Title

VMs/Dockerfile

@@ -1,12 +1,10 @@
 # This dockerfile builds a container that pulls down and runs the latest version of BenchmarkJava
-FROM ubuntu:latest
-MAINTAINER "Dave Wichers dave.wichers@owasp.org"
+FROM sapmachine:22.0.1-jdk-ubuntu-24.04
 
 RUN apt-get update
 RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
+
 RUN apt-get install -q -y \
-     openjdk-11-jre-headless \
-     openjdk-11-jdk \
      git \
      maven \
      wget \
@@ -23,22 +21,22 @@ RUN mvn install
 
 # Download, build BenchmarkJava
 WORKDIR /owasp
-RUN git clone https://github.com/OWASP-Benchmark/BenchmarkJava
+RUN git clone https://github.com/flawgarden/BenchmarkJava-mutated.git
 
 # Workaround for security fix for CVE-2022-24765
-RUN git config --global --add safe.directory /owasp/BenchmarkJava
+RUN git config --global --add safe.directory /owasp/BenchmarkJava-mutated
 
-WORKDIR /owasp/BenchmarkJava
+WORKDIR /owasp/BenchmarkJava-mutated
 RUN mvn clean package cargo:install
 
 RUN useradd -d /home/bench -m -s /bin/bash bench 
 RUN echo bench:bench | chpasswd
 
 RUN chown -R bench /owasp/
-ENV PATH /owasp/BenchmarkJava:$PATH
+ENV PATH=/owasp/BenchmarkJava-mutated:$PATH
 
 # start up Benchmark once, for 60 seconds, then kill it, so the additional dependencies required to run it are downloaded/cached in the image as well.
 # exit 0 is required to return a 'success' code, otherwise the timeout returns a failure code, causing the Docker build to fail.
-WORKDIR /owasp/BenchmarkJava
+WORKDIR /owasp/BenchmarkJava-mutated
 RUN timeout 60 ./runBenchmark.sh; exit 0
 

VMs/buildDockerImage.sh

@@ -1,13 +1,3 @@
-# Pull in latest version of ubuntu. This builds an image using the OS native to this platform.
-docker pull ubuntu:latest
-# Remove any ubuntu:<none> image if it was left behind by a new version of ubuntu:latest being pulled
-i=$(docker images | grep "ubuntu" | grep "<none" | awk '{print $3}')
-if [ "$i" ]
-then
-  docker rmi $i
-fi
-
-# Since Docker doesn't auto delete anything, just like for the Ubuntu update, delete any existing benchmark:latest image before building a new one
-docker image rm benchmark:latest
-docker build -t benchmark .
-
+# Since Docker doesn't auto delete anything, just like for the Ubuntu update, delete any existing benchmark-mutated:latest image before building a new one
+docker image rm benchmark-mutated:latest
+docker build -t benchmark-mutated .

VMs/runDockerImage.sh

@@ -1,2 +1,2 @@
-docker run -t -i -p 8443:8443 --rm benchmark /bin/bash -c "git pull && ./runRemoteAccessibleBenchmark.sh"
+docker run -t -i -p 8443:8443 --rm benchmark-mutated /bin/bash -c "git pull && ./runRemoteAccessibleBenchmark.sh"
 

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00004178.java

@@ -26,7 +26,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/trustbound-00/BenchmarkTest00004")
+@WebServlet(value = "/trustbound-00/BenchmarkTest00004178")
 public class BenchmarkTest00004178 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest000041781.java

@@ -26,7 +26,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/trustbound-00/BenchmarkTest00004")
+@WebServlet(value = "/trustbound-00/BenchmarkTest000041781")
 public class BenchmarkTest000041781 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007141.java

@@ -26,7 +26,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/cmdi-00/BenchmarkTest00007")
+@WebServlet(value = "/cmdi-00/BenchmarkTest00007141")
 public class BenchmarkTest00007141 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest000081.java

@@ -24,7 +24,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/sqli-00/BenchmarkTest00008")
+@WebServlet(value = "/sqli-00/BenchmarkTest000081")
 public class BenchmarkTest000081 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000810.java

@@ -24,7 +24,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/sqli-00/BenchmarkTest00008")
+@WebServlet(value = "/sqli-00/BenchmarkTest0000810")
 public class BenchmarkTest0000810 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00008102.java

@@ -25,7 +25,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/sqli-00/BenchmarkTest00008")
+@WebServlet(value = "/sqli-00/BenchmarkTest00008102")
 public class BenchmarkTest00008102 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest0000811.java

@@ -24,7 +24,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/sqli-00/BenchmarkTest00008")
+@WebServlet(value = "/sqli-00/BenchmarkTest0000811")
 public class BenchmarkTest0000811 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00008111.java

@@ -24,7 +24,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-@WebServlet(value = "/sqli-00/BenchmarkTest00008")
+@WebServlet(value = "/sqli-00/BenchmarkTest00008111")
 public class BenchmarkTest00008111 extends HttpServlet {
 
     private static final long serialVersionUID = 1L;