From f7f3bba34b8c6fde159833b7eed802f4b7817a4f Mon Sep 17 00:00:00 2001 From: RenFengJiang <1111> Date: Mon, 15 Jan 2024 17:02:08 +0800 Subject: [PATCH] =?UTF-8?q?=E6=96=B0=E5=A2=9E=EF=BC=9A=E5=9C=A8=E6=9E=84?= =?UTF-8?q?=E5=BB=BA=E5=91=BD=E4=BB=A4=E5=89=8D=E5=AF=B9=E8=BE=93=E5=85=A5?= =?UTF-8?q?=E6=95=B0=E6=8D=AE=E8=BF=9B=E8=A1=8C=E9=AA=8C=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../rules/checkers/CmdDataVerifyChecker.java | 102 ++++++++++++++++++ .../checkers/CmdDataVerifyCheckerTest.java | 33 ++++++ .../rules/checkers/CmdDataVerifyChecker.cc | 21 ++++ 3 files changed, 156 insertions(+) create mode 100644 sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.java create mode 100644 sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyCheckerTest.java create mode 100644 sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.cc diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.java new file mode 100644 index 0000000..55ed070 --- /dev/null +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.java @@ -0,0 +1,102 @@ +/* + * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. + * 项目名称：C++ 信息安全性设计准则 + * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 + * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 + */ +package com.keyware.sonar.cxx.rules.checkers; + +import com.keyware.sonar.cxx.SubscriptionAstVisitor; +import com.sonar.cxx.sslr.api.AstNode; +import com.sonar.cxx.sslr.api.AstNodeType; +import com.sonar.cxx.sslr.api.Grammar; +import org.sonar.check.Priority; +import org.sonar.check.Rule; +import org.sonar.cxx.parser.CxxGrammarImpl; +import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault; +import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation; +import org.sonar.cxx.squidbridge.checks.SquidCheck; + +import javax.annotation.Nonnull; +import java.util.ArrayList; +import java.util.List; + +/** + * TODO CmdDataVerifyChecker + * + * @author RenFengJiang + * @date 2024/1/15 + */ +@Rule(key = "CmdDataVerifyChecker", name = "在构建命令前对输入数据进行验证", description = "在构建命令前对输入数据进行验证，确保输入数据仅能用于构成允许的命令。", priority = Priority.INFO, tags = {"28suo"}) +@ActivatedByDefault +@SqaleConstantRemediation("5min") +public class CmdDataVerifyChecker extends SquidCheck { + @Override + public void init() { + // 指定当前访问器需要访问的节点类型，functionBody（函数）主体节点 + this.subscribeTo( + CxxGrammarImpl.functionBody + ); + } + + /** + * 访问AST节点 + * + * @param node 要处理的AST节点，该节点类型为通过subscribeTo方法订阅的类型 + */ + @Override + public void visitNode(@Nonnull AstNode node) { + IfOrder ifOrder = new IfOrder(this); + ifOrder.accept(node); + } + + + class IfOrder extends SubscriptionAstVisitor { + + List lists = new ArrayList(); + public IfOrder(SquidCheck checker){ + super(checker); + } + + @Override + public List visitNodeTypes() { + // 指定当前访问器需要访问的节点类型，这里指定了simpleDeclaration（简单声明）节点类型 + return List.of(CxxGrammarImpl.functionBody); + } + + @Override + public void visitNode(@Nonnull AstNode node) { + //选择节点语句 + List nodeDescendants = node.getDescendants(CxxGrammarImpl.selectionStatement); + for (AstNode astNode:nodeDescendants) { + //判断节点是不是if节点 + if("if".equals(astNode.getToken().getValue())){ + //获取其中的参数 + List astNodeList = astNode.getDescendants(CxxGrammarImpl.expressionList); + for (AstNode expr:astNodeList) { + lists.add(expr.getToken().getValue()); + } + + if(astNodeList.size() == 0){ + List descendants = astNode.getDescendants(CxxGrammarImpl.condition); + for (AstNode desc:descendants) { + lists.add(desc.getToken().getValue()); + } + } + } + } + //获取表达是数据信息 + List descendants = node.getDescendants(CxxGrammarImpl.expressionList); + for (AstNode ast:descendants) { + String name = ast.getParent().getToken().getValue(); + //判断是否时使用sanitizeString方法 + if("system".equals(name)){ + //判断方法参数是否进行校验 + if(!lists.contains(ast.getToken().getValue())){ + reportIssue(ast, "在构建命令前对输入数据进行验证"); + } + } + } + } + } + } diff --git a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyCheckerTest.java b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyCheckerTest.java new file mode 100644 index 0000000..6a69ab8 --- /dev/null +++ b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyCheckerTest.java @@ -0,0 +1,33 @@ +/* + * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. + * 项目名称：C++ 信息安全性设计准则 + * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 + * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 + */ +package com.keyware.sonar.cxx.rules.checkers; + +import com.keyware.sonar.cxx.CxxFileTesterHelper; +import org.junit.jupiter.api.Test; +import org.sonar.cxx.CxxAstScanner; +import org.sonar.cxx.squidbridge.api.SourceFile; +import org.sonar.cxx.squidbridge.checks.CheckMessagesVerifier; + +import java.io.IOException; + +/** + * TODO CmdDataVerifyCheckerTest + * + * @author RenFengJiang + * @date 2024/1/15 + */ +public class CmdDataVerifyCheckerTest { + @Test + public void checkTest() throws IOException { + var checker = new CmdDataVerifyChecker(); + var tester = CxxFileTesterHelper.create("CmdDataVerifyChecker.cc"); + SourceFile file = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker); + CheckMessagesVerifier.verify(file.getCheckMessages()) + .next().atLine(12).withMessage("在构建命令前对输入数据进行验证") + .noMore(); + } +} diff --git a/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.cc b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.cc new file mode 100644 index 0000000..e7fa8f1 --- /dev/null +++ b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.cc @@ -0,0 +1,21 @@ +#include +#include // 包含系统调用相关的头文件 + +int main() { + std::string command = "echo Hello, World!"; // 要构建的命令 + +// if(a(command)){ +// } +// if(command.contains("/") ){ +// } + // 使用system函数执行命令 + int result = system(command); + + if (result == 0) { + std::cout << "命令执行成功。" << std::endl; + } else { + std::cout << "命令执行失败。" << std::endl; + } + + return 0; +}