hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14610 from atorralba/atorralba/java/jms-deserialization

Browse Source 
Java: Add JMS sink to java/unsafe-deserialization
This commit is contained in:
Tony Torralba
2023-11-08 09:10:20 +01:00
committed by GitHub
parent f643fd7d74 45cf50c2af
commit 5442cdb49c
6 changed files with 42 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/lib/semmle/code/java/frameworks/Jms.qll Normal file
View File

@@ -0,0 +1,10 @@
/** Provides definitions for working with the JMS library. */
import java
/** The method `ObjectMessage.getObject`. */
class ObjectMessageGetObjectMethod extends Method {
ObjectMessageGetObjectMethod() {
this.hasQualifiedName(["javax", "jakarta"] + ".jms", "ObjectMessage", "getObject")
}
}

7
java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
View File

@@ -4,6 +4,7 @@
import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.dataflow.TaintTracking2
private import semmle.code.java.dispatch.VirtualDispatch
private import semmle.code.java.frameworks.Kryo
private import semmle.code.java.frameworks.XStream
private import semmle.code.java.frameworks.SnakeYaml
@@ -15,6 +16,7 @@ private import semmle.code.java.frameworks.HessianBurlap
private import semmle.code.java.frameworks.Castor
private import semmle.code.java.frameworks.Jackson
private import semmle.code.java.frameworks.Jabsorb
private import semmle.code.java.frameworks.Jms
private import semmle.code.java.frameworks.JoddJson
private import semmle.code.java.frameworks.Flexjson
private import semmle.code.java.frameworks.google.Gson
@@ -224,6 +226,11 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
m instanceof GsonDeserializeMethod and
sink = ma.getArgument(0) and
UnsafeTypeFlow::flowToExpr(ma.getArgument(1))
or
m.getASourceOverriddenMethod*() instanceof ObjectMessageGetObjectMethod and
sink = ma.getQualifier().getUnderlyingExpr() and
// If we can see an implementation, we trust dataflow to find a path to the other sinks instead
not exists(viableCallable(ma))
)
}