hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactor TimingAttackAgainstHeader

Browse Source
This commit is contained in:
Ed Minnix
2023-04-12 13:12:17 -04:00
parent a186b771ba
commit 157b7ceaff
1 changed files with 8 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/src/experimental/Security/CWE/CWE-208/TimingAttackAgainstHeader.ql
View File

@@ -14,7 +14,7 @@
import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph
import NonConstantTimeComparisonFlow::PathGraph
/** A static method that uses a non-constant-time algorithm for comparing inputs. */
private class NonConstantTimeComparisonCall extends StaticMethodAccess {
@@ -54,20 +54,18 @@ class ClientSuppliedIpTokenCheck extends DataFlow::Node {
}
}
class NonConstantTimeComparisonConfig extends TaintTracking::Configuration {
NonConstantTimeComparisonConfig() { this = "NonConstantTimeComparisonConfig" }
module NonConstantTimeComparisonConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ClientSuppliedIpTokenCheck }
override predicate isSource(DataFlow::Node source) {
source instanceof ClientSuppliedIpTokenCheck
}
override predicate isSink(DataFlow::Node sink) {
predicate isSink(DataFlow::Node sink) {
isNonConstantEqualsCallArgument(sink.asExpr()) or
isNonConstantComparisonCallArgument(sink.asExpr())
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, NonConstantTimeComparisonConfig conf
where conf.hasFlowPath(source, sink)
module NonConstantTimeComparisonFlow = TaintTracking::Global<NonConstantTimeComparisonConfig>;
from NonConstantTimeComparisonFlow::PathNode source, NonConstantTimeComparisonFlow::PathNode sink
where NonConstantTimeComparisonFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "Possible timing attack against $@ validation.",
source.getNode(), "client-supplied token"