Skip to content

Commit b9ab9ba

Browse files
VillanChVillanCh
committed
add verified rule
1 parent b37bed3 commit b9ab9ba

File tree

3 files changed

+301
-0
lines changed

3 files changed

+301
-0
lines changed

‎java-verified-rules/java-springboot-websecurity-click-hijack-checking.sf

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
desc(
2+
title: "Find Simple Trail of frameOptions Disabled",
3+
type: vuln,
4+
level: low,
5+
desc: <<<TEXT
6+
禁用 X-Frame-Options 头部可能会使应用程序容易受到点击劫持攻击。建议启用该头部，以防止应用程序被嵌入到其他网站的iframe中。
7+
TEXT
8+
)
9+
10+
.csrf().disable() as $vuln;
11+
check $vuln;
12+
alert $vuln;
13+
14+
desc(
15+
lang: java,
16+
'safefile:///safeconfig.java': <<<CONFIG
17+
package com.ruoyi.modules.monitor.config;
18+
19+
import de.codecentric.boot.admin.server.config.AdminServerProperties;
20+
import org.springframework.context.annotation.Bean;
21+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
22+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
23+
import org.springframework.security.web.SecurityFilterChain;
24+
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
25+
26+
@EnableWebSecurity
27+
public class WebSecurityConfigurer
28+
{
29+
private final String adminContextPath;
30+
31+
public WebSecurityConfigurer(AdminServerProperties adminServerProperties)
32+
{
33+
this.adminContextPath = adminServerProperties.getContextPath();
34+
}
35+
36+
@Bean
37+
public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception
38+
{
39+
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
40+
successHandler.setTargetUrlParameter("redirectTo");
41+
successHandler.setDefaultTargetUrl(adminContextPath + "/");
42+
43+
return httpSecurity
44+
.authorizeRequests()
45+
.antMatchers(adminContextPath + "/assets/**"
46+
, adminContextPath + "/login"
47+
, adminContextPath + "/actuator/**"
48+
, adminContextPath + "/instances/**"
49+
).permitAll()
50+
.anyRequest().authenticated()
51+
.and()
52+
.formLogin().loginPage(adminContextPath + "/login")
53+
.successHandler(successHandler).and()
54+
.logout().logoutUrl(adminContextPath + "/logout")
55+
.and()
56+
.httpBasic().and()
57+
.build();
58+
}
59+
}
60+
CONFIG,
61+
'file:///config.java': <<<CONFIG
62+
package com.ruoyi.modules.monitor.config;
63+
64+
import de.codecentric.boot.admin.server.config.AdminServerProperties;
65+
import org.springframework.context.annotation.Bean;
66+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
67+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
68+
import org.springframework.security.web.SecurityFilterChain;
69+
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
70+
71+
/**
72+
* 监控权限配置
73+
*
74+
* @author ruoyi
75+
*/
76+
@EnableWebSecurity
77+
public class WebSecurityConfigurer
78+
{
79+
private final String adminContextPath;
80+
81+
public WebSecurityConfigurer(AdminServerProperties adminServerProperties)
82+
{
83+
this.adminContextPath = adminServerProperties.getContextPath();
84+
}
85+
86+
@Bean
87+
public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception
88+
{
89+
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
90+
successHandler.setTargetUrlParameter("redirectTo");
91+
successHandler.setDefaultTargetUrl(adminContextPath + "/");
92+
93+
return httpSecurity
94+
.headers().frameOptions().disable()
95+
.and().authorizeRequests()
96+
.antMatchers(adminContextPath + "/assets/**"
97+
, adminContextPath + "/login"
98+
, adminContextPath + "/actuator/**"
99+
, adminContextPath + "/instances/**"
100+
).permitAll()
101+
.anyRequest().authenticated()
102+
.and()
103+
.formLogin().loginPage(adminContextPath + "/login")
104+
.successHandler(successHandler).and()
105+
.logout().logoutUrl(adminContextPath + "/logout")
106+
.and()
107+
.httpBasic().and()
108+
.csrf()
109+
.disable()
110+
.build();
111+
}
112+
}
113+
CONFIG,
114+
)

‎java-verified-rules/java-springfox-awared.sf

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
desc(
2+
title: 'Checking [Swagger2 Configuration] in Springfox Aware',
3+
type: audit,
4+
level: low,
5+
desc: <<<TEXT
6+
Springfox 是一个用于生成 Spring Boot 应用程序的 API 文档的库，主要与 Swagger 结合使用。它通过注解和配置来自动生成 API 文档，并提供一个用户友好的界面来查看和测试 API。
7+
TEXT
8+
)
9+
10+
.api?{ <getFormalParams>?{<typeName>?{have: SwaggerProperties} } } as $config;
11+
check $config
12+
alert $config;
13+
14+
desc(
15+
'file://config.java': <<<TEXT
16+
package com.ruoyi.common.swagger.config;
17+
18+
import java.util.ArrayList;
19+
import java.util.Arrays;
20+
import springfox.documentation.spi.DocumentationType;
21+
import springfox.documentation.spi.service.contexts.SecurityContext;
22+
import springfox.documentation.spring.web.plugins.ApiSelectorBuilder;
23+
import springfox.documentation.spring.web.plugins.Docket;
24+
import springfox.documentation.swagger2.annotations.EnableSwagger2;
25+
26+
@Configuration
27+
@EnableSwagger2
28+
@EnableConfigurationProperties(SwaggerProperties.class)
29+
@ConditionalOnProperty(name = "swagger.enabled", matchIfMissing = true)
30+
@Import({SwaggerBeanPostProcessor.class, SwaggerWebConfiguration.class})
31+
public class SwaggerAutoConfiguration
32+
{
33+
/**
34+
* 默认的排除路径，排除Spring Boot默认的错误处理路径和端点
35+
*/
36+
private static final List<String> DEFAULT_EXCLUDE_PATH = Arrays.asList("/error", "/actuator/**");
37+
38+
private static final String BASE_PATH = "/**";
39+
40+
@Bean
41+
public Docket api(SwaggerProperties swaggerProperties)
42+
{
43+
// base-path处理
44+
if (swaggerProperties.getBasePath().isEmpty())
45+
{
46+
swaggerProperties.getBasePath().add(BASE_PATH);
47+
}
48+
// noinspection unchecked
49+
List<Predicate<String>> basePath = new ArrayList<Predicate<String>>();
50+
swaggerProperties.getBasePath().forEach(path -> basePath.add(PathSelectors.ant(path)));
51+
52+
// exclude-path处理
53+
if (swaggerProperties.getExcludePath().isEmpty())
54+
{
55+
swaggerProperties.getExcludePath().addAll(DEFAULT_EXCLUDE_PATH);
56+
}
57+
58+
List<Predicate<String>> excludePath = new ArrayList<>();
59+
swaggerProperties.getExcludePath().forEach(path -> excludePath.add(PathSelectors.ant(path)));
60+
61+
ApiSelectorBuilder builder = new Docket(DocumentationType.SWAGGER_2).host(swaggerProperties.getHost())
62+
.apiInfo(apiInfo(swaggerProperties)).select()
63+
.apis(RequestHandlerSelectors.basePackage(swaggerProperties.getBasePackage()));
64+
65+
swaggerProperties.getBasePath().forEach(p -> builder.paths(PathSelectors.ant(p)));
66+
swaggerProperties.getExcludePath().forEach(p -> builder.paths(PathSelectors.ant(p).negate()));
67+
68+
return builder.build().securitySchemes(securitySchemes()).securityContexts(securityContexts()).pathMapping("/");
69+
}
70+
}
71+
TEXT
72+
)

‎java-verified-rules/java-websecurity-csrf-disabled-simple.sf

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
desc(
2+
title: "Find Simple Trail of CSRF Disabled",
3+
type: vuln,
4+
level: low,
5+
desc: <<<TEXT
6+
禁用CSRF（跨站请求伪造）保护可能会使应用程序容易受到CSRF攻击。虽然在某些情况下（例如API服务）可以考虑禁用CSRF，但在Web应用程序中，建议保留CSRF保护
7+
TEXT
8+
)
9+
10+
.csrf().disable() as $vuln;
11+
check $vuln;
12+
alert $vuln;
13+
14+
desc(
15+
lang: java,
16+
'safefile:///safeconfig.java': <<<CONFIG
17+
package com.ruoyi.modules.monitor.config;
18+
19+
import de.codecentric.boot.admin.server.config.AdminServerProperties;
20+
import org.springframework.context.annotation.Bean;
21+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
22+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
23+
import org.springframework.security.web.SecurityFilterChain;
24+
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
25+
26+
@EnableWebSecurity
27+
public class WebSecurityConfigurer
28+
{
29+
private final String adminContextPath;
30+
31+
public WebSecurityConfigurer(AdminServerProperties adminServerProperties)
32+
{
33+
this.adminContextPath = adminServerProperties.getContextPath();
34+
}
35+
36+
@Bean
37+
public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception
38+
{
39+
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
40+
successHandler.setTargetUrlParameter("redirectTo");
41+
successHandler.setDefaultTargetUrl(adminContextPath + "/");
42+
43+
return httpSecurity
44+
.headers().frameOptions().disable()
45+
.and().authorizeRequests()
46+
.antMatchers(adminContextPath + "/assets/**"
47+
, adminContextPath + "/login"
48+
, adminContextPath + "/actuator/**"
49+
, adminContextPath + "/instances/**"
50+
).permitAll()
51+
.anyRequest().authenticated()
52+
.and()
53+
.formLogin().loginPage(adminContextPath + "/login")
54+
.successHandler(successHandler).and()
55+
.logout().logoutUrl(adminContextPath + "/logout")
56+
.and()
57+
.httpBasic().and()
58+
.build();
59+
}
60+
}
61+
CONFIG,
62+
'file:///config.java': <<<CONFIG
63+
package com.ruoyi.modules.monitor.config;
64+
65+
import de.codecentric.boot.admin.server.config.AdminServerProperties;
66+
import org.springframework.context.annotation.Bean;
67+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
68+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
69+
import org.springframework.security.web.SecurityFilterChain;
70+
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
71+
72+
/**
73+
* 监控权限配置
74+
*
75+
* @author ruoyi
76+
*/
77+
@EnableWebSecurity
78+
public class WebSecurityConfigurer
79+
{
80+
private final String adminContextPath;
81+
82+
public WebSecurityConfigurer(AdminServerProperties adminServerProperties)
83+
{
84+
this.adminContextPath = adminServerProperties.getContextPath();
85+
}
86+
87+
@Bean
88+
public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception
89+
{
90+
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
91+
successHandler.setTargetUrlParameter("redirectTo");
92+
successHandler.setDefaultTargetUrl(adminContextPath + "/");
93+
94+
return httpSecurity
95+
.headers().frameOptions().disable()
96+
.and().authorizeRequests()
97+
.antMatchers(adminContextPath + "/assets/**"
98+
, adminContextPath + "/login"
99+
, adminContextPath + "/actuator/**"
100+
, adminContextPath + "/instances/**"
101+
).permitAll()
102+
.anyRequest().authenticated()
103+
.and()
104+
.formLogin().loginPage(adminContextPath + "/login")
105+
.successHandler(successHandler).and()
106+
.logout().logoutUrl(adminContextPath + "/logout")
107+
.and()
108+
.httpBasic().and()
109+
.csrf()
110+
.disable()
111+
.build();
112+
}
113+
}
114+
CONFIG,
115+
)

0 commit comments

Comments
 (0)