hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Convert file-path-injection to data extensions.

Browse Source
This commit is contained in:
Michael Nebel
2022-11-21 15:44:12 +01:00
parent b61f515af2
commit 665d40dc4b
3 changed files with 33 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql
View File

@@ -12,12 +12,17 @@
*/
import java
import semmle.code.java.dataflow.ExternalFlow
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.PathCreation
import JFinalController
import semmle.code.java.security.PathSanitizer
import DataFlow::PathGraph
private class ActivateModels extends ActiveExperimentalModels {
ActivateModels() { this = "file-path-injection" }
}
/** A complementary sanitizer that protects against path traversal using path normalization. */
class PathNormalizeSanitizer extends MethodAccess {
PathNormalizeSanitizer() {

21
java/ql/src/experimental/Security/CWE/CWE-073/JFinalController.qll
View File

@@ -61,24 +61,3 @@ private class SetToGetAttributeStep extends AdditionalValueStep {
)
}
}
/** Remote flow source models relating to `JFinal`. */
private class JFinalControllerSource extends SourceModelCsv {
override predicate row(string row) {
row =
[
"com.jfinal.core;Controller;true;getCookie" + ["", "Object", "Objects", "ToInt", "ToLong"] +
";;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getFile" + ["", "s"] + ";;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getHeader;;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getKv;;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getPara" +
[
"", "Map", "ToBoolean", "ToDate", "ToInt", "ToLong", "Values", "ValuesToInt",
"ValuesToLong"
] + ";;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;get" + ["", "Int", "Long", "Boolean", "Date"] +
";;;ReturnValue;remote;manual"
]
}
}