[Yasca] element index

All elements
a b c d e f g h i j l m n o p r s t u v x y _
_
top
_Error-Handling.Catch.Empty.php
_Error-Handling.Catch.Empty.php in _Error-Handling.Catch.Empty.php
_StrutsValidator.php
_StrutsValidator.php in _StrutsValidator.php
_Lint4J.php
_Lint4J.php in _Lint4J.php
__construct
a
top
$acceptable_urls
$adjustment_list
Adjusted information for various plugins. Used so we don't have to modify the original plugins.
$age
Cache::$age in cache.php
$attachment_list
This list contains all attachment references to the general cache
add_attachment
Adds an attachment to the attachment list. Only allows attachment that are represented in the general cache.
array2json
XMLReport::array2json() in XMLReport.php
Antic.php
Antic.php in Antic.php
Authentication.Weak.php
Authentication.Weak.php in Authentication.Weak.php
AllTargetsFinder.php
AllTargetsFinder.php in AllTargetsFinder.php
b
top
base64_decode_safe
base64_decode_safe() in common.php
Decodes a string in a format similar to base64.
base64_encode_safe
base64_encode_safe() in common.php
Encodes a string in a format similar to base64, but that can be used as a filename.
BasicSummaryReport.php
BasicSummaryReport.php in BasicSummaryReport.php
c
top
$cache
Yasca::$cache in Yasca.php
$CACHE_ID
$CACHE_ID
Plugin_AllTargetsFinder::$CACHE_ID in AllTargetsFinder.php
Unique ID used by this plugin to refer to the general cache.
$CACHE_ID
Plugin_BasicSummaryGrid::$CACHE_ID in BasicSummaryReport.php
$category
Result::$category in Result.php
$category
$category_link
$category_link
$context_size
Plugin::$context_size in Plugin.php
How many lines to include in the context returned.
$custom
Result::$custom in Result.php
Cache
Cache in cache.php
calculate_signature
Signs a piece of data using a hash. Uses SHA-1 to hash the data.
check_for_java
Checks for the current version of Java. The version must be greater than or equal to 1.4, or else the function will return true.
check_in_filetype
check_in_filetype() in common.php
Checks to see if the given filename has a passed extension. $filename does not have to be an actual existing file.
collapse_dir
collapse_dir() in common.php
This function takes all files under $start_dir and places them in
contains
Cache::contains() in cache.php
create_output_handle
Creates an output handle to write the report to. If the requested file is not writeable, the same filename will be attempted to be placed in the temporary directory.
CSVReport
CSVReport in CSVReport.php
CSVReport Class
custom_error_handler
cache.php
cache.php in cache.php
common-analysis.php
common-analysis.php in common-analysis.php
common.php
common.php in common.php
CSVReport.php
CSVReport.php in CSVReport.php
Code-Quality.JavaScript.Obfuscated.php
Code-Quality.JavaScript.Obfuscated.php in Code-Quality.JavaScript.Obfuscated.php
Code-Quality.Null.Redundant.php
Code-Quality.Null.Redundant.php in Code-Quality.Null.Redundant.php
Code-Quality.Resource-Leak.GETMAIN.php
Code-Quality.Resource-Leak.GETMAIN.php in Code-Quality.Resource-Leak.GETMAIN.php
d
top
$data
Cache::$data in cache.php
$data_age
Cache::$data_age in cache.php
$data_size
Cache::$data_size in cache.php
$default_extension
The default extension used for reports of this type.
$default_extension
The default extension used for reports of this type.
$default_extension
The default extension used for reports of this type.
$default_extension
The default extension used for reports of this type.
$default_extension
The default extension used for reports of this type.
$default_extension
The default extension used for reports of this type.
$description
Result::$description in Result.php
$description
$description
Plugin::$description in Plugin.php
Description of this plugin (what it looks for, why it's important, how to remediate.
destructor
Plugin::destructor() in Plugin.php
This function is called to de-allocate as much of the object as possible.
DetailedReport
DetailedReport in DetailedReport.php
DetailedReport Class
dir_recursive
Recursive directory listing. Returns all files starting at $start_dir.
DetailedReport.php
DetailedReport.php in DetailedReport.php
e
top
$event_callback_list
Holds the event array for callbacks
ellipsize
ellipsize() in common.php
endsWith
endsWith() in common.php
error2string
error2string() in yasca.php
Converts an error value to a string.
evict
Cache::evict() in cache.php
execute
Executes the PMD function. This calls out to pmd.bat which then calls Java, but process output comes back here.
execute
Report::execute() in Report.php
The execute function renders the particular report. Since this is is an abstract class, this function should never actually be called, but should be overriden by a subclass.
execute
Plugin::execute() in Plugin.php
This function should not be called, since this class is abstract. The execute() function should be overridden by child classes.
execute
Plugin_links_external::execute() in Links.External.php
execute
execute
Plugin_struts_membernotreset::execute() in Struts.MemberNotReset.php
execute
Plugin_logging_logviewer::execute() in Logging.LogViewer.php
execute
execute
XMLReport::execute() in XMLReport.php
Executes an XMLReport, with output going to $options['output']
execute
execute
Plugin_StrutsValidator::execute() in _StrutsValidator.php
execute
Plugin_injection_xss_println::execute() in Injection.XSS.Println.php
execute
Plugin_error_handling_catch_empty::execute() in _Error-Handling.Catch.Empty.php
execute
Plugin_struts_noresetfunction::execute() in Struts.NoResetFunction.php
execute
Plugin_information_disclosure_email_external::execute() in Information-Disclosure.Email.External.php
execute
Plugin_code_quality_null_redundant::execute() in Code-Quality.Null.Redundant.php
execute
Plugin_code_quality_resource_leak_getmain::execute() in Code-Quality.Resource-Leak.GETMAIN.php
execute
CSVReport::execute() in CSVReport.php
Executes a CSVReport, with output going to $options['output']
execute
Plugin_code_quality_javascript_obfuscated::execute() in Code-Quality.JavaScript.Obfuscated.php
Executes the plugin to scan a particular file. Uses a cache to speed things up.
execute
Plugin_BasicSummaryGrid::execute() in BasicSummaryReport.php
execute
execute
Plugin_authentication_weak::execute() in Authentication.Weak.php
execute
Plugin_injection_xss_jsp::execute() in Injection.XSS.JSP.php
execute
DetailedReport::execute() in DetailedReport.php
Executes a DetailedReport, with output going to $options['output']
execute
HTMLReport::execute() in HTMLReport.php
Executes an HTMLReport, with output going to $options['output']
execute
Plugin_AllTargetsFinder::execute() in AllTargetsFinder.php
Executes this plugin, scanning for files, placing them into an attachment.
execute
HTMLGroupReport::execute() in HTMLGroupReport.php
Executes an HTMLReport, with output going to $options['output']
execute
execute
Plugin_file_system_temporary_files::execute() in File-System.Temporary-Files.php
execute
Executes the scanning function. This calls out to findbugs.bat which then calls Java, but process output comes back here.
execute
Plugin_file_system_non_current_libraries::execute() in File-System.Non-Current-Libraries.php
Executes the plugin to scan a particular file. Uses a cache to speed things up.
execute_callback
Executes callbacks for a particular event.
f
top
$filename
Result::$filename in Result.php
$filename
Plugin::$filename in Plugin.php
Holds the filename that this Plugin happens to be working on.
$file_contents
Holds the file contents that this Plugin is working on. This can be either an array of strings or just a \n-separated string, in which case it will be exploded when the object is created.
$file_type
FILE_APPEND
FILE_APPEND in common.php
file_put_contents
file_put_contents() in common.php
find_matching_prefix_length
find_member_variables
find_member_variables() in common-analysis.php
Finds non-static member variables of a class.
find_similar_text
find_similar_text() in common.php
find_target_by_relative_name
Attempts to find a target that matches the relative name supplied.
flatten_array
flatten_array() in common.php
fnmatch
fnmatch() in common.php
File-System.Non-Current-Libraries.php
File-System.Non-Current-Libraries.php in File-System.Non-Current-Libraries.php
File-System.Temporary-Files.php
File-System.Temporary-Files.php in File-System.Temporary-Files.php
FindBugs.php
FindBugs.php in FindBugs.php
g
top
$general_cache
The general_cache array contains arrays of data to be cached. Read-Write by anyone.
$grep
Plugin_Grep::$grep in Grep.php
generate_attachment_list
Generates a list of DIVs that contain the attachment contents.
generate_attachment_select_box
Generates a dropdown select box to choose a particular attachment to show.
get
Cache::get() in cache.php
getInstance
Gets the singleton instance of the Yasca object
get_adjusted_alternate_name
Gets the adjusted alternate name for a specific plugin.
get_adjusted_description
Gets the adjusted description of the finding.
get_adjusted_severity
Gets the adjusted severity for a specific plugin.
get_adjustment
Retrieves a specific adjustment.
get_class_from_file
get_class_from_file() in common.php
Extracts class name from a file.
get_file_contents
get_method_contents
get_method_contents() in common-analysis.php
Gets method contents from a specific file.
get_owasp_vulnerability_content
Loads an external vulnerability from OWASP
get_postamble
get_postamble
HTMLGroupReport::get_postamble() in HTMLGroupReport.php
get_postamble
DetailedReport::get_postamble() in DetailedReport.php
get_postamble
get_postamble
HTMLReport::get_postamble() in HTMLReport.php
get_preamble
CSVReport::get_preamble() in CSVReport.php
get_preamble
DetailedReport::get_preamble() in DetailedReport.php
get_preamble
HTMLGroupReport::get_preamble() in HTMLGroupReport.php
get_preamble
HTMLReport::get_preamble() in HTMLReport.php
get_preamble
XMLReport::get_preamble() in XMLReport.php
get_report_extension
Finds the actual extension to be used for the report chosen. Includes the period (.).
get_rulesets
Gets the specific rulesets to be included. The rule is that any plugin that has an .xml extension is fair game, except for those starting with an underscore (_).
get_severity_description
Translated a severity number into a description.
Grep.php
Grep.php in Grep.php
h
top
help
Yasca::help() in Yasca.php
Returns the help message (used in console mode.
HTMLGroupReport
HTMLGroupReport in HTMLGroupReport.php
HTMLGroupReport Class
HTMLReport
HTMLReport in HTMLReport.php
HTMLReport Class
html_header
HTMLGroupReport.php
HTMLGroupReport.php in HTMLGroupReport.php
HTMLReport.php
HTMLReport.php in HTMLReport.php
i
top
$initialized
Plugin::$initialized in Plugin.php
Internal variable set to true at the end of the constructor.
$instance
Yasca::$instance in Yasca.php
$invalid_file_types
$invalid_file_types
$is_multi_target
$is_multi_target
True iff this object is to be only invoked once. The object itself should prevent multiple executions.
$is_multi_target
This class is multi-target.
$is_multi_target
$is_multi_target
$is_multi_target
This plugin is multi-target, only run once.
$is_multi_target
This class is multi-target.
$is_multi_target
$is_source_code
$is_valid_filetype
True iff this object was initialized (i.e. has a valid extension)
include_plugins
Finds and includes all plugins.
initialize
Re-initializes the variables back to their original state.
initialize_cache
Plugin_file_system_non_current_libraries::initialize_cache() in File-System.Non-Current-Libraries.php
This function initializes the cache from a text file that was presumably loaded by a separate process. The file contains a list of jar files that are considered "current". Any jar file that is not in that list is considered non-standard or non-current.
instantiate_report
Instantiates a new Report object based on the data passed in.
is_severity_sufficient
Tests whether the severity is sufficient to warrant including in the output.
Injection.XSS.JSP.php
Injection.XSS.JSP.php in Injection.XSS.JSP.php
Injection.XSS.Println.php
Injection.XSS.Println.php in Injection.XSS.Println.php
Information-Disclosure.Email.External.php
Information-Disclosure.Email.External.php in Information-Disclosure.Email.External.php
j
top
JLint.php
JLint.php in JLint.php
l
top
$library_cache
Plugin_file_system_non_current_libraries::$library_cache in File-System.Non-Current-Libraries.php
$line_number
Result::$line_number in Result.php
$lookahead_length
load_adjustments
Loads all of the adjustments from resources/adjustments.xml.
log_message
This is the main error log and event log for the application. Depending on
Logging.LogViewer.php
Logging.LogViewer.php in Logging.LogViewer.php
Links.External.php
Links.External.php in Links.External.php
m
top
$max_size
Cache::$max_size in cache.php
main
main() in yasca.php
Main entry point for the Yasca engine.
memory_get_usage
memory_get_usage() in common.php
mime_extract_rfc2822_address
n
top
$name
Plugin_Grep::$name in Grep.php
o
top
$options
Yasca::$options in Yasca.php
Options parsed from the command line.
$options
Report::$options in Report.php
Options parsed from the command line.
p
top
$pattern_list
Plugin_file_system_temporary_files::$pattern_list in File-System.Temporary-Files.php
$plugin_file_list
$plugin_list
Yasca::$plugin_list in Yasca.php
The list of available plugin functions.
$plugin_name
Result::$plugin_name in Result.php
$progress_callback
Plugin.php
Plugin.php in Plugin.php
parse_command_line_arguments
Parses the command line arguments (argc, argv).
Plugin
Plugin::Plugin() in Plugin.php
Creates a new generic Plugin.
Plugin
Plugin in Plugin.php
Plugin Class
PMD.php
PMD.php in PMD.php
Plugin_AllTargetsFinder
Plugin_AllTargetsFinder in AllTargetsFinder.php
This class looks for all scanned files, placing them in an attachment.
Plugin_Antic
Plugin_Antic in Antic.php
The Antic Plugin uses Antic to discover potential vulnerabilities in Java or C/C++ files.
Plugin_authentication_weak
Plugin_authentication_weak in Authentication.Weak.php
This class looks for weak authentication values, where *.username = *.password.
Plugin_BasicSummaryGrid
Plugin_BasicSummaryGrid in BasicSummaryReport.php
This plugin creates a basic summary grids and adds it as an attachment to the report.
Plugin_code_quality_javascript_obfuscated
Plugin_code_quality_javascript_obfuscated in Code-Quality.JavaScript.Obfuscated.php
This class looks for obfuscated JavaScript.
Plugin_code_quality_null_redundant
Plugin_code_quality_null_redundant in Code-Quality.Null.Redundant.php
This class looks for cases in code like this:
Plugin_code_quality_resource_leak_getmain
Plugin_code_quality_resource_leak_getmain in Code-Quality.Resource-Leak.GETMAIN.php
This class looks for GETMAIN/FREEMAIN resource leaks in COBOL source code.
Plugin_error_handling_catch_empty
Plugin_error_handling_catch_empty in _Error-Handling.Catch.Empty.php
This class looks for empty catch blocks: try { ...
Plugin_file_system_non_current_libraries
Plugin_file_system_non_current_libraries in File-System.Non-Current-Libraries.php
This class looks for library files (.jar, .so, .dll) that are not of the latest version, or not known at all. Uses resources/current_libraries/*.
Plugin_file_system_temporary_files
Plugin_file_system_temporary_files in File-System.Temporary-Files.php
This class looks for temporary files.
Plugin_FindBugs
Plugin_FindBugs in FindBugs.php
The FindBugs Plugin uses the open source tool FindBugs to discover potential vulnerabilities in compiled Java code.
Plugin_Grep
Plugin_Grep in Grep.php
The Grep Plugin is a special plugin that faciliates .grep psuedo-plugins, which are just files in the PLUGINS directory that contain necessary information to scan the target files.
Plugin_information_disclosure_email_external
Plugin_information_disclosure_email_external in Information-Disclosure.Email.External.php
This class looks for e-mail addresses that aren't UBS ones.
Plugin_injection_xss_jsp
Plugin_injection_xss_jsp in Injection.XSS.JSP.php
This class looks for XSS vulnerabilities of the form: String foo = request.getParameter("foo"); ...
Plugin_injection_xss_println
Plugin_injection_xss_println in Injection.XSS.Println.php
This class looks for XSS vulnerabilities of the form: String foo = request.getParameter("foo"); ...
Plugin_JLint
Plugin_JLint in JLint.php
The JLint Plugin uses JLint to discover potential vulnerabilities in .class files.
Plugin_links_external
Plugin_links_external in Links.External.php
This class looks for external links (to non-UBS resources).
Plugin_Lint4J
Plugin_Lint4J in _Lint4J.php
The Lint4J Plugin uses Lint4J to discover potential vulnerabilities in .class files.
Plugin_logging_logviewer
Plugin_logging_logviewer in Logging.LogViewer.php
This class looks for Java source code that might indicate an online log viewer.
Plugin_PMD
Plugin_PMD in PMD.php
The PMD Plugin uses PMD to discover potential vulnerabilities in .java files.
Plugin_StrutsValidator
Plugin_StrutsValidator in _StrutsValidator.php
This class looks finds all calls to request.getParameter, extracts all of the variable names, and puts them in a spreadsheet.
Plugin_struts_membernotreset
Plugin_struts_membernotreset in Struts.MemberNotReset.php
This class looks for ActionMapping classes that do not reset all member variables.
Plugin_struts_noresetfunction
Plugin_struts_noresetfunction in Struts.NoResetFunction.php
This class looks for ActionMapping classes that do not have reset() functions.
Plugin_URLFinder
Plugin_URLFinder in URLFinder.php
This class looks for all URLs located in the source code.
profile
profile() in yasca.php
Function profiler for PHP.
put
Cache::put() in cache.php
put_file_contents
r
top
$results
Yasca::$results in Yasca.php
The results of the scan.
$results
Report::$results in Report.php
The results of the scan.
$result_list
Plugin::$result_list in Plugin.php
Holds the results of the scan.
Report.php
Report.php in Report.php
Result.php
Result.php in Result.php
random_string
random_string() in common.php
Generates a random alphanumeric string.
register_callback
Registers a callback function to be executed at some time. Valid events are:
Report
Report::Report() in Report.php
Report
Report in Report.php
Report Class
report_callback
Callback function for turning the URL list into an HTML table.
report_callback
Callback function for turning the URL list into an HTML table.
Result
Result in Result.php
Result Class
result_list_comparator
Compares results to sort them by severity.
result_list_comparator
Compares results to sort them by severity.
run
Plugin::run() in Plugin.php
Starts execution of the specific plugin. Calls the overridden method of child classes to perform the scan. This function just wraps that.
s
top
$severity
Result::$severity in Result.php
$severity
$size
Cache::$size in cache.php
$source
Result::$source in Result.php
$source_context
Struts.MemberNotReset.php
Struts.MemberNotReset.php in Struts.MemberNotReset.php
Struts.NoResetFunction.php
Struts.NoResetFunction.php in Struts.NoResetFunction.php
scan
Yasca::scan() in Yasca.php
This function initiaates the scan. After checking various things, it passes execution along to each of the plugins available, on each of the target files available.
startsWith
startsWith() in common.php
Does the provided string start with a specific substring? Case sensitive.
stripos
stripos() in common.php
strripos
strripos() in common.php
substr_in_array
substr_in_array() in common.php
Checks to see if $needle is anywhere within any of the components of $haystack.
sys_get_temp_dir
sys_get_temp_dir() in common.php
t
top
$target_list
Yasca::$target_list in Yasca.php
The target list of files to scan.
to_array
Cache::to_array() in cache.php
u
top
$union_valid_file_types
$use_digital_signature
Include a digital signature in the report file?
URLFinder.php
URLFinder.php in URLFinder.php
unlink_recursive
unlink_recursive() in common.php
v
top
$valid_domain_list
Plugin_information_disclosure_email_external::$valid_domain_list in Information-Disclosure.Email.External.php
$valid_file_types
Valid file types that this Plugin can operate on.
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
Plugin_error_handling_catch_empty::$valid_file_types in _Error-Handling.Catch.Empty.php
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
Plugin_code_quality_javascript_obfuscated::$valid_file_types in Code-Quality.JavaScript.Obfuscated.php
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
$valid_file_types
Plugin_code_quality_resource_leak_getmain::$valid_file_types in Code-Quality.Resource-Leak.GETMAIN.php
$valid_file_types
$valid_file_types
$valid_file_types
Plugin_file_system_non_current_libraries::$valid_file_types in File-System.Non-Current-Libraries.php
$valid_file_types
Plugin_information_disclosure_email_external::$valid_file_types in Information-Disclosure.Email.External.php
$valid_file_types
$valid_file_types
validate_report
Validates whether a report content has a valid hash.
validate_signature
Validates if a signature has been tampered with. Uses calculate_signature() to re-calculate the signature.
VERSION
VERSION in Yasca.php
x
top
XMLReport.php
XMLReport.php in XMLReport.php
XMLReport
XMLReport in XMLReport.php
XMLReport Class
y
top
Yasca.php
Yasca.php in Yasca.php
Yasca
Yasca::Yasca() in Yasca.php
Creates a new Yasca scanner object using the options passed in.
Yasca
Yasca in Yasca.php
This class implements a generic code scanner.
yasca.php
yasca.php in yasca.php
a b c d e f g h i j l m n o p r s t u v x y _