Skip to content

Commit c30bdb6

Browse files
ESS-ENNESS-ENN
authored
Two Java rules 10Oct2024 (#16)
* cookie-missing-secure-flag-java * jedis-jedisfactory-hardcoded-password-java
1 parent 7fc798f commit c30bdb6

6 files changed

+465
-0
lines changed

‎rules/java/security/cookie-missing-secure-flag-java.yml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
id: cookie-missing-secure-flag-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
A cookie was detected without setting the 'secure' flag. The 'secure'
6+
flag for cookies prevents the client from transmitting the cookie over
7+
insecure channels such as HTTP. Set the 'secure' flag by calling
8+
'$COOKIE.setSecure(true);'.
9+
note: >-
10+
[CWE-614] Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
11+
[REFERENCES]
12+
- https://owasp.org/www-community/controls/SecureCookieAttribute
13+
utils:
14+
MATCH_RESPONSE_COOKIE_STATEMENT:
15+
kind: expression_statement
16+
all:
17+
- has:
18+
stopBy: neighbor
19+
kind: method_invocation
20+
all:
21+
- has:
22+
stopBy: neighbor
23+
kind: identifier
24+
regex: "response"
25+
- has:
26+
stopBy: neighbor
27+
kind: identifier
28+
regex: "addCookie"
29+
- has:
30+
stopBy: neighbor
31+
kind: argument_list
32+
has:
33+
stopBy: neighbor
34+
kind: identifier
35+
- not:
36+
follows:
37+
stopBy: end
38+
kind: expression_statement
39+
all:
40+
- has:
41+
stopBy: end
42+
kind: identifier
43+
- has:
44+
stopBy: end
45+
kind: identifier
46+
regex: "setSecure|setValue"
47+
- has:
48+
stopBy: end
49+
kind: argument_list
50+
51+
rule:
52+
kind: expression_statement
53+
matches: MATCH_RESPONSE_COOKIE_STATEMENT

‎rules/java/security/jedis-jedisfactory-hardcoded-password-java.yml

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
id: jedis-jedisfactory-hardcoded-password-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
MATCH_PATTERN_JEDISFACTORY:
16+
kind: expression_statement
17+
all:
18+
- has:
19+
stopBy: neighbor
20+
kind: method_invocation
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: identifier
25+
pattern: $R
26+
- has:
27+
stopBy: neighbor
28+
kind: identifier
29+
regex: "^setPassword$"
30+
- has:
31+
stopBy: neighbor
32+
kind: argument_list
33+
has:
34+
stopBy: neighbor
35+
kind: string_literal
36+
- follows:
37+
stopBy: end
38+
kind: local_variable_declaration
39+
all:
40+
- has:
41+
stopBy: neighbor
42+
kind: type_identifier
43+
regex: "^JedisFactory$|^jedis.ConnectionFactory$"
44+
- has:
45+
stopBy: neighbor
46+
kind: variable_declarator
47+
all:
48+
- has:
49+
stopBy: neighbor
50+
kind: identifier
51+
pattern: $R
52+
- has:
53+
stopBy: neighbor
54+
kind: object_creation_expression
55+
- inside:
56+
stopBy: end
57+
kind: class_declaration
58+
follows:
59+
stopBy: end
60+
kind: import_declaration
61+
has:
62+
stopBy: neighbor
63+
kind: scoped_identifier
64+
all:
65+
- has:
66+
stopBy: end
67+
kind: identifier
68+
regex: "^redis$"
69+
- has:
70+
stopBy: end
71+
kind: identifier
72+
regex: "^clients$"
73+
74+
MATCH_PATTERN_CLIENT_JEDIS.JEDISFACTORY:
75+
kind: expression_statement
76+
all:
77+
- has:
78+
stopBy: neighbor
79+
kind: method_invocation
80+
all:
81+
- has:
82+
stopBy: neighbor
83+
kind: identifier
84+
pattern: $R
85+
- has:
86+
stopBy: neighbor
87+
kind: identifier
88+
regex: "^setPassword$"
89+
- has:
90+
stopBy: neighbor
91+
kind: argument_list
92+
has:
93+
stopBy: neighbor
94+
kind: string_literal
95+
- follows:
96+
stopBy: end
97+
kind: local_variable_declaration
98+
all:
99+
- has:
100+
stopBy: neighbor
101+
kind: scoped_type_identifier
102+
all:
103+
- has:
104+
stopBy: neighbor
105+
kind: scoped_type_identifier
106+
all:
107+
- has:
108+
stopBy: neighbor
109+
kind: type_identifier
110+
regex: "^clients$"
111+
- has:
112+
stopBy: neighbor
113+
kind: type_identifier
114+
regex: "^jedis$"
115+
- has:
116+
stopBy: neighbor
117+
kind: type_identifier
118+
regex: "^JedisFactory$|^ConnectionFactory$"
119+
- has:
120+
stopBy: end
121+
kind: variable_declarator
122+
has:
123+
stopBy: neighbor
124+
kind: identifier
125+
pattern: $R
126+
- inside:
127+
stopBy: end
128+
kind: class_declaration
129+
follows:
130+
stopBy: end
131+
kind: import_declaration
132+
all:
133+
- has:
134+
stopBy: end
135+
kind: identifier
136+
regex: "^redis$"
137+
- has:
138+
stopBy: end
139+
kind: asterisk
140+
141+
MATCH_PATTERN_JEDIS.JEDISFACTORY:
142+
kind: expression_statement
143+
all:
144+
- has:
145+
stopBy: neighbor
146+
kind: method_invocation
147+
all:
148+
- has:
149+
stopBy: neighbor
150+
kind: identifier
151+
pattern: $R
152+
- has:
153+
stopBy: neighbor
154+
kind: identifier
155+
regex: "^setPassword$"
156+
- has:
157+
stopBy: neighbor
158+
kind: argument_list
159+
has:
160+
stopBy: neighbor
161+
kind: string_literal
162+
- follows:
163+
stopBy: end
164+
kind: local_variable_declaration
165+
all:
166+
- has:
167+
stopBy: neighbor
168+
kind: scoped_type_identifier
169+
all:
170+
- has:
171+
stopBy: neighbor
172+
kind: type_identifier
173+
regex: "^jedis$"
174+
- has:
175+
stopBy: neighbor
176+
kind: type_identifier
177+
regex: "^JedisFactory$|^ConnectionFactory$"
178+
- has:
179+
stopBy: neighbor
180+
kind: variable_declarator
181+
has:
182+
stopBy: neighbor
183+
kind: identifier
184+
pattern: $R
185+
186+
MATCH_PATTERN_REDIS_CLIENT_JEDIS.JEDISFACTORY:
187+
kind: expression_statement
188+
all:
189+
- has:
190+
stopBy: neighbor
191+
kind: method_invocation
192+
all:
193+
- has:
194+
stopBy: neighbor
195+
kind: identifier
196+
pattern: $R
197+
- has:
198+
stopBy: neighbor
199+
kind: identifier
200+
regex: "^setPassword$"
201+
- has:
202+
stopBy: neighbor
203+
kind: argument_list
204+
has:
205+
stopBy: neighbor
206+
kind: string_literal
207+
- follows:
208+
stopBy: end
209+
kind: local_variable_declaration
210+
all:
211+
- has:
212+
stopBy: neighbor
213+
kind: scoped_type_identifier
214+
all:
215+
- has:
216+
stopBy: neighbor
217+
kind: scoped_type_identifier
218+
all:
219+
- has:
220+
stopBy: end
221+
kind: type_identifier
222+
regex: "^redis$"
223+
- has:
224+
stopBy: end
225+
kind: type_identifier
226+
regex: "^clients$"
227+
- has:
228+
stopBy: end
229+
kind: type_identifier
230+
regex: "^jedis$"
231+
- has:
232+
stopBy: end
233+
kind: type_identifier
234+
regex: "^ConnectionFactory$|^JedisFactory$"
235+
- has:
236+
stopBy: neighbor
237+
kind: variable_declarator
238+
has:
239+
stopBy: end
240+
kind: identifier
241+
pattern: $R
242+
rule:
243+
kind: expression_statement
244+
any:
245+
- matches: MATCH_PATTERN_JEDISFACTORY
246+
- matches: MATCH_PATTERN_CLIENT_JEDIS.JEDISFACTORY
247+
- matches: MATCH_PATTERN_JEDIS.JEDISFACTORY
248+
- matches: MATCH_PATTERN_REDIS_CLIENT_JEDIS.JEDISFACTORY

‎tests/__snapshots__/cookie-missing-secure-flag-java-snapshot.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: cookie-missing-secure-flag-java
2+
snapshots:
3+
? |
4+
public class CookieController {
5+
6+
@RequestMapping(value = "/cookie1", method = "GET")
7+
public void setCookie(@RequestParam String value, HttpServletResponse response) {
8+
Cookie cookie = new Cookie("cookie", value);
9+
response.addCookie(cookie);
10+
}
11+
: labels:
12+
- source: response.addCookie(cookie);
13+
style: primary
14+
start: 220
15+
end: 247
16+
- source: response
17+
style: secondary
18+
start: 220
19+
end: 228
20+
- source: addCookie
21+
style: secondary
22+
start: 229
23+
end: 238
24+
- source: cookie
25+
style: secondary
26+
start: 239
27+
end: 245
28+
- source: (cookie)
29+
style: secondary
30+
start: 238
31+
end: 246
32+
- source: response.addCookie(cookie)
33+
style: secondary
34+
start: 220
35+
end: 246

0 commit comments

Comments
 (0)