hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Query to detect LDAP injections in Java

Browse Source 
Cleanup
This commit is contained in:
Grzegorz Golawski
2020-01-18 20:21:38 +01:00
parent 95723b08e1
commit 00ee3d2549
5 changed files with 18 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
java/ql/src/Security/CWE/CWE-90/LdapInjectionLib.qll
View File

@@ -6,7 +6,6 @@ import semmle.code.java.frameworks.UnboundId
import semmle.code.java.frameworks.SpringLdap import semmle.code.java.frameworks.SpringLdap
import semmle.code.java.frameworks.ApacheLdap import semmle.code.java.frameworks.ApacheLdap
/** Holds if the parameter of `c` at index `paramIndex` is varargs. */ /** Holds if the parameter of `c` at index `paramIndex` is varargs. */
bindingset[paramIndex] bindingset[paramIndex]
predicate isVarargs(Callable c, int paramIndex) { predicate isVarargs(Callable c, int paramIndex) {
@@ -20,8 +19,8 @@ abstract class LdapInjectionSource extends DataFlow::Node { }
abstract class LdapInjectionSink extends DataFlow::ExprNode { } abstract class LdapInjectionSink extends DataFlow::ExprNode { }
/** /**
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries. * A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/ */
class LdapInjectionFlowConfig extends TaintTracking::Configuration { class LdapInjectionFlowConfig extends TaintTracking::Configuration {
LdapInjectionFlowConfig() { this = "LdapInjectionFlowConfig" } LdapInjectionFlowConfig() { this = "LdapInjectionFlowConfig" }
@@ -79,7 +78,7 @@ class JndiLdapInjectionSink extends LdapInjectionSink {
| |
m.getDeclaringType().getAnAncestor() instanceof TypeDirContext and m.getDeclaringType().getAnAncestor() instanceof TypeDirContext and
m.hasName("search") and m.hasName("search") and
index in [0..1] index in [0 .. 1]
) )
} }
} }
@@ -129,18 +128,15 @@ class SpringLdapInjectionSink extends LdapInjectionSink {
) and ) and
( (
// Parameter index is 1 (DN or query) or 2 (filter) if method is not authenticate // Parameter index is 1 (DN or query) or 2 (filter) if method is not authenticate
( index in [0 .. 1] and
index in [0..1] and
not m instanceof MethodSpringLdapTemplateAuthenticate not m instanceof MethodSpringLdapTemplateAuthenticate
) or or
// But it's not the last parameter in case of authenticate method (last param is password) // But it's not the last parameter in case of authenticate method (last param is password)
( index in [0 .. 1] and
index in [0..1] and
index < m.getNumberOfParameters() - 1 and index < m.getNumberOfParameters() - 1 and
m instanceof MethodSpringLdapTemplateAuthenticate m instanceof MethodSpringLdapTemplateAuthenticate
) )
) )
)
} }
} }

4
java/ql/src/semmle/code/java/frameworks/ApacheLdap.qll
View File

@@ -23,7 +23,5 @@ class TypeApacheSearchRequest extends Interface {
/** The class `org.apache.directory.api.ldap.model.name.Dn`. */ /** The class `org.apache.directory.api.ldap.model.name.Dn`. */
class TypeApacheDn extends Class { class TypeApacheDn extends Class {
TypeApacheDn() { TypeApacheDn() { this.hasQualifiedName("org.apache.directory.api.ldap.model.name", "Dn") }
this.hasQualifiedName("org.apache.directory.api.ldap.model.name", "Dn")
}
} }

4
java/ql/src/semmle/code/java/frameworks/SpringLdap.qll
View File

@@ -9,7 +9,9 @@ import semmle.code.java.Member
/*--- Types ---*/ /*--- Types ---*/
/** The class `org.springframework.ldap.core.LdapTemplate`. */ /** The class `org.springframework.ldap.core.LdapTemplate`. */
class TypeSpringLdapTemplate extends Class { class TypeSpringLdapTemplate extends Class {
TypeSpringLdapTemplate() { this.hasQualifiedName("org.springframework.ldap.core", "LdapTemplate") } TypeSpringLdapTemplate() {
this.hasQualifiedName("org.springframework.ldap.core", "LdapTemplate")
}
} }
/** The class `org.springframework.ldap.query.LdapQueryBuilder`. */ /** The class `org.springframework.ldap.query.LdapQueryBuilder`. */