Fix the hardcoded cookie value, which was might have been discarded as being outside the acceptable time window by the flask frontend and thus lead to false negatives.

PiperOrigin-RevId: 929186392
Change-Id: I566d5a338fb6f32a013e046d8ac8b216aff5cec4

Author: paradoxengine

community/detectors/apache_airflow_cve_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

@@ -50,11 +50,13 @@
 import com.google.tsunami.proto.Vulnerability;
 import com.google.tsunami.proto.VulnerabilityId;
 import java.io.IOException;
+import java.math.BigInteger;
 import java.net.HttpCookie;
 import java.net.URLEncoder;
 import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
+import java.util.Base64;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -200,6 +202,38 @@ private boolean isServiceVulnerable(NetworkService networkService) {
     }
   }
 
+  private String toTimestamp(long l) {
+    if (l < 0) {
+      throw new IllegalArgumentException("Timestamp must be non-negative");
+    }
+    if (l == 0) {
+      return "";
+    }
+    byte[] bytes = BigInteger.valueOf(l).toByteArray();
+    // Flask uses the base64 library to sign session cookies, which encodes timestamps
+    // by taking the Unix epoch seconds, converting it to the minimal number of bytes
+    // in big-endian order, and then encoding those bytes using URL-safe Base64.
+    //
+    // The equivalent of Python's `int_to_bytes` in Java is tricky. `BigInteger.toByteArray()`
+    // produces a two's-complement representation in big-endian order. For positive numbers,
+    // this representation must have a 0 sign bit. If a positive number's minimal byte
+    // representation would start with a byte >= 0x80 (i.e., MSB is 1), `toByteArray()`
+    // prepends an extra 0x00 byte to ensure the number is interpreted as positive.
+    //
+    // For example, timestamp 2147483648 (0x80000000) is encoded by base64 using 4 bytes
+    // `\x80\x00\x00\x00`, but `BigInteger.toByteArray()` returns 5 bytes: `\x00\x80\x00\x00\x00`.
+    //
+    // Since base64 does not expect this leading 0x00, we must remove it when present
+    // to ensure compatibility. The condition `bytes[0] == 0 && bytes.length > 1` detects
+    // and removes this extra byte.
+    if (bytes[0] == 0 && bytes.length > 1) {
+      byte[] tmp = new byte[bytes.length - 1];
+      System.arraycopy(bytes, 1, tmp, 0, bytes.length - 1);
+      bytes = tmp;
+    }
+    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+  }
+
   private Map<String, String> getFreshCsrfTokenAndSessionCookie(NetworkService networkService)
       throws IOException {
     String rootUrl = NetworkServiceUtils.buildWebApplicationRootUrl(networkService);
@@ -208,7 +242,7 @@ private Map<String, String> getFreshCsrfTokenAndSessionCookie(NetworkService net
     FlaskSessionSigner newToken =
         new FlaskSessionSigner(
             "{\"_fresh\":true,\"user_id\":1,\"_permanent\":true}",
-            "Zzx63w",
+            toTimestamp(utcClock.instant().getEpochSecond()),
             "temporary_key",
             "cookie-session");
 

community/detectors/apache_airflow_cve_2020_17526/src/test/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorTest.java

@@ -39,6 +39,7 @@
 import com.google.tsunami.proto.TargetInfo;
 import java.io.IOException;
 import java.security.SecureRandom;
+import java.time.Duration;
 import java.time.Instant;
 import java.util.Arrays;
 import java.util.Objects;
@@ -118,6 +119,8 @@ public void detect_withCallbackServer_onVulnerableTarget_returnsVulnerability()
         detector.detect(targetInfo, ImmutableList.of(targetNetworkService));
 
     Truth.assertThat(mockCallbackServer.getRequestCount()).isEqualTo(1);
+    // The cookie timestamp is generated from fakeUtcClock, which is 2020-01-01T00:00:00.00Z
+    // (1577836800). Itsdangerous encodes this as 'XgvhAA'.
     assertThat(detectionReports.getDetectionReportsList())
         .comparingExpectedFieldsOnly()
         .containsExactly(
@@ -178,6 +181,55 @@ public void detect_withoutCallbackServer_returnsEmpty() throws IOException {
     assertThat(detectionReports.getDetectionReportsList()).isEmpty();
   }
 
+  @Test
+  public void detect_whenTimeAdvanced_usesNewTimestampInCookie()
+      throws IOException, InterruptedException {
+    startMockWebServer();
+    createInjector();
+    mockCallbackServer.enqueue(PayloadTestHelper.generateMockSuccessfulCallbackResponse());
+    var unused = fakeUtcClock.advance(Duration.ofSeconds(1));
+    NetworkService targetNetworkService =
+        NetworkService.newBuilder()
+            .setNetworkEndpoint(
+                forHostnameAndPort(mockTargetService.getHostName(), mockTargetService.getPort()))
+            .addSupportedHttpMethods("POST")
+            .build();
+    TargetInfo targetInfo =
+        TargetInfo.newBuilder()
+            .addNetworkEndpoints(targetNetworkService.getNetworkEndpoint())
+            .build();
+
+    var unused2 = detector.detect(targetInfo, ImmutableList.of(targetNetworkService));
+
+    RecordedRequest request = mockTargetService.takeRequest();
+    Truth.assertThat(request.getPath()).isEqualTo("/admin/");
+    // After advancing the clock by 1 second, the timestamp becomes 1577836801, which
+    // base64ncodes as 'XgvhAQ'.
+    Truth.assertThat(request.getHeader("Cookie")).contains(".XgvhAQ.");
+  }
+
+  @Test
+  public void toTimestamp_coversAllBranches() throws Exception {
+    createInjector();
+    java.lang.reflect.Method toTimestampMethod =
+        Cve202017526Detector.class.getDeclaredMethod("toTimestamp", long.class);
+    toTimestampMethod.setAccessible(true);
+
+    // Test l == 0
+    Truth.assertThat(toTimestampMethod.invoke(detector, 0L)).isEqualTo("");
+
+    // Test l > 0 with leading zero byte (e.g., 2147483648L)
+    Truth.assertThat(toTimestampMethod.invoke(detector, 2147483648L)).isEqualTo("gAAAAA");
+
+    // Test l < 0
+    try {
+      toTimestampMethod.invoke(detector, -1L);
+      Truth.assertWithMessage("Expected InvocationTargetException").fail();
+    } catch (java.lang.reflect.InvocationTargetException e) {
+      Truth.assertThat(e.getCause()).isInstanceOf(IllegalArgumentException.class);
+    }
+  }
+
   private void startMockWebServer() throws IOException {
     final Dispatcher dispatcher =
         new Dispatcher() {