Skip to content

Commit 88bc663

Browse files
preetkaran20preetkaran20
authored
Merge pull request #7 from SasanLabs/develop
atleast one configuration should be present for scanrule to execute
2 parents 11b6588 + df26570 commit 88bc663

File tree

7 files changed

+60
-38
lines changed

7 files changed

+60
-38
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
All notable changes to this add-on will be documented in this file.
33

44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
5+
## [1.0.1] - 2021-08-19
6+
- Minor change
7+
- Scan rule will only execute if add-on configuration is specified.
58

69
## [1.0.0] - 2021-08-05
710
- First version of FileUpload Addon.

‎build.gradle.kts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ tasks.compileJava {
3737

3838
tasks.withType<JavaCompile>().configureEach { options.encoding = "utf-8"}
3939

40-
version = "1.0.0"
40+
version = "1.0.1"
4141
description = "Detect File upload requests and scan them to find related vulnerabilities"
4242

4343
zapAddOn {

‎src/main/java/org/sasanlabs/fileupload/FileUploadScanRule.java‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,15 @@
1515

1616
import java.io.IOException;
1717
import java.util.List;
18+
import org.apache.commons.lang3.StringUtils;
1819
import org.apache.log4j.LogManager;
1920
import org.apache.log4j.Logger;
2021
import org.parosproxy.paros.core.scanner.AbstractAppParamPlugin;
2122
import org.parosproxy.paros.core.scanner.Category;
2223
import org.parosproxy.paros.core.scanner.NameValuePair;
2324
import org.parosproxy.paros.network.HttpMessage;
2425
import org.sasanlabs.fileupload.attacks.FileUploadAttackExecutor;
26+
import org.sasanlabs.fileupload.configuration.FileUploadConfiguration;
2527
import org.sasanlabs.fileupload.i18n.FileUploadI18n;
2628
import org.zaproxy.zap.core.scanner.InputVector;
2729
import org.zaproxy.zap.core.scanner.InputVectorBuilder;
@@ -79,6 +81,19 @@ public void decreaseRequestCount() {
7981
this.maxRequestCount--;
8082
}
8183

84+
private boolean isConfigured() {
85+
return StringUtils.isNotBlank(
86+
FileUploadConfiguration.getInstance().getStaticLocationURIRegex())
87+
|| StringUtils.isNotBlank(
88+
FileUploadConfiguration.getInstance().getDynamicLocationURIRegex())
89+
|| (StringUtils.isNotBlank(
90+
FileUploadConfiguration.getInstance()
91+
.getParseResponseStartIdentifier())
92+
&& StringUtils.isNotBlank(
93+
FileUploadConfiguration.getInstance()
94+
.getParseResponseEndIdentifier()));
95+
}
96+
8297
@Override
8398
protected void scan(List<NameValuePair> nameValuePairs) {
8499
try {
@@ -99,7 +114,7 @@ protected void scan(List<NameValuePair> nameValuePairs) {
99114
}
100115
}
101116
}
102-
if (isMultipart) {
117+
if (isMultipart && isConfigured()) {
103118
FileUploadAttackExecutor fileUploadAttackExecutor =
104119
new FileUploadAttackExecutor(
105120
this, nameValuePairs, originalFileName, originalContentType);

‎src/main/java/org/sasanlabs/fileupload/configuration/FileUploadConfiguration.java‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,15 @@ public class FileUploadConfiguration extends VersionedAbstractParam {
3535
PARAM_BASE_KEY + ".staticlocation.uriregex";
3636
private static final String PARAM_DYNAMIC_LOCATION_CONFIGURATION_URI_REGEX =
3737
PARAM_BASE_KEY + ".dynamiclocation.uriregex";
38-
private static final String PARAM_DYNAMIC_LOCATION_CONFIGURATION_START_IDENTIFIER =
39-
PARAM_BASE_KEY + ".dynamiclocation.startidentifier";
40-
private static final String PARAM_DYNAMIC_LOCATION_CONFIGURATION_END_IDENTIFIER =
41-
PARAM_BASE_KEY + ".dynamiclocation.endidentifier";
38+
private static final String PARAM_PARSE_RESPONSE_CONFIGURATION_START_IDENTIFIER =
39+
PARAM_BASE_KEY + ".parseresponse.startidentifier";
40+
private static final String PARAM_PARSE_RESPONSE_CONFIGURATION_END_IDENTIFIER =
41+
PARAM_BASE_KEY + ".parseresponse.endidentifier";
4242

4343
private String staticLocationURIRegex;
4444
private String dynamicLocationURIRegex;
45-
private String dynamicLocationStartIdentifier;
46-
private String dynamicLocationEndIdentifier;
45+
private String parseResponseStartIdentifier;
46+
private String parseResponseEndIdentifier;
4747

4848
private static volatile FileUploadConfiguration fileUploadConfiguration;
4949

@@ -81,28 +81,28 @@ public void setDynamicLocationURIRegex(String dynamicLocationURIRegex) {
8181
PARAM_DYNAMIC_LOCATION_CONFIGURATION_URI_REGEX, dynamicLocationURIRegex);
8282
}
8383

84-
public String getDynamicLocationStartIdentifier() {
85-
return dynamicLocationStartIdentifier;
84+
public String getParseResponseStartIdentifier() {
85+
return parseResponseStartIdentifier;
8686
}
8787

88-
public void setDynamicLocationStartIdentifier(String dynamicLocationStartIdentifier) {
89-
this.dynamicLocationStartIdentifier = dynamicLocationStartIdentifier;
88+
public void setParseResponseStartIdentifier(String parseResponseStartIdentifier) {
89+
this.parseResponseStartIdentifier = parseResponseStartIdentifier;
9090
this.getConfig()
9191
.setProperty(
92-
PARAM_DYNAMIC_LOCATION_CONFIGURATION_START_IDENTIFIER,
93-
dynamicLocationStartIdentifier);
92+
PARAM_PARSE_RESPONSE_CONFIGURATION_START_IDENTIFIER,
93+
parseResponseStartIdentifier);
9494
}
9595

96-
public String getDynamicLocationEndIdentifier() {
97-
return dynamicLocationEndIdentifier;
96+
public String getParseResponseEndIdentifier() {
97+
return parseResponseEndIdentifier;
9898
}
9999

100-
public void setDynamicLocationEndIdentifier(String dynamicLocationEndIdentifier) {
101-
this.dynamicLocationEndIdentifier = dynamicLocationEndIdentifier;
100+
public void setParseResponseEndIdentifier(String parseResponseEndIdentifier) {
101+
this.parseResponseEndIdentifier = parseResponseEndIdentifier;
102102
this.getConfig()
103103
.setProperty(
104-
PARAM_DYNAMIC_LOCATION_CONFIGURATION_END_IDENTIFIER,
105-
dynamicLocationEndIdentifier);
104+
PARAM_PARSE_RESPONSE_CONFIGURATION_END_IDENTIFIER,
105+
parseResponseEndIdentifier);
106106
}
107107

108108
@Override
@@ -121,10 +121,10 @@ protected void parseImpl() {
121121
getConfig().getString(PARAM_STATIC_LOCATION_CONFIGURATION_URI_REGEX));
122122
this.setDynamicLocationURIRegex(
123123
getConfig().getString(PARAM_DYNAMIC_LOCATION_CONFIGURATION_URI_REGEX));
124-
this.setDynamicLocationStartIdentifier(
125-
getConfig().getString(PARAM_DYNAMIC_LOCATION_CONFIGURATION_START_IDENTIFIER));
126-
this.setDynamicLocationEndIdentifier(
127-
getConfig().getString(PARAM_DYNAMIC_LOCATION_CONFIGURATION_END_IDENTIFIER));
124+
this.setParseResponseStartIdentifier(
125+
getConfig().getString(PARAM_PARSE_RESPONSE_CONFIGURATION_START_IDENTIFIER));
126+
this.setParseResponseEndIdentifier(
127+
getConfig().getString(PARAM_PARSE_RESPONSE_CONFIGURATION_END_IDENTIFIER));
128128
}
129129

130130
@Override

‎src/main/java/org/sasanlabs/fileupload/locator/URILocatorImpl.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,13 @@ private URI parseResponseAndGetCompleteURI(
6969
.toString()
7070
.indexOf(
7171
FileUploadConfiguration.getInstance()
72-
.getDynamicLocationStartIdentifier());
72+
.getParseResponseStartIdentifier());
7373
int endIndex =
7474
msg.getResponseBody()
7575
.toString()
7676
.indexOf(
7777
FileUploadConfiguration.getInstance()
78-
.getDynamicLocationEndIdentifier());
78+
.getParseResponseEndIdentifier());
7979
if (startIndex < 0 || endIndex < 0 || startIndex > endIndex) {
8080
throw new FileUploadException(
8181
"StartIndex or EndIndex configuration is either not present in the response or invalid. Start index:"
@@ -89,7 +89,7 @@ private URI parseResponseAndGetCompleteURI(
8989
.substring(
9090
startIndex
9191
+ FileUploadConfiguration.getInstance()
92-
.getDynamicLocationStartIdentifier()
92+
.getParseResponseStartIdentifier()
9393
.length(),
9494
endIndex);
9595
return this.getCompleteURI(uriRegex, fileName, originalMsg);
@@ -126,10 +126,10 @@ public URI get(
126126
} else {
127127
if (StringUtils.isNotBlank(
128128
FileUploadConfiguration.getInstance()
129-
.getDynamicLocationStartIdentifier())
129+
.getParseResponseStartIdentifier())
130130
&& StringUtils.isNotBlank(
131131
FileUploadConfiguration.getInstance()
132-
.getDynamicLocationEndIdentifier())) {
132+
.getParseResponseEndIdentifier())) {
133133
try {
134134
return this.parseResponseAndGetCompleteURI(msg, fileName, msg);
135135
} catch (FileUploadException e) {

‎src/main/java/org/sasanlabs/fileupload/ui/FileUploadOptionsPanel.java‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -237,9 +237,8 @@ public void initParam(Object optionParams) {
237237
dynamicLocationConfigurationURIRegex.setText(
238238
fileUploadConfiguration.getDynamicLocationURIRegex());
239239
parseResponseStartIdentifier.setText(
240-
fileUploadConfiguration.getDynamicLocationStartIdentifier());
241-
parseResponseEndIdentifier.setText(
242-
fileUploadConfiguration.getDynamicLocationEndIdentifier());
240+
fileUploadConfiguration.getParseResponseStartIdentifier());
241+
parseResponseEndIdentifier.setText(fileUploadConfiguration.getParseResponseEndIdentifier());
243242
}
244243

245244
@Override
@@ -257,12 +256,16 @@ public void validateParam(Object optionParams) throws Exception {
257256
&& (isDynamicUrlPresent || isStartIdentifierPresent || isEndIdentifierPresent)) {
258257
throw new IllegalArgumentException(
259258
FileUploadI18n.getMessage(
260-
"fileupload.settings.alert.static.dynamicconfiguration.both.present"));
259+
"fileupload.settings.alert.static.dynamicconfiguration.parseconfiguration.present"));
261260
} else if ((isStartIdentifierPresent && !isEndIdentifierPresent)
262261
|| (!isStartIdentifierPresent && isEndIdentifierPresent)) {
263262
throw new IllegalArgumentException(
264263
FileUploadI18n.getMessage(
265264
"fileupload.settings.alert.invalid.httpresponseparseconfiguration"));
265+
} else if (isDynamicUrlPresent && !isStartIdentifierPresent) {
266+
throw new IllegalArgumentException(
267+
FileUploadI18n.getMessage(
268+
"fileupload.settings.alert.invalid.dynamicconfiguration.parseidentifier.not.present"));
266269
}
267270
}
268271

@@ -279,9 +282,9 @@ public void saveParam(Object optionParams) throws Exception {
279282
this.staticLocationConfigurationURIRegex.getText());
280283
fileUploadConfiguration.setDynamicLocationURIRegex(
281284
this.dynamicLocationConfigurationURIRegex.getText());
282-
fileUploadConfiguration.setDynamicLocationStartIdentifier(
285+
fileUploadConfiguration.setParseResponseStartIdentifier(
283286
this.parseResponseStartIdentifier.getText());
284-
fileUploadConfiguration.setDynamicLocationEndIdentifier(
287+
fileUploadConfiguration.setParseResponseEndIdentifier(
285288
this.parseResponseEndIdentifier.getText());
286289
}
287290
}

‎src/main/resources/org/sasanlabs/fileupload/i18n/Messages.properties‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,13 @@ fileupload.settings.urilocator.staticlocation.uriregex=URI Regex
77

88
fileupload.settings.urilocator.dynamiclocation.title=Dynamic Location Configuration
99
fileupload.settings.urilocator.dynamiclocation.uriregex=URI Regex
10-
fileupload.settings.urilocator.parseresponseconfiguration.title=Parse Http Response Configuration
10+
fileupload.settings.urilocator.parseresponseconfiguration.title=Parse HTTP Response Configuration
1111
fileupload.settings.urilocator.parseresponseconfiguration.startidentifer=Start Identifier
1212
fileupload.settings.urilocator.parseresponseconfiguration.endidentifer=End Identifier
1313

14-
fileupload.settings.alert.invalid.httpresponseparseconfiguration=Both dynamic start and end identifier should be present.
15-
fileupload.settings.alert.static.dynamicconfiguration.both.present=Only one of the static and dynamic configuration should be present.
14+
fileupload.settings.alert.invalid.httpresponseparseconfiguration=Both parse HTTP response start and end identifier should be present.
15+
fileupload.settings.alert.static.dynamicconfiguration.parseconfiguration.present=Static configuration should not be present with dynamic or parse HTTP response configuration.
16+
fileupload.settings.alert.invalid.dynamicconfiguration.parseidentifier.not.present=Both dynamic configuration and parse HTTP response configuration should be present.
1617

1718
# Alert details
1819
fileupload.alert.attack=Retrieval Request: {0} \n Retrieval Response: {1}

0 commit comments

Comments
 (0)