// Path: src/main/java/burp/j2ee/CustomScanIssue.java
// public class CustomScanIssue implements IScanIssue {
// 
//     private IHttpService httpService;
//     private URL url;
//     private IHttpRequestResponse httpMessages;
//     private String name;
//     private String detail;
//     private Risk severity;
//     private String remedy;
//     private Confidence confidence = Confidence.Certain;
//     
//     public CustomScanIssue(
//             IHttpService httpService,
//             URL url,
//             IHttpRequestResponse httpMessages,
//             String name,
//             String detail,
//             String remedy,
//             Risk severity,
//             Confidence confidence) {
//         this.httpService = httpService;
//         this.url = url;
//         this.httpMessages = httpMessages;
//         this.name = "J2EEScan - " + name;
//         this.detail = detail;
//         this.remedy = remedy;
//         this.severity = severity;
//         this.confidence = confidence;
//     }      
//     
// 
//     @Override
//     public URL getUrl() {
//         return url;
//     }
// 
//     @Override
//     public String getIssueName() {
//         return name;
//     }
// 
//     @Override
//     public int getIssueType() {
//         return 0;
//     }
// 
//     @Override
//     public String getSeverity() {
//         return severity.toString();
//     }
// 
//     @Override
//     // "Certain", "Firm" or "Tentative"
//     public String getConfidence() {
//         return confidence.toString();
//     }
// 
//     @Override
//     public String getIssueBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getRemediationBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getIssueDetail() {
//         return detail;
//     }
// 
//     @Override
//     public String getRemediationDetail() {
//         return remedy;
//     }
// 
//     @Override
//     public IHttpRequestResponse[] getHttpMessages() {
//         return new IHttpRequestResponse[]{httpMessages};
//     }
// 
//     @Override
//     public IHttpService getHttpService() {
//         return httpService;
//     }
// 
// }


import burp.j2ee.Confidence;
import burp.j2ee.CustomScanIssue;
import burp.j2ee.Risk;
import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringReader;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
package burp;


/**
 * If Burp was able to retrieve remote configuration files, execute some policy
 * checks on these files to identify further security issues or not recommended
 * configurations.
 *
 */
public class J2EELocalAssessment {


    private static final Pattern WEB_APP_PATTERN = Pattern.compile("(<web-app.*?</web-app>)", Pattern.DOTALL | Pattern.MULTILINE);

    public static void analyzeWEBXML(byte[] webxmlFile, IBurpExtenderCallbacks cb,
            IHttpRequestResponse baseRequestResponse) {

        IExtensionHelpers helpers = cb.getHelpers();
        PrintWriter stderr = new PrintWriter(cb.getStderr(), true);
        String webxml = helpers.bytesToString(webxmlFile);
        IRequestInfo requestInfo = helpers.analyzeRequest(baseRequestResponse);

        Matcher matcher = WEB_APP_PATTERN.matcher(webxml);
        if (matcher.find()) {

            try {

                String webxmlContent = matcher.group(1);

                DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
                DocumentBuilder dBuilder;

                dBuilder = dbFactory.newDocumentBuilder();
                InputSource is = new InputSource(new StringReader(webxmlContent));
                Document doc = dBuilder.parse(is);

                /**
                 * HTTP VERB Tampering
                 *
                 * http://docs.oracle.com/cd/E14571_01/web.1111/e13712/web_xml.htm#WBAPP502
                 * https://weblogs.java.net/blog/swchan2/archive/2013/04/19/deny-uncovered-http-methods-servlet-31
                 * http-method should not be defined, to restrict access to a
                 * resources using HTTP verbs In Servlet 3.1 spec, the attribute
                 * "deny-uncovered-http-methods" could be used to deny uncovered
                 * HTTP verbs
                 *
                 */
                try {
                    NodeList httpMethods = doc.getElementsByTagName("http-method");

                    if ((httpMethods != null) && (httpMethods.getLength() >= 1)) {
// Path: src/main/java/burp/j2ee/CustomScanIssue.java
// public class CustomScanIssue implements IScanIssue {
// 
//     private IHttpService httpService;
//     private URL url;
//     private IHttpRequestResponse httpMessages;
//     private String name;
//     private String detail;
//     private Risk severity;
//     private String remedy;
//     private Confidence confidence = Confidence.Certain;
//     
//     public CustomScanIssue(
//             IHttpService httpService,
//             URL url,
//             IHttpRequestResponse httpMessages,
//             String name,
//             String detail,
//             String remedy,
//             Risk severity,
//             Confidence confidence) {
//         this.httpService = httpService;
//         this.url = url;
//         this.httpMessages = httpMessages;
//         this.name = "J2EEScan - " + name;
//         this.detail = detail;
//         this.remedy = remedy;
//         this.severity = severity;
//         this.confidence = confidence;
//     }      
//     
// 
//     @Override
//     public URL getUrl() {
//         return url;
//     }
// 
//     @Override
//     public String getIssueName() {
//         return name;
//     }
// 
//     @Override
//     public int getIssueType() {
//         return 0;
//     }
// 
//     @Override
//     public String getSeverity() {
//         return severity.toString();
//     }
// 
//     @Override
//     // "Certain", "Firm" or "Tentative"
//     public String getConfidence() {
//         return confidence.toString();
//     }
// 
//     @Override
//     public String getIssueBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getRemediationBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getIssueDetail() {
//         return detail;
//     }
// 
//     @Override
//     public String getRemediationDetail() {
//         return remedy;
//     }
// 
//     @Override
//     public IHttpRequestResponse[] getHttpMessages() {
//         return new IHttpRequestResponse[]{httpMessages};
//     }
// 
//     @Override
//     public IHttpService getHttpService() {
//         return httpService;
//     }
// 
// }


// Path: src/main/java/burp/J2EELocalAssessment.java
import burp.j2ee.Confidence;
import burp.j2ee.CustomScanIssue;
import burp.j2ee.Risk;
import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringReader;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;

package burp;


/**
 * If Burp was able to retrieve remote configuration files, execute some policy
 * checks on these files to identify further security issues or not recommended
 * configurations.
 *
 */
public class J2EELocalAssessment {


    private static final Pattern WEB_APP_PATTERN = Pattern.compile("(<web-app.*?</web-app>)", Pattern.DOTALL | Pattern.MULTILINE);

    public static void analyzeWEBXML(byte[] webxmlFile, IBurpExtenderCallbacks cb,
            IHttpRequestResponse baseRequestResponse) {

        IExtensionHelpers helpers = cb.getHelpers();
        PrintWriter stderr = new PrintWriter(cb.getStderr(), true);
        String webxml = helpers.bytesToString(webxmlFile);
        IRequestInfo requestInfo = helpers.analyzeRequest(baseRequestResponse);

        Matcher matcher = WEB_APP_PATTERN.matcher(webxml);
        if (matcher.find()) {

            try {

                String webxmlContent = matcher.group(1);

                DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
                DocumentBuilder dBuilder;

                dBuilder = dbFactory.newDocumentBuilder();
                InputSource is = new InputSource(new StringReader(webxmlContent));
                Document doc = dBuilder.parse(is);

                /**
                 * HTTP VERB Tampering
                 *
                 * http://docs.oracle.com/cd/E14571_01/web.1111/e13712/web_xml.htm#WBAPP502
                 * https://weblogs.java.net/blog/swchan2/archive/2013/04/19/deny-uncovered-http-methods-servlet-31
                 * http-method should not be defined, to restrict access to a
                 * resources using HTTP verbs In Servlet 3.1 spec, the attribute
                 * "deny-uncovered-http-methods" could be used to deny uncovered
                 * HTTP verbs
                 *
                 */
                try {
                    NodeList httpMethods = doc.getElementsByTagName("http-method");

                    if ((httpMethods != null) && (httpMethods.getLength() >= 1)) {
                        cb.addScanIssue(new CustomScanIssue(