Added new test large

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/.mvn/extensions.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<extensions>
+    <extension>
+        <groupId>co.leantechniques</groupId>
+        <artifactId>maven-buildtime-extension</artifactId>
+        <version>3.0.3</version>
+    </extension>
+</extensions>
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/.scannerwork/css-bundle/stylelintconfig.json

@@ -0,0 +1 @@
+{"rules":{"block-no-empty":true,"comment-no-empty":true,"string-no-newline":true,"function-linear-gradient-no-nonstandard-direction":true,"media-feature-name-no-unknown":true,"color-no-invalid-hex":true,"font-family-no-duplicate-names":true,"no-duplicate-at-import-rules":true,"no-empty-source":true,"declaration-block-no-duplicate-properties":[true,{"ignore":["consecutive-duplicates-with-different-values"]}],"selector-type-no-unknown":[true,{"ignoreTypes":["/^(mat|md|fa)-/"],"ignore":["custom-elements"]}],"at-rule-no-unknown":[true,{"ignoreAtRules":["value","at-root","content","debug","each","else","error","for","function","if","include","mixin","return","warn","while","extend","use","/^@.*/"]}],"no-duplicate-selectors":true,"font-family-no-missing-generic-family-keyword":true,"no-extra-semicolons":true,"no-invalid-double-slash-comments":true,"selector-pseudo-element-no-unknown":[true,{"ignorePseudoElements":["ng-deep","v-deep"]}],"selector-pseudo-class-no-unknown":[true,{"ignorePseudoClasses":["local","global","export","import"]}],"keyframe-declaration-no-important":true,"property-no-unknown":[true,{"ignoreProperties":["composes","/^mso-/"],"ignoreSelectors":["/^:export.*/","/^:import.*/"]}],"declaration-block-no-shorthand-property-overrides":true,"unit-no-unknown":[true,{"ignoreUnits":["x"]}],"function-calc-no-invalid":true}}

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/.scannerwork/report-task.txt

@@ -0,0 +1,6 @@
+projectKey=ds_owasp_22_cli
+serverUrl=http://localhost:9000
+serverVersion=9.3.0.51899
+dashboardUrl=http://localhost:9000/dashboard?id=ds_owasp_22_cli
+ceTaskId=AYH2eX4ofr18r_Wq_bEJ
+ceTaskUrl=http://localhost:9000/api/ce/task?id=AYH2eX4ofr18r_Wq_bEJ

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/.travis.yml

@@ -0,0 +1,20 @@
+language: java
+
+env:
+  global:
+   # The next declaration is the encrypted COVERITY_SCAN_TOKEN, created
+   #   via the "travis encrypt" command using the project repo's public key
+   - secure: "nQwb2puOx0qCJs9ealFxjlnMl7Qzue1Ii8n9yTpqdU+T+nRRIJyjHUmifEPfmTofAUGRGuvC1jP3PFl4mIfaL0uiovGIS2ON+GdzAdO+ExpHjbteaf3eg8hfV7mmei1GgAdwHv2o7cKb0EAr+LP/6gHUPYeeR1sGwv5h5agcMq7Q33ix4+z0v4lS5OGufH8Wpo/Oy/9t2K0G8whbtVjnn3IQb6+OG/5JfQFO2jgtJZvB8JOxWAZZ2mbwPrDxArc+XLTVXBZcm4S7sr3i2yr31+SlLfKi7X4ZIlN5P6nH8O+7rdOwFTjx/n+tHiTq8xIs0uO3gZsYVT6m8yA1PQauQIC0URB0NYxR31XDLI+T131qsz7YfzVl8SD8jntG+VwnQvvedJzy5EQvq+wQvBF8rPhXXY3+ZqfERbfKWafEauMOMxuupHopiL0QtrcpLXzz6Nw1KoK+YL4dgAd9TpseuRNy1Z68dfBsGiqaBCMSg0ytftSxoPDvOXK1b9k3vY3/ByjYgutkz7VGNY7DKYODQLlpdfs3+N4GWw8l7TRtAOiKye/JzBH7RlJrpsINBL539zbpmDlf6SeLKYesA2G+ZBNgj2vy6GGFzS9dwY8mzK2TlKbxHA5mKokVcULVyEw+kEL7sKuI6ldqc0bMAuWF7gHeA2TBGXknmwtDco1WVlg="
+
+before_install:
+  - echo -n | openssl s_client -connect https://scan.coverity.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | sudo tee -a /etc/ssl/certs/ca-
+
+addons:
+  coverity_scan:
+    project:
+      name: "OWASP/Benchmark"
+      description: "OWASP Benchmark"
+    notification_email: dave.wichers@owasp.org
+    build_command_prepend: ""
+    build_command: "mvn clean compile"
+    branch_pattern: master

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/DevStyleHtml.prefs

@@ -0,0 +1,4 @@
+eclipse.preferences.version=1
+indentationChar=space
+indentationSize=4
+lineWidth=999

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/DevStyleXml.prefs

@@ -0,0 +1,6 @@
+eclipse.preferences.version=1
+indentationChar=space
+indentationSize=4
+lineWidth=999
+formatCommentJoinLines=true
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/OWASP Benchmark.URL

@@ -0,0 +1,6 @@
+[InternetShortcut]
+URL=https://localhost:8443/benchmark/
+IDList=
+HotKey=0
+IconFile=./src/main/webapp/favicon.ico
+IconIndex=0

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/README.md

@@ -0,0 +1,6 @@
+# OWASP Benchmark
+The OWASP Benchmark Project is a Java test suite designed to verify the speed and accuracy of vulnerability detection tools. It is a fully runnable open source web application that can be analyzed by any type of Application Security Testing (AST) tool, including SAST, DAST (like <a href="https://owasp.org/www-project-zap">OWASP ZAP</a>), and IAST tools. The intent is that all the vulnerabilities deliberately included in and scored by the Benchmark are actually exploitable so its a fair test for any kind of application vulnerability detection tool. The Benchmark also includes scorecard generators for numerous open source and commercial AST tools, and the set of supported tools is growing all the time.
+
+The project documentation is all on the OWASP site at the <a href="https://owasp.org/www-project-benchmark">OWASP Benchmark</a> project pages. Please refer to that site for all the project details.
+
+The current latest release is v1.2. Note that all the releases that are available here: https://github.com/OWASP/Benchmark/releases are historical. The latest release is always available live by simply cloning or pulling the head of this repository (i.e., git pull).

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/VMs/Dockerfile

@@ -0,0 +1,27 @@
+# This dockerfile builds a container that pulls down and runs the latest version of Benchmark
+FROM ubuntu:latest
+MAINTAINER "Dave Wichers dave.wichers@owasp.org"
+
+RUN apt-get update
+RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
+RUN apt-get install -q -y \
+     openjdk-8-jre-headless \
+     openjdk-8-jdk \
+     git \
+     maven \
+     wget \
+     iputils-ping \
+     && apt-get clean
+
+RUN mkdir /owasp
+WORKDIR /owasp
+RUN git clone https://github.com/OWASP-Benchmark/BenchmarkJava
+WORKDIR /owasp/BenchmarkJava
+RUN mvn clean package cargo:install
+
+RUN useradd -d /home/bench -m -s /bin/bash bench 
+RUN echo bench:bench | chpasswd
+
+RUN chown -R bench /owasp/
+ENV PATH /owasp/BenchmarkJava:$PATH
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/VMs/buildDockerImage.sh

@@ -0,0 +1,13 @@
+# Pull in latest version of ubuntu
+docker pull ubuntu:latest
+# Remove any ubuntu:<none> image if it was left behind by a new version of ubunto:latest being pulled
+i=$(docker images | grep "ubuntu" | grep "<none" | awk '{print $3}')
+if [ "$i" ]
+then
+  docker rmi $i
+fi
+
+# Since Docker doesn't auto delete anything, just like for the Ubunto update, delete any existing benchmark:latest image before building a new one
+docker image rm benchmark:latest
+docker build -t benchmark .
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/VMs/runDockerImage.sh

@@ -0,0 +1,2 @@
+docker run -t -i -p 8443:8443 --rm benchmark /bin/bash -c "git pull && ./runRemoteAccessibleBenchmark.sh"
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/createAnonScorecards.sh

@@ -0,0 +1,3 @@
+source "scripts/verifyBenchmarkPluginAvailable.sh"
+mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard -DconfigFile=data/anonymousScoringConfig.yaml
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/createScorecards.bat

@@ -0,0 +1,4 @@
+# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
+#mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard -DconfigFile=config/score_v1.3config.yaml
+call mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/createScorecards.sh

@@ -0,0 +1,4 @@
+source "scripts/verifyBenchmarkPluginAvailable.sh"
+#mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard -DconfigFile=config/score_v1.3config.yaml
+mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard
+

owasp_9_cwe_wise/OWASP9_CWE_22/BenchmarkJava/data/anonymousScoringConfig.yaml

@@ -0,0 +1,4 @@
+# This configuration simply enables anonymous scoring mode
+
+anonymousmode: true # If true, anonymize names of commercial tools
+