hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Consider setStartTLSRequired for Apache SimpleEmail

Browse Source
This commit is contained in:
Tony Torralba
2021-06-30 12:22:48 +02:00
parent baffb0ed89
commit 2d1278ece5
3 changed files with 63 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/semmle/code/java/security/Mail.qll
View File

@@ -33,7 +33,7 @@ predicate isInsecureMailPropertyConfig(VarAccess propertiesVarAccess) {
* Holds if `ma` enables TLS/SSL with Apache Email.
*/
predicate enablesEmailSsl(MethodAccess ma) {
ma.getMethod().hasName("setSSLOnConnect") and
ma.getMethod().hasName(["setSSLOnConnect", "setStartTLSRequired"]) and
ma.getMethod().getDeclaringType() instanceof ApacheEmail and
ma.getArgument(0).(BooleanLiteral).getBooleanValue() = true
}

31
java/ql/test/query-tests/security/CWE-297/InsecureJavaMailTest.java
View File

@@ -4,12 +4,6 @@ import javax.mail.Authenticator;
import javax.mail.PasswordAuthentication;
import javax.mail.Session;
import org.apache.commons.mail.DefaultAuthenticator;
import org.apache.commons.mail.Email;
import org.apache.commons.mail.SimpleEmail;
import java.util.Properties;
class InsecureJavaMailTest {
public void testJavaMail() {
final Properties properties = new Properties();
@@ -46,30 +40,5 @@ class InsecureJavaMailTest {
final Session session = Session.getInstance(properties, authenticator); // Safe
}
public void testSimpleMail() throws Exception {
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setSSLOnConnect(true); // $hasInsecureJavaMail
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
public void testSecureSimpleMail() throws Exception {
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setSSLOnConnect(true); // Safe
email.setSSLCheckServerIdentity(true);
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
}

62
java/ql/test/query-tests/security/CWE-297/InsecureSimpleEmailTest.java Normal file
View File

@@ -0,0 +1,62 @@
import org.apache.commons.mail.DefaultAuthenticator;
import org.apache.commons.mail.Email;
import org.apache.commons.mail.SimpleEmail;
public class InsecureSimpleEmailTest {
public void test() throws Exception {
// with setSSLOnConnect
{
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setSSLOnConnect(true); // $hasInsecureJavaMail
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
// with setStartTLSRequired
{
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setStartTLSRequired(true); // $hasInsecureJavaMail
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
// safe with setSSLOnConnect
{
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setSSLOnConnect(true); // Safe
email.setSSLCheckServerIdentity(true);
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
// safe with setStartTLSRequired
{
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setStartTLSRequired(true); // Safe
email.setSSLCheckServerIdentity(true);
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
}
}