added vulnerable code to test frog-bot

[MohammedKamle]

No description provided.

[MohammedKamle]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 2 issues

Scan Category	Status	Security Issues
Software Composition Analysis	ℹ️ Not Scanned	-
Contextual Analysis	ℹ️ Not Scanned	-
Static Application Security Testing (SAST)	✅ Done	2 Issues Found 1 Medium 1 Low
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

---

🐸 JFrog Frogbot

[MohammedKamle]

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Medium	Using outdated or insecure encryption algorithm

Full description

Vulnerability Details

Rule ID:	java-weak-crypto-algorithm

Overview

Insecure SSL protocols refer to older versions of the SSL (Secure Socket Layer) and TLS
(Transport Layer Security) protocols that have known security vulnerabilities. These
vulnerabilities can be exploited by attackers to compromise the confidentiality, integrity,
and authenticity of the communication between a client and a server.

Vulnerable example

public class weak_crypto_vuln {
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String data = request.getParameter("data");
        Cipher decryptor;

        decryptor = Cipher.getInstance("DES");
        decryptor.init(Cipher.DECRYPT_MODE, key);

        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
        outputStream.write(decryptor.doFinal(Base64.getDecoder().decode(data)));
        String decryptedData = outputStream.toString();
    }
}

DES is a weak cryptographic algorithm.

Remediation

public class weak_crypto_safe {
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String data = request.getParameter("data");
        Cipher decryptor;

        - decryptor = Cipher.getInstance("DES");
        + decryptor = Cipher.getInstance("AES");
        decryptor.init(Cipher.DECRYPT_MODE, key);

        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
        outputStream.write(decryptor.doFinal(Base64.getDecoder().decode(data)));
        String decryptedData = outputStream.toString();
    }
}

AES is a strong cryptographic algorithm.

---

🐸 JFrog Frogbot

[MohammedKamle]

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Low	Internal code structure may be revealed through error message

Full description

Vulnerability Details

Rule ID:	java-stack-trace-exposure

Overview

Stack trace exposure is a type of security vulnerability that occurs when a program reveals
sensitive information, such as the names and locations of internal files and variables,
in error messages or other diagnostic output. This can happen when a program crashes or
encounters an error, and the stack trace (a record of the program's call stack at the time
of the error) is included in the output. Stack trace exposure can provide attackers with
valuable information about a program's internal workings and vulnerabilities, making it
easier for them to exploit those vulnerabilities and gain unauthorized access
to the system.

Vulnerable example

In this example, an exception is caught, and its stack trace is printed directly to the HTTP response, exposing internal details.

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringWriter;

public class stack_trace_exposure_vuln extends HttpServlet {

    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            int result = 10 / 0; // Simulate an error
            response.getWriter().println("Result: " + result);
        } catch (Exception e) {
            // Vulnerable: Printing full stack trace to the response
            StringWriter sw = new StringWriter();
            PrintWriter pw = new PrintWriter(sw);
            e.printStackTrace(pw);
            response.getWriter().println("Error: " + sw.toString());
        }
    }
}

Remediation

Avoid sending out data from exceptions thrown in the code. Instead, log the detailed error internally and provide a generic error message to the user.

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class stack_trace_exposure_safe extends HttpServlet {

    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            int result = 10 / 0; // Simulate an error
            response.getWriter().println("Result: " + result);
        } catch (Exception e) {
            // Secure: Log detailed error internally (not shown) and present generic message
            System.err.println("An error occurred: " + e.getMessage());
            response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "An unexpected error occurred.");
        }
    }
}

<details><summary><b>Code Flows</b></summary>
<details><summary><b>Vulnerable data flow analysis result</b></summary>

↘️ `Exception e` (at src/main/java/VulnerableApp.java line 104)

↘️ `e` (at src/main/java/VulnerableApp.java line 105)
<br></details><br></details><br></details>

---
<div align='center'>

[🐸 JFrog Frogbot](https://docs.jfrog-applications.jfrog.io/jfrog-applications/frogbot)

</div>