hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Move source and sink into importable library

Browse Source
This commit is contained in:
Remco Vermeulen
2020-07-09 14:53:59 +02:00
parent b66f391c31
commit 7435dac3d2
4 changed files with 40 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
View File

@@ -11,7 +11,8 @@
*/ */
import java import java
import ServletResponseSplitting import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.ResponseSplitting
import DataFlow::PathGraph import DataFlow::PathGraph
class ResponseSplittingConfig extends TaintTracking::Configuration { class ResponseSplittingConfig extends TaintTracking::Configuration {

2
java/ql/src/Security/CWE/CWE-113/ResponseSplittingLocal.ql
View File

@@ -12,7 +12,7 @@
import java import java
import semmle.code.java.dataflow.FlowSources import semmle.code.java.dataflow.FlowSources
import ServletResponseSplitting import semmle.code.java.security.ResponseSplitting
import DataFlow::PathGraph import DataFlow::PathGraph
class ResponseSplittingLocalConfig extends TaintTracking::Configuration { class ResponseSplittingLocalConfig extends TaintTracking::Configuration {

39
java/ql/src/Security/CWE/CWE-113/ServletResponseSplitting.qll
View File

@@ -1,39 +0,0 @@
import java
import semmle.code.java.frameworks.Servlets
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.ResponseSplitting
/**
* Header-splitting sinks. Expressions that end up in an HTTP header.
*/
class ServletHeaderSplittingSink extends HeaderSplittingSink {
ServletHeaderSplittingSink() {
exists(ResponseAddCookieMethod m, MethodAccess ma |
ma.getMethod() = m and
this.asExpr() = ma.getArgument(0)
)
or
exists(ResponseAddHeaderMethod m, MethodAccess ma |
ma.getMethod() = m and
this.asExpr() = ma.getAnArgument()
)
or
exists(ResponseSetHeaderMethod m, MethodAccess ma |
ma.getMethod() = m and
this.asExpr() = ma.getAnArgument()
)
or
exists(JaxRsResponseBuilder builder, Method m |
m = builder.getAMethod() and m.getName() = "header"
|
this.asExpr() = m.getAReference().getArgument(1)
)
}
}
class ServletSafeHeaderSplittingSource extends SafeHeaderSplittingSource {
ServletSafeHeaderSplittingSource() {
this.asExpr().(MethodAccess).getMethod() instanceof HttpServletRequestGetHeaderMethod or
this.asExpr().(MethodAccess).getMethod() instanceof CookieGetNameMethod
}
}

37
java/ql/src/semmle/code/java/security/ResponseSplitting.qll
View File

@@ -1,4 +1,6 @@
import semmle.code.java.dataflow.DataFlow import semmle.code.java.dataflow.DataFlow
import semmle.code.java.frameworks.Servlets
import semmle.code.java.frameworks.JaxWS
/** /**
* Header-splitting sinks. Expressions that end up in an HTTP header. * Header-splitting sinks. Expressions that end up in an HTTP header.
@@ -9,3 +11,38 @@ abstract class HeaderSplittingSink extends DataFlow::Node { }
* Sources that cannot be used to perform a header splitting attack. * Sources that cannot be used to perform a header splitting attack.
*/ */
abstract class SafeHeaderSplittingSource extends DataFlow::Node { } abstract class SafeHeaderSplittingSource extends DataFlow::Node { }
/**
* Header-splitting sinks. Expressions that end up in an HTTP header.
*/
private class ServletHeaderSplittingSink extends HeaderSplittingSink {
ServletHeaderSplittingSink() {
exists(ResponseAddCookieMethod m, MethodAccess ma |
ma.getMethod() = m and
this.asExpr() = ma.getArgument(0)
)
or
exists(ResponseAddHeaderMethod m, MethodAccess ma |
ma.getMethod() = m and
this.asExpr() = ma.getAnArgument()
)
or
exists(ResponseSetHeaderMethod m, MethodAccess ma |
ma.getMethod() = m and
this.asExpr() = ma.getAnArgument()
)
or
exists(JaxRsResponseBuilder builder, Method m |
m = builder.getAMethod() and m.getName() = "header"
|
this.asExpr() = m.getAReference().getArgument(1)
)
}
}
private class ServletSafeHeaderSplittingSource extends SafeHeaderSplittingSource {
ServletSafeHeaderSplittingSource() {
this.asExpr().(MethodAccess).getMethod() instanceof HttpServletRequestGetHeaderMethod or
this.asExpr().(MethodAccess).getMethod() instanceof CookieGetNameMethod
}
}