AppScan Source测试ExploitMe Mobile Android Labs项目.docx

TODO：分析一下误报率、漏报率Android SDK 的Eclipse安装AppScan Source插件：AppDOS.readLine（通过readLine造成DoS攻击）Collection:kbarticles/content/nl_en/File:kbarticles/content/nl_en/Java/AppDOS.readLine.articleID:kbarticles/content/nl_en/Java/AppDOS.readLineExportBufferedReader.readLine() is susceptible to application Denial of Service (DoS) attacks because it reads input until the end-of-line is reached. A line is considered to be terminated by any one of a line feed (\n), a carriage return (\r), or a carriage return followed immediately by a linefeed (\r\n). If the provided input stream does not contain any of these terminators, this method will continue reading input and dynamically growing its input buffer until all heap space is exhausted, causing an OutOfMemory exception and stopping the Java Virtual Machine (JVM) and the application. Using this vulnerability, attackers can launch a DoS attack against the application by providing a very large input file with no end-of-line terminators. Presumably, files native to the servers local file system are not maliciously constructed, so readLine() is only a serious DoS threat when processing user-uploaded data or a custom (non-HTTP) network protocol input stream. MitigationThe recommended solution is to use a method that enforces a read length limit, such as BufferedReader.read()ExampleString getHelpContents( String fileName ){BufferedReader reader;StringBuffersb = new StringBuffer();try{reader = new BufferedReader( new FileReader( help.txt ));String line;while (( line = reader.readLine() ) != null ){sb.append( line );}}catch ( Exception e ){// Handle error}finally{reader.close();}returnsb.toString();}ExampleIf you intend to load the entire help file into memory, use read(char[], int, int) in a loop instead, and then parse lines from the character buffer as needed. String getHelpContents( String fileName ){finalint MAX_SIZE = 200000;char[] buffer = new char[MAX_SIZE];BufferedReader reader;try{reader = new BufferedReader( new FileReader( help.txt