hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Apply suggestions from review.

Browse Source
This commit is contained in:
intrigus
2021-04-15 21:20:46 +02:00
parent 4a00670b68
commit 6f217d37da
1 changed files with 5 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.ql
View File

@@ -80,7 +80,8 @@ class InsecureTrustManagerConfiguration extends TaintTracking::Configuration {
bindingset[result] bindingset[result]
private string getAFlagName() { private string getAFlagName() {
result result
.regexpMatch("(?i).*(secure|disable|selfCert|selfSign|validat|verif|trust|ignore|nocertificatecheck).*") .regexpMatch("(?i).*(secure|disable|selfCert|selfSign|validat|verif|trust|ignore|nocertificatecheck).*") and
result != "equalsIgnoreCase"
} }
/** /**
@@ -94,11 +95,6 @@ private class FlagType extends Type {
} }
} }
private predicate isEqualsIgnoreCaseMethodAccess(MethodAccess ma) {
ma.getMethod().hasName("equalsIgnoreCase") and
ma.getMethod().getDeclaringType() instanceof TypeString
}
/** Holds if `source` should is considered a flag. */ /** Holds if `source` should is considered a flag. */
private predicate isFlag(DataFlow::Node source) { private predicate isFlag(DataFlow::Node source) {
exists(VarAccess v | v.getVariable().getName() = getAFlagName() | exists(VarAccess v | v.getVariable().getName() = getAFlagName() |
@@ -109,13 +105,13 @@ private predicate isFlag(DataFlow::Node source) {
or or
exists(MethodAccess ma | ma.getMethod().getName() = getAFlagName() | exists(MethodAccess ma | ma.getMethod().getName() = getAFlagName() |
source.asExpr() = ma and source.asExpr() = ma and
ma.getType() instanceof FlagType and ma.getType() instanceof FlagType
not isEqualsIgnoreCaseMethodAccess(ma)
) )
} }
/** /**
* Holds if there is flow from `node1` to `node2` either due to local flow or due to custom flow steps: * Holds if there is local flow from `node1` to `node2` either due to standard data-flow steps or the
* following custom flow steps:
* 1. `Boolean.parseBoolean(taintedValue)` taints the return value of `parseBoolean`. * 1. `Boolean.parseBoolean(taintedValue)` taints the return value of `parseBoolean`.
* 2. A call to an `EnvReadMethod` such as `System.getProperty` where a tainted value is used as an argument. * 2. A call to an `EnvReadMethod` such as `System.getProperty` where a tainted value is used as an argument.
* The return value of such a method is then tainted. * The return value of such a method is then tainted.