1

我想改进对 PREDICTABLE_RANDOM_SCALA 代码的检测。

  • methodName 包含“token”、“id”、“csrf”等。
  • find-sec-bug 现有检测逻辑

但在斯卡拉。scala 源代码和 javap -v 你可以在下面看到。

class PredictableRandomScala {
  def generateToken(): String ={
    val result = Seq.fill(16)(Random.nextInt())
    result.map("%02x" format _).mkString
  }
}

{
  public java.lang.String generateToken();
    descriptor: ()Ljava/lang/String;
    flags: ACC_PUBLIC
    Code:
      stack=5, locals=2, args_size=1
         0: getstatic     #16                 // Field scala/collection/Seq$.MODULE$:Lscala/collection/Seq$;
         3: bipush        16
         5: new           #18                 // class bugs/PredictableRandomScala$$anonfun$1
         8: dup
         9: aload_0
        10: invokespecial #22                 // Method bugs/PredictableRandomScala$$anonfun$1."<init>":(Lbugs/PredictableRandomScala;)V
        13: invokevirtual #26                 // Method scala/collection/Seq$.fill:(ILscala/Function0;)Lscala/collection/GenTraversable;
        16: checkcast     #28                 // class scala/collection/Seq
        19: astore_1
        20: aload_1
        21: new           #30                 // class bugs/PredictableRandomScala$$anonfun$generateToken$1
        24: dup
        25: aload_0
        26: invokespecial #31                 // Method bugs/PredictableRandomScala$$anonfun$generateToken$1."<init>":(Lbugs/PredictableRandomScala;)V
        29: getstatic     #16                 // Field scala/collection/Seq$.MODULE$:Lscala/collection/Seq$;
        32: invokevirtual #35                 // Method scala/collection/Seq$.canBuildFrom:()Lscala/collection/generic/CanBuildFrom;
        35: invokeinterface #39,  3           // InterfaceMethod scala/collection/Seq.map:(Lscala/Function1;Lscala/collection/generic/CanBuildFrom;)Ljava/lang/Object;
        40: checkcast     #41                 // class scala/collection/TraversableOnce
        43: invokeinterface #44,  1           // InterfaceMethod scala/collection/TraversableOnce.mkString:()Ljava/lang/String;
        48: areturn
      LocalVariableTable:
        Start  Length  Slot  Name   Signature
            0      49     0  this   Lbugs/PredictableRandomScala;
           20      28     1 result   Lscala/collection/Seq;
      LineNumberTable:
        line 7: 0
        line 8: 20

  public bugs.PredictableRandomScala();
    descriptor: ()V
    flags: ACC_PUBLIC
    Code:
      stack=1, locals=1, args_size=1
         0: aload_0
         1: invokespecial #51                 // Method java/lang/Object."<init>":()V
         4: return
      LocalVariableTable:
        Start  Length  Slot  Name   Signature
            0       5     0  this   Lbugs/PredictableRandomScala;
      LineNumberTable:
        line 10: 0
}
SourceFile: "PredictableRandomScala.scala"
InnerClasses:
     public final #18; //class bugs/PredictableRandomScala$$anonfun$1
     public final #30; //class bugs/PredictableRandomScala$$anonfun$generateToken$1
RuntimeVisibleAnnotations:
  0: #6(#7=s#8)
Error: unknown attribute
  ScalaSig: length = 0x3
   05 00 00

可以看到，scala使用了innerClass，绕过了我的判断方法：xxxtoken方法是否调用了Random。是否有任何 API 来获取内部类并加载它，或者有什么方法可以实现这个逻辑。

4

0 回答 0