From 9788a484326e2a01b05a9dc7ef5b1500572a8c64 Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Fri, 11 Mar 2022 11:22:25 +0200 Subject: [PATCH 1/7] fix sqli in forum.jsp --- src/main/webapp/vulnerability/forum.jsp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/main/webapp/vulnerability/forum.jsp b/src/main/webapp/vulnerability/forum.jsp index f65bf75..c89e705 100644 --- a/src/main/webapp/vulnerability/forum.jsp +++ b/src/main/webapp/vulnerability/forum.jsp @@ -45,13 +45,13 @@ { Statement stmt = con.createStatement(); //Posting Content - stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')"); - //String sql = "INSERT into posts(content,title,user) values (?,?,?)" - //PreparedStatement prepStmt = con.preparedStatement(sql); - //prepStmt.setString(1,content); - //prepStmt.setString(2,title); - //prepStmt.setString(3,user); - //prepStmt.executeQuery(); + //stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')"); + String sql = "INSERT into posts(content,title,user) values (?,?,?)" + PreparedStatement prepStmt = con.preparedStatement(sql); + prepStmt.setString(1,content); + prepStmt.setString(2,title); + prepStmt.setString(3,user); + prepStmt.executeQuery(); out.print("Successfully posted"); } } From 119050a58c2fb0d54356095a3a73b2c9d9d58dca Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Wed, 13 Sep 2023 20:21:37 +0300 Subject: [PATCH 2/7] delete trigger scan --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index c7de0d2..32557d7 100644 --- a/README.md +++ b/README.md @@ -77,5 +77,4 @@ How to Use/Setup ? Get the VulnerableSpring Project from here: https://github.com/CSPF-Founder/VulnerableSpring -trigger scan From c4e9903b20e167cbfee558a68fd8fd0cd6277730 Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Wed, 13 Sep 2023 20:36:13 +0300 Subject: [PATCH 3/7] actions permissions -> write --- .github/workflows/checkmarx-one.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/checkmarx-one.yml b/.github/workflows/checkmarx-one.yml index 7cf5d72..01e65d0 100644 --- a/.github/workflows/checkmarx-one.yml +++ b/.github/workflows/checkmarx-one.yml @@ -31,7 +31,7 @@ jobs: permissions: contents: read # for actions/checkout to fetch code security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - actions: read # only required for a private repository by github/codeql-action/upload-sarif + actions: write # only required for a private repository by github/codeql-action/upload-sarif # The type of runner that the job will run on runs-on: ubuntu-latest From dc66387cd7ccb671a68bdd6115ae9eb5cf002fa6 Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Wed, 13 Sep 2023 20:40:56 +0300 Subject: [PATCH 4/7] no permissions --- .github/workflows/checkmarx-one.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/checkmarx-one.yml b/.github/workflows/checkmarx-one.yml index 01e65d0..c15aac6 100644 --- a/.github/workflows/checkmarx-one.yml +++ b/.github/workflows/checkmarx-one.yml @@ -21,17 +21,15 @@ on: branches: [ "master" ] push: branches: [ "master" ] -permissions: - contents: read # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - actions: write # only required for a private repository by github/codeql-action/upload-sarif + # permissions: + # contents: read # for actions/checkout to fetch code + # security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + # actions: write # only required for a private repository by github/codeql-action/upload-sarif # The type of runner that the job will run on runs-on: ubuntu-latest From 268251eece2ed378717e7b61a40cd11e23fefb4e Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Wed, 13 Sep 2023 20:47:47 +0300 Subject: [PATCH 5/7] sast only contents permissions --- .github/workflows/checkmarx-one.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/checkmarx-one.yml b/.github/workflows/checkmarx-one.yml index c15aac6..9ff3fef 100644 --- a/.github/workflows/checkmarx-one.yml +++ b/.github/workflows/checkmarx-one.yml @@ -26,8 +26,8 @@ on: jobs: # This workflow contains a single job called "build" build: - # permissions: - # contents: read # for actions/checkout to fetch code + permissions: + contents: read # for actions/checkout to fetch code # security-events: write # for github/codeql-action/upload-sarif to upload SARIF results # actions: write # only required for a private repository by github/codeql-action/upload-sarif @@ -47,7 +47,7 @@ jobs: cx_client_id: ${{ secrets.AST_CLIENT_ID }} # This should be created within your Checkmarx One account : https://checkmarx.com/resource/documents/en/34965-118315-authentication-for-checkmarx-one-cli.html#UUID-a4e31a96-1f36-6293-e95a-97b4b9189060_UUID-4123a2ff-32d0-2287-8dd2-3c36947f675e cx_client_secret: ${{ secrets.AST_CLIENT_SECRET }} # This should be created within your Checkmarx One account : https://checkmarx.com/resource/documents/en/34965-118315-authentication-for-checkmarx-one-cli.html#UUID-a4e31a96-1f36-6293-e95a-97b4b9189060_UUID-4123a2ff-32d0-2287-8dd2-3c36947f675e cx_tenant: ${{ secrets.TENANT }} # This should be replaced by your tenant for Checkmarx One - additional_params: --report-format sarif --output-path . --tags ${{ github.event.pull_request.head.sha }},${{ github.sha }} + additional_params: --scan-types sast --report-format sarif --output-path . --tags ${{ github.event.pull_request.head.sha }},${{ github.sha }} - name: Upload SARIF file uses: github/codeql-action/upload-sarif@v2 with: From ded9545068da2deb9ba510eaf6f47911f7f31a68 Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Wed, 13 Sep 2023 20:54:06 +0300 Subject: [PATCH 6/7] contents permissions write --- .github/workflows/checkmarx-one.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/checkmarx-one.yml b/.github/workflows/checkmarx-one.yml index 9ff3fef..3125fbd 100644 --- a/.github/workflows/checkmarx-one.yml +++ b/.github/workflows/checkmarx-one.yml @@ -27,7 +27,7 @@ jobs: # This workflow contains a single job called "build" build: permissions: - contents: read # for actions/checkout to fetch code + contents: write # for actions/checkout to fetch code # security-events: write # for github/codeql-action/upload-sarif to upload SARIF results # actions: write # only required for a private repository by github/codeql-action/upload-sarif From 4928a5d47185d16366dd5b3fad0bf8a982d20dc9 Mon Sep 17 00:00:00 2001 From: juegge <64655256+juegge@users.noreply.github.com> Date: Wed, 13 Sep 2023 20:59:23 +0300 Subject: [PATCH 7/7] no permissions block --- .github/workflows/checkmarx-one.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/checkmarx-one.yml b/.github/workflows/checkmarx-one.yml index 3125fbd..0f5bf6f 100644 --- a/.github/workflows/checkmarx-one.yml +++ b/.github/workflows/checkmarx-one.yml @@ -26,8 +26,8 @@ on: jobs: # This workflow contains a single job called "build" build: - permissions: - contents: write # for actions/checkout to fetch code + # permissions: + # contents: write # for actions/checkout to fetch code # security-events: write # for github/codeql-action/upload-sarif to upload SARIF results # actions: write # only required for a private repository by github/codeql-action/upload-sarif