노현종 / 2018-1-Capstone1-VulnNotti

Go to a project
Toggle navigation Toggle navigation pinning
노현종
99620979 1 parent 7e21fc12

파이썬 CVE 취약 코드 발견 후 패치 이전 코드 수집중

Inline Side-by-side
Showing 3 changed files with 186 additions and 1 deletions
1 -using System; 1 +using LibGit2Sharp;
2 +using System;
2 using System.Collections.Generic; 3 using System.Collections.Generic;
4 +using System.IO;
3 using System.Linq; 5 using System.Linq;
4 using System.Text; 6 using System.Text;
7 +using System.Text.RegularExpressions;
5 using System.Threading.Tasks; 8 using System.Threading.Tasks;
6 9
7 namespace VulnCrawler 10 namespace VulnCrawler
...@@ -9,7 +12,171 @@ namespace VulnCrawler ...@@ -9,7 +12,171 @@ namespace VulnCrawler
9 class Program 12 class Program
10 { 13 {
11 static void Main(string[] args) { 14 static void Main(string[] args) {
15 + //if (Directory.Exists(@"c:\test")) {
16 + // DeleteDirectory(@"c:\test");
17 +
18 + //}
19 +
20 + //var co = new CloneOptions {
21 + // OnCheckoutProgress = CheckoutProcess,
22 + // OnTransferProgress = TransferProgress,
23 +
24 + // CredentialsProvider = (_url, _user, _cred) => new UsernamePasswordCredentials { Username = "yhackerbv@gmail.com", Password = "@@GUSwjdaf12@@" }
25 +
26 + //};
27 +
28 + //Repository.Clone("https://github.com/torvalds/linux.git", @"\test\", co);
29 + using (var r = new Repository(@"c:\test2")) {
30 + var commits = r.Commits
31 + .Where(c => Regex.Match(c.Message, @"CVE-20\d\d-\d{4}", RegexOptions.IgnoreCase).Success)
32 + //.Where(c => c.Message.IndexOf("CVE-20",
33 + //StringComparison.CurrentCultureIgnoreCase) >= 0)
34 + .ToList();
35 + Console.WriteLine(commits.Count);
36 + foreach (var commit in commits) {
37 +
38 + string message = commit.Message;
39 + Console.ForegroundColor = ConsoleColor.Yellow;
40 + Console.WriteLine($"Commit Message: {message}");
41 + Console.ResetColor();
42 + foreach (var parent in commit.Parents) {
43 + var patch = r.Diff.Compare<Patch>(parent.Tree, commit.Tree, new CompareOptions { });
44 +
45 + var entrys = patch.Where(e => e.Path.EndsWith(".py"));
46 + foreach (var entry in entrys) {
47 +
48 + Console.ForegroundColor = ConsoleColor.Blue;
49 + Console.WriteLine($"status: {entry.Status.ToString()}");
50 + Console.WriteLine($"added: {entry.LinesAdded.ToString()}, deleted: {entry.LinesDeleted.ToString()}");
51 + Console.WriteLine($"old path: {entry.OldPath.ToString()}, new path: {entry.Path.ToString()}");
52 + Console.ResetColor();
53 + var oldOid = entry.OldOid;
54 + Blob oldBlob = r.Lookup<Blob>(oldOid);
55 + string oldContent = oldBlob.GetContentText();
56 +
57 + var newOid = entry.Oid;
58 + Blob newBlob = r.Lookup<Blob>(newOid);
59 + string newContent = newBlob.GetContentText();
60 +
61 +
62 +
63 + //ContentChanges changes = r.Diff.Compare(oldBlob, newBlob);
64 +
65 + // Console.WriteLine(changes.Patch);
66 +
67 + // @@ -290,8 + 290,12 @@ def i
68 + // @@ -290,8 +290,12 @@ def is_safe_url(url, host=None):
69 + var regs = Regex.Matches(entry.Patch, @"@@ \-(?<oldStart>\d+),(?<oldLines>\d+) \+(?<newStart>\d+),(?<newLines>\d+) @@ def (?<methodName>\w+)");
70 +
71 +
72 +
73 + if (regs.Count > 0) {
74 + Console.BackgroundColor = ConsoleColor.DarkBlue;
75 + Console.WriteLine($"Old Content: \n{oldContent}");
76 + Console.ResetColor();
77 +
78 + Console.BackgroundColor = ConsoleColor.DarkMagenta;
79 + Console.WriteLine($"New Content: \n{newContent}");
80 + Console.ResetColor();
81 +
82 +
83 + Console.BackgroundColor = ConsoleColor.DarkRed;
84 +
85 + Console.WriteLine($"Patched: \n{entry.Patch}");
86 +
87 + Console.ResetColor();
88 + Console.WriteLine("-----------");
89 + Console.WriteLine(regs.Count);
12 90
13 } 91 }
92 +
93 + foreach (var reg in regs) {
94 + var match = reg as Match;
95 + int.TryParse(match.Groups["oldStart"].Value, out int oldStart);
96 + int.TryParse(match.Groups["oldLines"].Value, out int oldLines);
97 + string methodName = match.Groups["methodName"].Value;
98 +
99 + Console.WriteLine(match.Groups["oldStart"].Value);
100 + Console.WriteLine(match.Groups["oldLines"].Value);
101 + Console.WriteLine(match.Groups["newStart"].Value);
102 + Console.WriteLine(match.Groups["newLines"].Value);
103 + Console.WriteLine(match.Groups["methodName"].Value);
104 + StringBuilder oldBuilder = new StringBuilder();
105 + using (var reader = new StreamReader(oldBlob.GetContentStream())) {
106 + int readCount = 0;
107 + while (!reader.EndOfStream && readCount <= oldStart + oldLines) {
108 + string line = reader.ReadLine();
109 +
110 + if (readCount++ >= oldStart) {
111 + oldBuilder.AppendLine(line);
112 + }
113 + }
114 +
115 + //bool found = false;
116 + //while (!reader.EndOfStream) {
117 +
118 + // string line = reader.ReadLine();
119 +
120 + // if (line.Contains(string.Join("def ", methodName))) {
121 +
122 + // }
123 +
124 + // if (found) {
125 +
126 + // }
127 + //}
128 + }
129 +
130 + string replace = Regex.Replace(oldBuilder.ToString(), "\t", "");
131 +
132 + Console.WriteLine($"Builder: \n{replace}");
133 +
134 + }
135 + Console.WriteLine("-----------");
136 + Console.ResetColor();
137 + }
138 + //Console.WriteLine(patch.Content);
139 + }
140 +
141 + Console.WriteLine($"Commit {commit.Sha} 추출 완료");
142 + // Task.Delay(1000).Wait();
143 + //break;
144 + }
145 + }
146 + }
147 + public static void DeleteDirectory(string targetDir) {
148 + File.SetAttributes(targetDir, FileAttributes.Normal);
149 +
150 + string[] files = Directory.GetFiles(targetDir);
151 + string[] dirs = Directory.GetDirectories(targetDir);
152 +
153 + foreach (string file in files) {
154 + File.SetAttributes(file, FileAttributes.Normal);
155 + File.Delete(file);
156 + }
157 +
158 + foreach (string dir in dirs) {
159 + DeleteDirectory(dir);
160 + }
161 +
162 + Directory.Delete(targetDir, false);
163 + }
164 + public static bool TransferProgress(TransferProgress progress) {
165 + int totalBytes = progress.TotalObjects;
166 + int receivedBytes = progress.ReceivedObjects;
167 + long receivedTotal = progress.ReceivedBytes;
168 + double received = progress.ReceivedBytes / 1000000;
169 + double percent = ((double)receivedBytes / (double)totalBytes) * 10;
170 +
171 + Console.WriteLine($"진행률: {percent.ToString("P2")}, 남은 파일: {receivedBytes} of {totalBytes}"); //, 받은 용량: {received.ToString()}MB");
172 + Console.ForegroundColor = ConsoleColor.DarkGreen;
173 + return true;
174 + }
175 +
176 + public static void CheckoutProcess(string path, int completedSteps, int totalSteps) {
177 + Console.WriteLine($"{completedSteps}, {totalSteps}, {path}");
178 + }
179 +
180 +
14 } 181 }
15 } 182 }
......
1 <?xml version="1.0" encoding="utf-8"?> 1 <?xml version="1.0" encoding="utf-8"?>
2 <Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> 2 <Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 + <Import Project="..\packages\LibGit2Sharp.NativeBinaries.1.0.210\build\net461\LibGit2Sharp.NativeBinaries.props" Condition="Exists('..\packages\LibGit2Sharp.NativeBinaries.1.0.210\build\net461\LibGit2Sharp.NativeBinaries.props')" />
3 <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" /> 4 <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
4 <PropertyGroup> 5 <PropertyGroup>
5 <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration> 6 <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
...@@ -11,6 +12,8 @@ ...@@ -11,6 +12,8 @@
11 <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion> 12 <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
12 <FileAlignment>512</FileAlignment> 13 <FileAlignment>512</FileAlignment>
13 <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects> 14 <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
15 + <NuGetPackageImportStamp>
16 + </NuGetPackageImportStamp>
14 </PropertyGroup> 17 </PropertyGroup>
15 <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' "> 18 <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
16 <PlatformTarget>AnyCPU</PlatformTarget> 19 <PlatformTarget>AnyCPU</PlatformTarget>
...@@ -32,6 +35,9 @@ ...@@ -32,6 +35,9 @@
32 <WarningLevel>4</WarningLevel> 35 <WarningLevel>4</WarningLevel>
33 </PropertyGroup> 36 </PropertyGroup>
34 <ItemGroup> 37 <ItemGroup>
38 + <Reference Include="LibGit2Sharp, Version=0.25.0.0, Culture=neutral, PublicKeyToken=7cbde695407f0333, processorArchitecture=MSIL">
39 + <HintPath>..\packages\LibGit2Sharp.0.25.0\lib\netstandard2.0\LibGit2Sharp.dll</HintPath>
40 + </Reference>
35 <Reference Include="System" /> 41 <Reference Include="System" />
36 <Reference Include="System.Core" /> 42 <Reference Include="System.Core" />
37 <Reference Include="System.Xml.Linq" /> 43 <Reference Include="System.Xml.Linq" />
...@@ -47,6 +53,13 @@ ...@@ -47,6 +53,13 @@
47 </ItemGroup> 53 </ItemGroup>
48 <ItemGroup> 54 <ItemGroup>
49 <None Include="App.config" /> 55 <None Include="App.config" />
56 + <None Include="packages.config" />
50 </ItemGroup> 57 </ItemGroup>
51 <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" /> 58 <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
59 + <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
60 + <PropertyGroup>
61 + <ErrorText>이 프로젝트는 이 컴퓨터에 없는 NuGet 패키지를 참조합니다. 해당 패키지를 다운로드하려면 NuGet 패키지 복원을 사용하십시오. 자세한 내용은 http://go.microsoft.com/fwlink/?LinkID=322105를 참조하십시오. 누락된 파일은 {0}입니다.</ErrorText>
62 + </PropertyGroup>
63 + <Error Condition="!Exists('..\packages\LibGit2Sharp.NativeBinaries.1.0.210\build\net461\LibGit2Sharp.NativeBinaries.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\LibGit2Sharp.NativeBinaries.1.0.210\build\net461\LibGit2Sharp.NativeBinaries.props'))" />
64 + </Target>
52 </Project> 65 </Project>
...\ No newline at end of file ...\ No newline at end of file
......
1 +<?xml version="1.0" encoding="utf-8"?>
2 +<packages>
3 + <package id="LibGit2Sharp" version="0.25.0" targetFramework="net461" />
4 + <package id="LibGit2Sharp.NativeBinaries" version="1.0.210" targetFramework="net461" />
5 +</packages>
...\ No newline at end of file ...\ No newline at end of file