hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17424 from RasmusWL/active-threat-model-source

Browse Source 
Go/Java/C#: Rename `ThreatModelFlowSource` to `ActiveThreatModelSource`
This commit is contained in:
Rasmus Wriedt Larsen
2024-09-26 13:08:17 +02:00
committed by GitHub
parent d7fb7ab551 63c3a71d95
commit 381ea93ec3
141 changed files with 216 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
csharp/ql/lib/change-notes/2024-09-10-ActiveThreatModelSource.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: deprecated
---
* The class `ThreatModelFlowSource` has been renamed to `ActiveThreatModelSource` to more clearly reflect it only contains the currently active threat model sources. `ThreatModelFlowSource` has been marked as deprecated.

2
csharp/ql/lib/semmle/code/csharp/security/auth/InsecureDirectObjectReferenceQuery.qll
View File

@@ -18,7 +18,7 @@ private predicate needsChecks(ActionMethod m) { m.isEdit() and not m.isAdmin() }
* that may indicate that it's used as the ID for some resource
*/
private predicate hasIdParameter(ActionMethod m) {
exists(ThreatModelFlowSource src | src.getEnclosingCallable() = m |
exists(ActiveThreatModelSource src | src.getEnclosingCallable() = m |
src.asParameter().getName().toLowerCase().matches(["%id", "%idx"])
or
// handle cases like `Request.QueryString["Id"]`

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
View File

@@ -55,7 +55,7 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource
deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll
View File

@@ -57,7 +57,7 @@ module CommandInjection = TaintTracking::Global<CommandInjectionConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** Command Injection sinks defined through Models as Data. */
private class ExternalCommandInjectionExprSink extends Sink {

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
View File

@@ -54,7 +54,7 @@ module ConditionalBypass = TaintTracking::Global<ConditionalBypassConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** The result of a reverse dns may be user-controlled. */
class ReverseDnsSource extends Source {

6
csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll
View File

@@ -73,14 +73,14 @@ class ExternalApiDataNode extends DataFlow::Node {
}
}
/** A configuration for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */
/** A configuration for tracking flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s. */
private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}
/** A module for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */
/** A module for tracking flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s. */
module RemoteSourceToExternalApi = TaintTracking::Global<RemoteSourceToExternalApiConfig>;
/** A node representing untrusted data being passed to an external API. */

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
View File

@@ -60,7 +60,7 @@ module LdapInjection = TaintTracking::Global<LdapInjectionConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** LDAP sinks defined through Models as Data. */
private class ExternalLdapExprSink extends Sink {

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
View File

@@ -43,7 +43,7 @@ private module LogForgingConfig implements DataFlow::ConfigSig {
module LogForging = TaintTracking::Global<LogForgingConfig>;
/** A source of remote user input. */
private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
private class HtmlSanitizer extends Sanitizer {
HtmlSanitizer() { this.asExpr() instanceof HtmlSanitizedExpr }

4
csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
View File

@@ -48,7 +48,7 @@ private module MissingXmlValidationConfig implements DataFlow::ConfigSig {
module MissingXmlValidation = TaintTracking::Global<MissingXmlValidationConfig>;
/**
* DEPRECATED: Use `ThreatModelFlowSource` instead.
* DEPRECATED: Use `ActiveThreatModelSource` instead.
*
* A source of remote user input.
*/
@@ -57,7 +57,7 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource
/**
* A source supported by the current threat model.
*/
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* The input argument to a call to `XmlReader.Create` where the input will not be validated against

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
View File

@@ -49,7 +49,7 @@ module ReDoS = TaintTracking::Global<ReDoSConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* An expression that represents a regular expression with potential exponential behavior.

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll
View File

@@ -48,7 +48,7 @@ module RegexInjection = TaintTracking::Global<RegexInjectionConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* A `pattern` argument to a construction of a `Regex`.

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll
View File

@@ -54,7 +54,7 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource
deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** An argument to the `ConnectionString` property on a data connection class. */
class SqlConnectionStringSink extends Sink {

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll
View File

@@ -65,7 +65,7 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource
deprecated class LocalSource extends DataFlow::Node instanceof LocalFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** An SQL expression passed to an API call that executes SQL. */
class SqlInjectionExprSink extends Sink {

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll
View File

@@ -50,7 +50,7 @@ module TaintedPath = TaintTracking::Global<TaintedPathConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* A path argument to a `File` method call.

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
View File

@@ -49,7 +49,7 @@ abstract private class ConstructorOrStaticMethodSink extends Sink { }
*/
abstract class Sanitizer extends DataFlow::Node { }
private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* User input to object method call deserialization flow tracking configuration.

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll
View File

@@ -52,7 +52,7 @@ module UrlRedirect = TaintTracking::Global<UrlRedirectConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** URL Redirection sinks defined through Models as Data. */
private class ExternalUrlRedirectExprSink extends Sink {

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll
View File

@@ -15,7 +15,7 @@ private import semmle.code.csharp.security.Sanitizers
*/
abstract class Source extends DataFlow::Node { }
private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* A data flow sink for untrusted user input used in XML processing.

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll
View File

@@ -58,7 +58,7 @@ module XpathInjection = TaintTracking::Global<XpathInjectionConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/** The `xpath` argument to an `XPathExpression.Compile(..)` call. */
class XPathExpressionCompileSink extends Sink {

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll
View File

@@ -165,7 +165,7 @@ module XssTrackingConfig implements DataFlow::ConfigSig {
module XssTracking = TaintTracking::Global<XssTrackingConfig>;
/** A source supported by the current threat model. */
private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }

11
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll
View File

@@ -20,11 +20,18 @@ abstract class SourceNode extends DataFlow::Node {
}
/**
* DEPRECATED: Use `ActiveThreatModelSource` instead.
*
* A class of data flow sources that respects the
* current threat model configuration.
*/
class ThreatModelFlowSource extends DataFlow::Node {
ThreatModelFlowSource() {
deprecated class ThreatModelFlowSource = ActiveThreatModelSource;
/**
* A data flow source that is enabled in the current threat model configuration.
*/
class ActiveThreatModelSource extends DataFlow::Node {
ActiveThreatModelSource() {
exists(string kind |
// Specific threat model.
currentThreatModel(kind) and

2
csharp/ql/src/Security Features/CWE-091/XMLInjection.ql
View File

@@ -20,7 +20,7 @@ import XmlInjection::PathGraph
* A taint-tracking configuration for untrusted user input used in XML.
*/
module XmlInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc |

2
csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql
View File

@@ -21,7 +21,7 @@ import AssemblyPathInjection::PathGraph
* A taint-tracking configuration for untrusted user input used to load a DLL.
*/
module AssemblyPathInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc, string name, int arg |

2
csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql
View File

@@ -17,7 +17,7 @@ import semmle.code.csharp.frameworks.Format
import FormatString::PathGraph
module FormatStringConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(FormatCall call | call.hasInsertions()).getFormatExpr()

2
csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll
View File

@@ -61,7 +61,7 @@ module TaintedWebClient = TaintTracking::Global<TaintedWebClientConfig>;
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
/** A source supported by the current threat model. */
class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* A path argument to a `WebClient` method call that has an address argument.

2
csharp/ql/src/experimental/CWE-918/RequestForgery.qll
View File

@@ -60,7 +60,7 @@ module RequestForgery {
/**
* A dataflow source for Server Side Request Forgery(SSRF) Vulnerabilities.
*/
private class ThreatModelSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
/**
* An url argument to a `HttpRequestMessage` constructor call

2
csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandArgs.ql
View File

@@ -2,5 +2,5 @@ import csharp
import semmle.code.csharp.security.dataflow.flowsources.FlowSources
from DataFlow::Node source
where source instanceof ThreatModelFlowSource
where source instanceof ActiveThreatModelSource
select source

2
csharp/ql/test/library-tests/dataflow/flowsources/local/commandargs/CommandLineFlow.ql
View File

@@ -2,7 +2,7 @@ import csharp
import semmle.code.csharp.security.dataflow.flowsources.FlowSources
module CommandLineFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc | mc.getTarget().hasName("Sink") | sink.asExpr() = mc.getArgument(0))

2
csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ql
View File

@@ -2,5 +2,5 @@ import csharp
import semmle.code.csharp.security.dataflow.flowsources.FlowSources
from DataFlow::Node source
where source instanceof ThreatModelFlowSource
where source instanceof ActiveThreatModelSource
select source, source.(SourceNode).getThreatModel()

2
csharp/ql/test/library-tests/dataflow/flowsources/stored/database/dapper/DatabaseSources.ql
View File

@@ -4,7 +4,7 @@ import TestUtilities.InlineFlowTest
import TaintFlowTest<DatabaseConfig>
module DatabaseConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc | mc.getTarget().hasName("Sink") | sink.asExpr() = mc.getArgument(0))

2
csharp/ql/test/library-tests/dataflow/flowsources/stored/file/Files.ql
View File

@@ -4,7 +4,7 @@ import TestUtilities.InlineFlowTest
import TaintFlowTest<FilesConfig>
module FilesConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc | mc.getTarget().hasName("Sink") | sink.asExpr() = mc.getArgument(0))

2
csharp/ql/test/library-tests/dataflow/threat-models/Test.qll
View File

@@ -4,7 +4,7 @@ private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private module ThreatModelConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sinkNode(sink, _) }
}

4
go/ql/lib/change-notes/2024-09-10-ActiveThreatModelSource.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: deprecated
---
* The class `ThreatModelFlowSource` has been renamed to `ActiveThreatModelSource` to more clearly reflect it only contains the currently active threat model sources. `ThreatModelFlowSource` has been marked as deprecated.

4
go/ql/lib/semmle/go/security/CommandInjectionCustomizations.qll
View File

@@ -31,12 +31,12 @@ module CommandInjection {
abstract class Sanitizer extends DataFlow::Node { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/** A source of untrusted data, considered as a taint source for command injection. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** A command name, considered as a taint sink for command injection. */
class CommandNameAsSink extends Sink {

8
go/ql/lib/semmle/go/security/ExternalAPIs.qll
View File

@@ -183,24 +183,24 @@ class UnknownExternalApiDataNode extends ExternalApiDataNode {
}
private module UntrustedDataConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}
/**
* Tracks data flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s.
* Tracks data flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s.
*/
module UntrustedDataToExternalApiFlow = DataFlow::Global<UntrustedDataConfig>;
private module UntrustedDataToUnknownExternalApiConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UnknownExternalApiDataNode }
}
/**
* Tracks data flow from `ThreatModelFlowSource`s to `UnknownExternalApiDataNode`s.
* Tracks data flow from `ActiveThreatModelSource`s to `UnknownExternalApiDataNode`s.
*/
module UntrustedDataToUnknownExternalApiFlow =
DataFlow::Global<UntrustedDataToUnknownExternalApiConfig>;

11
go/ql/lib/semmle/go/security/FlowSources.qll
View File

@@ -55,11 +55,18 @@ abstract class SourceNode extends DataFlow::Node {
}
/**
* DEPRECATED: Use `ActiveThreatModelSource` instead.
*
* A class of data flow sources that respects the
* current threat model configuration.
*/
class ThreatModelFlowSource extends DataFlow::Node {
ThreatModelFlowSource() {
deprecated class ThreatModelFlowSource = ActiveThreatModelSource;
/**
* A data flow source that is enabled in the current threat model configuration.
*/
class ActiveThreatModelSource extends DataFlow::Node {
ActiveThreatModelSource() {
exists(string kind |
// Specific threat model.
currentThreatModel(kind) and

4
go/ql/lib/semmle/go/security/LogInjectionCustomizations.qll
View File

@@ -26,12 +26,12 @@ module LogInjection {
abstract class Sanitizer extends DataFlow::Node { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/** A source of untrusted data, considered as a taint source for log injection. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** An argument to a logging mechanism. */
class LoggerSink extends Sink {

2
go/ql/lib/semmle/go/security/MissingJwtSignatureCheckCustomizations.qll
View File

@@ -49,7 +49,7 @@ module MissingJwtSignatureCheck {
}
}
private class DefaultSource extends Source instanceof ThreatModelFlowSource { }
private class DefaultSource extends Source instanceof ActiveThreatModelSource { }
private class DefaultSink extends Sink {
DefaultSink() { sinkNode(this, "jwt") }

4
go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll
View File

@@ -43,14 +43,14 @@ module OpenUrlRedirect {
}
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/**
* A source of third-party user input, considered as a flow source for URL redirects.
*/
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource {
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource {
ThreatModelFlowAsSource() {
// exclude some fields and methods of URLs that are generally not attacker-controllable for
// open redirect exploits

4
go/ql/lib/semmle/go/security/ReflectedXssCustomizations.qll
View File

@@ -35,14 +35,14 @@ module ReflectedXss {
}
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/**
* A third-party controllable input, considered as a flow source for reflected XSS.
*/
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** An arbitrary XSS sink, considered as a flow sink for stored XSS. */
private class AnySink extends Sink instanceof SharedXss::Sink { }

4
go/ql/lib/semmle/go/security/RequestForgeryCustomizations.qll
View File

@@ -34,14 +34,14 @@ module RequestForgery {
abstract class SanitizerEdge extends DataFlow::Node { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/**
* A third-party controllable input, considered as a flow source for request forgery.
*/
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
private class DefaultRequestForgerySink extends Sink {
string kind;

4
go/ql/lib/semmle/go/security/SqlInjectionCustomizations.qll
View File

@@ -26,12 +26,12 @@ module SqlInjection {
abstract class Sanitizer extends DataFlow::Node { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/** A source of untrusted data, considered as a taint source for SQL injection. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** An SQL string, considered as a taint sink for SQL injection. */
class SqlQueryAsSink extends Sink instanceof SQL::QueryString { }

4
go/ql/lib/semmle/go/security/TaintedPathCustomizations.qll
View File

@@ -45,12 +45,12 @@ module TaintedPath {
}
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/** A source of untrusted data, considered as a taint source for path traversal. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** A path expression, considered as a taint sink for path traversal. */
class PathAsSink extends Sink {

2
go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
View File

@@ -21,7 +21,7 @@ module UncontrolledAllocationSize {
abstract class Sanitizer extends DataFlow::Node { }
/** A source of untrusted data, considered as a taint source for uncontrolled size allocation vulnerabilities. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** The size argument of a memory allocation function. */
private class AllocationSizeAsSink extends Sink instanceof AllocationSizeOverflow::AllocationSize {

4
go/ql/lib/semmle/go/security/XPathInjectionCustomizations.qll
View File

@@ -25,12 +25,12 @@ module XPathInjection {
abstract class Sanitizer extends DataFlow::ExprNode { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/** A source of untrusted data, used in an XPath expression. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/** An XPath expression string, considered as a taint sink for XPath injection. */
class XPathExpressionStringAsSink extends Sink instanceof XPath::XPathExpressionString { }

4
go/ql/src/Security/CWE-640/EmailInjectionCustomizations.qll
View File

@@ -17,12 +17,12 @@ module EmailInjection {
abstract class Sink extends DataFlow::Node { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowSourceAsSource = ThreatModelFlowAsSource;
/** A source of untrusted data, considered as a taint source for email injection. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/**
* A data-flow node that becomes part of an email considered as a taint sink for email injection.

8
go/ql/src/experimental/CWE-090/LDAPInjection.qll
View File

@@ -98,13 +98,13 @@ private class LdapClientDNSink extends LdapSink {
/**
* DEPRECATED: Use `LdapInjectionFlow` instead.
*
* A taint-tracking configuration for reasoning about when a `ThreatModelFlowSource`
* A taint-tracking configuration for reasoning about when a `ActiveThreatModelSource`
* flows into an argument or field that is vulnerable to LDAP injection.
*/
deprecated class LdapInjectionConfiguration extends TaintTracking::Configuration {
LdapInjectionConfiguration() { this = "Ldap injection" }
override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
override predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof LdapSink }
@@ -112,7 +112,7 @@ deprecated class LdapInjectionConfiguration extends TaintTracking::Configuration
}
private module LdapInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof LdapSink }
@@ -120,7 +120,7 @@ private module LdapInjectionConfig implements DataFlow::ConfigSig {
}
/**
* Tracks taint flow for reasoning about when a `ThreatModelFlowSource` flows
* Tracks taint flow for reasoning about when a `ActiveThreatModelSource` flows
* into an argument or field that is vulnerable to LDAP injection.
*/
module LdapInjectionFlow = TaintTracking::Global<LdapInjectionConfig>;

2
go/ql/src/experimental/CWE-203/Timing.ql
View File

@@ -98,7 +98,7 @@ private class SensitiveStringSink extends Sink {
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource and not isBadResult(source)
source instanceof ActiveThreatModelSource and not isBadResult(source)
}
predicate isSink(DataFlow::Node sink) { sink instanceof Sink and not isBadResult(sink) }

2
go/ql/src/experimental/CWE-287/ImproperLdapAuthCustomizations.qll
View File

@@ -68,7 +68,7 @@ module ImproperLdapAuth {
private module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource or source instanceof EmptyString
source instanceof ActiveThreatModelSource or source instanceof EmptyString
}
predicate isSink(DataFlow::Node sink) { sink instanceof LdapAuthSink }

2
go/ql/src/experimental/CWE-369/DivideByZero.ql
View File

@@ -28,7 +28,7 @@ predicate divideByZeroSanitizerGuard(DataFlow::Node g, Expr e, boolean branch) {
}
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(Function f, DataFlow::CallNode cn | cn = f.getACall() |

2
go/ql/src/experimental/CWE-74/DsnInjection.ql
View File

@@ -14,7 +14,7 @@ import DsnInjectionCustomizations
import DsnInjectionFlow::PathGraph
/** A remote flow source taken as a source for the `DsnInjection` taint-flow configuration. */
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
from DsnInjectionFlow::PathNode source, DsnInjectionFlow::PathNode sink
where DsnInjectionFlow::flowPath(source, sink)

8
go/ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View File

@@ -36,7 +36,7 @@ class PassthroughTypeName extends string {
}
module UntrustedToPassthroughTypeConversionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
additional predicate isSinkToPassthroughType(DataFlow::TypeCastNode sink, PassthroughTypeName name) {
exists(Type typ |
@@ -53,7 +53,7 @@ module UntrustedToPassthroughTypeConversionConfig implements DataFlow::ConfigSig
}
/**
* Tracks taint flow for reasoning about when a `ThreatModelFlowSource` is
* Tracks taint flow for reasoning about when a `ActiveThreatModelSource` is
* converted into a special "passthrough" type which will not be escaped by the
* template generator; this allows the injection of arbitrary content (html,
* css, js) into the generated output of the templates.
@@ -109,13 +109,13 @@ predicate isSinkToTemplateExec(DataFlow::Node sink, DataFlow::CallNode call) {
}
module FromUntrustedToTemplateExecutionCallConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { isSinkToTemplateExec(sink, _) }
}
/**
* Tracks taint flow from a `ThreatModelFlowSource` into a template executor
* Tracks taint flow from a `ActiveThreatModelSource` into a template executor
* call.
*/
module FromUntrustedToTemplateExecutionCallFlow =

4
go/ql/src/experimental/CWE-807/SensitiveConditionBypass.qll
View File

@@ -52,7 +52,7 @@ deprecated class Configuration extends TaintTracking::Configuration {
Configuration() { this = "Condtional Expression Check Bypass" }
override predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource
source instanceof ActiveThreatModelSource
or
exists(DataFlow::FieldReadNode f |
f.getField().hasQualifiedName("net/http", "Request", "Host")
@@ -71,7 +71,7 @@ deprecated class Configuration extends TaintTracking::Configuration {
private module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource
source instanceof ActiveThreatModelSource
or
exists(DataFlow::FieldReadNode f |
f.getField().hasQualifiedName("net/http", "Request", "Host")

2
go/ql/src/experimental/CWE-840/ConditionalBypass.ql
View File

@@ -14,7 +14,7 @@ import go
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource
source instanceof ActiveThreatModelSource
or
source = any(Field f | f.hasQualifiedName("net/http", "Request", "Host")).getARead()
}

4
go/ql/src/experimental/CWE-918/SSRF.qll
View File

@@ -87,14 +87,14 @@ module ServerSideRequestForgery {
abstract class SanitizerEdge extends DataFlow::Node { }
/**
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
* DEPRECATED: Use `ActiveThreatModelSource` or `Source` instead.
*/
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
/**
* An user controlled input, considered as a flow source for request forgery.
*/
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
private class ThreatModelFlowAsSource extends Source instanceof ActiveThreatModelSource { }
/**
* The URL of an HTTP request, viewed as a sink for request forgery.

16
go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql
View File

@@ -52,7 +52,7 @@ class AllowCredentialsHeaderWrite extends Http::HeaderWrite {
}
module UntrustedToAllowOriginHeaderConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
additional predicate isSinkHW(DataFlow::Node sink, AllowOriginHeaderWrite hw) {
sink = hw.getValue()
@@ -70,7 +70,7 @@ module UntrustedToAllowOriginHeaderConfig implements DataFlow::ConfigSig {
}
module UntrustedToAllowOriginConfigConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
additional predicate isSinkWrite(DataFlow::Node sink, GinCors::AllowOriginsWrite w) { sink = w }
@@ -78,13 +78,13 @@ module UntrustedToAllowOriginConfigConfig implements DataFlow::ConfigSig {
}
/**
* Tracks taint flowfor reasoning about when a `ThreatModelFlowSource` flows to
* Tracks taint flowfor reasoning about when a `ActiveThreatModelSource` flows to
* a `HeaderWrite` that writes an `Access-Control-Allow-Origin` header's value.
*/
module UntrustedToAllowOriginHeaderFlow = TaintTracking::Global<UntrustedToAllowOriginHeaderConfig>;
/**
* Tracks taint flowfor reasoning about when a `ThreatModelFlowSource` flows to
* Tracks taint flowfor reasoning about when a `ActiveThreatModelSource` flows to
* a `AllowOriginsWrite` that writes an `Access-Control-Allow-Origin` header's value.
*/
module UntrustedToAllowOriginConfigFlow = TaintTracking::Global<UntrustedToAllowOriginConfigConfig>;
@@ -121,7 +121,7 @@ predicate allowCredentialsIsSetToTrue(DataFlow::ExprNode allowOriginHW) {
/**
* Holds if the provided `allowOriginHW` HeaderWrite's value is set using an
* ThreatModelFlowSource.
* ActiveThreatModelSource.
* The `message` parameter is populated with the warning message to be returned by the query.
*/
predicate flowsFromUntrustedToAllowOrigin(DataFlow::ExprNode allowOriginHW, string message) {
@@ -169,7 +169,7 @@ class MapRead extends DataFlow::ElementReadNode {
}
module FromUntrustedConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { isSinkCgn(sink, _) }
@@ -208,13 +208,13 @@ module FromUntrustedConfig implements DataFlow::ConfigSig {
}
/**
* Tracks taint flow for reasoning about when a `ThreatModelFlowSource` flows
* Tracks taint flow for reasoning about when a `ActiveThreatModelSource` flows
* somewhere.
*/
module FromUntrustedFlow = TaintTracking::Global<FromUntrustedConfig>;
/**
* Holds if the provided `allowOriginHW` is also destination of a `ThreatModelFlowSource`.
* Holds if the provided `allowOriginHW` is also destination of a `ActiveThreatModelSource`.
*/
predicate flowsToGuardedByCheckOnUntrusted(DataFlow::ExprNode allowOriginHW) {
exists(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn |

2
go/ql/src/experimental/frameworks/DecompressionBombs.qll
View File

@@ -29,7 +29,7 @@ module DecompressionBomb {
class FlowState = DecompressionBombs::FlowState;
predicate isSource(DataFlow::Node source, FlowState state) {
source instanceof ThreatModelFlowSource and
source instanceof ActiveThreatModelSource and
state = ""
}

2
go/ql/test/library-tests/semmle/go/dataflow/ThreatModels/Test.qll
View File

@@ -4,7 +4,7 @@ private import semmle.go.dataflow.ExternalFlow
private import semmle.go.dataflow.DataFlow
private module ThreatModelConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
sink = any(DataFlow::CallNode c | c.getTarget().getName() = "sink").getAnArgument()

2
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/environment/test.ql
View File

@@ -6,7 +6,7 @@ module SourceTest implements TestSig {
string getARelevantTag() { result = "source" }
predicate hasActualResult(Location location, string element, string tag, string value) {
exists(ThreatModelFlowSource s |
exists(ActiveThreatModelSource s |
s.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = s.toString() and

2
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/file/test.ql
View File

@@ -6,7 +6,7 @@ module SourceTest implements TestSig {
string getARelevantTag() { result = "source" }
predicate hasActualResult(Location location, string element, string tag, string value) {
exists(ThreatModelFlowSource s |
exists(ActiveThreatModelSource s |
s.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = s.toString() and

4
java/ql/lib/change-notes/2024-09-10-ActiveThreatModelSource.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: deprecated
---
* The class `ThreatModelFlowSource` has been renamed to `ActiveThreatModelSource` to more clearly reflect it only contains the currently active threat model sources. `ThreatModelFlowSource` has been marked as deprecated.

15
java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -42,11 +42,18 @@ abstract class SourceNode extends DataFlow::Node {
}
/**
* DEPRECATED: Use `ActiveThreatModelSource` instead.
*
* A class of data flow sources that respects the
* current threat model configuration.
*/
class ThreatModelFlowSource extends DataFlow::Node {
ThreatModelFlowSource() {
deprecated class ThreatModelFlowSource = ActiveThreatModelSource;
/**
* A data flow source that is enabled in the current threat model configuration.
*/
class ActiveThreatModelSource extends DataFlow::Node {
ActiveThreatModelSource() {
exists(string kind |
// Specific threat model.
currentThreatModel(kind) and
@@ -195,7 +202,7 @@ abstract class LocalUserInput extends UserInput {
/**
* DEPRECATED: Use the threat models feature.
* That is, use `ThreatModelFlowSource` as the class of nodes for sources
* That is, use `ActiveThreatModelSource` as the class of nodes for sources
* and set up the threat model configuration to filter source nodes.
* Alternatively, use `getThreatModel` to filter nodes to create the
* class of nodes you need.
@@ -266,7 +273,7 @@ private class FileInput extends LocalUserInput {
/**
* DEPRECATED: Use the threat models feature.
* That is, use `ThreatModelFlowSource` as the class of nodes for sources
* That is, use `ActiveThreatModelSource` as the class of nodes for sources
* and set up the threat model configuration to filter source nodes.
* Alternatively, use `getThreatModel` to filter nodes to create the
* class of nodes you need.

2
java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -640,7 +640,7 @@ private MethodCall callReturningSameType(Expr ref) {
}
private SrcRefType entrypointType() {
exists(ThreatModelFlowSource s, RefType t |
exists(ActiveThreatModelSource s, RefType t |
s instanceof DataFlow::ExplicitParameterNode and
t = pragma[only_bind_out](s).getType() and
not t instanceof TypeObject and

6
java/ql/lib/semmle/code/java/security/AndroidIntentRedirectionQuery.qll
View File

@@ -9,7 +9,7 @@ import semmle.code.java.security.AndroidIntentRedirection
/** A taint tracking configuration for tainted Intents being used to start Android components. */
module IntentRedirectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof IntentRedirectionSink }
@@ -38,7 +38,7 @@ private class OriginalIntentSanitizer extends IntentRedirectionSanitizer {
* flowing directly to sinks that start Android components.
*/
private module SameIntentBeingRelaunchedConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof IntentRedirectionSink }
@@ -74,7 +74,7 @@ private class IntentWithTaintedComponent extends DataFlow::Node {
* A taint tracking configuration for tainted data flowing to an `Intent`'s component.
*/
private module TaintedIntentComponentConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
any(IntentSetComponent setComponent).getSink() = sink.asExpr()

2
java/ql/lib/semmle/code/java/security/ArbitraryApkInstallation.qll
View File

@@ -75,7 +75,7 @@ class ExternalApkSource extends ApiSourceNode {
sourceNode(this, "android-external-storage-dir") or
this.asExpr().(MethodCall).getMethod() instanceof UriConstructorMethod or
this.asExpr().(StringLiteral).getValue().matches("file://%") or
this instanceof ThreatModelFlowSource
this instanceof ActiveThreatModelSource
}
}

4
java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
View File

@@ -6,7 +6,7 @@ private import semmle.code.java.security.ArithmeticCommon
/** A taint-tracking configuration to reason about overflow from unvalidated input. */
module ArithmeticOverflowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
@@ -22,7 +22,7 @@ deprecated module RemoteUserInputOverflowConfig = ArithmeticOverflowConfig;
/** A taint-tracking configuration to reason about underflow from unvalidated input. */
module ArithmeticUnderflowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }

2
java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
View File

@@ -49,7 +49,7 @@ private class DefaultCommandInjectionSanitizer extends CommandInjectionSanitizer
* A taint-tracking configuration for unvalidated user input that is used to run an external process.
*/
module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }

2
java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
View File

@@ -40,7 +40,7 @@ private predicate endsWithStep(DataFlow::Node node1, DataFlow::Node node2) {
* A taint tracking configuration for untrusted data flowing to sensitive conditions.
*/
module ConditionalBypassFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { conditionControlsMethod(_, sink.asExpr()) }

4
java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
View File

@@ -93,10 +93,10 @@ class ExternalApiDataNode extends DataFlow::Node {
}
/**
* Taint tracking configuration for flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s.
* Taint tracking configuration for flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s.
*/
module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}

2
java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringQuery.qll
View File

@@ -16,7 +16,7 @@ private class StringFormatSink extends ApiSinkNode {
* A taint-tracking configuration for externally controlled format string vulnerabilities.
*/
module ExternallyControlledFormatStringConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof StringFormatSink }

2
java/ql/lib/semmle/code/java/security/FragmentInjectionQuery.qll
View File

@@ -10,7 +10,7 @@ import semmle.code.java.security.FragmentInjection
* that is used to create Android fragments dynamically.
*/
module FragmentInjectionTaintConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof FragmentInjectionSink }

2
java/ql/lib/semmle/code/java/security/GroovyInjectionQuery.qll
View File

@@ -10,7 +10,7 @@ import semmle.code.java.security.GroovyInjection
* that is used to evaluate a Groovy expression.
*/
module GroovyInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof GroovyInjectionSink }

2
java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
View File

@@ -9,7 +9,7 @@ private import semmle.code.java.dataflow.FlowSources
* user-provided size used for array construction.
*/
module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)

2
java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
View File

@@ -9,7 +9,7 @@ private import semmle.code.java.dataflow.FlowSources
* of user-provided array index.
*/
module ImproperValidationOfArrayIndexConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
any(CheckableArrayAccess caa).canThrowOutOfBounds(sink.asExpr())

2
java/ql/lib/semmle/code/java/security/InsecureBeanValidationQuery.qll
View File

@@ -46,7 +46,7 @@ class SetMessageInterpolatorCall extends MethodCall {
* to the argument of a method that builds constraint error messages.
*/
module BeanValidationConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof BeanValidationSink }

2
java/ql/lib/semmle/code/java/security/IntentUriPermissionManipulationQuery.qll
View File

@@ -12,7 +12,7 @@ private import IntentUriPermissionManipulation
* A taint tracking configuration for user-provided Intents being returned to third party apps.
*/
module IntentUriPermissionManipulationConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof IntentUriPermissionManipulationSink }

2
java/ql/lib/semmle/code/java/security/JexlInjectionQuery.qll
View File

@@ -44,7 +44,7 @@ private class DefaultJexlInjectionAdditionalTaintStep extends JexlInjectionAddit
* It supports both JEXL 2 and 3.
*/
module JexlInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }

2
java/ql/lib/semmle/code/java/security/JndiInjectionQuery.qll
View File

@@ -11,7 +11,7 @@ private import semmle.code.java.security.Sanitizers
* A taint-tracking configuration for unvalidated user input that is used in JNDI lookup.
*/
module JndiInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof JndiInjectionSink }

2
java/ql/lib/semmle/code/java/security/LdapInjectionQuery.qll
View File

@@ -8,7 +8,7 @@ import semmle.code.java.security.LdapInjection
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/
module LdapInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof LdapInjectionSink }

2
java/ql/lib/semmle/code/java/security/LogInjectionQuery.qll
View File

@@ -8,7 +8,7 @@ import semmle.code.java.security.LogInjection
* A taint-tracking configuration for tracking untrusted user input used in log entries.
*/
module LogInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof LogInjectionSink }

2
java/ql/lib/semmle/code/java/security/MvelInjectionQuery.qll
View File

@@ -10,7 +10,7 @@ import semmle.code.java.security.MvelInjection
* that is used to construct and evaluate a MVEL expression.
*/
module MvelInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof MvelEvaluationSink }

2
java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
View File

@@ -85,7 +85,7 @@ private predicate smallExpr(Expr e) {
* numeric cast.
*/
module NumericCastFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(NumericNarrowingCastExpr cast).getExpr() and

2
java/ql/lib/semmle/code/java/security/OgnlInjectionQuery.qll
View File

@@ -9,7 +9,7 @@ private import semmle.code.java.security.Sanitizers
* A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
*/
module OgnlInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof OgnlInjectionSink }

2
java/ql/lib/semmle/code/java/security/PartialPathTraversalQuery.qll
View File

@@ -12,7 +12,7 @@ import semmle.code.java.dataflow.FlowSources
* and remains vulnerable to Partial Path Traversal.
*/
module PartialPathTraversalFromRemoteConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node node) { node instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node node) {
any(PartialPathTraversalMethodCall ma).getQualifier() = node.asExpr()

2
java/ql/lib/semmle/code/java/security/RequestForgeryConfig.qll
View File

@@ -12,7 +12,7 @@ import semmle.code.java.security.RequestForgery
*/
module RequestForgeryConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource and
source instanceof ActiveThreatModelSource and
// Exclude results of remote HTTP requests: fetching something else based on that result
// is no worse than following a redirect returned by the remote server, and typically
// we're requesting a resource via https which we trust to only send us to safe URLs.

2
java/ql/lib/semmle/code/java/security/ResponseSplittingQuery.qll
View File

@@ -10,7 +10,7 @@ import semmle.code.java.security.ResponseSplitting
*/
module ResponseSplittingConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource and
source instanceof ActiveThreatModelSource and
not source instanceof SafeHeaderSplittingSource
}

2
java/ql/lib/semmle/code/java/security/SensitiveResultReceiverQuery.qll
View File

@@ -19,7 +19,7 @@ private class ResultReceiverSendCall extends MethodCall {
}
private module UntrustedResultReceiverConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node node) { node instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node node) {
node.asExpr() = any(ResultReceiverSendCall c).getReceiver()

2
java/ql/lib/semmle/code/java/security/SpelInjectionQuery.qll
View File

@@ -11,7 +11,7 @@ private import semmle.code.java.security.SpelInjection
* that is used to construct and evaluate a SpEL expression.
*/
module SpelInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof SpelExpressionEvaluationSink }

2
java/ql/lib/semmle/code/java/security/SqlInjectionQuery.qll
View File

@@ -15,7 +15,7 @@ import semmle.code.java.security.QueryInjection
* A taint-tracking configuration for unvalidated user input that is used in SQL queries.
*/
module QueryInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }

2
java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll
View File

@@ -26,7 +26,7 @@ abstract class ExecTaintedEnvironmentSanitizer extends DataFlow::Node { }
* A taint-tracking configuration that tracks flow from unvalidated data to an environment variable for a subprocess.
*/
module ExecTaintedEnvironmentConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof ExecTaintedEnvironmentSanitizer }

2
java/ql/lib/semmle/code/java/security/TaintedPathQuery.qll
View File

@@ -60,7 +60,7 @@ private class TaintPreservingUriCtorParam extends Parameter {
* A taint-tracking configuration for tracking flow from remote sources to the creation of a path.
*/
module TaintedPathConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof TaintedPathSink }

2
java/ql/lib/semmle/code/java/security/TaintedPermissionsCheckQuery.qll
View File

@@ -54,7 +54,7 @@ private class WildCardPermissionConstruction extends ClassInstanceExpr, Permissi
* A configuration for tracking flow from user input to a permissions check.
*/
module TaintedPermissionsCheckFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(PermissionsConstruction p).getInput()

2
java/ql/lib/semmle/code/java/security/TemplateInjection.qll
View File

@@ -83,7 +83,7 @@ abstract deprecated class TemplateInjectionSanitizerWithState extends DataFlow::
abstract deprecated predicate hasState(DataFlow::FlowState state);
}
private class DefaultTemplateInjectionSource extends TemplateInjectionSource instanceof ThreatModelFlowSource
private class DefaultTemplateInjectionSource extends TemplateInjectionSource instanceof ActiveThreatModelSource
{ }
private class DefaultTemplateInjectionSink extends TemplateInjectionSink {

2
java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
View File

@@ -13,7 +13,7 @@ private import semmle.code.java.security.Sanitizers
*/
abstract class TrustBoundaryViolationSource extends DataFlow::Node { }
private class ThreatModelSource extends TrustBoundaryViolationSource instanceof ThreatModelFlowSource
private class ThreatModelSource extends TrustBoundaryViolationSource instanceof ActiveThreatModelSource
{ }
/**

2
java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll
View File

@@ -10,7 +10,7 @@ import semmle.code.java.security.UnsafeAndroidAccess
* A taint configuration tracking flow from untrusted inputs to a resource fetching call.
*/
module FetchUntrustedResourceConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UrlResourceSink }

2
java/ql/lib/semmle/code/java/security/UnsafeContentUriResolutionQuery.qll
View File

@@ -9,7 +9,7 @@ import semmle.code.java.security.UnsafeContentUriResolution
* A taint-tracking configuration to find paths from remote sources to content URI resolutions.
*/
module UnsafeContentResolutionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ContentUriResolutionSink }

4
java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
View File

@@ -316,7 +316,7 @@ private predicate isUnsafeDeserializationTaintStep(DataFlow::Node pred, DataFlow
/** Tracks flows from remote user input to a deserialization sink. */
private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserializationSink }
@@ -418,7 +418,7 @@ private predicate isUnsafeTypeAdditionalTaintStep(DataFlow::Node fromNode, DataF
* If this is user-controlled, arbitrary code could be executed while instantiating the user-specified type.
*/
module UnsafeTypeConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeTypeSink }

2
java/ql/lib/semmle/code/java/security/UrlForwardQuery.qll
View File

@@ -178,7 +178,7 @@ private class FullyDecodesUrlBarrier extends DataFlow::Node {
*/
module UrlForwardFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof ThreatModelFlowSource and
source instanceof ActiveThreatModelSource and
// excluded due to FPs
not exists(MethodCall mc, Method m |
m instanceof HttpServletRequestGetRequestUriMethod or

2
java/ql/lib/semmle/code/java/security/UrlRedirectQuery.qll
View File

@@ -8,7 +8,7 @@ private import semmle.code.java.security.UrlRedirect
* A taint-tracking configuration for reasoning about URL redirections.
*/
module UrlRedirectConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UrlRedirectSink }

2
java/ql/lib/semmle/code/java/security/XPathInjectionQuery.qll
View File

@@ -9,7 +9,7 @@ private import semmle.code.java.security.XPath
* A taint-tracking configuration for reasoning about XPath injection vulnerabilities.
*/
module XPathInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof XPathInjectionSink }

2
java/ql/lib/semmle/code/java/security/XsltInjectionQuery.qll
View File

@@ -11,7 +11,7 @@ private import semmle.code.java.security.Sanitizers
* A taint-tracking configuration for unvalidated user input that is used in XSLT transformation.
*/
module XsltInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSink(DataFlow::Node sink) { sink instanceof XsltInjectionSink }

Some files were not shown because too many files have changed in this diff Show More