errors due to updates are fixed now

Author: grandsilva

community/detectors/kubeflow_exposed_ui_rce/build.gradle

@@ -29,6 +29,7 @@ dependencies {
     testImplementation "junit:junit:4.13"
     testImplementation "com.google.inject:guice:4.2.3"
     testImplementation "com.google.inject.extensions:guice-testlib:4.2.3"
+    testImplementation "com.squareup.okhttp3:mockwebserver:3.12.0"
     testImplementation "org.mockito:mockito-core:2.28.2"
     testImplementation "com.google.truth:truth:1.0.1"
     testImplementation "com.google.truth.extensions:truth-java8-extension:1.0.1"

community/detectors/kubeflow_exposed_ui_rce/src/main/java/com/google/tsunami/plugins/detectors/rce/KubeflowRceDetector.java

@@ -65,7 +65,6 @@
 import okhttp3.MultipartBody;
 import okhttp3.RequestBody;
 import okio.Buffer;
-import org.apache.commons.lang3.RandomStringUtils;
 
 /** A {@link VulnDetector} that detects publicly exposed kubeflow instances. */
 @PluginInfo(
@@ -259,8 +258,7 @@ private boolean isServiceVulnerable(NetworkService networkService) {
                 post(rootUrl
                         + String.format(
                             "pipeline/apis/v2beta1/pipelines/upload?name=%s&description=&namespace=%s",
-                            "TsunamiPipeline-" + RandomStringUtils.randomAlphanumeric(10),
-                            nameSpace))
+                            "TsunamiPipeline-" + generateRandomAlphanumeric(), nameSpace))
                     .setHeaders(
                         HttpHeaders.builder()
                             .addHeader(
@@ -421,7 +419,7 @@ private static String getFirstPipelineVersionId(String response) {
     try {
       JsonObject jsonObject = JsonParser.parseString(response).getAsJsonObject();
       JsonArray pipelineVersions = jsonObject.getAsJsonArray("pipeline_versions");
-      if (!pipelineVersions.isEmpty()) {
+      if (pipelineVersions.size() > 0) {
         JsonObject firstPipelineVersion = pipelineVersions.get(0).getAsJsonObject();
         return firstPipelineVersion.get("pipeline_version_id").getAsString();
       }
@@ -431,24 +429,40 @@ private static String getFirstPipelineVersionId(String response) {
     return "";
   }
 
+  private static String generateRandomAlphanumeric() {
+    String characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    StringBuilder result = new StringBuilder();
+    java.util.Random random = new java.util.Random();
+    for (int i = 0; i < 10; i++) {
+      result.append(characters.charAt(random.nextInt(characters.length())));
+    }
+    return result.toString();
+  }
+
+  @Override
+  public ImmutableList<Vulnerability> getAdvisories() {
+    return ImmutableList.of(
+        Vulnerability.newBuilder()
+            .setMainId(
+                VulnerabilityId.newBuilder()
+                    .setPublisher("TSUNAMI_COMMUNITY")
+                    .setValue("KUBEFLOW_EXPOSED_API_RCE"))
+            .setSeverity(Severity.CRITICAL)
+            .setTitle("Exposed kubeflow API")
+            .setDescription(
+                "This vulnerability check exposed Kubeflow API by executing a OS command in a"
+                    + " kubeflow pipeline.")
+            .build());
+  }
+
   private DetectionReport buildDetectionReport(
       TargetInfo targetInfo, NetworkService vulnerableNetworkService) {
     return DetectionReport.newBuilder()
         .setTargetInfo(targetInfo)
         .setNetworkService(vulnerableNetworkService)
         .setDetectionTimestamp(Timestamps.fromMillis(Instant.now(utcClock).toEpochMilli()))
         .setDetectionStatus(DetectionStatus.VULNERABILITY_VERIFIED)
-        .setVulnerability(
-            Vulnerability.newBuilder()
-                .setMainId(
-                    VulnerabilityId.newBuilder()
-                        .setPublisher("TSUNAMI_COMMUNITY")
-                        .setValue("KUBEFLOW_EXPOSED_API_RCE"))
-                .setSeverity(Severity.CRITICAL)
-                .setTitle("Exposed kubeflow API")
-                .setDescription(
-                    "This vulnerability check exposed Kubeflow API by executing a OS command in a"
-                        + " kubeflow pipeline."))
+        .setVulnerability(this.getAdvisories().get(0))
         .build();
   }
 }