hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-01 13:23:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3543 from porcupineyhairs/WebsocketReadAsSource

Browse Source 
Java: add websocket reads as remote flow source.
This commit is contained in:
Anders Schack-Mulligen
2020-09-01 10:58:02 +02:00
committed by GitHub
parent beca44ec2f 4f07733b06
commit 1dae99e4a5
3 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
java/ql/src/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -15,6 +15,7 @@ import semmle.code.java.frameworks.ApacheHttp
import semmle.code.java.frameworks.android.XmlParsing
import semmle.code.java.frameworks.android.WebView
import semmle.code.java.frameworks.JaxWS
import semmle.code.java.frameworks.javase.WebSocket
import semmle.code.java.frameworks.android.Intent
import semmle.code.java.frameworks.spring.SpringWeb
import semmle.code.java.frameworks.spring.SpringController
@@ -155,6 +156,14 @@ private class ThriftIfaceParameterSource extends RemoteFlowSource {
override string getSourceType() { result = "Thrift Iface parameter" }
}
private class WebSocketMessageParameterSource extends RemoteFlowSource {
WebSocketMessageParameterSource() {
exists(WebsocketOnText t | t.getParameter(1) = this.asParameter())
}
override string getSourceType() { result = "Websocket onText parameter" }
}
/** Class for `tainted` user input. */
abstract class UserInput extends DataFlow::Node { }

21
java/ql/src/semmle/code/java/frameworks/javase/WebSocket.qll Normal file
View File

@@ -0,0 +1,21 @@
/**
* Provides classes for identifying methods called by the Java SE WebSocket package.
*/
import java
/** The `java.net.http.Websocket.Listener` interface. */
class WebsocketListener extends Interface {
WebsocketListener() { this.hasQualifiedName("java.net.http", "WebSocket$Listener") }
}
/** The method `onText` on a type that implements the `java.net.http.Websocket.Listener` interface. */
class WebsocketOnText extends Method {
WebsocketOnText() {
exists(WebsocketListener l |
this.getDeclaringType().extendsOrImplements(l) and
// onText(WebSocket webSocket, CharSequence data, boolean last)
this.hasName("onText")
)
}
}