770348d041
* Add check for security standard mismatch * Fix security standard mismatches * Fix Resources/Standards links for secrets rules * Fix check * Fix links and update security standard mapping * Fix maintanability issue * Apply review suggestions * Apply suggestions from code review Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com> * Fix typo Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com> --------- Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
100 lines
3.7 KiB
Plaintext
100 lines
3.7 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
File f = new File("ZipBomb.zip");
|
|
ZipFile zipFile = new ZipFile(f);
|
|
Enumeration<? extends ZipEntry> entries = zipFile.entries(); // Sensitive
|
|
|
|
while(entries.hasMoreElements()) {
|
|
ZipEntry ze = entries.nextElement();
|
|
File out = new File("./output_onlyfortesting.txt");
|
|
Files.copy(zipFile.getInputStream(ze), out.toPath(), StandardCopyOption.REPLACE_EXISTING);
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
Do not rely on https://docs.oracle.com/javase/7/docs/api/java/util/zip/ZipEntry.html#getSize()[getsize] to retrieve the size of an uncompressed entry because this method returns what is defined in the archive headers which can be forged by attackers, instead calculate the actual entry size when unzipping it:
|
|
|
|
[source,java]
|
|
----
|
|
File f = new File("ZipBomb.zip");
|
|
ZipFile zipFile = new ZipFile(f);
|
|
Enumeration<? extends ZipEntry> entries = zipFile.entries();
|
|
|
|
int THRESHOLD_ENTRIES = 10000;
|
|
int THRESHOLD_SIZE = 1000000000; // 1 GB
|
|
double THRESHOLD_RATIO = 10;
|
|
int totalSizeArchive = 0;
|
|
int totalEntryArchive = 0;
|
|
|
|
while(entries.hasMoreElements()) {
|
|
ZipEntry ze = entries.nextElement();
|
|
InputStream in = new BufferedInputStream(zipFile.getInputStream(ze));
|
|
OutputStream out = new BufferedOutputStream(new FileOutputStream("./output_onlyfortesting.txt"));
|
|
|
|
totalEntryArchive ++;
|
|
|
|
int nBytes = -1;
|
|
byte[] buffer = new byte[2048];
|
|
int totalSizeEntry = 0;
|
|
|
|
while((nBytes = in.read(buffer)) > 0) { // Compliant
|
|
out.write(buffer, 0, nBytes);
|
|
totalSizeEntry += nBytes;
|
|
totalSizeArchive += nBytes;
|
|
|
|
double compressionRatio = totalSizeEntry / ze.getCompressedSize();
|
|
if(compressionRatio > THRESHOLD_RATIO) {
|
|
// ratio between compressed and uncompressed data is highly suspicious, looks like a Zip Bomb Attack
|
|
break;
|
|
}
|
|
}
|
|
|
|
if(totalSizeArchive > THRESHOLD_SIZE) {
|
|
// the uncompressed data size is too much for the application resource capacity
|
|
break;
|
|
}
|
|
|
|
if(totalEntryArchive > THRESHOLD_ENTRIES) {
|
|
// too much entries in this archive, can lead to inodes exhaustion of the system
|
|
break;
|
|
}
|
|
}
|
|
----
|
|
|
|
== See
|
|
|
|
* OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
|
|
* OWASP - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[Top 10 2021 Category A5 - Security Misconfiguration]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control[Top 10 2017 Category A5 - Broken Access Control]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[Top 10 2017 Category A6 - Security Misconfiguration]
|
|
* CWE - https://cwe.mitre.org/data/definitions/409[CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)]
|
|
* https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream[CERT, IDS04-J.] - Safely extract files from ZipInputStream
|
|
* https://www.bamsoftware.com/hacks/zipbomb/[bamsoftware.com] - A better Zip Bomb
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 16 Nov 2018, 14:29:00 Alexandre Gigleux wrote:
|
|
In addition to ZipEntry, this Security Hotspot should highlight all use of implementations of ArchiveEntry: ArArchiveEntry, ArjArchiveEntry, CpioArchiveEntry, DumpArchiveEntry, JarArchiveEntry, SevenZArchiveEntry, TarArchiveEntry, ZipArchiveEntry: \https://commons.apache.org/proper/commons-compress/apidocs/org/apache/commons/compress/archivers/ArchiveEntry.html
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|