hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: narrow query

Browse Source 
remove PUT and DELETE from StaplerCsrfUnprotectedMethod

remove OPTIONS and TRACE from SpringCsrfUnprotectedMethod
This commit is contained in:
Jami Cogswell
2025-01-29 21:30:53 -05:00
parent ead224c7b2
commit 530103e2d9
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/test/query-tests/security/CWE-352/CsrfUnprotectedRequestTypeTest.java
View File

@@ -88,6 +88,17 @@ public class CsrfUnprotectedRequestTypeTest {
} catch (SQLException e) { }
}
// GOOD: uses OPTIONS or TRACE, which are unlikely to be exploitable via CSRF
@RequestMapping(value = "", method = { OPTIONS, TRACE })
public void good0() {
try {
String sql = "DELETE";
Connection conn = DriverManager.getConnection("url");
PreparedStatement ps = conn.prepareStatement(sql);
ps.executeUpdate(); // database update method call
} catch (SQLException e) { }
}
// GOOD: uses POST request when updating a database
@RequestMapping(value = "", method = RequestMethod.POST)
public void good1() {
@@ -430,11 +441,10 @@ public class CsrfUnprotectedRequestTypeTest {
return "post";
}
// BAD: Stapler web method annotated with `@PUT` and method name that implies a state-change
// We treat this case as bad for Stapler since the Jenkins docs only say that @POST/@RequirePOST
// provide default protection against CSRF.
// GOOD: Stapler web method annotated with `@PUT` and method name that implies a state-change
// We treat this case as good since PUT is only exploitable if there is a CORS issue.
@PUT
public String doPut(String user) { // $ hasCsrfUnprotectedRequestType
public String doPut(String user) {
return "put";
}