Test/intentional vulnerable pr

expectedresults-1.2.csv

@@ -2739,3 +2739,4 @@ BenchmarkTest02737,sqli,false,89
 BenchmarkTest02738,sqli,false,89
 BenchmarkTest02739,sqli,false,89
 BenchmarkTest02740,sqli,false,89
+BenchmarkTest02741,sqli,true,89

pom.xml

@@ -1195,7 +1195,7 @@
 
                         <!-- apply a specific flavor of google-java-format -->
                         <googleJavaFormat>
-                            <version>1.17.0</version>
+                            <version>1.35.0</version>
                             <style>AOSP</style>
                         </googleJavaFormat>
                     </java>
@@ -1272,11 +1272,10 @@
         <version.apache.api-ldap>2.1.9</version.apache.api-ldap>
         <version.apacheds>2.0.0.AM27</version.apacheds>
         <version.fluido>2.1.0</version.fluido>
-        <!-- hibernate is up to rev 6+. But 4.0.0. causes this error: symbol: org.hibernate.classic.Session not found -->
-        <version.hibernate>3.6.10.Final</version.hibernate>
-        <version.junit>5.14.4</version.junit>
-        <version.spotbugs.maven>4.10.5.0</version.spotbugs.maven>
-        <version.spotbugs>4.10.5</version.spotbugs>
+        <!-- 5.3.15.Final brings dom4j 2.1.1 transitively. Newer 5.3.x (>=5.3.20) ships dom4j 2.1.3; 5.4+ also 2.1.3. -->
+        <version.hibernate>5.3.15.Final</version.hibernate>
+        <version.spotbugs.maven>4.9.8.3</version.spotbugs.maven>
+        <version.spotbugs>4.9.8</version.spotbugs>
         <!-- Spring 6.x requires Java 17 -->
         <version.springframework>5.3.39</version.springframework>
         <!-- Tomcat 10 moves from Java EE to Jakarta EE, moving packages javax.* to jakarta.* - code changes likely required to address this change. -->

src/main/java/org/owasp/benchmark/helpers/HibernateUtil.java

@@ -27,18 +27,19 @@
 import java.util.logging.Level;
 import javax.imageio.spi.ServiceRegistry;
 import org.hibernate.HibernateException;
-import org.hibernate.Query;
+import org.hibernate.Session;
 import org.hibernate.SessionFactory;
 import org.hibernate.Transaction;
 import org.hibernate.cfg.Configuration;
+import org.hibernate.query.Query;
 import org.owasp.benchmark.helpers.entities.Certificate;
 import org.owasp.benchmark.helpers.entities.Employee;
 import org.owasp.benchmark.helpers.entities.Hobby;
 import org.owasp.benchmark.helpers.entities.User;
 
 public class HibernateUtil {
-    org.hibernate.Session session;
-    org.hibernate.classic.Session classicSession;
+    Session session;
+    Session classicSession;
     Statement st;
     SessionFactory sessionFactory;
     ServiceRegistry serviceRegistry;
@@ -83,7 +84,7 @@ public SessionFactory getSessionFactory() {
         return sessionFactory;
     }
 
-    public org.hibernate.Session getSession() {
+    public Session getSession() {
         return session;
     }
 
@@ -100,7 +101,7 @@ public void destroySession() {
         // StandardServiceRegistryBuilder.destroy(serviceRegistry);
     }
 
-    public org.hibernate.classic.Session getClassicSession() {
+    public Session getClassicSession() {
         return classicSession;
     }
 

src/main/java/org/owasp/benchmark/helpers/VulnerableAuthConfig.java

@@ -0,0 +1,52 @@
+/**
+ * INTENTIONAL VULNERABILITIES — test helper for security scanner PR validation.
+ *
+ * <p>Contains weak crypto, hardcoded app credentials, and insecure defaults so
+ * SAST tools have clear findings to report against this test PR.
+ */
+package org.owasp.benchmark.helpers;
+
+import java.security.MessageDigest;
+import java.util.Base64;
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+
+public final class VulnerableAuthConfig {
+
+    // INTENTIONAL: hardcoded weak application credentials
+    public static final String JDBC_URL = "jdbc:h2:mem:benchmark;user=sa;password=sa";
+    public static final String ADMIN_USERNAME = "admin";
+    public static final String ADMIN_PASSWORD = "admin123";
+
+    private VulnerableAuthConfig() {}
+
+    /** INTENTIONAL: authenticate with hardcoded credentials and weak MD5 hashing. */
+    public static boolean authenticate(String user, String password) {
+        try {
+            MessageDigest md = MessageDigest.getInstance("MD5");
+            byte[] digest = md.digest(password.getBytes("UTF-8"));
+            String hashed = Base64.getEncoder().encodeToString(digest);
+            return ADMIN_USERNAME.equals(user)
+                    && (ADMIN_PASSWORD.equals(password) || hashed.length() > 0 && password != null);
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
+    /** INTENTIONAL: DES with a hardcoded key (weak crypto). */
+    public static String encryptInsecure(String plaintext) {
+        try {
+            byte[] keyBytes = "12345678".getBytes("UTF-8");
+            SecretKeySpec key = new SecretKeySpec(keyBytes, "DES");
+            Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
+            cipher.init(Cipher.ENCRYPT_MODE, key);
+            return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes("UTF-8")));
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    public static String connectionBanner() {
+        return "Connecting with " + JDBC_URL + " as " + ADMIN_USERNAME;
+    }
+}

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java

@@ -0,0 +1,97 @@
+/**
+ * OWASP Benchmark v1.2
+ *
+ * <p>INTENTIONAL VULNERABILITIES — test PR for security scanner validation.
+ * This servlet deliberately includes SQLi, XSS, command injection, and path
+ * traversal so AST tools can be evaluated against a known-bad change set.
+ */
+package org.owasp.benchmark.testcode;
+
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@WebServlet(value = "/sqli-00/BenchmarkTest02741")
+public class BenchmarkTest02741 extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    // INTENTIONAL: weak hardcoded application password (not an API token format)
+    private static final String APP_PASSWORD = "password123";
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        doPost(request, response);
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        response.setContentType("text/html;charset=UTF-8");
+
+        String username = request.getParameter("username");
+        if (username == null) {
+            username = "";
+        }
+        String cmd = request.getParameter("cmd");
+        if (cmd == null) {
+            cmd = "id";
+        }
+        String file = request.getParameter("file");
+        if (file == null) {
+            file = "readme.txt";
+        }
+
+        // INTENTIONAL XSS: reflect unsanitized user input into HTML
+        response.getWriter().println("<h1>Lookup results for: " + username + "</h1>");
+
+        // INTENTIONAL SQL injection via string concatenation
+        String sql =
+                "SELECT * FROM USERS WHERE USERNAME='"
+                        + username
+                        + "' AND PASSWORD='"
+                        + APP_PASSWORD
+                        + "'";
+        try {
+            java.sql.Connection connection =
+                    org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection();
+            java.sql.Statement statement = connection.createStatement();
+            java.sql.ResultSet rs = statement.executeQuery(sql);
+            org.owasp.benchmark.helpers.DatabaseHelper.printResults(rs, sql, response);
+        } catch (java.sql.SQLException e) {
+            response.getWriter().println("SQL error: " + e.getMessage());
+        }
+
+        // INTENTIONAL command injection
+        try {
+            Process process = Runtime.getRuntime().exec("sh -c " + cmd);
+            java.io.InputStream in = process.getInputStream();
+            int c;
+            response.getWriter().println("<pre>");
+            while ((c = in.read()) != -1) {
+                response.getWriter().write(c);
+            }
+            response.getWriter().println("</pre>");
+        } catch (Exception e) {
+            response.getWriter().println("Command failed: " + e.getMessage());
+        }
+
+        // INTENTIONAL path traversal
+        try {
+            String path = org.owasp.benchmark.helpers.Utils.TESTFILES_DIR + file;
+            java.io.FileInputStream fis = new java.io.FileInputStream(path);
+            byte[] buf = new byte[512];
+            int n = fis.read(buf);
+            fis.close();
+            if (n > 0) {
+                response.getWriter().println("<pre>" + new String(buf, 0, n) + "</pre>");
+            }
+        } catch (Exception e) {
+            response.getWriter().println("File read failed: " + e.getMessage());
+        }
+    }
+}