Skip to content

Commit 2cfd68f

Browse files
PeterSchaferPeterSchafer
authored
Merge pull request #6472 from snyk/fix/cli-1308_dotSnykExcludeRules
fix: apply ignores correctly for .snyk excludes
2 parents acb804c + a61589c commit 2cfd68f

22 files changed

+3024
-3
lines changed

‎cliv2/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ require (
2020
github.com/snyk/cli-extension-secrets v0.0.0-20260119125200-a69877b835d2
2121
github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7
2222
github.com/snyk/error-catalog-golang-public v0.0.0-20260108110943-21ad0c940c14
23-
github.com/snyk/go-application-framework v0.0.0-20260126103810-195f34e2e0a2
23+
github.com/snyk/go-application-framework v0.0.0-20260128131202-72ae858e7d08
2424
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65
2525
github.com/snyk/snyk-iac-capture v0.6.5
2626
github.com/snyk/snyk-ls v0.0.0-20260128094006-1a31e5aa396e

‎cliv2/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -555,8 +555,8 @@ github.com/snyk/dep-graph/go v0.0.0-20251219134535-fcb262dc6d25 h1:dwJ4Kdp4c5aaW
555555
github.com/snyk/dep-graph/go v0.0.0-20251219134535-fcb262dc6d25/go.mod h1:hTr91da/4ze2nk9q6ZW1BmfM2Z8rLUZSEZ3kK+6WGpc=
556556
github.com/snyk/error-catalog-golang-public v0.0.0-20260108110943-21ad0c940c14 h1:R74dgtKtcrIOG/349YDV8arH7D09pob3lAcJc290FqI=
557557
github.com/snyk/error-catalog-golang-public v0.0.0-20260108110943-21ad0c940c14/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
558-
github.com/snyk/go-application-framework v0.0.0-20260126103810-195f34e2e0a2 h1:GPPfUrc/qgRqqkd+4FSbD+OYXVwrb9JG8vMjgN0Kmjw=
559-
github.com/snyk/go-application-framework v0.0.0-20260126103810-195f34e2e0a2/go.mod h1:LPR080GrK2jqNN9/hgVwKkXTVS3BlvwqmTN60lX5wdA=
558+
github.com/snyk/go-application-framework v0.0.0-20260128131202-72ae858e7d08 h1:spA/w4h6q+UJq054xF3rhaqIeF8UYuHPjiLGezViAYU=
559+
github.com/snyk/go-application-framework v0.0.0-20260128131202-72ae858e7d08/go.mod h1:LPR080GrK2jqNN9/hgVwKkXTVS3BlvwqmTN60lX5wdA=
560560
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65 h1:CEQuYv0Go6MEyRCD3YjLYM2u3Oxkx8GpCpFBd4rUTUk=
561561
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65/go.mod h1:88KbbvGYlmLgee4OcQ19yr0bNpXpOr2kciOthaSzCAg=
562562
github.com/snyk/policy-engine v1.1.2 h1:BYWigTxPjiQer4m2jYhO623KmGdmmzA3S60k9AJPT+Q=

‎test/fixtures/sast/shallow_sast_webgoat_with_dotSnyk/Assignment5.java‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/*
2+
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
3+
*
4+
* Copyright (c) 2002 - 2019 Bruce Mayhew
5+
*
6+
* This program is free software; you can redistribute it and/or modify it under the terms of the
7+
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
8+
* License, or (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
11+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along with this program; if
15+
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
16+
* 02111-1307, USA.
17+
*
18+
* Getting Source ==============
19+
*
20+
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
21+
*/
22+
23+
package org.owasp.webgoat.challenges.challenge5;
24+
25+
import lombok.extern.slf4j.Slf4j;
26+
import org.owasp.webgoat.assignments.AssignmentEndpoint;
27+
import org.owasp.webgoat.assignments.AttackResult;
28+
import org.owasp.webgoat.challenges.Flag;
29+
import org.springframework.util.StringUtils;
30+
import org.springframework.web.bind.annotation.PostMapping;
31+
import org.springframework.web.bind.annotation.RequestParam;
32+
import org.springframework.web.bind.annotation.ResponseBody;
33+
import org.springframework.web.bind.annotation.RestController;
34+
35+
import javax.sql.DataSource;
36+
import java.sql.PreparedStatement;
37+
import java.sql.ResultSet;
38+
39+
@RestController
40+
@Slf4j
41+
public class Assignment5 extends AssignmentEndpoint {
42+
43+
private final DataSource dataSource;
44+
45+
public Assignment5(DataSource dataSource) {
46+
this.dataSource = dataSource;
47+
}
48+
49+
@PostMapping("/challenge/5")
50+
@ResponseBody
51+
public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {
52+
if (!StringUtils.hasText(username_login) || !StringUtils.hasText(password_login)) {
53+
return failed(this).feedback("required4").build();
54+
}
55+
if (!"Larry".equals(username_login)) {
56+
return failed(this).feedback("user.not.larry").feedbackArgs(username_login).build();
57+
}
58+
try (var connection = dataSource.getConnection()) {
59+
PreparedStatement statement = connection.prepareStatement("select password from challenge_users where userid = '" + username_login + "' and password = '" + password_login + "'");
60+
ResultSet resultSet = statement.executeQuery();
61+
62+
if (resultSet.next()) {
63+
return success(this).feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(5)).build();
64+
} else {
65+
return failed(this).feedback("challenge.close").build();
66+
}
67+
}
68+
}
69+
}
70+

‎test/fixtures/sast/shallow_sast_webgoat_with_dotSnyk/DeserializeTest.java‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
package org.owasp.webgoat.deserialization;
2+
3+
import static org.hamcrest.Matchers.is;
4+
import static org.mockito.Mockito.when;
5+
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
6+
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
7+
import static org.springframework.test.web.servlet.setup.MockMvcBuilders.standaloneSetup;
8+
9+
import org.dummy.insecure.framework.VulnerableTaskHolder;
10+
import org.hamcrest.CoreMatchers;
11+
import org.junit.Before;
12+
import org.junit.Test;
13+
import org.junit.runner.RunWith;
14+
import org.mockito.junit.MockitoJUnitRunner;
15+
import org.owasp.webgoat.assignments.AssignmentEndpointTest;
16+
import org.springframework.test.web.servlet.MockMvc;
17+
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
18+
19+
@RunWith(MockitoJUnitRunner.class)
20+
public class DeserializeTest extends AssignmentEndpointTest {
21+
22+
private MockMvc mockMvc;
23+
24+
private static String OS = System.getProperty("os.name").toLowerCase();
25+
26+
@Before
27+
public void setup() {
28+
InsecureDeserializationTask insecureTask = new InsecureDeserializationTask();
29+
init(insecureTask);
30+
this.mockMvc = standaloneSetup(insecureTask).build();
31+
}
32+
33+
@Test
34+
public void success() throws Exception {
35+
if (OS.indexOf("win")>-1) {
36+
mockMvc.perform(MockMvcRequestBuilders.post("/InsecureDeserialization/task")
37+
.header("x-request-intercepted", "true")
38+
.param("token", SerializationHelper.toString(new VulnerableTaskHolder("wait", "ping localhost -n 5"))))
39+
.andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true)));
40+
} else {
41+
mockMvc.perform(MockMvcRequestBuilders.post("/InsecureDeserialization/task")
42+
.header("x-request-intercepted", "true")
43+
.param("token", SerializationHelper.toString(new VulnerableTaskHolder("wait", "sleep 5"))))
44+
.andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(true)));
45+
}
46+
}
47+
48+
@Test
49+
public void fail() throws Exception {
50+
mockMvc.perform(MockMvcRequestBuilders.post("/InsecureDeserialization/task")
51+
.header("x-request-intercepted", "true")
52+
.param("token", SerializationHelper.toString(new VulnerableTaskHolder("delete", "rm *"))))
53+
.andExpect(status().isOk()).andExpect(jsonPath("$.lessonCompleted", is(false)));
54+
}
55+
56+
@Test
57+
public void wrongVersion() throws Exception {
58+
String token = "rO0ABXNyADFvcmcuZHVtbXkuaW5zZWN1cmUuZnJhbWV3b3JrLlZ1bG5lcmFibGVUYXNrSG9sZGVyAAAAAAAAAAECAANMABZyZXF1ZXN0ZWRFeGVjdXRpb25UaW1ldAAZTGphdmEvdGltZS9Mb2NhbERhdGVUaW1lO0wACnRhc2tBY3Rpb250ABJMamF2YS9sYW5nL1N0cmluZztMAAh0YXNrTmFtZXEAfgACeHBzcgANamF2YS50aW1lLlNlcpVdhLobIkiyDAAAeHB3DgUAAAfjCR4GIQgMLRSoeHQACmVjaG8gaGVsbG90AAhzYXlIZWxsbw";
59+
mockMvc.perform(MockMvcRequestBuilders.post("/InsecureDeserialization/task")
60+
.header("x-request-intercepted", "true")
61+
.param("token", token))
62+
.andExpect(status().isOk())
63+
.andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("insecure-deserialization.invalidversion"))))
64+
.andExpect(jsonPath("$.lessonCompleted", is(false)));
65+
}
66+
67+
@Test
68+
public void expiredTask() throws Exception {
69+
String token = "rO0ABXNyADFvcmcuZHVtbXkuaW5zZWN1cmUuZnJhbWV3b3JrLlZ1bG5lcmFibGVUYXNrSG9sZGVyAAAAAAAAAAICAANMABZyZXF1ZXN0ZWRFeGVjdXRpb25UaW1ldAAZTGphdmEvdGltZS9Mb2NhbERhdGVUaW1lO0wACnRhc2tBY3Rpb250ABJMamF2YS9sYW5nL1N0cmluZztMAAh0YXNrTmFtZXEAfgACeHBzcgANamF2YS50aW1lLlNlcpVdhLobIkiyDAAAeHB3DgUAAAfjCR4IDC0YfvNIeHQACmVjaG8gaGVsbG90AAhzYXlIZWxsbw";
70+
mockMvc.perform(MockMvcRequestBuilders.post("/InsecureDeserialization/task")
71+
.header("x-request-intercepted", "true")
72+
.param("token", token))
73+
.andExpect(status().isOk())
74+
.andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("insecure-deserialization.expired"))))
75+
.andExpect(jsonPath("$.lessonCompleted", is(false)));
76+
}
77+
78+
79+
80+
@Test
81+
public void checkOtherObject() throws Exception {
82+
String token = "rO0ABXQAVklmIHlvdSBkZXNlcmlhbGl6ZSBtZSBkb3duLCBJIHNoYWxsIGJlY29tZSBtb3JlIHBvd2VyZnVsIHRoYW4geW91IGNhbiBwb3NzaWJseSBpbWFnaW5l";
83+
mockMvc.perform(MockMvcRequestBuilders.post("/InsecureDeserialization/task")
84+
.header("x-request-intercepted", "true")
85+
.param("token", token))
86+
.andExpect(status().isOk())
87+
.andExpect(jsonPath("$.feedback", CoreMatchers.is(messages.getMessage("insecure-deserialization.stringobject"))))
88+
.andExpect(jsonPath("$.lessonCompleted", is(false)));
89+
}
90+
91+
92+
93+
}

‎test/fixtures/sast/shallow_sast_webgoat_with_dotSnyk/HashingAssignment.java‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
/*
2+
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
3+
*
4+
* Copyright (c) 2002 - 2019 Bruce Mayhew
5+
*
6+
* This program is free software; you can redistribute it and/or modify it under the terms of the
7+
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
8+
* License, or (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
11+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along with this program; if
15+
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
16+
* 02111-1307, USA.
17+
*
18+
* Getting Source ==============
19+
*
20+
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
21+
*/
22+
23+
package org.owasp.webgoat.crypto;
24+
25+
import java.security.MessageDigest;
26+
import java.security.NoSuchAlgorithmException;
27+
import java.util.Random;
28+
29+
import javax.servlet.http.HttpServletRequest;
30+
import javax.xml.bind.DatatypeConverter;
31+
32+
import org.owasp.webgoat.assignments.AssignmentEndpoint;
33+
import org.owasp.webgoat.assignments.AssignmentHints;
34+
import org.owasp.webgoat.assignments.AttackResult;
35+
import org.springframework.http.MediaType;
36+
import org.springframework.web.bind.annotation.PostMapping;
37+
import org.springframework.web.bind.annotation.RequestMapping;
38+
import org.springframework.web.bind.annotation.RequestParam;
39+
import org.springframework.web.bind.annotation.ResponseBody;
40+
import org.springframework.web.bind.annotation.RestController;
41+
42+
@RestController
43+
@AssignmentHints({"crypto-hashing.hints.1","crypto-hashing.hints.2"})
44+
public class HashingAssignment extends AssignmentEndpoint {
45+
46+
public static final String[] SECRETS = {"secret","admin","password", "123456", "passw0rd"};
47+
48+
@RequestMapping(path="/crypto/hashing/md5",produces=MediaType.TEXT_HTML_VALUE)
49+
@ResponseBody
50+
public String getMd5(HttpServletRequest request) throws NoSuchAlgorithmException {
51+
52+
String md5Hash = (String) request.getSession().getAttribute("md5Hash");
53+
if (md5Hash == null) {
54+
55+
String secret = SECRETS[new Random().nextInt(SECRETS.length)];
56+
57+
MessageDigest md = MessageDigest.getInstance("MD5");
58+
md.update(secret.getBytes());
59+
byte[] digest = md.digest();
60+
md5Hash = DatatypeConverter
61+
.printHexBinary(digest).toUpperCase();
62+
request.getSession().setAttribute("md5Hash", md5Hash);
63+
request.getSession().setAttribute("md5Secret", secret);
64+
}
65+
return md5Hash;
66+
}
67+
68+
@RequestMapping(path="/crypto/hashing/sha256",produces=MediaType.TEXT_HTML_VALUE)
69+
@ResponseBody
70+
public String getSha256(HttpServletRequest request) throws NoSuchAlgorithmException {
71+
72+
String sha256 = (String) request.getSession().getAttribute("sha256");
73+
if (sha256 == null) {
74+
String secret = SECRETS[new Random().nextInt(SECRETS.length)];
75+
sha256 = getHash(secret, "SHA-256");
76+
request.getSession().setAttribute("sha256Hash", sha256);
77+
request.getSession().setAttribute("sha256Secret", secret);
78+
}
79+
return sha256;
80+
}
81+
82+
@PostMapping("/crypto/hashing")
83+
@ResponseBody
84+
public AttackResult completed(HttpServletRequest request, @RequestParam String answer_pwd1, @RequestParam String answer_pwd2) {
85+
86+
String md5Secret = (String) request.getSession().getAttribute("md5Secret");
87+
String sha256Secret = (String) request.getSession().getAttribute("sha256Secret");
88+
89+
if (answer_pwd1!=null && answer_pwd2 !=null) {
90+
if (answer_pwd1.equals(md5Secret)
91+
&& answer_pwd2.equals(sha256Secret)) {
92+
return success(this)
93+
.feedback("crypto-hashing.success")
94+
.build();
95+
} else if (answer_pwd1.equals(md5Secret)
96+
|| answer_pwd2.equals(sha256Secret)) {
97+
return failed(this).feedback("crypto-hashing.oneok").build();
98+
}
99+
}
100+
return failed(this).feedback("crypto-hashing.empty").build();
101+
}
102+
103+
public static String getHash(String secret, String algorithm) throws NoSuchAlgorithmException {
104+
MessageDigest md = MessageDigest.getInstance(algorithm);
105+
md.update(secret.getBytes());
106+
byte[] digest = md.digest();
107+
return DatatypeConverter
108+
.printHexBinary(digest).toUpperCase();
109+
}
110+
111+
}

‎test/fixtures/sast/shallow_sast_webgoat_with_dotSnyk/IDORLogin.java‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
/*
2+
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
3+
*
4+
* Copyright (c) 2002 - 2019 Bruce Mayhew
5+
*
6+
* This program is free software; you can redistribute it and/or modify it under the terms of the
7+
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
8+
* License, or (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
11+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along with this program; if
15+
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
16+
* 02111-1307, USA.
17+
*
18+
* Getting Source ==============
19+
*
20+
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
21+
*/
22+
23+
package org.owasp.webgoat.idor;
24+
25+
import org.owasp.webgoat.assignments.AssignmentEndpoint;
26+
import org.owasp.webgoat.assignments.AssignmentHints;
27+
import org.owasp.webgoat.assignments.AttackResult;
28+
29+
import org.owasp.webgoat.session.UserSessionData;
30+
import org.springframework.web.bind.annotation.*;
31+
32+
import java.util.HashMap;
33+
import java.util.Map;
34+
35+
@RestController
36+
@AssignmentHints({"idor.hints.idor_login"})
37+
public class IDORLogin extends AssignmentEndpoint {
38+
39+
private Map<String, Map<String, String>> idorUserInfo = new HashMap<>();
40+
41+
public void initIDORInfo() {
42+
43+
idorUserInfo.put("tom", new HashMap<String, String>());
44+
idorUserInfo.get("tom").put("password", "cat");
45+
idorUserInfo.get("tom").put("id", "2342384");
46+
idorUserInfo.get("tom").put("color", "yellow");
47+
idorUserInfo.get("tom").put("size", "small");
48+
49+
idorUserInfo.put("bill", new HashMap<String, String>());
50+
idorUserInfo.get("bill").put("password", "buffalo");
51+
idorUserInfo.get("bill").put("id", "2342388");
52+
idorUserInfo.get("bill").put("color", "brown");
53+
idorUserInfo.get("bill").put("size", "large");
54+
55+
}
56+
57+
@PostMapping("/IDOR/login")
58+
@ResponseBody
59+
public AttackResult completed(@RequestParam String username, @RequestParam String password) {
60+
initIDORInfo();
61+
UserSessionData userSessionData = getUserSessionData();
62+
63+
if (idorUserInfo.containsKey(username)) {
64+
if ("tom".equals(username) && idorUserInfo.get("tom").get("password").equals(password)) {
65+
userSessionData.setValue("idor-authenticated-as", username);
66+
userSessionData.setValue("idor-authenticated-user-id", idorUserInfo.get(username).get("id"));
67+
return success(this).feedback("idor.login.success").feedbackArgs(username).build();
68+
} else {
69+
return failed(this).feedback("idor.login.failure").build();
70+
}
71+
} else {
72+
return failed(this).feedback("idor.login.failure").build();
73+
}
74+
}
75+
}

0 commit comments

Comments
 (0)