Skip to content

Commit b173685

Browse files
curryooocurryooo
authored
Curry240123 (#39)
* remove unused case * 0096fix * case stuct from file to anatation * Update AnnotationProcessorUtil.java * case引擎与评价体系case比对 * Update java引擎评价体系.md * update * Update JAVA.md * Update JAVA.md * Update JAVA.md * Update JAVA.md * Update JAVA.md * Update JAVA.md * json * Update JAVA.md * Update JAVA.md * Update JAVA.md
1 parent c7cef8e commit b173685

17 files changed

+2214
-305
lines changed

‎iast-java/src/main/java/com/iast/astbenchmark/analyser/bean/consts/CaseTypeEnum.java

+30-6
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,32 @@
11
package com.iast.astbenchmark.analyser.bean.consts;
22

3+
import org.apache.commons.lang.StringUtils;
4+
35
public enum CaseTypeEnum {
4-
T001("污点对象完整度能力检测"),
5-
T002("污点链路完整度能力检测"),
6-
T003("异步跟踪能力检测"),
7-
T004("跨进程跟踪能力检测"),
8-
T005("污点准确度能力检测");
6+
T001("IAST引擎能力评估体系(JAVA)->完整度->基础跟踪能力->污点对象完整度","污点对象完整度能力检测"),
7+
T002("IAST引擎能力评估体系(JAVA)->完整度->基础跟踪能力->污点链路完整度","污点链路完整度能力检测"),
8+
T003("IAST引擎能力评估体系(JAVA)->完整度->异步跟踪能力","异步跟踪能力检测"),
9+
T004("IAST引擎能力评估体系(JAVA)->完整度->跨进城跟踪能力","跨进程跟踪能力检测"),
10+
T005("IAST引擎能力评估体系(JAVA)->准确度","污点准确度能力检测");
911
String desc;
10-
CaseTypeEnum(String desc){
12+
13+
String tag;
14+
CaseTypeEnum(String tag,String desc){
1115
this.desc=desc;
16+
this.tag=tag;
1217
}
1318

19+
public static String getDescByTag(String data) {
20+
if(StringUtils.isEmpty(data)){
21+
return data;
22+
}
23+
for (CaseTypeEnum caseTypeEnum : values()) {
24+
if (data.contains(caseTypeEnum.getTag())) {
25+
return caseTypeEnum.name();
26+
}
27+
}
28+
return null;
29+
}
1430

1531
public String getDesc() {
1632
return desc;
@@ -19,4 +35,12 @@ public String getDesc() {
1935
public void setDesc(String desc) {
2036
this.desc = desc;
2137
}
38+
39+
public String getTag() {
40+
return tag;
41+
}
42+
43+
public void setTag(String tag) {
44+
this.tag = tag;
45+
}
2246
}

‎iast-java/src/main/java/com/iast/astbenchmark/analyser/cache/AnnotationProcessorUtil.java

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
package com.iast.astbenchmark.analyser.cache;
2+
3+
import com.google.common.collect.Lists;
4+
import com.iast.astbenchmark.analyser.bean.CaseTargetBean;
5+
import com.iast.astbenchmark.analyser.bean.CaseTargetItemBean;
6+
import com.iast.astbenchmark.analyser.bean.consts.CaseTypeEnum;
7+
import org.springframework.util.CollectionUtils;
8+
9+
import java.lang.reflect.Method;
10+
import java.util.List;
11+
12+
public final class AnnotationProcessorUtil {
13+
14+
/**
15+
* 处理类注解
16+
* test method
17+
* @param clazz 待处理的类
18+
*/
19+
public static void processAnnotations(Class<?> clazz) {
20+
// 处理方法注解
21+
22+
// 处理方法注解
23+
for (Method method : clazz.getDeclaredMethods()) {
24+
// 判断方法是否有@CaseTag注解
25+
if (method.isAnnotationPresent(CaseTag.class)) {
26+
// 获取方法上的@CaseTag注解
27+
CaseTag methodAnnotation = method.getAnnotation(CaseTag.class);
28+
// 打印方法名和注解值
29+
System.out.println("Method " + method.getName() + " has annotation with value: " + methodAnnotation.caseNo());
30+
}
31+
}
32+
}
33+
34+
35+
/**
36+
* 构建用例映射
37+
*
38+
* @param clazz 待处理的类
39+
*/
40+
public static void buildCaseMap(Class<?> clazz) {
41+
// 遍历类中的所有方法
42+
for (Method method : clazz.getDeclaredMethods()) {
43+
// 判断方法是否被@CaseTag注解标记
44+
if (method.isAnnotationPresent(CaseTag.class)) {
45+
// 获取@CaseTag注解实例
46+
CaseTag methodAnnotation = method.getAnnotation(CaseTag.class);
47+
// 获取用例编号
48+
String caseNo = methodAnnotation.caseNo();
49+
// 判断用例编号对应的目标对象是否已存在
50+
if (!CasetargeCache.targetMap.containsKey(caseNo)) {
51+
// 如果不存在，则构建新的目标对象并添加到缓存中
52+
CasetargeCache.targetMap.put(caseNo, buildTargetBean(methodAnnotation));
53+
} else {
54+
// 如果已存在，则修改目标对象并替换缓存中的对象
55+
CaseTargetBean modifyBean = modifyTargetBean(CasetargeCache.targetMap.get(caseNo), methodAnnotation);
56+
CasetargeCache.targetMap.replace(caseNo, modifyBean);
57+
}
58+
}
59+
}
60+
}
61+
62+
/**
63+
* 构建用例目标 bean
64+
*
65+
* @param methodAnnotation 方法注解
66+
* @return 用例目标 bean
67+
*/
68+
private static CaseTargetBean buildTargetBean(CaseTag methodAnnotation) {
69+
String caseNo = methodAnnotation.caseNo();
70+
String caseFullName = methodAnnotation.caseFullName();
71+
String thisMethodTag = methodAnnotation.thisMethodTag();
72+
boolean result = methodAnnotation.thisMethodExpectedResult();
73+
CaseTargetBean targetBean = new CaseTargetBean();
74+
targetBean.setCaseNo(caseNo);
75+
CaseTargetItemBean itemBean = new CaseTargetItemBean();
76+
itemBean.setTag(thisMethodTag);
77+
itemBean.setResult(result);
78+
List<CaseTargetItemBean> item = Lists.newArrayList();
79+
item.add(itemBean);
80+
targetBean.setCaseDesc(caseFullName);
81+
targetBean.setData(item);
82+
targetBean.setCaseType(CaseTypeEnum.getDescByTag(caseFullName));
83+
targetBean.setWeight(1);
84+
return targetBean;
85+
}
86+
87+
/**
88+
* 修改用例目标 bean
89+
*
90+
* @param caseTargetBean 原始的用例目标 bean
91+
* @param methodAnnotation 方法注解，包含用例标签和预期结果
92+
* @return 修改后的用例目标 bean，包含新的用例标签和预期结果
93+
*/
94+
private static CaseTargetBean modifyTargetBean(CaseTargetBean caseTargetBean, CaseTag methodAnnotation) {
95+
// 获取方法注解中的用例标签和预期结果
96+
String thisMethodTag = methodAnnotation.thisMethodTag();
97+
boolean result = methodAnnotation.thisMethodExpectedResult();
98+
// 创建一个新的用例目标项 bean，设置用例标签和预期结果
99+
CaseTargetItemBean itemBean = new CaseTargetItemBean();
100+
itemBean.setTag(thisMethodTag);
101+
itemBean.setResult(result);
102+
// 获取原始用例目标 bean 中的用例目标项列表
103+
List<CaseTargetItemBean> itemBeans = caseTargetBean.getData();
104+
// 如果用例目标项列表为空，则直接将新的用例目标项添加到列表中
105+
if (CollectionUtils.isEmpty(itemBeans)) {
106+
itemBeans.add(itemBean);
107+
} else {
108+
// 如果用例目标项列表不为空，则判断是否已存在相同标签的用例目标项
109+
boolean itemExist = false;
110+
for (CaseTargetItemBean item : itemBeans) {
111+
if (item.getTag().equalsIgnoreCase(thisMethodTag)) {
112+
itemExist = true;
113+
break;
114+
}
115+
}
116+
// 如果不存在相同标签的用例目标项，则将新的用例目标项添加到列表中
117+
if (!itemExist) {
118+
itemBeans.add(itemBean);
119+
}
120+
}
121+
122+
// 将更新后的用例目标项列表设置回用例目标 bean 中，并返回修改后的用例目标 bean
123+
caseTargetBean.setData(itemBeans);
124+
return caseTargetBean;
125+
}
126+
127+
}

‎iast-java/src/main/java/com/iast/astbenchmark/analyser/cache/CaseStuctCache.java

+8-11
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,9 @@
88

99
@Slf4j
1010
public class CaseStuctCache {
11-
private static CaseNode root;
12-
private static Map<String, CaseNode> leafData ;
13-
static {
14-
root = CaseNodeTreeUtil.initRoot();
15-
leafData=CaseNodeTreeUtil.leafMap(root);
16-
}
11+
protected static CaseNode root;
12+
protected static Map<String, CaseNode> leafData ;
13+
1714

1815
public static CaseNode getLeafByCaseNo(String caseNo){
1916
try {
@@ -31,9 +28,9 @@ public static CaseNode getRoot(){
3128
return root;
3229
}
3330

34-
public static void main(String[] args) {
35-
for (CaseNode value : CaseStuctCache.getAllLeaf().values()) {
36-
System.out.println(value.getFullName());
37-
}
38-
}
31+
//public static void main(String[] args) {
32+
// for (CaseNode value : CaseStuctCache.getAllLeaf().values()) {
33+
// System.out.println(value.getFullName());
34+
// }
35+
//}
3936
}

‎iast-java/src/main/java/com/iast/astbenchmark/analyser/cache/CaseTag.java

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package com.iast.astbenchmark.analyser.cache;
2+
3+
import java.lang.annotation.ElementType;
4+
import java.lang.annotation.Retention;
5+
import java.lang.annotation.RetentionPolicy;
6+
import java.lang.annotation.Target;
7+
8+
@Target(ElementType.METHOD) // 定义注解可以应用于方法
9+
@Retention(RetentionPolicy.RUNTIME) // 定义注解在运行时可用
10+
public @interface CaseTag {
11+
/**
12+
* Case编码
13+
*
14+
* @return
15+
*/
16+
String caseNo();
17+
18+
19+
/**
20+
* case 全名包括路径
21+
*
22+
* @return
23+
*/
24+
String caseFullName();
25+
26+
/**
27+
* 这个方法期望检出漏洞的结果,true为期待检出,false为不期待检出
28+
*
29+
* @return
30+
*/
31+
boolean thisMethodExpectedResult();
32+
33+
/**
34+
* 这个方法的标识，可以用于日志等检出结果中检索
35+
*
36+
* @return
37+
*/
38+
String thisMethodTag();
39+
}

‎iast-java/src/main/java/com/iast/astbenchmark/analyser/cache/CasetargeCache.java

+67-21
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,37 @@
11
package com.iast.astbenchmark.analyser.cache;
22

3-
import cn.hutool.core.io.FileUtil;
43
import cn.hutool.core.io.IoUtil;
54
import cn.hutool.core.io.resource.ClassPathResource;
65
import cn.hutool.json.JSONArray;
76
import cn.hutool.json.JSONUtil;
8-
import com.iast.astbenchmark.analyser.bean.CaseTargetBean;
97
import com.google.common.collect.Maps;
8+
import com.iast.astbenchmark.analyser.bean.CaseTargetBean;
9+
import com.iast.astbenchmark.cases.AstTaintCase001;
10+
import com.iast.astbenchmark.cases.AstTaintCase002;
11+
import com.iast.astbenchmark.cases.AstTaintCase003;
12+
import com.iast.astbenchmark.cases.AstTaintCase004;
13+
import com.iast.astbenchmark.cli.tree.CaseNode;
14+
import com.iast.astbenchmark.cli.tree.CaseNodeTreeUtil;
1015
import lombok.extern.slf4j.Slf4j;
1116
import org.springframework.stereotype.Component;
1217

1318
import javax.annotation.PostConstruct;
1419
import java.nio.charset.Charset;
20+
import java.util.Collections;
21+
import java.util.HashSet;
22+
import java.util.List;
1523
import java.util.Map;
24+
import java.util.Set;
25+
import java.util.stream.Collectors;
26+
27+
import static com.iast.astbenchmark.analyser.cache.AnnotationProcessorUtil.buildCaseMap;
28+
import static com.iast.astbenchmark.analyser.cache.CaseStuctCache.leafData;
1629

1730
@Component
1831
@Slf4j
1932
public class CasetargeCache {
20-
private static Map<String, CaseTargetBean> targetMap = Maps.newLinkedHashMap();
33+
protected static Map<String, CaseTargetBean> targetMap = Maps.newLinkedHashMap();
34+
protected static Map<String, CaseTargetBean> targetMap2 = Maps.newLinkedHashMap();
2135

2236
@PostConstruct
2337
void init() {
@@ -28,33 +42,65 @@ public static void initNow() {
2842
new CasetargeCache().goinit();
2943
}
3044

45+
//public static void main(String[] args) {
46+
// /**
47+
// * json转注解，两边结果对比
48+
// * root2,json解析的root
49+
// * leafData2,json解析的所有叶子节点数据
50+
// */
51+
// CaseNode root2;
52+
// Map<String, CaseNode> leafData2 ;
53+
// new CasetargeCache().initNow();
54+
// String target = IoUtil.read(new ClassPathResource("config/case_target_list.json").getStream(), Charset.forName("utf-8"));
55+
// JSONArray array = JSONUtil.parseArray(target);
56+
// array.stream().forEach(e -> {
57+
// CaseTargetBean bean = JSONUtil.toBean(JSONUtil.toJsonStr(e), CaseTargetBean.class);
58+
// targetMap2.put(bean.getCaseNo(), bean);
59+
// });
60+
// root2=CaseNodeTreeUtil.initRoot2();
61+
// leafData2=CaseNodeTreeUtil.leafMap(root2);
62+
// System.out.println(leafData.size()+"/"+ leafData2.size());
63+
// Set<String> keySet= new HashSet<>();
64+
// keySet.addAll(leafData2.keySet()) ;
65+
// keySet.addAll(leafData.keySet());
66+
// for (String key : keySet) {
67+
// if(!leafData.containsKey(key)){
68+
// System.out.println("注解缺少"+key);
69+
// continue;
70+
// }
71+
// if(!leafData2.containsKey(key)){
72+
// System.out.println("json缺少:"+key);
73+
// continue;
74+
// }
75+
// CaseTargetBean leaf =leafData.get(key).getLeafData();
76+
// List<String> targetData=leaf.getData().stream().map(e->e.getTag()+e.getResult()).collect(Collectors.toList());
77+
// CaseTargetBean leaf2 =leafData2.get(key).getLeafData();
78+
// List<String> targetData2=leaf2.getData().stream().map(e->e.getTag()+e.getResult()).collect(Collectors.toList());
79+
// Collections.sort(targetData);
80+
// Collections.sort(targetData2);
81+
// if(!targetData.equals(targetData2)){
82+
// System.out.println(key);
83+
// }
84+
//
85+
// }
86+
//
87+
//}
3188
private void goinit() {
3289
if (targetMap.isEmpty()) {
3390
try {
34-
String target = IoUtil.read(new ClassPathResource("config/case_target_list.json").getStream(),Charset.forName("utf-8"));
35-
//JSONArray array = JSONUtil.readJSONArray(FileUtil.file("case_target_list.json"), Charset.forName("utf-8"));
36-
JSONArray array =JSONUtil.parseArray(target);
37-
array.stream().forEach(e -> {
38-
CaseTargetBean bean = JSONUtil.toBean(JSONUtil.toJsonStr(e), CaseTargetBean.class);
39-
targetMap.put(bean.getCaseNo(), bean);
40-
});
41-
91+
buildCaseMap(AstTaintCase001.class);
92+
buildCaseMap(AstTaintCase002.class);
93+
buildCaseMap(AstTaintCase003.class);
94+
buildCaseMap(AstTaintCase004.class);
95+
CaseStuctCache.root = CaseNodeTreeUtil.initRoot();
96+
CaseStuctCache.leafData=CaseNodeTreeUtil.leafMap(CaseStuctCache.root);
4297
} catch (Exception e) {
4398
log.error("ERROR : Case加载失败，请检查您的case_target_list.json:{}", e);
4499
}
45100
}
46101
}
47102

48-
//public static void main(String[] args) {
49-
// String target = IoUtil.read(new ClassPathResource("config/case_target_list.json").getStream(),Charset.forName("utf-8"));
50-
// //JSONArray array = JSONUtil.readJSONArray(FileUtil.file("case_target_list.json"), Charset.forName("utf-8"));
51-
// JSONArray array =JSONUtil.parseArray(target);
52-
// array.stream().forEach(e -> {
53-
// CaseTargetBean bean = JSONUtil.toBean(JSONUtil.toJsonStr(e), CaseTargetBean.class);
54-
// targetMap.put(bean.getCaseNo(), bean);
55-
// });
56-
// targetMap.forEach((k,v)-> System.out.println(k+"____"+v.getCaseDesc()));
57-
//}
103+
58104

59105
public static CaseTargetBean getTargetByCaseKey(String key) {
60106
return targetMap.get(key);

0 commit comments

Comments
 (0)