Http3 xx status code based injection vulnerability fix #368

ehizman · 2022-06-04T16:22:34Z

used the browser's window location reference to determine redirect URL

.../static/templates/Http3xxStatusCodeBasedInjection/LEVEL_1/Http3xxStatusCodeBasedInjection.js

preetkaran20 · 2022-06-06T17:00:33Z

...n/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java

@@ -53,7 +53,7 @@ public class Http3xxStatusCodeBasedInjection {

    private static final String LOCATION_HEADER_KEY = "Location";
    private static final String RETURN_TO = "returnTo";
-    private static final Set<String> WHITELISTED_URLS = new HashSet<>(Arrays.asList("/"));
+    private static final Set<String> WHITELISTED_URLS = new HashSet<>(Arrays.asList("/", "/VulnerableApp/"));


if possible, can you please write a unit test case?

Sure thing!

preetkaran20 · 2022-06-20T16:11:44Z

@ehizman can you please execute ./gradlew spotlessApply in your machine and then checkin the change? it is failing due to checkstyle issue.

ehizman · 2022-06-20T16:53:52Z

Noted.

…

On Mon, 20 Jun 2022 at 17:11, Karan Preet Singh Sasan < ***@***.***> wrote: @ehizman <https://github.com/ehizman> can you please execute ./gradlew spotlessApply in your machine and then checkin the change? it is failing due to checkstyle issue. — Reply to this email directly, view it on GitHub <#368 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFRLSUT7OAITUCR6ICBTN43VQCJ4XANCNFSM5X3VLBIA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

preetkaran20 · 2022-06-29T05:16:46Z

@ehizman there was one error due to newer java google formatter, i removed that and it compiled successfully.

Will be merging the PR, Thank You!!!

ehizman · 2022-07-02T16:40:42Z

Hello @preetkaran20. I noticed that you removed the version number of the googleJavaFormat extension. Why is that? Because whenever I try to run ./gradlew spotlessApply. It returns this:
java.lang.NoSuchFieldError: reader.

Specifying the version of the googleJavaFormat extension fixes it.

preetkaran20 · 2022-07-02T16:50:30Z

The PR build is failing with that version as we are using older Java version in PR build. So please update that as well with format version.

Also which Java version are you using?

ehizman · 2022-07-02T18:01:36Z

I am using java 17 with the following gradle properties as a workaround for some issues with the googleJavaFormat plugin for java 16+

org.gradle.jvmargs=--add-exports jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED

The project refuses to build now that I have changed to java 8

ehizman · 2022-07-02T18:07:00Z

What gradle properties do you use for Java 8 on your machine

preetkaran20 · 2022-07-03T05:02:44Z

I am using java 17 with the following gradle properties as a workaround for some issues with the googleJavaFormat plugin for java 16+
org.gradle.jvmargs=--add-exports jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED \
  --add-exports jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
The project refuses to build now that I have changed to java 8

My java version is:
openjdk version "1.8.0_322"
OpenJDK Runtime Environment (build 1.8.0_322-bre_2022_02_28_15_01-b00)
OpenJDK 64-Bit Server VM (build 25.322-b00, mixed mode)

The project PR is build using following github action:
https://github.com/SasanLabs/VulnerableApp/blob/master/.github/workflows/gradle.yml

Please let me know what error are you facing and also please run java -version and send the the output of the command.

ehizman · 2022-07-03T17:43:57Z

my java version is:

openjdk version "1.8.0_332"
OpenJDK Runtime Environment (Zulu 8.62.0.19-CA-linux64) (build 1.8.0_332-b09)
OpenJDK 64-Bit Server VM (Zulu 8.62.0.19-CA-linux64) (build 25.332-b09, mixed mode)

ehizman · 2022-07-03T17:47:41Z

Now when I try to apply spotless, I get the following error:

Starting a Gradle Daemon, 1 incompatible Daemon could not be reused, use --status for details
Could not write standard input to Gradle build daemon.
java.io.IOException: Stream closed
        at java.lang.ProcessBuilder$NullOutputStream.write(ProcessBuilder.java:433)
        at java.io.OutputStream.write(OutputStream.java:116)
        at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
        at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
        at org.gradle.process.internal.streams.ExecOutputHandleRunner.forwardContent(ExecOutputHandleRunner.java:68)
        at org.gradle.process.internal.streams.ExecOutputHandleRunner.run(ExecOutputHandleRunner.java:53)
        at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:64)
        at org.gradle.internal.concurrent.ManagedExecutorImpl$1.run(ManagedExecutorImpl.java:48)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at org.gradle.internal.concurrent.ThreadFactoryImpl$ManagedThreadRunnable.run(ThreadFactoryImpl.java:56)
        at java.lang.Thread.run(Thread.java:750)

FAILURE: Build failed with an exception.

* What went wrong:
Unable to start the daemon process.
This problem might be caused by incorrect configuration of the daemon.
For example, an unrecognized jvm option is used.
Please refer to the User Manual chapter on the daemon at https://docs.gradle.org/7.0/userguide/gradle_daemon.html
Process command line: /home/***/.sdkman/candidates/java/8.0.332-zulu/bin/java --add-exports jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED --add-exports jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED --add-exports jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED --add-exports jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED -Dfile.encoding=UTF-8 -Duser.country=NG -Duser.language=en -Duser.variant -cp /home/anina/.gradle/wrapper/dists/gradle-7.0-bin/2p9ebqfz6ilrfozi676ogco7n/gradle-7.0/lib/gradle-launcher-7.0.jar org.gradle.launcher.daemon.bootstrap.GradleDaemon 7.0
Please read the following process output to find out more:
-----------------------
Unrecognized option: --add-exports
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.


* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

I think that it is because of the gradle properties defined in USER_HOME/gradle

ehizman · 2022-07-03T18:02:06Z

I have removed the gradle properties. When I apply spotless, I get the same error as above.

preetkaran20 · 2022-07-04T07:30:00Z

I think somehow gradle is still pointing to newer java version. can you please check JAVA_HOME and see if it is pointing to newer versions and also there is no need to modify gradle.properties and instead using gradle wrapper ./gradlew spotlessApply

thanks,
Karan

preetkaran20 · 2022-07-04T07:32:56Z

actually, --add-exports should not be added as JVM option, did you changes something in the project for making it compatible with java 17?

ehizman · 2022-07-04T15:52:25Z

My project SDK was set to java 17 but I just changed it to Java 8. Also, JAVA_HOME points to java 8. Still, when I run ./gradlew spotlessApply, it still gives the --add-exports error.

preetkaran20 · 2022-07-04T15:59:03Z

there should be something wrong in your setup for sure. I would suggest to uninstall java17 and any other versions and then try.

ehizman · 2022-07-04T16:05:05Z

Okay. I was also thinking of deleting my local version and then cloning the project again

ehizman · 2022-07-04T19:36:40Z

Hey @preetkaran20, I found the error. There was a gradle.properties file in my GRADLE_USER_HOME.
Deleted it and ./gradlew spotlessApply now works

ehizman added 2 commits June 4, 2022 17:20

Http3 xx status code based injection vulnerability fix

b72199f

Http3 xx status code based injection vulnerability fix

d07845f

preetkaran20 reviewed Jun 6, 2022

View reviewed changes

.../static/templates/Http3xxStatusCodeBasedInjection/LEVEL_1/Http3xxStatusCodeBasedInjection.js Outdated Show resolved Hide resolved

preetkaran20 reviewed Jun 6, 2022

View reviewed changes

.../static/templates/Http3xxStatusCodeBasedInjection/LEVEL_1/Http3xxStatusCodeBasedInjection.js Outdated Show resolved Hide resolved

preetkaran20 reviewed Jun 6, 2022

View reviewed changes

ehizman added 2 commits June 20, 2022 13:42

refactored the endsWith argument. Removed the port number

b61034b

refactored the endsWith argument. Removed the port number

fdfe899

preetkaran20 approved these changes Jun 20, 2022

View reviewed changes

ehizman and others added 2 commits June 29, 2022 01:23

applied spotless to code. Specified googleJavaFormat to be 1.12.0

4fd8101

Update build.gradle

af3f101

preetkaran20 merged commit bdcc492 into SasanLabs:master Jun 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Http3 xx status code based injection vulnerability fix #368

Http3 xx status code based injection vulnerability fix #368

ehizman commented Jun 4, 2022

preetkaran20 Jun 6, 2022

ehizman Jun 6, 2022

preetkaran20 commented Jun 20, 2022

ehizman commented Jun 20, 2022 via email

preetkaran20 commented Jun 29, 2022

ehizman commented Jul 2, 2022

preetkaran20 commented Jul 2, 2022

ehizman commented Jul 2, 2022 •

edited

Loading

ehizman commented Jul 2, 2022

preetkaran20 commented Jul 3, 2022

ehizman commented Jul 3, 2022

ehizman commented Jul 3, 2022

ehizman commented Jul 3, 2022

preetkaran20 commented Jul 4, 2022

preetkaran20 commented Jul 4, 2022 •

edited

Loading

ehizman commented Jul 4, 2022

preetkaran20 commented Jul 4, 2022

ehizman commented Jul 4, 2022

ehizman commented Jul 4, 2022

Http3 xx status code based injection vulnerability fix #368

Http3 xx status code based injection vulnerability fix #368

Conversation

ehizman commented Jun 4, 2022

preetkaran20 Jun 6, 2022

Choose a reason for hiding this comment

ehizman Jun 6, 2022

Choose a reason for hiding this comment

preetkaran20 commented Jun 20, 2022

ehizman commented Jun 20, 2022 via email

preetkaran20 commented Jun 29, 2022

ehizman commented Jul 2, 2022

preetkaran20 commented Jul 2, 2022

ehizman commented Jul 2, 2022 • edited Loading

ehizman commented Jul 2, 2022

preetkaran20 commented Jul 3, 2022

ehizman commented Jul 3, 2022

ehizman commented Jul 3, 2022

ehizman commented Jul 3, 2022

preetkaran20 commented Jul 4, 2022

preetkaran20 commented Jul 4, 2022 • edited Loading

ehizman commented Jul 4, 2022

preetkaran20 commented Jul 4, 2022

ehizman commented Jul 4, 2022

ehizman commented Jul 4, 2022

ehizman commented Jul 2, 2022 •

edited

Loading

preetkaran20 commented Jul 4, 2022 •

edited

Loading