hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Query to detect LDAP injections in Java

Browse Source 
Cleanup
This commit is contained in:
Grzegorz Golawski
2020-01-18 20:21:38 +01:00
parent 95723b08e1
commit 00ee3d2549
5 changed files with 18 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
java/ql/src/Security/CWE/CWE-90/LdapInjectionLib.qll
View File

@@ -6,7 +6,6 @@ import semmle.code.java.frameworks.UnboundId
import semmle.code.java.frameworks.SpringLdap
import semmle.code.java.frameworks.ApacheLdap
/** Holds if the parameter of `c` at index `paramIndex` is varargs. */
bindingset[paramIndex]
predicate isVarargs(Callable c, int paramIndex) {
@@ -20,8 +19,8 @@ abstract class LdapInjectionSource extends DataFlow::Node { }
abstract class LdapInjectionSink extends DataFlow::ExprNode { }
/**
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/
class LdapInjectionFlowConfig extends TaintTracking::Configuration {
LdapInjectionFlowConfig() { this = "LdapInjectionFlowConfig" }
@@ -79,7 +78,7 @@ class JndiLdapInjectionSink extends LdapInjectionSink {
|
m.getDeclaringType().getAnAncestor() instanceof TypeDirContext and
m.hasName("search") and
index in [0..1]
index in [0 .. 1]
)
}
}
@@ -129,16 +128,13 @@ class SpringLdapInjectionSink extends LdapInjectionSink {
) and
(
// Parameter index is 1 (DN or query) or 2 (filter) if method is not authenticate
(
index in [0..1] and
not m instanceof MethodSpringLdapTemplateAuthenticate
) or
index in [0 .. 1] and
not m instanceof MethodSpringLdapTemplateAuthenticate
or
// But it's not the last parameter in case of authenticate method (last param is password)
(
index in [0..1] and
index < m.getNumberOfParameters() - 1 and
m instanceof MethodSpringLdapTemplateAuthenticate
)
index in [0 .. 1] and
index < m.getNumberOfParameters() - 1 and
m instanceof MethodSpringLdapTemplateAuthenticate
)
)
}
@@ -442,4 +438,4 @@ predicate apacheLdapDnGetStep(ExprNode n1, ExprNode n2) {
m.getDeclaringType().getAnAncestor() instanceof TypeApacheDn and
(m.hasName("getName") or m.hasName("getNormName") or m.hasName("toString"))
)
}
}