hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3491 from luchua-bc/java-insecure-smtp-ssl

Browse Source 
Java: CWE-297 insecure JavaMail SSL configuration
This commit is contained in:
Anders Schack-Mulligen
2020-06-10 11:02:50 +02:00
committed by GitHub
parent 06066f0c5b 1fd9c7fdec
commit 4b3ca13f25
17 changed files with 2783 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.expected Normal file
View File

@@ -0,0 +1,2 @@
| InsecureJavaMail.java:29:27:29:72 | getInstance(...) | Java mailing has insecure SSL configuration |
| InsecureJavaMail.java:37:3:37:29 | setSSLOnConnect(...) | Java mailing has insecure SSL configuration |

45
java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.java Normal file
View File

@@ -0,0 +1,45 @@
import java.util.Properties;
import javax.mail.Authenticator;
import javax.mail.PasswordAuthentication;
import javax.mail.Session;
import org.apache.commons.mail.DefaultAuthenticator;
import org.apache.commons.mail.Email;
import org.apache.commons.mail.SimpleEmail;
import java.util.Properties;
class InsecureJavaMail {
public void testJavaMail() {
final Properties properties = new Properties();
properties.put("mail.transport.protocol", "protocol");
properties.put("mail.smtp.host", "hostname");
properties.put("mail.smtp.socketFactory.class", "classname");
final javax.mail.Authenticator authenticator = new javax.mail.Authenticator() {
protected PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication("username", "password");
}
};
if (null != authenticator) {
properties.put("mail.smtp.auth", "true");
// properties.put("mail.smtp.ssl.checkserveridentity", "true");
}
final Session session = Session.getInstance(properties, authenticator);
}
public void testSimpleMail() {
Email email = new SimpleEmail();
email.setHostName("config.hostName");
email.setSmtpPort(25);
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
email.setSSLOnConnect(true);
// email.setSSLCheckServerIdentity(true);
email.setFrom("fromAddress");
email.setSubject("subject");
email.setMsg("body");
email.addTo("toAddress");
email.send();
}
}

1
java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-297/InsecureJavaMail.ql

1
java/ql/test/experimental/query-tests/security/CWE-297/options Normal file
View File

@@ -0,0 +1 @@
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-commons-email-1.6.0:${testdir}/../../../../stubs/javamail-api-1.6.2