hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Move shared code to the lib folder and update qldoc

Browse Source
This commit is contained in:
luchua-bc
2022-02-15 17:28:13 +00:00
parent fd533f2ba8
commit 40bf093d34
4 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.qhelp
View File

@@ -6,12 +6,12 @@
<overview>
<p>External Control of File Name or Path, also called File Path Injection, is a vulnerability by which
a file path is created using data from outside the application (such as the HTTP request, the database, or
the filesystem). It allows an attacker to traverse through the filesystem and access arbitrary files.</p>
a file path is created using data from outside the application (such as the HTTP request). It allows
an attacker to traverse through the filesystem and access arbitrary files.</p>
</overview>
<recommendation>
<p>Unsanitized user-provided data must not be used to construct the file path. In order to prevent File
<p>Unsanitized user-provided data must not be used to construct file paths. In order to prevent File
Path Injection, it is recommended to avoid concatenating user input directly into the file path. Instead,
user input should be checked against allowed or disallowed paths (for example, the path must be within
<code>/user_content/</code> or must not be within <code>/internal</code>), ensuring that neither path

2
java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql
View File

@@ -15,7 +15,7 @@ import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.PathCreation
import JFinalController
import PathSanitizer
import experimental.semmle.code.java.PathSanitizer
import DataFlow::PathGraph
class InjectFilePathConfig extends TaintTracking::Configuration {

11
java/ql/src/experimental/Security/CWE/CWE-073/JFinalController.qll
View File

@@ -22,7 +22,7 @@ class SetSessionAttributeMethod extends Method {
}
}
/** The request attribute getter method of `JFinalController`. */
/** A request attribute getter method of `JFinalController`. */
class GetRequestAttributeMethod extends Method {
GetRequestAttributeMethod() {
this.getName().matches("getAttr%") and
@@ -30,7 +30,7 @@ class GetRequestAttributeMethod extends Method {
}
}
/** The request attribute setter method of `JFinalController`. */
/** A request attribute setter method of `JFinalController`. */
class SetRequestAttributeMethod extends Method {
SetRequestAttributeMethod() {
this.getName() = ["set", "setAttr"] and
@@ -38,7 +38,10 @@ class SetRequestAttributeMethod extends Method {
}
}
/** Value step from the setter call to the getter call of a session or request attribute. */
/**
* Value step from a setter call to a corresponding getter call relating to a
* session or request attribute.
*/
private class SetToGetAttributeStep extends AdditionalValueStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(MethodAccess gma, MethodAccess sma |
@@ -58,7 +61,7 @@ private class SetToGetAttributeStep extends AdditionalValueStep {
}
}
/** Source model of remote flow source with `JFinal`. */
/** Remote flow source models relating to `JFinal`. */
private class JFinalControllerSource extends SourceModelCsv {
override predicate row(string row) {
row =

0
java/ql/src/experimental/Security/CWE/CWE-073/PathSanitizer.qll → java/ql/src/experimental/semmle/code/java/PathSanitizer.qll
View File