hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into refacReDoS

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-08-09 16:18:46 +02:00
parent 9bc12ed8fd add9e9dac4
commit 49276b1f38
1452 changed files with 75078 additions and 71169 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
View File

@@ -8,6 +8,7 @@ edges
| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader |
| Test.java:80:31:80:32 | br : BufferedReader | Test.java:80:31:80:43 | readLine(...) : String |
| Test.java:80:31:80:43 | readLine(...) : String | Test.java:82:67:82:81 | ... + ... |
| Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp |
nodes
| Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
| Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -20,6 +21,8 @@ nodes
| Test.java:80:31:80:32 | br : BufferedReader | semmle.label | br : BufferedReader |
| Test.java:80:31:80:43 | readLine(...) : String | semmle.label | readLine(...) : String |
| Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
| Test.java:88:17:88:37 | getHostName(...) : String | semmle.label | getHostName(...) : String |
| Test.java:90:26:90:29 | temp | semmle.label | temp |
subpaths
#select
| Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
@@ -27,3 +30,4 @@ subpaths
| Test.java:30:11:30:48 | getPath(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
| Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
| Test.java:82:52:82:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |
| Test.java:90:26:90:29 | temp | Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp | $@ flows to here and is used in a path. | Test.java:88:17:88:37 | getHostName(...) | User-provided value |

21
java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
View File

@@ -2,7 +2,6 @@
// http://cwe.mitre.org/data/definitions/22.html
package test.cwe22.semmle.tests;
import javax.servlet.http.*;
import javax.servlet.ServletException;
@@ -12,6 +11,7 @@ import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.FileSystems;
import org.apache.commons.io.output.LockableFileWriter;
class Test {
void doGet1(InetAddress address)
@@ -19,13 +19,13 @@ class Test {
String temp = address.getHostName();
File file;
Path path;
// BAD: construct a file path with user input
file = new File(temp);
// BAD: construct a path with user input
path = Paths.get(temp);
// BAD: construct a path with user input
path = FileSystems.getDefault().getPath(temp);
@@ -34,7 +34,7 @@ class Test {
file = new File(temp);
}
}
void doGet2(InetAddress address)
throws IOException {
String temp = address.getHostName();
@@ -44,7 +44,7 @@ class Test {
if(isSafe(temp))
file = new File(temp);
}
void doGet3(InetAddress address)
throws IOException {
String temp = address.getHostName();
@@ -66,7 +66,7 @@ class Test {
return false;
return true;
}
boolean isSortOfSafe(String pathSpec) {
// no file separators
if (pathSpec.contains(File.separator))
@@ -82,4 +82,11 @@ class Test {
BufferedWriter bw = new BufferedWriter(new FileWriter("dir/"+filename, true));
}
}
void doGet4(InetAddress address)
throws IOException {
String temp = address.getHostName();
// BAD: open a file based on user input, using a MaD-documented API
new LockableFileWriter(temp);
}
}

2
java/ql/test/query-tests/security/CWE-022/semmle/tests/options
View File

@@ -1 +1 @@
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6

54
java/ql/test/query-tests/security/CWE-295/ImproperWebVeiwCertificateValidation/Test.java Normal file
View File

@@ -0,0 +1,54 @@
import android.webkit.WebViewClient;
import android.webkit.WebView;
import android.webkit.SslErrorHandler;
import android.net.http.SslError;
import android.net.http.SslCertificate;
import android.app.AlertDialog;
import android.content.DialogInterface;
import android.app.Activity;
class Test {
class A extends WebViewClient {
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) { // $hasResult
handler.proceed();
}
}
interface Validator {
boolean isValid(SslCertificate cert);
}
class B extends WebViewClient {
Validator v;
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) {
if (this.v.isValid(error.getCertificate())) {
handler.proceed();
}
else {
handler.cancel();
}
}
}
class C extends WebViewClient {
Activity activity;
public void onReceivedSslError (WebView view, SslErrorHandler handler, SslError error) {
new AlertDialog.Builder(activity).
setTitle("SSL error").
setMessage("SSL error. Connect anyway?").
setPositiveButton("Yes", new DialogInterface.OnClickListener() {
@Override
public void onClick(DialogInterface dialog, int which) {
handler.proceed();
}
}).setNegativeButton("No", new DialogInterface.OnClickListener() {
@Override
public void onClick(DialogInterface dialog, int which) {
handler.cancel();
}
}).show();
}
}
}

1
java/ql/test/query-tests/security/CWE-295/ImproperWebVeiwCertificateValidation/options Normal file
View File

@@ -0,0 +1 @@
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/google-android-9.0.0

0
java/ql/test/query-tests/security/CWE-295/ImproperWebVeiwCertificateValidation/test.expected Normal file
View File

19
java/ql/test/query-tests/security/CWE-295/ImproperWebVeiwCertificateValidation/test.ql Normal file
View File

@@ -0,0 +1,19 @@
import java
import semmle.code.java.security.AndroidWebViewCertificateValidationQuery
import TestUtilities.InlineExpectationsTest
class WebViewTest extends InlineExpectationsTest {
WebViewTest() { this = "WebViewTest" }
override string getARelevantTag() { result = "hasResult" }
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(OnReceivedSslErrorMethod m |
trustsAllCerts(m) and
location = m.getLocation() and
element = m.toString() and
tag = "hasResult" and
value = ""
)
}
}

11
java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTestKt.kt Normal file
View File

@@ -0,0 +1,11 @@
import android.app.Activity
import android.content.Context
import android.content.SharedPreferences
class CleartextStorageSharedPrefsTestKt : Activity() {
fun testSetSharedPrefs1(context: Context, name: String, password: String) {
val sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
sharedPrefs.edit().putString("name", name).apply(); // Safe
sharedPrefs.edit().putString("password", password).apply(); // $ hasCleartextStorageSharedPrefs
}
}

1
java/ql/test/query-tests/security/CWE-312/options
View File

@@ -1 +1,2 @@
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/google-android-9.0.0
// codeql-extractor-kotlin-options: ${testdir}/../../../stubs/google-android-9.0.0

1
java/ql/test/query-tests/security/CWE-749/AndroidManifest.xml
View File

@@ -44,6 +44,7 @@
<activity android:name=".UnsafeActivity3" android:exported="true" />
<activity android:name=".UnsafeActivity4" android:exported="true" />
<activity android:name=".UnsafeActivityKt" android:exported="true" />
<receiver android:name=".UnsafeAndroidBroadcastReceiver" android:exported="true" />
</application>

20
java/ql/test/query-tests/security/CWE-749/UnsafeActivityKt.kt Normal file
View File

@@ -0,0 +1,20 @@
package com.example.app
import android.app.Activity
import android.os.Bundle
import android.webkit.WebSettings
import android.webkit.WebView
import android.webkit.WebViewClient
class UnsafeActivityKt : Activity() {
override fun onCreate(savedInstanceState : Bundle) {
val wv = findViewById<WebView>(-1)
// Implicit not-nulls happening here
wv.settings.setJavaScriptEnabled(true)
wv.settings.setAllowFileAccessFromFileURLs(true)
val thisUrl : String = intent.extras.getString("url")
wv.loadUrl(thisUrl) // $ hasUnsafeAndroidAccess
}
}

3
java/ql/test/query-tests/security/CWE-749/options
View File

@@ -1 +1,2 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/android
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/google-android-9.0.0
//codeql-extractor-kotlin-options: ${testdir}/../../../stubs/google-android-9.0.0

9
java/ql/test/query-tests/security/CWE-925/AndroidManifest.xml Normal file
View File

@@ -0,0 +1,9 @@
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="test">
<application>
<receiver android:name=".BootReceiverXml">
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED" />
</intent-filter>
</receiver>
</application>
</manifest>

13
java/ql/test/query-tests/security/CWE-925/BootReceiverXml.java Normal file
View File

@@ -0,0 +1,13 @@
package test;
import android.content.Intent;
import android.content.Context;
import android.content.BroadcastReceiver;
class BootReceiverXml extends BroadcastReceiver {
void doStuff(Intent intent) {}
@Override
public void onReceive(Context ctx, Intent intent) { // $hasResult
doStuff(intent);
}
}

0
java/ql/test/query-tests/security/CWE-925/ImproperIntentVerification.expected Normal file
View File

18
java/ql/test/query-tests/security/CWE-925/ImproperIntentVerification.ql Normal file
View File

@@ -0,0 +1,18 @@
import java
import semmle.code.java.security.ImproperIntentVerificationQuery
import TestUtilities.InlineExpectationsTest
class HasFlowTest extends InlineExpectationsTest {
HasFlowTest() { this = "HasFlowTest" }
override string getARelevantTag() { result = "hasResult" }
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasResult" and
exists(Method orm | unverifiedSystemReceiver(_, orm, _) |
orm.getLocation() = location and
element = orm.toString() and
value = ""
)
}
}

1
java/ql/test/query-tests/security/CWE-925/options Normal file
View File

@@ -0,0 +1 @@
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/google-android-9.0.0