hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-11 01:54:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: rename 'UnsafeUrlForward' to 'UrlForward'

Browse Source
This commit is contained in:
Jami Cogswell
2023-12-01 08:56:20 -05:00
parent 6e7c05467b
commit 09bc21dbd3
11 changed files with 57 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/lib/semmle/code/java/security/UnsafeUrlForward.qll → java/ql/lib/semmle/code/java/security/UrlForward.qll
View File

@@ -1,23 +1,23 @@
/** Provides classes related to unsafe URL forwarding in Java. */
/** Provides classes to reason about URL forward attacks. */
import java
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.dataflow.StringPrefixes
/** A sink for unsafe URL forward vulnerabilities. */
abstract class UnsafeUrlForwardSink extends DataFlow::Node { }
/** A URL forward sink. */
abstract class UrlForwardSink extends DataFlow::Node { }
/** A default sink representing methods susceptible to unsafe URL forwarding. */
private class DefaultUnsafeUrlForwardSink extends UnsafeUrlForwardSink {
DefaultUnsafeUrlForwardSink() { sinkNode(this, "url-forward") }
/** A default sink representing methods susceptible to URL forwarding attacks. */
private class DefaultUrlForwardSink extends UrlForwardSink {
DefaultUrlForwardSink() { sinkNode(this, "url-forward") }
}
/**
* An expression appended (perhaps indirectly) to `"forward:"`, and which
* is reachable from a Spring entry point.
*/
private class SpringUrlForwardSink extends UnsafeUrlForwardSink {
private class SpringUrlForwardSink extends UrlForwardSink {
SpringUrlForwardSink() {
// TODO: check if can use MaD "Annotated" for `SpringRequestMappingMethod` or if too complicated for MaD (probably too complicated).
any(SpringRequestMappingMethod sqmm).polyCalls*(this.getEnclosingCallable()) and
@@ -32,10 +32,10 @@ private class ForwardPrefix extends InterestingPrefix {
override int getOffset() { result = 0 }
}
/** A sanitizer for unsafe URL forward vulnerabilities. */
abstract class UnsafeUrlForwardSanitizer extends DataFlow::Node { }
/** A URL forward sanitizer. */
abstract class UrlForwardSanitizer extends DataFlow::Node { }
private class PrimitiveSanitizer extends UnsafeUrlForwardSanitizer {
private class PrimitiveSanitizer extends UrlForwardSanitizer {
PrimitiveSanitizer() {
this.getType() instanceof PrimitiveType or
this.getType() instanceof BoxedType or
@@ -44,7 +44,7 @@ private class PrimitiveSanitizer extends UnsafeUrlForwardSanitizer {
}
// TODO: double-check this sanitizer (and should I switch all "sanitizer" naming to "barrier" instead?)
private class FollowsSanitizingPrefix extends UnsafeUrlForwardSanitizer {
private class FollowsSanitizingPrefix extends UrlForwardSanitizer {
FollowsSanitizingPrefix() { this.asExpr() = any(SanitizingPrefix fp).getAnAppendedExpression() }
}

18
java/ql/lib/semmle/code/java/security/UnsafeUrlForwardQuery.qll → java/ql/lib/semmle/code/java/security/UrlForwardQuery.qll
View File

@@ -1,18 +1,18 @@
/** Provides configurations to be used in queries related to unsafe URL forwarding. */
/** Provides a taint-tracking configuration for reasoning about URL forwarding. */
import java
import semmle.code.java.security.UnsafeUrlForward
import semmle.code.java.security.UrlForward
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.PathSanitizer
/**
* A taint-tracking configuration for untrusted user input in a URL forward or include.
* A taint-tracking configuration for reasoning about URL forwarding.
*/
module UnsafeUrlForwardFlowConfig implements DataFlow::ConfigSig {
module UrlForwardFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource and
// TODO: move below logic to class in UnsafeUrlForward.qll? And check exactly why these were excluded.
// TODO: move below logic to class in UrlForward.qll? And check exactly why these were excluded.
not exists(MethodCall ma, Method m | ma.getMethod() = m |
(
m instanceof HttpServletRequestGetRequestUriMethod or
@@ -23,10 +23,10 @@ module UnsafeUrlForwardFlowConfig implements DataFlow::ConfigSig {
)
}
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeUrlForwardSink }
predicate isSink(DataFlow::Node sink) { sink instanceof UrlForwardSink }
predicate isBarrier(DataFlow::Node node) {
node instanceof UnsafeUrlForwardSanitizer or
node instanceof UrlForwardSanitizer or
node instanceof PathInjectionSanitizer
}
@@ -35,6 +35,6 @@ module UnsafeUrlForwardFlowConfig implements DataFlow::ConfigSig {
}
/**
* Taint-tracking flow for untrusted user input in a URL forward or include.
* Taint-tracking flow for URL forwarding.
*/
module UnsafeUrlForwardFlow = TaintTracking::Global<UnsafeUrlForwardFlowConfig>;
module UrlForwardFlow = TaintTracking::Global<UrlForwardFlowConfig>;