Skip to content

Commit 29ca5c3

Browse files
cklincklin
committed
Java: apply query alert restrictions
1 parent aed9c89 commit 29ca5c3

File tree

60 files changed

+243
-13
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+243
-13
lines changed

‎java/ql/lib/semmle/code/java/security/CleartextStorageQuery.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ abstract class Storable extends Call {
3636
abstract Expr getAStore();
3737
}
3838

39-
private module SensitiveSourceFlowConfig implements DataFlow::ConfigSig {
39+
/** Flow configuration for sensitive data flowing into cleartext storage. */
40+
module SensitiveSourceFlowConfig implements DataFlow::ConfigSig {
4041
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof SensitiveExpr }
4142

4243
predicate isSink(DataFlow::Node sink) { sink instanceof CleartextStorageSink }

‎java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import semmle.code.java.security.InformationLeak
77
/**
88
* One of the `printStackTrace()` overloads on `Throwable`.
99
*/
10-
private class PrintStackTraceMethod extends Method {
10+
class PrintStackTraceMethod extends Method {
1111
PrintStackTraceMethod() {
1212
this.getDeclaringType()
1313
.getSourceDeclaration()
@@ -17,7 +17,11 @@ private class PrintStackTraceMethod extends Method {
1717
}
1818
}
1919

20-
private module ServletWriterSourceToPrintStackTraceMethodFlowConfig implements DataFlow::ConfigSig {
20+
/**
21+
* Flow configuration for xss vulnerable writer source flowing to `Throwable.printStackTrace()` on
22+
* a stream that is connected to external output.
23+
*/
24+
module ServletWriterSourceToPrintStackTraceMethodFlowConfig implements DataFlow::ConfigSig {
2125
predicate isSource(DataFlow::Node src) { src instanceof XssVulnerableWriterSourceNode }
2226

2327
predicate isSink(DataFlow::Node sink) {
@@ -55,7 +59,10 @@ private predicate printWriterOnStringWriter(Expr printWriter, Variable stringWri
5559
)
5660
}
5761

58-
private predicate stackTraceExpr(Expr exception, MethodCall stackTraceString) {
62+
/**
63+
* Holds if `stackTraceString` writes the stack trace from `exception` to a string.
64+
*/
65+
predicate stackTraceExpr(Expr exception, MethodCall stackTraceString) {
5966
exists(Expr printWriter, Variable stringWriterVar, MethodCall printStackCall |
6067
printWriterOnStringWriter(printWriter, stringWriterVar) and
6168
printStackCall.getMethod() instanceof PrintStackTraceMethod and
@@ -66,7 +73,8 @@ private predicate stackTraceExpr(Expr exception, MethodCall stackTraceString) {
6673
)
6774
}
6875

69-
private module StackTraceStringToHttpResponseSinkFlowConfig implements DataFlow::ConfigSig {
76+
/** Flow configuration for stack trace flowing to http response. */
77+
module StackTraceStringToHttpResponseSinkFlowConfig implements DataFlow::ConfigSig {
7078
predicate isSource(DataFlow::Node src) { stackTraceExpr(_, src.asExpr()) }
7179

7280
predicate isSink(DataFlow::Node sink) { sink instanceof InformationLeakSink }

‎java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,7 @@ deprecated class UnsafeDeserializationConfig extends TaintTracking::Configuratio
334334
}
335335

336336
/** Tracks flows from remote user input to a deserialization sink. */
337-
private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
337+
module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
338338
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
339339

340340
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserializationSink }

‎java/ql/src/Likely Bugs/Arithmetic/InformationLoss.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ Variable getVariable(Expr dest) {
3535

3636
from DangerousAssignOpExpr a, Expr e, Top v
3737
where
38+
AlertFiltering::filterByLocatable(a) and
3839
e = a.getSource() and
3940
problematicCasting(a.getDest().getType(), e) and
4041
(

‎java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* external/cwe/cwe-020
1313
*/
1414

15+
private import semmle.code.java.AlertFiltering
1516
private import semmle.code.java.regex.RegexTreeView::RegexTreeView as TreeView
1617
import codeql.regex.OverlyLargeRangeQuery::Make<TreeView>
1718

@@ -22,6 +23,7 @@ TreeView::RegExpCharacterClass potentialMisparsedCharClass() {
2223

2324
from TreeView::RegExpCharacterRange range, string reason
2425
where
26+
AlertFiltering::filterByLocation(range.getLocation()) and
2527
problem(range, reason) and
2628
not range.getParent() = potentialMisparsedCharClass()
2729
select range, "Suspicious character range that " + reason + "."

‎java/ql/src/Security/CWE/CWE-022/TaintedPath.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
import java
1717
import semmle.code.java.security.PathCreation
1818
import semmle.code.java.security.TaintedPathQuery
19+
20+
module TaintedPathFlow = TaintTracking::Global<DataFlow::FilteredConfig<TaintedPathConfig>>;
21+
1922
import TaintedPathFlow::PathGraph
2023

2124
from TaintedPathFlow::PathNode source, TaintedPathFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-022/ZipSlip.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414

1515
import java
1616
import semmle.code.java.security.ZipSlipQuery
17+
18+
module ZipSlipFlow = TaintTracking::Global<DataFlow::FilteredConfig<ZipSlipConfig>>;
19+
1720
import ZipSlipFlow::PathGraph
1821

1922
from ZipSlipFlow::PathNode source, ZipSlipFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@
1111
*/
1212

1313
import semmle.code.java.security.PartialPathTraversalQuery
14+
15+
module PartialPathTraversalFromRemoteFlow =
16+
TaintTracking::Global<DataFlow::FilteredConfig<PartialPathTraversalFromRemoteConfig>>;
17+
1418
import PartialPathTraversalFromRemoteFlow::PathGraph
1519

1620
from

‎java/ql/src/Security/CWE/CWE-074/JndiInjection.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.JndiInjectionQuery
16+
17+
module JndiInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<JndiInjectionFlowConfig>>;
18+
1619
import JndiInjectionFlow::PathGraph
1720

1821
from JndiInjectionFlow::PathNode source, JndiInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-074/XsltInjection.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.XsltInjectionQuery
16+
17+
module XsltInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<XsltInjectionFlowConfig>>;
18+
1619
import XsltInjectionFlow::PathGraph
1720

1821
from XsltInjectionFlow::PathNode source, XsltInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-078/ExecTainted.ql

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,20 @@
1414

1515
import java
1616
import semmle.code.java.security.CommandLineQuery
17+
private import semmle.code.java.dataflow.TaintTracking
18+
19+
module InputToArgumentToExecFlow =
20+
TaintTracking::Global<DataFlow::FilteredConfig<InputToArgumentToExecFlowConfig>>;
21+
1722
import InputToArgumentToExecFlow::PathGraph
1823

24+
predicate execIsTainted(
25+
InputToArgumentToExecFlow::PathNode source, InputToArgumentToExecFlow::PathNode sink, Expr execArg
26+
) {
27+
InputToArgumentToExecFlow::flowPath(source, sink) and
28+
argumentToExec(execArg, sink.getNode())
29+
}
30+
1931
from
2032
InputToArgumentToExecFlow::PathNode source, InputToArgumentToExecFlow::PathNode sink, Expr execArg
2133
where execIsTainted(source, sink, execArg)

‎java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ predicate builtFromUncontrolledConcat(Expr expr) {
4747

4848
from StringArgumentToExec argument
4949
where
50+
AlertFiltering::filterByLocatable(argument) and
5051
builtFromUncontrolledConcat(argument) and
5152
not execIsTainted(_, _, argument)
5253
select argument, "Command line is built with string concatenation."

‎java/ql/src/Security/CWE/CWE-079/XSS.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.XssQuery
16+
17+
module XssFlow = TaintTracking::Global<DataFlow::FilteredConfig<XssConfig>>;
18+
1619
import XssFlow::PathGraph
1720

1821
from XssFlow::PathNode source, XssFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-089/SqlTainted.ql

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,18 @@
1515
import java
1616
import semmle.code.java.dataflow.FlowSources
1717
import semmle.code.java.security.SqlInjectionQuery
18+
19+
module QueryInjectionFlow =
20+
TaintTracking::Global<DataFlow::FilteredConfig<QueryInjectionFlowConfig>>;
21+
1822
import QueryInjectionFlow::PathGraph
1923

24+
predicate queryIsTaintedBy(
25+
QueryInjectionSink query, QueryInjectionFlow::PathNode source, QueryInjectionFlow::PathNode sink
26+
) {
27+
QueryInjectionFlow::flowPath(source, sink) and sink.getNode() = query
28+
}
29+
2030
from
2131
QueryInjectionSink query, QueryInjectionFlow::PathNode source, QueryInjectionFlow::PathNode sink
2232
where queryIsTaintedBy(query, source, sink)

‎java/ql/src/Security/CWE/CWE-090/LdapInjection.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
import java
1515
import semmle.code.java.dataflow.FlowSources
1616
import semmle.code.java.security.LdapInjectionQuery
17+
18+
module LdapInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<LdapInjectionFlowConfig>>;
19+
1720
import LdapInjectionFlow::PathGraph
1821

1922
from LdapInjectionFlow::PathNode source, LdapInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/GroovyInjection.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.GroovyInjectionQuery
16+
17+
module GroovyInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<GroovyInjectionConfig>>;
18+
1619
import GroovyInjectionFlow::PathGraph
1720

1821
from GroovyInjectionFlow::PathNode source, GroovyInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@
1212

1313
import java
1414
import semmle.code.java.security.InsecureBeanValidationQuery
15+
16+
module BeanValidationFlow = TaintTracking::Global<DataFlow::FilteredConfig<BeanValidationConfig>>;
17+
1518
import BeanValidationFlow::PathGraph
1619

1720
from BeanValidationFlow::PathNode source, BeanValidationFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/JexlInjection.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.JexlInjectionQuery
16+
17+
module JexlInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<JexlInjectionConfig>>;
18+
1619
import JexlInjectionFlow::PathGraph
1720

1821
from JexlInjectionFlow::PathNode source, JexlInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/MvelInjection.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.MvelInjectionQuery
16+
17+
module MvelInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<MvelInjectionFlowConfig>>;
18+
1619
import MvelInjectionFlow::PathGraph
1720

1821
from MvelInjectionFlow::PathNode source, MvelInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/SpelInjection.ql

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.SpelInjectionQuery
16-
import semmle.code.java.dataflow.DataFlow
16+
import semmle.code.java.dataflow.TaintTracking
17+
18+
module SpelInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<SpelInjectionConfig>>;
19+
1720
import SpelInjectionFlow::PathGraph
1821

1922
from SpelInjectionFlow::PathNode source, SpelInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.TemplateInjectionQuery
16+
17+
module TemplateInjectionFlow =
18+
TaintTracking::Global<DataFlow::FilteredConfig<TemplateInjectionFlowConfig>>;
19+
1620
import TemplateInjectionFlow::PathGraph
1721

1822
from TemplateInjectionFlow::PathNode source, TemplateInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-113/NettyResponseSplitting.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,4 +93,5 @@ private class InsecureDefaultFullHttpRequestClassInstantiation extends RequestSp
9393
}
9494

9595
from InsecureNettyObjectCreation new
96+
where AlertFiltering::filterByLocatable(new)
9697
select new, new.splittingType() + " vulnerability due to header value verification being disabled."

‎java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.ResponseSplittingQuery
16+
17+
module ResponseSplittingFlow =
18+
TaintTracking::Global<DataFlow::FilteredConfig<ResponseSplittingConfig>>;
19+
1620
import ResponseSplittingFlow::PathGraph
1721

1822
from ResponseSplittingFlow::PathNode source, ResponseSplittingFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-1204/StaticInitializationVector.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.StaticInitializationVectorQuery
16+
17+
module StaticInitializationVectorFlow =
18+
TaintTracking::Global<DataFlow::FilteredConfig<StaticInitializationVectorConfig>>;
19+
1620
import StaticInitializationVectorFlow::PathGraph
1721

1822
from StaticInitializationVectorFlow::PathNode source, StaticInitializationVectorFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,13 @@
1111
*/
1212

1313
import java
14+
import semmle.code.java.dataflow.TaintTracking
1415
import semmle.code.java.security.ExternallyControlledFormatStringQuery
1516
import semmle.code.java.StringFormat
17+
18+
module ExternallyControlledFormatStringFlow =
19+
TaintTracking::Global<DataFlow::FilteredConfig<ExternallyControlledFormatStringConfig>>;
20+
1621
import ExternallyControlledFormatStringFlow::PathGraph
1722

1823
from

‎java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,35 @@
1515

1616
import java
1717
import semmle.code.java.dataflow.DataFlow
18+
import semmle.code.java.dataflow.TaintTracking
1819
import semmle.code.java.security.StackTraceExposureQuery
1920

21+
private module ServletWriterSourceToPrintStackTraceMethodFlow =
22+
TaintTracking::Global<DataFlow::FilteredConfig<ServletWriterSourceToPrintStackTraceMethodFlowConfig>>;
23+
24+
private predicate printsStackToWriter(MethodCall call) {
25+
exists(PrintStackTraceMethod printStackTrace |
26+
call.getMethod() = printStackTrace and
27+
ServletWriterSourceToPrintStackTraceMethodFlow::flowToExpr(call.getAnArgument())
28+
)
29+
}
30+
31+
predicate printsStackExternally(MethodCall call, Expr stackTrace) {
32+
printsStackToWriter(call) and
33+
call.getQualifier() = stackTrace and
34+
not call.getQualifier() instanceof SuperAccess
35+
}
36+
37+
private module StackTraceStringToHttpResponseSinkFlow =
38+
TaintTracking::Global<DataFlow::FilteredConfig<StackTraceStringToHttpResponseSinkFlowConfig>>;
39+
40+
predicate stringifiedStackFlowsExternally(DataFlow::Node externalExpr, Expr stackTrace) {
41+
exists(MethodCall stackTraceString |
42+
stackTraceExpr(stackTrace, stackTraceString) and
43+
StackTraceStringToHttpResponseSinkFlow::flow(DataFlow::exprNode(stackTraceString), externalExpr)
44+
)
45+
}
46+
2047
from Expr externalExpr, Expr errorInformation
2148
where
2249
printsStackExternally(externalExpr, errorInformation) or

‎java/ql/src/Security/CWE/CWE-266/IntentUriPermissionManipulation.ql

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,11 @@
1414

1515
import java
1616
import semmle.code.java.security.IntentUriPermissionManipulationQuery
17-
import semmle.code.java.dataflow.DataFlow
17+
import semmle.code.java.dataflow.TaintTracking
18+
19+
module IntentUriPermissionManipulationFlow =
20+
TaintTracking::Global<DataFlow::FilteredConfig<IntentUriPermissionManipulationConfig>>;
21+
1822
import IntentUriPermissionManipulationFlow::PathGraph
1923

2024
from

‎java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,7 @@ import java
1414
import semmle.code.java.security.AndroidLocalAuthQuery
1515

1616
from AuthenticationSuccessCallback c
17-
where not exists(c.getAResultUse())
17+
where
18+
AlertFiltering::filterByLocatable(c) and
19+
not exists(c.getAResultUse())
1820
select c, "This authentication callback does not use its result for a cryptographic operation."

‎java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,7 @@ import java
1414
import semmle.code.java.security.AndroidWebViewCertificateValidationQuery
1515

1616
from OnReceivedSslErrorMethod m
17-
where trustsAllCerts(m)
17+
where
18+
AlertFiltering::filterByLocatable(m) and
19+
trustsAllCerts(m)
1820
select m, "This handler accepts all SSL certificates."

‎java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313
import java
1414
import semmle.code.java.dataflow.DataFlow
1515
import semmle.code.java.security.InsecureTrustManagerQuery
16+
17+
module InsecureTrustManagerFlow =
18+
DataFlow::Global<DataFlow::FilteredConfig<InsecureTrustManagerConfig>>;
19+
1620
import InsecureTrustManagerFlow::PathGraph
1721

1822
from InsecureTrustManagerFlow::PathNode source, InsecureTrustManagerFlow::PathNode sink

0 commit comments

Comments
 (0)