新增：在构建命令前对输入数据进行验证

10 months ago · f7f3bba34b
parent 536e299ef8
commit f7f3bba34b
3 changed files with 156 additions and 0 deletions
--- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.java
+++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.java
@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx.rules.checkers;
+
+import com.keyware.sonar.cxx.SubscriptionAstVisitor;
+import com.sonar.cxx.sslr.api.AstNode;
+import com.sonar.cxx.sslr.api.AstNodeType;
+import com.sonar.cxx.sslr.api.Grammar;
+import org.sonar.check.Priority;
+import org.sonar.check.Rule;
+import org.sonar.cxx.parser.CxxGrammarImpl;
+import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault;
+import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation;
+import org.sonar.cxx.squidbridge.checks.SquidCheck;
+
+import javax.annotation.Nonnull;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * TODO CmdDataVerifyChecker
+ *
+ * @author RenFengJiang
+ * @date 2024/1/15
+ */
+@Rule(key = "CmdDataVerifyChecker", name = "在构建命令前对输入数据进行验证", description = "在构建命令前对输入数据进行验证，确保输入数据仅能用于构成允许的命令。", priority = Priority.INFO, tags = {"28suo"})
+@ActivatedByDefault
+@SqaleConstantRemediation("5min")
+public class CmdDataVerifyChecker extends SquidCheck<Grammar> {
+    @Override
+    public void init() {
+        // 指定当前访问器需要访问的节点类型，functionBody（函数）主体节点
+        this.subscribeTo(
+                CxxGrammarImpl.functionBody
+        );
+    }
+
+    /**
+     * 访问AST节点
+     *
+     * @param node 要处理的AST节点，该节点类型为通过subscribeTo方法订阅的类型
+     */
+    @Override
+    public void visitNode(@Nonnull AstNode node) {
+        IfOrder ifOrder = new IfOrder(this);
+        ifOrder.accept(node);
+    }
+
+
+    class IfOrder extends SubscriptionAstVisitor {
+
+        List lists = new ArrayList<String>();
+        public IfOrder(SquidCheck<Grammar> checker){
+            super(checker);
+        }
+
+        @Override
+        public List<AstNodeType> visitNodeTypes() {
+            // 指定当前访问器需要访问的节点类型，这里指定了simpleDeclaration（简单声明）节点类型
+            return List.of(CxxGrammarImpl.functionBody);
+        }
+
+        @Override
+        public void visitNode(@Nonnull AstNode node) {
+            //选择节点语句
+            List<AstNode> nodeDescendants = node.getDescendants(CxxGrammarImpl.selectionStatement);
+            for (AstNode astNode:nodeDescendants) {
+                //判断节点是不是if节点
+                if("if".equals(astNode.getToken().getValue())){
+                    //获取其中的参数
+                    List<AstNode> astNodeList = astNode.getDescendants(CxxGrammarImpl.expressionList);
+                    for (AstNode expr:astNodeList) {
+                        lists.add(expr.getToken().getValue());
+                    }
+
+                    if(astNodeList.size() == 0){
+                        List<AstNode> descendants = astNode.getDescendants(CxxGrammarImpl.condition);
+                        for (AstNode desc:descendants) {
+                            lists.add(desc.getToken().getValue());
+                        }
+                    }
+                }
+            }
+            //获取表达是数据信息
+            List<AstNode> descendants = node.getDescendants(CxxGrammarImpl.expressionList);
+            for (AstNode ast:descendants) {
+                String name = ast.getParent().getToken().getValue();
+                //判断是否时使用sanitizeString方法
+                if("system".equals(name)){
+                    //判断方法参数是否进行校验
+                    if(!lists.contains(ast.getToken().getValue())){
+                        reportIssue(ast, "在构建命令前对输入数据进行验证");
+                    }
+                }
+            }
+        }
+    }
+ }
--- a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyCheckerTest.java
+++ b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyCheckerTest.java
@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx.rules.checkers;
+
+import com.keyware.sonar.cxx.CxxFileTesterHelper;
+import org.junit.jupiter.api.Test;
+import org.sonar.cxx.CxxAstScanner;
+import org.sonar.cxx.squidbridge.api.SourceFile;
+import org.sonar.cxx.squidbridge.checks.CheckMessagesVerifier;
+
+import java.io.IOException;
+
+/**
+ * TODO CmdDataVerifyCheckerTest
+ *
+ * @author RenFengJiang
+ * @date 2024/1/15
+ */
+public class CmdDataVerifyCheckerTest {
+    @Test
+    public void checkTest() throws IOException {
+        var checker = new CmdDataVerifyChecker();
+        var tester = CxxFileTesterHelper.create("CmdDataVerifyChecker.cc");
+        SourceFile file = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker);
+        CheckMessagesVerifier.verify(file.getCheckMessages())
+                .next().atLine(12).withMessage("在构建命令前对输入数据进行验证")
+                .noMore();
+    }
+}
--- a/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.cc
+++ b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/CmdDataVerifyChecker.cc
@ -0,0 +1,21 @@
+#include <iostream>
+#include <cstdlib> // 包含系统调用相关的头文件
+
+int main() {
+    std::string command = "echo Hello, World!"; // 要构建的命令
+
+//    if(a(command)){
+//    }
+//    if(command.contains("/") ){
+//    }
+    // 使用system函数执行命令
+    int result = system(command);
+
+    if (result == 0) {
+        std::cout << "命令执行成功。" << std::endl;
+    } else {
+        std::cout << "命令执行失败。" << std::endl;
+    }
+
+    return 0;
+}