRegistrar",
- "ConfigurationFileLanguage",
- "ConfigFileSquidSensor",
- "File Suffixes");
+ "JavaFileCheckRegistrar"
+// "ConfigurationFileLanguage",
+// "ConfigFileSquidSensor",
+// "File Suffixes"
+ );
}
public static class MockedSonarRuntime implements SonarRuntime {