Network Security Tools

Symptom Code Databases

A symptom code database serves as an initial test plan at the start of each code review and can be continuously updated as new symptoms are discovered. How you construct symptom code depends on which static analysis tool you use and the programming languages it supports. Pattern-matching tools describe symptom code as a combination of regular expressions, and you can build custom regular expressions for any programming language (VBScript, C#, VB.NET, Java, PHP, etc.). Table 6-3 is an updated version of Table 6-2 that includes examples of Perl 5 regular expressions representing potential Java symptom code.

This is not a complete list of potential symptom code regular expressions. In fact, some of these examples might produce false positives, and others might produce false negatives. All special characters that are to be treated as literals are escaped with the \ character.

Table 6-3. Java symptom code

Symptom	Perl 5 regexes for Java code	Vulnerability/attack
Dynamic SQL	select.+from insert.+into update.+set	SQL injection
Methods for executing commands	(Runtime|getRuntime\(\)){0,1}\.exec	Command injection
File I/O methods	new\s+(java\.io\.){0,1}File\s*\( new\s+(java\.io\.){0,1}FileReader\s*\(	Arbitrary file creation, reading
Writing inline request objects	\<\s*%\s*=.+request	Cross-site scripting
Cookie access methods	getCookies addCookie	Broken access control
Plaintext database connection strings	jdbc\:	Information leakage, unauthorized ...