## log4shell false positive

This is a simple web project with a sanitised log4shell vulnerability. For an unsanitised version, see [](
The project defines a simple `scabench.HelloWorldService` get service returning a plain text string `hello world`.
The service does not expect parameters, and if parameters are encountered, an error 
is logged. 

The vulnerable dependency is [org.apache.logging.log4j:log4j-core:2.14.1](, the vulnerability is [CVE-2021-44228]( 

### Sanitisation

The project uses an [agent build by Amazon]( when *log4shell* emerged and no patch was available.
The agent will disable the vulnerable class `org.apache.logging.log4j.core.lookup.JndiLookup`. 

Using the agent is enforced by installing (aka attaching) the agent dynamically when `scabench.HelloWorldService` is loaded (in the static block of the class), 
if this fails, the application crashes. This requires that the JVM enables agent self-attachment.

### Running the Application

1. enable JVM agent self attachment: `export MAVEN_OPTS="-Djdk.attach.allowAttachSelf=true"`
2. start the embedded web server: `mvn jetty:run`
3. start the included the ldap server: `java -jar dodgy-ldap-server.jar` (the vulnerable copde will download Java code from this server)
4. point the browser to `http://localhost:8080/`, this site contains a pre-populated form with a malicious payload `${jndi:ldap://}`
5. submit this form
6. this will *NOT* create the file `foo` on the server (as the [un-sanitised version](( does)

Note that when running the application, the following line appears on the console:

`Transforming org/apache/logging/log4j/core/lookup/JndiLookup `.

### Demonstrating the Sanitisation using a Test

This requires unix or macos. It is easy to port this project to windows.
A unit test is provided to demonstrate the vulnerability, the setup is the same used in 
[]( Due to santitisation,
the test now *fails*. 

### Running Software Composition Analyses

There are several sh scripts to run different analyses, result resports can be found in `scan-results`.

### Generating the SBOM

The `pom.xml` has a plugin to generate a [SBOM]( in [CycloneDX]( format. 
To do this, run `mvn cyclonedx:makePackageBom`, the SBOM can be found in 
`target/` in `json` and `xml` format.