hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor Security.CWE.CWE-807.TaintedPermissionsCheck

Browse Source
This commit is contained in:
Ed Minnix
2023-03-15 15:21:24 -04:00
parent a9561a97c3
commit 310af99843
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
java/ql/src/Security/CWE/CWE-807/TaintedPermissionsCheck.ql
View File

@@ -14,7 +14,7 @@
import java
import semmle.code.java.dataflow.FlowSources
import DataFlow::PathGraph
import semmle.code.java.dataflow.TaintTracking
class TypeShiroSubject extends RefType {
TypeShiroSubject() { this.getQualifiedName() = "org.apache.shiro.subject.Subject" }
@@ -52,19 +52,22 @@ class WCPermissionConstruction extends ClassInstanceExpr, PermissionsConstructio
override Expr getInput() { result = this.getArgument(0) }
}
class TaintedPermissionsCheckFlowConfig extends TaintTracking::Configuration {
TaintedPermissionsCheckFlowConfig() { this = "TaintedPermissionsCheckFlowConfig" }
private module TaintedPermissionsCheckFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof UserInput }
override predicate isSource(DataFlow::Node source) { source instanceof UserInput }
override predicate isSink(DataFlow::Node sink) {
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(PermissionsConstruction p).getInput()
}
}
module TaintedPermissionsCheckFlow = TaintTracking::Make<TaintedPermissionsCheckFlowConfig>;
import TaintedPermissionsCheckFlow::PathGraph
from
DataFlow::PathNode source, DataFlow::PathNode sink, PermissionsConstruction p,
TaintedPermissionsCheckFlowConfig conf
where sink.getNode().asExpr() = p.getInput() and conf.hasFlowPath(source, sink)
TaintedPermissionsCheckFlow::PathNode source, TaintedPermissionsCheckFlow::PathNode sink,
PermissionsConstruction p
where
sink.getNode().asExpr() = p.getInput() and TaintedPermissionsCheckFlow::hasFlowPath(source, sink)
select p, source, sink, "Permissions check depends on a $@.", source.getNode(),
"user-controlled value"