Securing Development with PMD Teaching an Old Dog New Tricks

Justin Clarke, Gotham Digital Science [email protected] [email protected] www.linkedin.com/in/connectjunkie

07/06/2013 1 Integrating Security with Developer Tooling

HUDSON

07/06/2013 2 Key Objectives

ž Learn about PMD

ž Understand how to extend PMD

ž Think about enhancements to similar tools

07/06/2013 3 What Is PMD?

§ Open source static analysis tool

§ Scans Java source code for potential problems — Possible bugs — Dead code

— Suboptimal code Very little related to security!! — Overcomplicated expressions — Duplicate code

07/06/2013 4 Bug Finders vs Security Static Analysis

ž Bug Finders (i.e. PMD) — Target buggy patterns — Minimize false positives even if high false negatives

ž Security Static Analysis — Target insecure patterns — Minimize false negatives even if some false positives — Context of violation must be investigated

07/06/2013 5 Why Extend Security to PMD?

ž Used extensively by Java developers already

ž Highly extensible with Rule and Report API

ž Strong documentation and support network

ž Integrates with many IDEs and build tools

ž PMD internals operate similar to commercial tools

07/06/2013 6 How does PMD work?

ž Run against source file, directory, or archive

ž Builds tree-like structure of source code (AST)

ž Performs semantic, basic control & data analysis

ž Traverses AST looking for patterns (Rules)

ž Generates a report of Rule Violations

07/06/2013 7 What Does AST Look Like?

Source Code

AST

07/06/2013 8 Extending PMD with Custom Rules

ž Implement as Xpath expression or Java class

ž Wire up rules for use by PMD in ruleset file

ž Modify behavior by configuring rule properties

ž Group rules into rulesets for enforcement

07/06/2013 9 DEMO

07/06/2013 10 Resources to Help Writing Rules

ž PMD Website — http://pmd.sourceforge.net/xpathruletutorial.html — http://pmd.sourceforge.net/howtowritearule.html (Java)

ž PMD source code — net.sourceforge.pmd.rules.* — net.sourceforge.pmd.dfa.DaaRule

ž PMD Applied (Centennial Books Nov 2005)

ž PMD test cases & framework (wraps JUnit) — test.net.sourceforge.pmd.testframework — test.net.sourceforge.pmd.*

07/06/2013 11 v1.0 Goals For Custom PMD Security Rules

ž Add security without modifying PMD itself

ž Write rules that identify “low hanging fruit”

ž Perform analysis beyond lexing and pattern match

07/06/2013 12 Selecting Rules for Implementation GDS Assessment Customer’s Secure Coding Guideline(s) Rule Type OWASP Top 10 Vulnerability SQL Injection 2.1 – Commands should not be Constructed Data Flow, A1: Injection through String Concatenation Structural Cross-Site 1.1 – All Input Crossing a Trust Boundary Data Flow A2: Cross-Site Scripting (XSS) Must be Validated Scripting (XSS) 1.2 – Data from External Sources must be Properly Encoded or Escaped Arbitrary File 1.1 – All Input Crossing a Trust Boundary Data Flow A4: Insecure Direct Retrieval Must be Validated Object References 3.2 – Callable Code Must Enforce Authorization Requirements Use of 4.1 – Use of Sound Encryption Algorithms Structural A7: Insecure Cryptographically 4.2 – Use of Sound Hashing Algorithms Cryptographic Insecure Storage Algorithms Arbitrary URL 1.1 – All Input Crossing a Trust Boundary Data Flow A10: Un-validated Redirection Must be Validated Redirects and Forwards

07/06/2013 13 Challenges to Writing PMD Security Rules

PMD Analysis Limitations Impact on Detecting Security Bugs § Analysis limited to single file at a time § Data often passes through multiple files/ § Data Flow Analyzer (DFA) limited to classes and tiers single method (intraprocedural)

§ DFA tracks local variable declarations and § Security bugs often result of mixing data references, but does not evaluate and code in wrong context expressions § Symbols limited to source file, resulting in § Custom code often wraps well-known names and types not fully resolved APIs (Java or Framework) § Only analyzes JSP files that are XHTML- § Standard JSP syntax more common compliant (i.e. JSP Documents / XML syntax) § Often severe web application security bugs in presentation layer

07/06/2013 14 Rule Writing Challenges – JSP Files

#1 – Overcome XHTML limitation

ž Solution: Leverage JSP compiler

ž Result: Java implementation of JSP logic in _jspService method

ž Benefit: — Identify security bugs in any JSP — Scope of PMD’s analysis increased

07/06/2013 15 Example of JSP to Java Translation

<% String a1 = request.getParameter("y1"); String b1 = a1; %> <%=b1 %> JSP Scriptlet Code

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { ..snip.. PageContext pageContext = null; ..snip.. out = pageContext.getOut(); ..snip.. String a1 = request.getParameter("y1"); String b1 = a1; out.print(b1 ); Translated Java code equivalent

07/06/2013 16 Rule Writing Challenges – Reporting

#2 – Report JSP security violations meaningful to developer

ž Solution: — Wrote custom Source Map Format (SMAP) translator (JSR-045) — Implemented net.sourceforge.pmd.IRuleViolation

ž Result: Report findings in terms of JSP line numbers

ž Benefit: — JSP developers remediate bugs in JSP — Security violations understood by PMD built-in renders

07/06/2013 17 SMAP Example

SMAP Header (SMAP, generated index7_jsp.java filename, default stratum) JSP *S JSP Stratum Section *F File Section (contains translated + 0 index7.jsp filenames and path) index7.jsp *L 2,10:53,0 12,3:55 Line Section (associates line numbers 14:58,0 in input source with output source) 15:60 16,3:61,0 *E End Section

07/06/2013 18 Rule Writing Challenges – DFA w/PMD

#3 – Despite PMD limitations, perform data flow analysis

ž Solution: Use PMD DFA and Symbol Table

ž Result: — Determine if variable assignments assigned source — Track those tainted variables down each data flow — Report security violations if tainted variable passed to sink

ž Benefit: Automated, accurate tracing from source to sink

07/06/2013 19 PMD Data Flow Analysis

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { variable definition ..snip.. Name=a1, Type=String

String a1 = request.getParameter("y1"); DataFlowNodes

String b1 = a1; out.print(b1 );

variable references Name=request.getParameter Arguments=y1 (Literal)

07/06/2013 20 PMD Data Flow Analysis

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { ..snip..

String a1 = request.getParameter("y1"); variable references Name=out.print Arguments=b1 (Name) String b1 = a1; out.print(b1); DataFlowNode

07/06/2013 21 PMD Data Flow Analysis

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { variable definition ..snip.. Name=a1, Type=String

String a1 = request.getParameter("y1");

variable reference String b1 = a1; Name=request.getParameter out.print(b1 ); Arguments=y1 (Literal)

07/06/2013 22 PMD Data Flow Analysis Extended (XSS)

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { variable definition ..snip.. Name=a1, Type=String (tainted variable)

String a1 = request.getParameter("y1");

variable reference String b1 = a1; Name=request.getParameter out.print(b1 ); (method, tainted source) Arguments=y1 (Literal) Type= javax.servlet.http.HttpServletRequest

07/06/2013 23 PMD Data Flow Analysis Extended (XSS)

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { variable definition ..snip.. Name=b1, Type=String (tainted variable)

String a1 = request.getParameter("y1");

String b1 = a1; out.print(b1 ); variable reference Name=a1 (tainted variable)

07/06/2013 24 PMD Data Flow Analysis Extended (XSS)

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { ..snip..

String a1 = request.getParameter("y1");

variable references String b1 = a1; Name=out.print out.print(b1); Arguments=b1 (Name) (tainted variable)

07/06/2013 25 PMD Data Flow Analysis Extended (XSS)

public void _jspService(HttpServletRequest request, HttpServletResponse response) throws java.io.IOException, ServletException { ..snip..

String a1 = request.getParameter("y1"); variable references Name=out.print String b1 = a1; (method, XSS sink) Type=javax.servlet.jsp.JspWriter out.print(b1); Arguments=b1 (Name) XSS Vulnerability (tainted variable)

07/06/2013 26 DFA Security Rule Usage Notes

ž Violations need to be manually investigated for proper escaping/validation

ž Configurable sources and sinks via properties — URL Redirection ○ javax.servlet.http.HttpServletResponse.sendRedirect — SQL Injection ○ java.sql.execute

ž Effective source/sink same method / “reflected” variants

07/06/2013 27 PMD Structural Rule Example – SQLi

ž DFA susceptible to false negatives — Data traverse multiple files between source and sink

ž Supplement with structural rule — Investigates AST AdditiveExpression nodes — Performs following analysis ○ Is string a SQL command? ○ Is concatenated data of type String? ○ Is concatenated data a method argument?

07/06/2013 28 DEMO

07/06/2013 29 Basic Usage Steps

ž Configure CLASSPATH — Add pmd-gds-1.0.jar — Add jars/classes used when building (for type resolution)

ž Configure PMD to use /rulesets/GDS/ SecureCodingRuleset.xml

ž Run PMD and audit results

07/06/2013 30 PMD ANT Task Example - CLASSPATH

..snip..

07/06/2013 31 PMD ANT Task Example – Rules Config

..snip..

07/06/2013 32 Configuring JSP to Java Translation

ž Add JSP compiler task to build tool (build.xml)

ž Configure smapSuppressed to false and smapDump to true

ž Add extra clean task to remove .smap files before production deployment

07/06/2013 33 Custom Rules with PMD Eclipse Plug-in

ž Plug-in only supports xpath rules out of box

ž Put custom rules on plug-in CLASSPATH — Requires modification of PMD Eclipse plugin jars — Add rules to PMD Eclipse plugin source and compile — Wrap PMD Eclipse plugin with custom plugin

07/06/2013 34 Current and Future Development

ž Publish version 1.0 of Secure Coding Ruleset @ https:// github.com/GDSSecurity

ž Integrate NIST Juliet Test cases

ž Contribute to PMD project (need to pass tests first!)

ž Extend rules beyond Java with PMD 5

ž Write PMD 5.0 Rules

ž Enhance PMD feature set

07/06/2013 35 Conclusion

ž Learned about PMD and extensibility

ž Discussed approach for rule writing & deployment

ž Use, add and improve SecureCodingRuleset on GitHub

ž Look for other developer tools where it would be practical to add security

07/06/2013 36 References

ž http://www.nysforum.org/committees/security/ 051409_pdfs/A%20CISO%27S%20Guide%20to %20Application%20Security.pdf ž http://samate.nist.gov/index.php/ Source_Code_Security_Analyzers.html ž https://www.owasp.org/ ž pmd.sourceforge.net ž http://tomcopeland.blogs.com/ ž PMD Applied (Centennial Books Nov 2005) ž Secure Programming with Static Analysis (Addison-Wesley Professional July 2007)

07/06/2013 37