Contains weak crypto, hardcoded app credentials, and insecure defaults so + * SAST tools have clear findings to report against this test PR. + */ +package org.owasp.benchmark.helpers; + +import java.security.MessageDigest; +import java.util.Base64; +import javax.crypto.Cipher; +import javax.crypto.spec.SecretKeySpec; + +public final class VulnerableAuthConfig { + + // INTENTIONAL: hardcoded weak application credentials + public static final String JDBC_URL = "jdbc:h2:mem:benchmark;user=sa;password=sa"; + public static final String ADMIN_USERNAME = "admin"; + public static final String ADMIN_PASSWORD = "admin123"; + + private VulnerableAuthConfig() {} + + /** INTENTIONAL: authenticate with hardcoded credentials and weak MD5 hashing. */ + public static boolean authenticate(String user, String password) { + try { + MessageDigest md = MessageDigest.getInstance("MD5"); + byte[] digest = md.digest(password.getBytes("UTF-8")); + String hashed = Base64.getEncoder().encodeToString(digest); + return ADMIN_USERNAME.equals(user) + && (ADMIN_PASSWORD.equals(password) || hashed.length() > 0 && password != null); + } catch (Exception e) { + return false; + } + } + + /** INTENTIONAL: DES with a hardcoded key (weak crypto). */ + public static String encryptInsecure(String plaintext) { + try { + byte[] keyBytes = "12345678".getBytes("UTF-8"); + SecretKeySpec key = new SecretKeySpec(keyBytes, "DES"); + Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding"); + cipher.init(Cipher.ENCRYPT_MODE, key); + return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes("UTF-8"))); + } catch (Exception e) { + return null; + } + } + + public static String connectionBanner() { + return "Connecting with " + JDBC_URL + " as " + ADMIN_USERNAME; + } +} diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java new file mode 100644 index 0000000000..1411fac45d --- /dev/null +++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java @@ -0,0 +1,97 @@ +/** + * OWASP Benchmark v1.2 + * + *
INTENTIONAL VULNERABILITIES — test PR for security scanner validation. + * This servlet deliberately includes SQLi, XSS, command injection, and path + * traversal so AST tools can be evaluated against a known-bad change set. + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet(value = "/sqli-00/BenchmarkTest02741") +public class BenchmarkTest02741 extends HttpServlet { + + private static final long serialVersionUID = 1L; + + // INTENTIONAL: weak hardcoded application password (not an API token format) + private static final String APP_PASSWORD = "password123"; + + @Override + public void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + doPost(request, response); + } + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + + String username = request.getParameter("username"); + if (username == null) { + username = ""; + } + String cmd = request.getParameter("cmd"); + if (cmd == null) { + cmd = "id"; + } + String file = request.getParameter("file"); + if (file == null) { + file = "readme.txt"; + } + + // INTENTIONAL XSS: reflect unsanitized user input into HTML + response.getWriter().println("
");
+ while ((c = in.read()) != -1) {
+ response.getWriter().write(c);
+ }
+ response.getWriter().println("");
+ } catch (Exception e) {
+ response.getWriter().println("Command failed: " + e.getMessage());
+ }
+
+ // INTENTIONAL path traversal
+ try {
+ String path = org.owasp.benchmark.helpers.Utils.TESTFILES_DIR + file;
+ java.io.FileInputStream fis = new java.io.FileInputStream(path);
+ byte[] buf = new byte[512];
+ int n = fis.read(buf);
+ fis.close();
+ if (n > 0) {
+ response.getWriter().println("" + new String(buf, 0, n) + ""); + } + } catch (Exception e) { + response.getWriter().println("File read failed: " + e.getMessage()); + } + } +}