Skip to content

Add files via upload #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SoftSec-Tech wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add files via upload #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions BadArray.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
public class BadArray {
private static int[] store = new int[4];

public static void putData(int pos, int num) {
if (pos < 0) {
return;
}
store[pos] = num;

@code-hawk-uat code-hawk-uat Bot Apr 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

数组越界写入漏洞
line 2 声明长度为 4 的数组 store（有效索引 0-3）→ line 5-7 仅校验下界 pos < 0 → line 8 直接执行 store[pos] = num，未校验上界。当调用者传入 pos >= 4（如 line 12 的 putData(5, 100)）时，触发 ArrayIndexOutOfBoundsException。

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 8

💬 详细说明：

  • 攻击者可通过构造越界索引导致程序崩溃（拒绝服务），或在特定 JVM 环境下可能引发不可预期的内存行为。此漏洞为典型的 CWE-787（Out-of-bounds Write）。

📝 问题代码：

        store[pos] = num;

💡 修复建议：

在写入数组前增加上界校验。应确保 pos 同时满足 pos >= 0 且 pos < store.length。

✅ 修复示例：

    public static void putData(int pos, int num) {
        if (pos < 0 || pos >= store.length) {
            return;
        }
        store[pos] = num;
    }

🔗 参考链接

无

@code-hawk-test code-hawk-test Bot Apr 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 AI 代码审查发现问题

📋 问题概述

发现 2 个邻近问题（第 5–8 行）

📍 问题详情

🔴 问题 1 | 严重程度: HIGH | 行号: 5

💬 详细说明：

  • line 5 处仅校验了 pos < 0 的下界，遗漏了 pos >= store.length 的上界校验。当 pos 越界时（如 line 12 传入的 5），line 8 处的数组赋值将直接触发 ArrayIndexOutOfBoundsException。

📝 问题代码：

        if (pos < 0) {

💡 修复建议：

在 putData 方法的边界检查中补充数组长度上界校验，确保 pos 处于 [0, store.length) 合法区间内。若此文件确为静态分析工具的故意缺陷测试用例，可保留现状。

✅ 修复示例：

    public static void putData(int pos, int num) {
        if (pos < 0 || pos >= store.length) {
            return;
        }
        store[pos] = num;
    }
🔴 问题 2 | 严重程度: HIGH | 行号: 8

💬 详细说明：

  • 攻击者可利用此漏洞导致程序崩溃（拒绝服务），或在特定 JVM 环境下尝试破坏内存布局。由于 main 函数已演示了越界调用，说明该缺陷是确定可触发的。

📝 问题代码：

        store[pos] = num;

💡 修复建议：

在访问数组前增加上界校验。应确保 pos 同时满足 pos >= 0 且 pos < store.length。

✅ 修复示例：

    public static void putData(int pos, int num) {
        if (pos < 0 || pos >= store.length) {
            return;
        }
        store[pos] = num;
    }

🔗 参考链接

无

}
Comment on lines +4 to +9

@coderabbitai coderabbitai Bot Apr 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

缺少上界检查，会抛出 ArrayIndexOutOfBoundsException。

putData 只校验了 pos < 0，没有校验 pos >= store.length。当传入的 pos 大于等于数组长度（如 main 中的 5）时，store[pos] = num; 会在运行时抛出 ArrayIndexOutOfBoundsException。建议补全上界校验，并保持与下界处理一致的策略（静默返回或抛出带明确信息的异常）。

🛡️ 建议的修复 
     public static void putData(int pos, int num) {
-        if (pos < 0) {
+        if (pos < 0 || pos >= store.length) {
             return;
         }
         store[pos] = num;
     }

如果更倾向于显式失败而非静默忽略，可改为：

     public static void putData(int pos, int num) {
-        if (pos < 0) {
-            return;
-        }
-        store[pos] = num;
+        if (pos < 0 || pos >= store.length) {
+            throw new IndexOutOfBoundsException("pos out of range: " + pos);
+        }
+        store[pos] = num;
     }
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@BadArray.java` around lines 4 - 9, putData currently only checks pos < 0 and
writes to store[pos], which can throw ArrayIndexOutOfBoundsException when pos >=
store.length; update putData to validate the upper bound against store.length
(e.g., if (pos < 0 || pos >= store.length) { return; } or throw a clear
IllegalArgumentException) so the behavior matches the existing lower-bound
handling or fails with an informative message; locate the check in the putData
method and use the store array name in the new condition and/or exception text.


public static void main(String[] args) {
putData(5, 100);
}
Comment on lines +11 to +13

@coderabbitai coderabbitai Bot Apr 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

main 中的调用会在运行时直接崩溃。

store 长度为 4，合法下标范围是 0..3，而 putData(5, 100) 传入的 pos = 5 将触发 ArrayIndexOutOfBoundsException。如果这是用于演示越界问题的示例代码，建议加一行注释说明意图；否则请改为合法下标（例如 putData(3, 100);）。在 putData 补全上界检查后，该调用将被安全地忽略或抛出受控异常。

🛠️ 建议的修复 
     public static void main(String[] args) {
-        putData(5, 100);
+        putData(3, 100);
     }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
public static void main(String[] args) {
putData(5, 100);
}
public static void main(String[] args) {
putData(3, 100);
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@BadArray.java` around lines 11 - 13, The call in main uses putData(5, 100)
which will throw ArrayIndexOutOfBoundsException because store has length 4
(valid indices 0..3); fix by either changing the call to a valid index such as
putData(3, 100) or adding a clear comment that the out-of-range call is
intentional for a demo. Also ensure the putData method (symbol: putData)
performs an explicit bounds check against store.length and either
returns/ignores or throws a controlled exception so out-of-range writes are
handled safely.

}