Skip to content

Commit

Permalink
Fix style
Browse files Browse the repository at this point in the history
  • Loading branch information
lokiuox committed Feb 7, 2025
1 parent 684cb32 commit 559ef0e
Show file tree
Hide file tree
Showing 4 changed files with 33 additions and 30 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -16,21 +16,21 @@

package com.google.tsunami.plugins.detectors.cves.cve202233891;

import javax.inject.Qualifier;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

import static java.lang.annotation.ElementType.FIELD;
import static java.lang.annotation.ElementType.METHOD;
import static java.lang.annotation.ElementType.PARAMETER;

import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import javax.inject.Qualifier;

/** Annotation for {@link Cve202233891VulnDetector}. */
public class Annotations {
@Qualifier
@Retention(RetentionPolicy.RUNTIME)
@Target({PARAMETER, METHOD, FIELD})
@interface OobSleepDuration {}
@Qualifier
@Retention(RetentionPolicy.RUNTIME)
@Target({PARAMETER, METHOD, FIELD})
@interface OobSleepDuration {}

private Annotations() {}
private Annotations() {}
}
Original file line number Diff line number Diff line change
Expand Up @@ -68,11 +68,14 @@ public final class Cve202233891VulnDetector implements VulnDetector {
private final int oobSleepDuration;

private static final String FINGERPRINT_MASTER = "<title>Spark Master at ";
private static final String FINGERPRINT_WORKER = "<title>Spark Worker at " ;
private static final String FINGERPRINT_WORKER = "<title>Spark Worker at ";

@Inject
Cve202233891VulnDetector(
@UtcClock Clock utcClock, HttpClient httpClient, PayloadGenerator payloadGenerator, @OobSleepDuration int oobSleepDuration) {
@UtcClock Clock utcClock,
HttpClient httpClient,
PayloadGenerator payloadGenerator,
@OobSleepDuration int oobSleepDuration) {
this.utcClock = checkNotNull(utcClock);
this.httpClient =
checkNotNull(httpClient, "HttpClient cannot be null.")
Expand Down Expand Up @@ -101,12 +104,12 @@ public DetectionReportList detect(
public boolean isSpark(NetworkService networkService) {
try {
String targetUri = NetworkServiceUtils.buildWebApplicationRootUrl(networkService);
HttpResponse response = this.httpClient.send(HttpRequest.get(targetUri).withEmptyHeaders().build());
HttpResponse response =
this.httpClient.send(HttpRequest.get(targetUri).withEmptyHeaders().build());

return response.status() == HttpStatus.OK && (
response.bodyString().orElse("").contains(FINGERPRINT_MASTER)
|| response.bodyString().orElse("").contains(FINGERPRINT_WORKER)
);
return response.status() == HttpStatus.OK
&& (response.bodyString().orElse("").contains(FINGERPRINT_MASTER)
|| response.bodyString().orElse("").contains(FINGERPRINT_WORKER));
} catch (IOException e) {
return false;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,5 +20,5 @@

@ConfigProperties("plugins.detectors.spark_cve202233891")
public class Cve202233891VulnDetectorConfigs {
int oobSleepDuration = -1;
int oobSleepDuration = -1;
}
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,8 @@
import static com.google.tsunami.plugins.detectors.cves.cve202233891.Annotations.OobSleepDuration;

import com.google.common.collect.ImmutableList;
import com.google.inject.testing.fieldbinder.Bind;
import com.google.inject.Guice;
import com.google.inject.testing.fieldbinder.Bind;
import com.google.inject.testing.fieldbinder.BoundFieldModule;
import com.google.inject.util.Modules;
import com.google.protobuf.util.Timestamps;
Expand Down Expand Up @@ -80,7 +80,7 @@ public void setUp() throws IOException {
new HttpClientModule.Builder().build(),
FakePayloadGeneratorModule.builder().setCallbackServer(mockCallbackServer).build(),
Modules.override(new Cve202233891VulnDetectorBootstrapModule())
.with(BoundFieldModule.of(this)))
.with(BoundFieldModule.of(this)))
.injectMembers(this);

service =
Expand Down Expand Up @@ -108,10 +108,9 @@ public void tearDown() throws IOException {
public void detect_whenVulnerable_returnsVulnerability() throws IOException {
// For fingerprinting
mockWebServer.enqueue(
new MockResponse()
.setResponseCode(200)
.setBody(
"<title>Spark Master at spark://testbed:7077</title>\n"));
new MockResponse()
.setResponseCode(200)
.setBody("<title>Spark Master at spark://testbed:7077</title>\n"));
// Sample response to exploit request
mockWebServer.enqueue(
new MockResponse()
Expand Down Expand Up @@ -156,11 +155,11 @@ public void detect_whenVulnerable_returnsVulnerability() throws IOException {
public void detect_ifNotVulnerable_doesNotReportVuln() {
// For fingerprinting
mockWebServer.enqueue(
new MockResponse()
.setResponseCode(200)
.setBody(
"<title>Spark Master at spark://testbed:7077</title>\n"));
mockWebServer.enqueue(new MockResponse().setResponseCode(HttpStatus.OK.code()).setBody("Hello world!"));
new MockResponse()
.setResponseCode(200)
.setBody("<title>Spark Master at spark://testbed:7077</title>\n"));
mockWebServer.enqueue(
new MockResponse().setResponseCode(HttpStatus.OK.code()).setBody("Hello world!"));
mockCallbackServer.enqueue(PayloadTestHelper.generateMockUnsuccessfulCallbackResponse());

DetectionReportList detectionReports = detector.detect(targetInfo, ImmutableList.of(service));
Expand All @@ -171,7 +170,8 @@ public void detect_ifNotVulnerable_doesNotReportVuln() {

@Test
public void detect_ifNotSpark_doesNotReportVuln() {
mockWebServer.enqueue(new MockResponse().setResponseCode(HttpStatus.OK.code()).setBody("This is not Spark"));
mockWebServer.enqueue(
new MockResponse().setResponseCode(HttpStatus.OK.code()).setBody("This is not Spark"));

DetectionReportList detectionReports = detector.detect(targetInfo, ImmutableList.of(service));
assertThat(detectionReports.getDetectionReportsList()).isEmpty();
Expand Down

0 comments on commit 559ef0e

Please sign in to comment.