problems/ProblematicCode.java at main · zuoyaofu/problems · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
importjava.sql.Connection;
importjava.sql.DriverManager;
importjava.sql.Statement;
importjava.io.File;
importjava.io.FileReader;
importjava.util.logging.Logger;

publicclassProblematicCode {
privatestaticfinalLoggerlogger = Logger.getLogger(ProblematicCode.class.getName());
privateConnectionconn;
privateStringpassword = "secretPassword123"; // Hard-coded credentials

publicvoidconnectToDatabase(StringuserInput) {
try {
// SQL Injection vulnerability
Stringquery = "SELECT * FROM users WHERE name = '" + userInput + "'";
Statementstmt = conn.createStatement();
stmt.execute(query);
 } catch (Exceptione) {
// Bad exception handling
e.printStackTrace();
 }
 }

publicbooleanreadSensitiveFile() {
FileReaderreader = null;
try {
// Potential path traversal vulnerability
Filefile = newFile(System.getProperty("user.home") + "/secret.txt");
reader = newFileReader(file);
returntrue;
 } catch (Exceptione) {
logger.severe("Error: " + e.getMessage());
returnfalse;
 }
// Resource leak - reader not closed
 }

publicvoidinsecureHash(Stringinput) {
try {
// Using weak MD5 hash
java.security.MessageDigestmd = java.security.MessageDigest.getInstance("MD5");
byte[] hash = md.digest(input.getBytes());
 } catch (Exceptione) {
// Empty catch block
 }
 }

publicsynchronizedvoidpotentialDeadlock(Objectlock1, Objectlock2) {
// Nested synchronization - potential deadlock
synchronized(lock1) {
synchronized(lock2) {
// Do something
 }
 }
 }

privatevoidunsafeDeserialization(Stringfilename) {
try {
// Unsafe deserialization vulnerability
java.io.ObjectInputStreamois = newjava.io.ObjectInputStream(
newjava.io.FileInputStream(filename));
Objectobj = ois.readObject();
 } catch (Exceptione) {
logger.warning(e.toString());
 }
 }
}