hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Added Accessor sink for MVEL injections

Browse Source
This commit is contained in:
Artem Smotrakov
2020-04-24 23:49:19 +02:00
parent 12e0234d40
commit 6a6c805048
6 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/test/experimental/Security/CWE/CWE-094/MvelInjection.expected
View File

@@ -2,8 +2,9 @@ edges
| MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | MvelInjection.java:20:17:20:21 | input |
| MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | MvelInjection.java:30:30:30:39 | expression |
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:41:7:41:15 | statement |
| MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | MvelInjection.java:52:7:52:16 | expression |
| MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | MvelInjection.java:62:7:62:16 | expression |
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:42:7:42:15 | statement |
| MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | MvelInjection.java:53:7:53:16 | expression |
| MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | MvelInjection.java:63:7:63:16 | expression |
nodes
| MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:20:17:20:21 | input | semmle.label | input |
@@ -11,13 +12,15 @@ nodes
| MvelInjection.java:30:30:30:39 | expression | semmle.label | expression |
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:41:7:41:15 | statement | semmle.label | statement |
| MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:52:7:52:16 | expression | semmle.label | expression |
| MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:62:7:62:16 | expression | semmle.label | expression |
| MvelInjection.java:42:7:42:15 | statement | semmle.label | statement |
| MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:53:7:53:16 | expression | semmle.label | expression |
| MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:63:7:63:16 | expression | semmle.label | expression |
#select
| MvelInjection.java:20:17:20:21 | input | MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | MvelInjection.java:20:17:20:21 | input | MVEL injection from $@. | MvelInjection.java:16:27:16:49 | getInputStream(...) | this user input |
| MvelInjection.java:30:30:30:39 | expression | MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | MvelInjection.java:30:30:30:39 | expression | MVEL injection from $@. | MvelInjection.java:25:27:25:49 | getInputStream(...) | this user input |
| MvelInjection.java:41:7:41:15 | statement | MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:41:7:41:15 | statement | MVEL injection from $@. | MvelInjection.java:35:27:35:49 | getInputStream(...) | this user input |
| MvelInjection.java:52:7:52:16 | expression | MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | MvelInjection.java:52:7:52:16 | expression | MVEL injection from $@. | MvelInjection.java:46:27:46:49 | getInputStream(...) | this user input |
| MvelInjection.java:62:7:62:16 | expression | MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | MvelInjection.java:62:7:62:16 | expression | MVEL injection from $@. | MvelInjection.java:57:27:57:49 | getInputStream(...) | this user input |
| MvelInjection.java:42:7:42:15 | statement | MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:42:7:42:15 | statement | MVEL injection from $@. | MvelInjection.java:35:27:35:49 | getInputStream(...) | this user input |
| MvelInjection.java:53:7:53:16 | expression | MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | MvelInjection.java:53:7:53:16 | expression | MVEL injection from $@. | MvelInjection.java:47:27:47:49 | getInputStream(...) | this user input |
| MvelInjection.java:63:7:63:16 | expression | MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | MvelInjection.java:63:7:63:16 | expression | MVEL injection from $@. | MvelInjection.java:58:27:58:49 | getInputStream(...) | this user input |

1
java/ql/test/experimental/Security/CWE/CWE-094/MvelInjection.java
View File

@@ -39,6 +39,7 @@ public class MvelInjection {
ExpressionCompiler compiler = new ExpressionCompiler(input);
ExecutableStatement statement = compiler.compile();
statement.getValue(new Object(), new ImmutableDefaultFactory());
statement.getValue(new Object(), new Object(), new ImmutableDefaultFactory());
}
}

7
java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/Accessor.java Normal file
View File

@@ -0,0 +1,7 @@
package org.mvel2.compiler;
import org.mvel2.integration.VariableResolverFactory;
public interface Accessor {
public Object getValue(Object ctx, Object elCtx, VariableResolverFactory factory);
}

1
java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/CompiledExpression.java
View File

@@ -5,4 +5,5 @@ import org.mvel2.integration.VariableResolverFactory;
public class CompiledExpression implements ExecutableStatement {
public Object getDirectValue(Object staticContext, VariableResolverFactory factory) { return null; }
public Object getValue(Object staticContext, VariableResolverFactory factory) { return null; }
public Object getValue(Object ctx, Object elCtx, VariableResolverFactory factory) { return null; }
}

2
java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/ExecutableStatement.java
View File

@@ -2,6 +2,6 @@ package org.mvel2.compiler;
import org.mvel2.integration.VariableResolverFactory;
public interface ExecutableStatement {
public interface ExecutableStatement extends Accessor {
public Object getValue(Object staticContext, VariableResolverFactory factory);
}