mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
1bbe4b1cfb
* chore: Exclude CLAUDE.md from Cargo.toml * feat: add callgraph module and integrate into main analysis flow * feat: enhance CLI with new severity filtering and analysis modes * feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling * feat: implement state-model dataflow analysis for resource lifecycle and auth state * feat: enhance diagnostic output formatting and add evidence structure * feat: implement attack surface ranking for diagnostics with scoring and sorting * feat: add comprehensive documentation for installation, usage, and rules reference * feat: add multiple language support for command execution and evaluation endpoints * feat: implement inline suppression for findings using `nyx:ignore` comments * feat: add confidence levels to AST patterns and update output structure * feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets * feat: bump version to 0.4.0 and update changelog with new features and improvements * feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs
48 lines
1.4 KiB
Java
48 lines
1.4 KiB
Java
import java.io.*;
|
|
import java.util.Random;
|
|
import java.security.MessageDigest;
|
|
|
|
class Positive {
|
|
// java.deser.readobject
|
|
void triggerDeser(InputStream is) throws Exception {
|
|
ObjectInputStream ois = new ObjectInputStream(is);
|
|
Object obj = ois.readObject();
|
|
}
|
|
|
|
// java.cmdi.runtime_exec
|
|
void triggerRuntimeExec(String cmd) throws Exception {
|
|
Runtime.getRuntime().exec(cmd);
|
|
}
|
|
|
|
// java.reflection.class_forname
|
|
void triggerClassForName(String name) throws Exception {
|
|
Class.forName(name);
|
|
}
|
|
|
|
// java.reflection.method_invoke
|
|
void triggerMethodInvoke(Object target) throws Exception {
|
|
java.lang.reflect.Method m = target.getClass().getMethod("run");
|
|
m.invoke(target);
|
|
}
|
|
|
|
// java.sqli.execute_concat
|
|
void triggerSqlConcat(java.sql.Statement stmt, String user) throws Exception {
|
|
stmt.executeQuery("SELECT * FROM users WHERE name = '" + user + "'");
|
|
}
|
|
|
|
// java.crypto.insecure_random
|
|
void triggerInsecureRandom() {
|
|
Random r = new Random();
|
|
int token = r.nextInt();
|
|
}
|
|
|
|
// java.crypto.weak_digest
|
|
void triggerWeakDigest() throws Exception {
|
|
MessageDigest md = MessageDigest.getInstance("MD5");
|
|
}
|
|
|
|
// java.xss.getwriter_print
|
|
void triggerGetWriterPrint(javax.servlet.http.HttpServletResponse resp) throws Exception {
|
|
resp.getWriter().println("<html>" + "data" + "</html>");
|
|
}
|
|
}
|