Merge pull request #604 from grandsilva:kubeflow_RCE

PiperOrigin-RevId: 809051454
Change-Id: I3a7919a6e18cd2b812fb111ef56cf6d00cc46b42

Author: copybara-github

community/detectors/kubeflow_exposed_ui_rce/README.md

@@ -0,0 +1,12 @@
+# Kubeflow Exposed API RCE Detector
+
+This detector identifies remote code execution vulnerabilities in exposed
+Kubeflow APIs.
+
+## Build JAR file for this plugin
+
+To build the JAR file for this plugin, use the following command with `gradlew`:
+
+```shell
+./gradlew jar
+```

community/detectors/kubeflow_exposed_ui_rce/build.gradle

@@ -0,0 +1,39 @@
+plugins {
+    id 'java-library'
+}
+
+description = 'Kubeflow Exposed UI VulnDetector plugin.'
+group 'com.google.tsunami'
+version '0.0.1-SNAPSHOT'
+
+repositories {
+    maven { // The google mirror is less flaky than mavenCentral()
+        url 'https://maven-central.storage-download.googleapis.com/repos/central/data/'
+    }
+    mavenCentral()
+    mavenLocal()
+}
+
+def coreRepoBranch = System.getenv("GITBRANCH_TSUNAMI_CORE") ?: "stable"
+def tcsRepoBranch = System.getenv("GITBRANCH_TSUNAMI_TCS") ?: "stable"
+
+dependencies {
+    implementation("com.google.tsunami:tsunami-common") {
+      version { branch = "${coreRepoBranch}" }
+    }
+    implementation("com.google.tsunami:tsunami-plugin") {
+      version { branch = "${coreRepoBranch}" }
+    }
+    implementation("com.google.tsunami:tsunami-proto") {
+      version { branch = "${coreRepoBranch}" }
+    }
+
+    testImplementation "com.google.inject:guice:6.0.0"
+    testImplementation "com.google.inject.extensions:guice-testlib:6.0.0"
+    testImplementation "com.google.truth:truth:1.4.4"
+    testImplementation "com.google.truth.extensions:truth-java8-extension:1.4.4"
+    testImplementation "com.google.truth.extensions:truth-proto-extension:1.4.4"
+    testImplementation "com.squareup.okhttp3:mockwebserver:3.12.0"
+    testImplementation "junit:junit:4.13.2"
+    testImplementation "org.mockito:mockito-core:5.18.0"
+}

community/detectors/kubeflow_exposed_ui_rce/settings.gradle

@@ -0,0 +1,12 @@
+rootProject.name = 'kubeflow_exposed_ui_rce'
+
+def coreRepository = System.getenv("GITREPO_TSUNAMI_CORE") ?: "https://github.com/google/tsunami-security-scanner.git"
+def tcsRepository = System.getenv("GITREPO_TSUNAMI_TCS") ?: "https://github.com/google/tsunami-security-scanner-callback-server.git"
+
+sourceControl {
+    gitRepository("${coreRepository}") {
+        producesModule("com.google.tsunami:tsunami-common")
+        producesModule("com.google.tsunami:tsunami-plugin")
+        producesModule("com.google.tsunami:tsunami-proto")
+    }
+}

community/detectors/kubeflow_exposed_ui_rce/src/main/java/com/google/tsunami/plugins/detectors/rce/kubeflowexposedui/Annotations.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.google.tsunami.plugins.detectors.rce.kubeflowexposedui;
+
+import static java.lang.annotation.ElementType.FIELD;
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.ElementType.PARAMETER;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import javax.inject.Qualifier;
+
+/** Annotation for {@link KubeflowRceDetector}. */
+final class Annotations {
+  @Qualifier
+  @Retention(RetentionPolicy.RUNTIME)
+  @Target({PARAMETER, METHOD, FIELD})
+  @interface KubeflowOobSleepDuration {}
+
+  private Annotations() {}
+}