hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Attempt to use information-leak sink category

Browse Source
This commit is contained in:
Alvaro Muñoz
2021-05-30 00:22:40 +02:00
parent ece84d13e5
commit 41d034d5a0
3 changed files with 33 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
View File

@@ -16,6 +16,7 @@ import java
import semmle.code.java.dataflow.DataFlow import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.XSS import semmle.code.java.security.XSS
import semmle.code.java.security.InformationLeak
/** /**
* One of the `printStackTrace()` overloads on `Throwable`. * One of the `printStackTrace()` overloads on `Throwable`.
@@ -83,14 +84,17 @@ predicate stackTraceExpr(Expr exception, MethodAccess stackTraceString) {
) )
} }
class StackTraceStringToXssSinkFlowConfig extends TaintTracking::Configuration { class StackTraceStringToHTTPResponseSinkFlowConfig extends TaintTracking::Configuration {
StackTraceStringToXssSinkFlowConfig() { StackTraceStringToHTTPResponseSinkFlowConfig() {
this = "StackTraceExposure::StackTraceStringToXssSinkFlowConfig" this = "StackTraceExposure::StackTraceStringToHTTPResponseSinkFlowConfig"
} }
override predicate isSource(DataFlow::Node src) { stackTraceExpr(_, src.asExpr()) } override predicate isSource(DataFlow::Node src) { stackTraceExpr(_, src.asExpr()) }
override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink } override predicate isSink(DataFlow::Node sink) {
sink instanceof XssSink or
sink instanceof InformationLeakSink
}
} }
/** /**
@@ -106,7 +110,7 @@ predicate printsStackExternally(MethodAccess call, Expr stackTrace) {
* A stringified stack trace flows to an external sink. * A stringified stack trace flows to an external sink.
*/ */
predicate stringifiedStackFlowsExternally(XssSink externalExpr, Expr stackTrace) { predicate stringifiedStackFlowsExternally(XssSink externalExpr, Expr stackTrace) {
exists(MethodAccess stackTraceString, StackTraceStringToXssSinkFlowConfig conf | exists(MethodAccess stackTraceString, StackTraceStringToHTTPResponseSinkFlowConfig conf |
stackTraceExpr(stackTrace, stackTraceString) and stackTraceExpr(stackTrace, stackTraceString) and
conf.hasFlow(DataFlow::exprNode(stackTraceString), externalExpr) conf.hasFlow(DataFlow::exprNode(stackTraceString), externalExpr)
) )

1
java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -79,6 +79,7 @@ private module Frameworks {
private import semmle.code.java.frameworks.guava.Guava private import semmle.code.java.frameworks.guava.Guava
private import semmle.code.java.frameworks.jackson.JacksonSerializability private import semmle.code.java.frameworks.jackson.JacksonSerializability
private import semmle.code.java.security.ResponseSplitting private import semmle.code.java.security.ResponseSplitting
private import semmle.code.java.security.InformationLeak
private import semmle.code.java.security.XSS private import semmle.code.java.security.XSS
private import semmle.code.java.security.LdapInjection private import semmle.code.java.security.LdapInjection
private import semmle.code.java.security.XPath private import semmle.code.java.security.XPath

23
java/ql/src/semmle/code/java/security/InformationLeak.qll Normal file
View File

@@ -0,0 +1,23 @@
/** Provides classes to reason about System Information Leak vulnerabilities. */
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.ExternalFlow
/** CSV sink models representing methods not susceptible to XSS but outputing to an HTTP response body. */
private class DefaultInformationLeakSinkModel extends SinkModelCsv {
override predicate row(string row) {
row =
[
"javax.servlet.http;HttpServletResponse;false;sendError;(int,String);;Argument[1];information-leak"
]
}
}
/** A sink that represent a method that outputs data to an HTTP response. */
abstract class InformationLeakSink extends DataFlow::Node { }
/** A default sink representing methods outputing data to an HTTP response. */
private class DefaultInformationLeakSink extends InformationLeakSink {
DefaultInformationLeakSink() { sinkNode(this, "information-leak") }
}