From 8c115e75d77ef4498779d1ba82d3b3cfa9f11bb0 Mon Sep 17 00:00:00 2001 From: bit4 Date: Wed, 13 Feb 2019 18:21:21 +0800 Subject: [PATCH 1/4] update rule and print out formate --- javaid.py | 11 +++++------ regexp.xml | 2 +- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/javaid.py b/javaid.py index 80b4d71..408ab42 100644 --- a/javaid.py +++ b/javaid.py @@ -50,7 +50,6 @@ "getRuntime.exec", "ProcessBuilder.start", "GroovyShell.evaluate" - ''' class javaid(object): @@ -66,12 +65,12 @@ def _run(self): try: self.banner() self.handlePath(self._dir) - print "[-]【JavaID】identify danger function Finished!" + print "[-][JavaID] identify danger function Finished!" except: raise - def report_id(self,vul): - print "[+]【"+vul+"】identify danger function ["+self._function+"] in file ["+self._filename+"]" + def report_id(self,vul,keyword): + print "[+][{0}] identified by danger function [{1} -- \"{2}\"] in file [{3}]".format(vul,self._function,keyword,self._filename) def report_line(self): print " --> [+] on line : "+ str(self._line) @@ -128,7 +127,7 @@ def regexp_search(self,rule_dom,content): exp_pattern = re.compile(regexp_dom.text) if exp_pattern.search(content): #print "identify sfunction is : "+self._function - self.report_id(self._vultype) + self.report_id(self._vultype,regexp_dom.text.replace("\\","")) self.function_search_line() return True @@ -150,7 +149,7 @@ def check_regexp(self, content): def remove_comment(self,content): return content def banner(self): - print "[-]【JavaID】 Danger function identify tool" + print "[-][JavaID] Danger function identify tool" if __name__ == '__main__': parser = optparse.OptionParser('usage: python %prog [options](eg: python %prog -d /user/java/demo)') parser.add_option('-d', '--dir', dest = 'dir', type = 'string', help = 'source code file dir') diff --git a/regexp.xml b/regexp.xml index 7ad5d2a..b45a818 100644 --- a/regexp.xml +++ b/regexp.xml @@ -82,7 +82,7 @@ - .load\( + \.load\( From 37e0f047cf11a9ce950725086155ad88371b9f63 Mon Sep 17 00:00:00 2001 From: bit4 Date: Wed, 13 Feb 2019 18:35:55 +0800 Subject: [PATCH 2/4] Update regexp.xml --- regexp.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/regexp.xml b/regexp.xml index b45a818..adb369e 100644 --- a/regexp.xml +++ b/regexp.xml @@ -85,6 +85,13 @@ \.load\( + + + + + new\s+XMLDecoder\( + + From 8a68f136380416dd3ab99dbbe016188b55d2c721 Mon Sep 17 00:00:00 2001 From: bit4 Date: Mon, 18 Feb 2019 15:24:25 +0800 Subject: [PATCH 3/4] Update regexp.xml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1.import org.apache.poi.xssf.usermodel.XSSFWorkbook; CVE-2016-5000 （Apache POI before 3.14） 2.Excel Streaming Reader <= 2.0.0 XXE --- regexp.xml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/regexp.xml b/regexp.xml index adb369e..9f4177b 100644 --- a/regexp.xml +++ b/regexp.xml @@ -41,6 +41,20 @@ createXMLStreamReader\( + + + + + StreamingReader\.builder\(\)( + + + + + + + new\s+XSSFWorkbook\( + + From b9702f702b61a4e00cb703e24e18431bd9b9c7da Mon Sep 17 00:00:00 2001 From: bit4 Date: Mon, 18 Feb 2019 16:09:15 +0800 Subject: [PATCH 4/4] Update regexp.xml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 格式化，并修改StreamingReader中的错误 --- regexp.xml | 601 ++++++++++++++++++++++++++--------------------------- 1 file changed, 296 insertions(+), 305 deletions(-) diff --git a/regexp.xml b/regexp.xml index 9f4177b..f4d4237 100644 --- a/regexp.xml +++ b/regexp.xml @@ -1,308 +1,299 @@ - - - - - new\s+SAXReader\(\) - - - - - - - new\s+SAXBuilder\(\) - - - - - - - newSAXParser\( - - - - - - - createXMLReader\( - - - - - - - newDocumentBuilder\( - - - - - - - createXMLStreamReader\( - - - - - - - StreamingReader\.builder\(\)( - - - - - - - new\s+XSSFWorkbook\( - - - - - - - - - \.readObject\( - - - - - - - JSON\.parseObject\( - - - - - - - ObjectMapper\.readValue - - - - - - - fromXML\( - - - - - - - readUnshared\( - - - - - - - \.load\( - - - - - - - new\s+XMLDecoder\( - - - - - - - - - openConnection\(|getInputStream\( - - - - - - - URL\(|openStream\( - - - - - - - ImageIO\.read\( - - - - - - - HttpClient\(|executeMethod\( - - - - - - - new\sSocket\( - - - - - - - \.newCall\(|Request.Builder\(\) - - - - - - - \.getConnection\( - - - - - - - \.getConnection\( - - - - - - - - - \.getOriginalFilename\(|MultipartFile\s - - - - - - - - - \.createNewFile\(|FileOutputStream\( - - - - - - - \.delete\(\) - - - - - - - new\sFileInputStream\( - - - - - - - - - @SessionAttributes - - - - - - - @ModelAttribute - - - - - - - - - sendRedirect\( - - - - - - - setHeader\(\"refresh - - - - - - - forward\( - - - - - - - - - getRuntime\(\)\.exec\( - - - - - - - ProcessBuilder|ProcessBuilder\.start - - - - - - - GroovyShell\.evaluate - - - - - - - - - SpelExpressionParser - - - - - - - getValue\(\) - - - - - - - - - (into|where)[^\$]*(\$\{[^,#=\s]+\}) - - - - - - - - - spring-boot-starter-actuator - - - - - + + + + new\s+SAXReader\(\) + + + + + + + new\s+SAXBuilder\(\) + + + + + + + newSAXParser\( + + + + + + + createXMLReader\( + + + + + + + newDocumentBuilder\( + + + + + + + createXMLStreamReader\( + + + + + + + StreamingReader\.builder\(\) + + + + + + + new\s+XSSFWorkbook\( + + + + + + + + + \.readObject\( + + + + + + + JSON\.parseObject\( + + + + + + + ObjectMapper\.readValue + + + + + + + fromXML\( + + + + + + + readUnshared\( + + + + + + + \.load\( + + + + + + + new\s+XMLDecoder\( + + + + + + + + + openConnection\(|getInputStream\( + + + + + + + URL\(|openStream\( + + + + + + + ImageIO\.read\( + + + + + + + HttpClient\(|executeMethod\( + + + + + + + new\sSocket\( + + + + + + + \.newCall\(|Request.Builder\(\) + + + + + + + \.getConnection\( + + + + + + + \.getConnection\( + + + + + + + + + \.getOriginalFilename\(|MultipartFile\s + + + + + + + + + \.createNewFile\(|FileOutputStream\( + + + + + + + \.delete\(\) + + + + + + + new\sFileInputStream\( + + + + + + + + + @SessionAttributes + + + + + + + @ModelAttribute + + + + + + + + + sendRedirect\( + + + + + + + setHeader\(\"refresh + + + + + + + forward\( + + + + + + + + + getRuntime\(\)\.exec\( + + + + + + + ProcessBuilder|ProcessBuilder\.start + + + + + + + GroovyShell\.evaluate + + + + + + + + + SpelExpressionParser + + + + + + + getValue\(\) + + + + + + + + + (into|where)[^\$]*(\$\{[^,#=\s]+\}) + + + + + + + + + spring-boot-starter-actuator + + + + +