hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Trust Boundary Query

Browse Source
This commit is contained in:
Ed Minnix
2023-06-05 15:55:02 -04:00
parent 41a527cf72
commit 76438f13b6
3 changed files with 94 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/ext/javax.servlet.http.model.yml
View File

@@ -26,6 +26,8 @@ extensions:
- ["javax.servlet.http", "HttpServletResponse", False, "addHeader", "", "", "Argument[0..1]", "response-splitting", "manual"]
- ["javax.servlet.http", "HttpServletResponse", False, "sendError", "(int,String)", "", "Argument[1]", "information-leak", "manual"]
- ["javax.servlet.http", "HttpServletResponse", False, "setHeader", "", "", "Argument[0..1]", "response-splitting", "manual"]
- ["javax.servlet.http", "HttpSession", True, "putValue", "", "", "Argument[0..1]", "trust-boundary", "manual"]
- ["javax.servlet.http", "HttpSession", True, "setAttribute", "", "", "Argument[0..1]", "trust-boundary", "manual"]
- addsTo:
pack: codeql/java-all
extensible: summaryModel

17
java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll Normal file
View File

@@ -0,0 +1,17 @@
/** Provides classes and predicates to reason about trust boundary violations */
import java
private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.frameworks.Servlets
class TrustBoundaryViolationSource extends DataFlow::Node {
TrustBoundaryViolationSource() {
this instanceof RemoteFlowSource and this.asExpr().getType() instanceof HttpServletRequest
}
}
class TrustBoundaryViolationSink extends DataFlow::Node {
TrustBoundaryViolationSink() { sinkNode(this, "trust-boundary") }
}