hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add the domain used to the alert message

Browse Source
This commit is contained in:
Joe Farebrother
2022-11-30 11:37:08 +00:00
parent ceb253e6d1
commit 603c1c1693
2 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll
View File

@@ -128,12 +128,21 @@ private class UntrustedUrlConfig extends TaintTracking::Configuration {
}
/** Holds if `node` is a network communication call for which certificate pinning is not implemented. */
predicate missingPinning(DataFlow::Node node) {
predicate missingPinning(DataFlow::Node node, string domain) {
isAndroid() and
node instanceof MissingPinningSink and
(
not exists(string s | trustedDomain(s))
not exists(string s | trustedDomain(s)) and
domain = ""
or
exists(UntrustedUrlConfig conf | conf.hasFlow(_, node))
exists(UntrustedUrlConfig conf, DataFlow::Node src |
conf.hasFlow(src, node) and
domain = getDomain(src.asExpr())
)
)
}
/** Gets the domain name from the given string literal */
private string getDomain(CompileTimeConstantExpr expr) {
result = expr.getStringValue().regexpCapture("(https?://)?([^/]*)/?", 2)
}

10
java/ql/src/Security/CWE/CWE-295/AndroidMissingCertificatePinning.ql
View File

@@ -13,10 +13,10 @@
import java
import semmle.code.java.security.AndroidCertificatePinningQuery
from DataFlow::Node node, string msg
from DataFlow::Node node, string domain, string msg
where
missingPinning(node) and
if exists(string x | trustedDomain(x))
then msg = "(untrusted domain)"
else msg = "(no trusted domains)"
missingPinning(node, domain) and
if domain = ""
then msg = "(no explicitly trusted domains)"
else msg = "(" + domain + " is not trusted by a pin)"
select node, "This network call does not implement certificate pinning. " + msg