Skip to content

Latest commit

 

History

History
81 lines (57 loc) · 3.5 KB

README.md

File metadata and controls

81 lines (57 loc) · 3.5 KB

coding-agent-example-java-codeql-autobuild

A demonstration Java application with intentional security vulnerabilities for CodeQL scanning.

Overview

This repository contains a simple Java application built with Maven that includes several common security vulnerabilities designed to be detected by GitHub's CodeQL static analysis tool.

Application Structure

  • Main Application: com.example.app.VulnerableApplication - Entry point that demonstrates various vulnerabilities
  • Database Layer: com.example.database.UserDatabase - Contains SQL injection vulnerabilities
  • Security Utils: com.example.security.CryptoUtils - Contains weak cryptographic implementations
  • Web/File Handling: com.example.web.FileController - Contains path traversal and command injection vulnerabilities
  • LDAP Authentication: com.example.ldap.LdapAuth - Contains LDAP injection vulnerabilities

Intentional Vulnerabilities

This application contains the following types of security vulnerabilities:

  1. SQL Injection - Direct string concatenation in SQL queries
  2. Command Injection - Unsanitized user input passed to system commands
  3. Path Traversal - File operations without path validation
  4. LDAP Injection - Unescaped user input in LDAP filters
  5. Weak Cryptography - Use of MD5 and weak random number generation
  6. Hard-coded Secrets - Embedded credentials and encryption keys
  7. Vulnerable Dependencies - Multiple packages with known vulnerabilities:
    • commons-collections:3.2.1 - Deserialization vulnerabilities (CVE-2015-7501), appears in multiple paths:
      • As a direct dependency
      • As a transitive dependency through commons-beanutils:1.9.2
      • As a transitive dependency through commons-digester:2.1 → commons-beanutils:1.8.3
    • commons-fileupload:1.3.1 - Arbitrary file upload vulnerabilities (CVE-2016-1000031)
    • commons-codec:1.6 - Older version with potential vulnerabilities
    • commons-dbcp:1.4 - Database connection pool with transitive dependencies
    • Additional transitive vulnerabilities through commons-io:2.2 and commons-pool:1.5.4

CodeQL Analysis

The repository includes a GitHub Actions workflow (.github/workflows/codeql-analysis.yml) that:

  • Runs CodeQL analysis on push and pull requests
  • Uses the autobuild functionality for Java
  • Includes security-and-quality queries for comprehensive coverage
  • Runs weekly scheduled scans

Building and Running

# Compile the application
mvn clean compile

# Run tests
mvn test

# Run the application (demonstrates vulnerabilities)
mvn exec:java -Dexec.mainClass="com.example.app.VulnerableApplication"

# View dependency tree to see multiple paths to commons-collections
mvn dependency:tree -Dverbose

Viewing Multiple Dependency Paths

To see how commons-collections:3.2.1 appears in multiple paths in the dependency graph, run:

mvn dependency:tree -Dverbose | grep -E "commons-collections|commons-beanutils|commons-digester"

Expected output shows commons-collections:3.2.1 appearing as:

  • A direct dependency
  • A transitive dependency through commons-beanutils (marked as "omitted for duplicate")
  • A transitive dependency through commons-digester → commons-beanutils

Warning

⚠️ This application contains intentional security vulnerabilities and should never be deployed in a production environment. It is designed solely for educational purposes and CodeQL demonstration.

License

This project is for educational and demonstration purposes only.