hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Added Accessor sink for MVEL injections

Browse Source
This commit is contained in:
Artem Smotrakov
2020-04-24 23:49:19 +02:00
parent 12e0234d40
commit 6a6c805048
6 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll
View File

@@ -37,7 +37,8 @@ class MvelEvaluationSink extends DataFlow::ExprNode {
(
m instanceof ExecutableStatementEvaluationMethod or
m instanceof CompiledExpressionEvaluationMethod or
m instanceof CompiledAccExpressionEvaluationMethod
m instanceof CompiledAccExpressionEvaluationMethod or
m instanceof AccessorEvaluationMethod
) and
(ma = asExpr() or ma.getQualifier() = asExpr())
)
@@ -159,6 +160,16 @@ class CompiledAccExpressionEvaluationMethod extends Method {
}
}
/**
* Methods in `Accessor` that trigger evaluating a MVEL expression.
*/
class AccessorEvaluationMethod extends Method {
AccessorEvaluationMethod() {
getDeclaringType() instanceof Accessor and
hasName("getValue")
}
}
class MVEL extends RefType {
MVEL() { hasQualifiedName("org.mvel2", "MVEL") }
}
@@ -178,3 +189,7 @@ class CompiledExpression extends RefType {
class CompiledAccExpression extends RefType {
CompiledAccExpression() { hasQualifiedName("org.mvel2.compiler", "CompiledAccExpression") }
}
class Accessor extends RefType {
Accessor() { hasQualifiedName("org.mvel2.compiler", "Accessor") }
}

19
java/ql/test/experimental/Security/CWE/CWE-094/MvelInjection.expected
View File

@@ -2,8 +2,9 @@ edges
| MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | MvelInjection.java:20:17:20:21 | input |
| MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | MvelInjection.java:30:30:30:39 | expression |
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:41:7:41:15 | statement |
| MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | MvelInjection.java:52:7:52:16 | expression |
| MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | MvelInjection.java:62:7:62:16 | expression |
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:42:7:42:15 | statement |
| MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | MvelInjection.java:53:7:53:16 | expression |
| MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | MvelInjection.java:63:7:63:16 | expression |
nodes
| MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:20:17:20:21 | input | semmle.label | input |
@@ -11,13 +12,15 @@ nodes
| MvelInjection.java:30:30:30:39 | expression | semmle.label | expression |
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:41:7:41:15 | statement | semmle.label | statement |
| MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:52:7:52:16 | expression | semmle.label | expression |
| MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:62:7:62:16 | expression | semmle.label | expression |
| MvelInjection.java:42:7:42:15 | statement | semmle.label | statement |
| MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:53:7:53:16 | expression | semmle.label | expression |
| MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:63:7:63:16 | expression | semmle.label | expression |
#select
| MvelInjection.java:20:17:20:21 | input | MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | MvelInjection.java:20:17:20:21 | input | MVEL injection from $@. | MvelInjection.java:16:27:16:49 | getInputStream(...) | this user input |
| MvelInjection.java:30:30:30:39 | expression | MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | MvelInjection.java:30:30:30:39 | expression | MVEL injection from $@. | MvelInjection.java:25:27:25:49 | getInputStream(...) | this user input |
| MvelInjection.java:41:7:41:15 | statement | MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:41:7:41:15 | statement | MVEL injection from $@. | MvelInjection.java:35:27:35:49 | getInputStream(...) | this user input |
| MvelInjection.java:52:7:52:16 | expression | MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | MvelInjection.java:52:7:52:16 | expression | MVEL injection from $@. | MvelInjection.java:46:27:46:49 | getInputStream(...) | this user input |
| MvelInjection.java:62:7:62:16 | expression | MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | MvelInjection.java:62:7:62:16 | expression | MVEL injection from $@. | MvelInjection.java:57:27:57:49 | getInputStream(...) | this user input |
| MvelInjection.java:42:7:42:15 | statement | MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:42:7:42:15 | statement | MVEL injection from $@. | MvelInjection.java:35:27:35:49 | getInputStream(...) | this user input |
| MvelInjection.java:53:7:53:16 | expression | MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | MvelInjection.java:53:7:53:16 | expression | MVEL injection from $@. | MvelInjection.java:47:27:47:49 | getInputStream(...) | this user input |
| MvelInjection.java:63:7:63:16 | expression | MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | MvelInjection.java:63:7:63:16 | expression | MVEL injection from $@. | MvelInjection.java:58:27:58:49 | getInputStream(...) | this user input |

1
java/ql/test/experimental/Security/CWE/CWE-094/MvelInjection.java
View File

@@ -39,6 +39,7 @@ public class MvelInjection {
ExpressionCompiler compiler = new ExpressionCompiler(input);
ExecutableStatement statement = compiler.compile();
statement.getValue(new Object(), new ImmutableDefaultFactory());
statement.getValue(new Object(), new Object(), new ImmutableDefaultFactory());
}
}

7
java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/Accessor.java Normal file
View File

@@ -0,0 +1,7 @@
package org.mvel2.compiler;
import org.mvel2.integration.VariableResolverFactory;
public interface Accessor {
public Object getValue(Object ctx, Object elCtx, VariableResolverFactory factory);
}

1
java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/CompiledExpression.java
View File

@@ -5,4 +5,5 @@ import org.mvel2.integration.VariableResolverFactory;
public class CompiledExpression implements ExecutableStatement {
public Object getDirectValue(Object staticContext, VariableResolverFactory factory) { return null; }
public Object getValue(Object staticContext, VariableResolverFactory factory) { return null; }
public Object getValue(Object ctx, Object elCtx, VariableResolverFactory factory) { return null; }
}

2
java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/ExecutableStatement.java
View File

@@ -2,6 +2,6 @@ package org.mvel2.compiler;
import org.mvel2.integration.VariableResolverFactory;
public interface ExecutableStatement {
public interface ExecutableStatement extends Accessor {
public Object getValue(Object staticContext, VariableResolverFactory factory);
}