Add a test for java

Add end-to-end test for Symbol Reachability pipeline

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Author: ziadhany

scanpipe/tests/data/reachability/java/app.java

@@ -0,0 +1,50 @@
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Map;
+
+public class App {
+    public static boolean debug = true;
+
+    public static class ReportGenerator {
+        private String baseDir;
+
+        public ReportGenerator(String baseDir) {
+            this.baseDir = baseDir;
+        }
+
+        public String getBaseDir() {
+            return baseDir;
+        }
+    }
+
+    public static String serveReport(Map<String, String> requestPayload) {
+        ReportGenerator generator = new ReportGenerator("/var/reports");
+        String requestedFile = requestPayload.get("file");
+
+        if (requestedFile == null || requestedFile.isEmpty()) {
+            return "Error: No file specified";
+        }
+
+        // VULNERABLE: Direct concatenation allows Path Traversal
+        // An attacker passing "../../etc/passwd" could read system files.
+        String targetPath = buildFilePath(generator, requestedFile);
+
+        try {
+            if (Files.exists(Paths.get(targetPath))) {
+                return "Serving content of " + targetPath;
+            }
+        } catch (Exception e) {
+            return "Error: Invalid path";
+        }
+
+        return "Error: File not found";
+    }
+
+    private static String buildFilePath(ReportGenerator generator, String filename) {
+        return Paths.get(generator.getBaseDir(), filename).toString();
+    }
+
+    public static String unrelatedTopLevelFunction() {
+        return "I am just here to add AST complexity.";
+    }
+}

scanpipe/tests/data/reachability/java/fixed-app.java

@@ -0,0 +1,60 @@
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Map;
+
+public class App {
+    public static boolean debug = false;
+
+    public static class ReportGenerator {
+        public String baseDir;
+
+        public ReportGenerator(String baseDir) {
+            this.baseDir = baseDir;
+        }
+    }
+
+    public static String serveReport(Map<String, String> requestPayload) {
+        ReportGenerator generator = new ReportGenerator("/var/reports");
+        String requestedFile = requestPayload.get("file");
+
+        if (requestedFile == null || requestedFile.isEmpty()) {
+            return "Error: No file specified";
+        }
+
+        String targetPath;
+        try {
+            targetPath = buildFilePath(generator, requestedFile);
+        } catch (Exception e) {
+            return "Error: Invalid path";
+        }
+
+        try {
+            if (Files.exists(Paths.get(targetPath))) {
+                return "Serving content of " + targetPath;
+            }
+        } catch (Exception e) {
+            return "Error: Invalid path";
+        }
+
+        return "Error: File not found";
+    }
+
+    /**
+     * FIXED: Validate that the resolved path stays within the base_dir
+     */
+    private static String buildFilePath(ReportGenerator generator, String filename) throws Exception {
+        Path base = Paths.get(generator.baseDir).toAbsolutePath().normalize();
+        Path target = Paths.get(generator.baseDir, filename).toAbsolutePath().normalize();
+
+        if (!target.startsWith(base)) {
+            throw new Exception("Path Traversal Detected");
+        }
+        return target.toString();
+    }
+
+
+    public static String unrelatedTopLevelFunction() {
+        return "I am just here to add AST complexity.";
+    }
+}

scanpipe/tests/data/reachability/java/vuln-app.java

@@ -0,0 +1,46 @@
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Map;
+
+public class App {
+    public static boolean debug = true;
+
+    public static class ReportGenerator {
+        public String baseDir;
+
+        public ReportGenerator(String baseDir) {
+            this.baseDir = baseDir;
+        }
+    }
+
+    public static String serveReport(Map<String, String> requestPayload) {
+        ReportGenerator generator = new ReportGenerator("/var/reports");
+        String requestedFile = requestPayload.get("file");
+
+        if (requestedFile == null || requestedFile.isEmpty()) {
+            return "Error: No file specified";
+        }
+
+        // VULNERABLE: Direct concatenation allows Path Traversal
+        // An attacker passing "../../etc/passwd" could read system files.
+        String targetPath = buildFilePath(generator, requestedFile);
+
+        try {
+            if (Files.exists(Paths.get(targetPath))) {
+                return "Serving content of " + targetPath;
+            }
+        } catch (Exception e) {
+            return "Error: Invalid path";
+        }
+
+        return "Error: File not found";
+    }
+
+    private static String buildFilePath(ReportGenerator generator, String filename) {
+        return Paths.get(generator.baseDir, filename).toString();
+    }
+
+    public static String unrelatedTopLevelFunction() {
+        return "I am just here to add AST complexity.";
+    }
+}