hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor JndiInjection

Browse Source
This commit is contained in:
Ed Minnix
2023-03-21 17:42:19 -04:00
parent 8bf3315bb5
commit 423ab1d9cf
3 changed files with 33 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
java/ql/lib/semmle/code/java/security/JndiInjectionQuery.qll
View File

@@ -7,9 +7,11 @@ import semmle.code.java.frameworks.SpringLdap
import semmle.code.java.security.JndiInjection
/**
* DEPRECATED: Use `JndiInjectionFlow` instead.
*
* A taint-tracking configuration for unvalidated user input that is used in JNDI lookup.
*/
class JndiInjectionFlowConfig extends TaintTracking::Configuration {
deprecated class JndiInjectionFlowConfig extends TaintTracking::Configuration {
JndiInjectionFlowConfig() { this = "JndiInjectionFlowConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -27,14 +29,32 @@ class JndiInjectionFlowConfig extends TaintTracking::Configuration {
}
}
/**
* A taint-tracking configuration for unvalidated user input that is used in JNDI lookup.
*/
private module JndiInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof JndiInjectionSink }
predicate isBarrier(DataFlow::Node node) {
node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(JndiInjectionAdditionalTaintStep c).step(node1, node2)
}
}
/** Tracks flow of unvalidated user input that is used in JNDI lookup */
module JndiInjectionFlow = TaintTracking::Make<JndiInjectionFlowConfig>;
/**
* A method that does a JNDI lookup when it receives a `SearchControls` argument with `setReturningObjFlag` = `true`
*/
private class UnsafeSearchControlsSink extends JndiInjectionSink {
UnsafeSearchControlsSink() {
exists(UnsafeSearchControlsConf conf, MethodAccess ma |
conf.hasFlowTo(DataFlow::exprNode(ma.getAnArgument()))
|
exists(MethodAccess ma | UnsafeSearchControlsFlow::hasFlowToExpr(ma.getAnArgument()) |
this.asExpr() = ma.getArgument(0)
)
}
@@ -44,14 +64,14 @@ private class UnsafeSearchControlsSink extends JndiInjectionSink {
* Find flows between a `SearchControls` object with `setReturningObjFlag` = `true`
* and an argument of an `LdapOperations.search` or `DirContext.search` call.
*/
private class UnsafeSearchControlsConf extends DataFlow2::Configuration {
UnsafeSearchControlsConf() { this = "UnsafeSearchControlsConf" }
private module UnsafeSearchControlsConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof UnsafeSearchControls }
override predicate isSource(DataFlow::Node source) { source instanceof UnsafeSearchControls }
override predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeSearchControlsArgument }
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeSearchControlsArgument }
}
private module UnsafeSearchControlsFlow = DataFlow::Make<UnsafeSearchControlsConfig>;
/**
* An argument of type `SearchControls` of an `LdapOperations.search` or `DirContext.search` call.
*/

6
java/ql/src/Security/CWE/CWE-074/JndiInjection.ql
View File

@@ -13,9 +13,9 @@
import java
import semmle.code.java.security.JndiInjectionQuery
import DataFlow::PathGraph
import JndiInjectionFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, JndiInjectionFlowConfig conf
where conf.hasFlowPath(source, sink)
from JndiInjectionFlow::PathNode source, JndiInjectionFlow::PathNode sink
where JndiInjectionFlow::hasFlowPath(source, sink)
select sink.getNode(), source, sink, "JNDI lookup might include name from $@.", source.getNode(),
"this user input"

2
java/ql/test/query-tests/security/CWE-074/JndiInjectionTest.ql
View File

@@ -9,7 +9,7 @@ class HasJndiInjectionTest extends InlineExpectationsTest {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasJndiInjection" and
exists(DataFlow::Node sink, JndiInjectionFlowConfig conf | conf.hasFlowTo(sink) |
exists(DataFlow::Node sink | JndiInjectionFlow::hasFlowTo(sink) |
sink.getLocation() = location and
element = sink.toString() and
value = ""