hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 08:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply JMS sink only when there isn't an implementation available

Browse Source
This commit is contained in:
Tony Torralba
2023-10-30 10:28:17 +01:00
parent 7af3d239ab
commit 45cf50c2af
2 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/lib/semmle/code/java/frameworks/Jms.qll Normal file
View File

@@ -0,0 +1,10 @@
/** Provides definitions for working with the JMS library. */
import java
/** The method `ObjectMessage.getObject`. */
class ObjectMessageGetObjectMethod extends Method {
ObjectMessageGetObjectMethod() {
this.hasQualifiedName(["javax", "jakarta"] + ".jms", "ObjectMessage", "getObject")
}
}

9
java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
View File

@@ -4,6 +4,7 @@
import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.dataflow.TaintTracking2
private import semmle.code.java.dispatch.VirtualDispatch
private import semmle.code.java.frameworks.Kryo
private import semmle.code.java.frameworks.XStream
private import semmle.code.java.frameworks.SnakeYaml
@@ -15,6 +16,7 @@ private import semmle.code.java.frameworks.HessianBurlap
private import semmle.code.java.frameworks.Castor
private import semmle.code.java.frameworks.Jackson
private import semmle.code.java.frameworks.Jabsorb
private import semmle.code.java.frameworks.Jms
private import semmle.code.java.frameworks.JoddJson
private import semmle.code.java.frameworks.Flexjson
private import semmle.code.java.frameworks.google.Gson
@@ -225,9 +227,10 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
sink = ma.getArgument(0) and
UnsafeTypeFlow::flowToExpr(ma.getArgument(1))
or
m.getASourceOverriddenMethod*()
.hasQualifiedName(["javax", "jakarta"] + ".jms", "ObjectMessage", "getObject") and
sink = ma.getQualifier().getUnderlyingExpr()
m.getASourceOverriddenMethod*() instanceof ObjectMessageGetObjectMethod and
sink = ma.getQualifier().getUnderlyingExpr() and
// If we can see an implementation, we trust dataflow to find a path to the other sinks instead
not exists(viableCallable(ma))
)
}