hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor OgnlInjection

Browse Source
This commit is contained in:
Ed Minnix
2023-03-21 18:02:19 -04:00
parent 3116e306b1
commit 7e1c42442a
3 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
java/ql/lib/semmle/code/java/security/OgnlInjectionQuery.qll
View File

@@ -5,9 +5,11 @@ import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.OgnlInjection
/**
* DEPRECATED: Use `OgnlInjectionFlow` instead.
*
* A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
*/
class OgnlInjectionFlowConfig extends TaintTracking::Configuration {
deprecated class OgnlInjectionFlowConfig extends TaintTracking::Configuration {
OgnlInjectionFlowConfig() { this = "OgnlInjectionFlowConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -22,3 +24,23 @@ class OgnlInjectionFlowConfig extends TaintTracking::Configuration {
any(OgnlInjectionAdditionalTaintStep c).step(node1, node2)
}
}
/**
* A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
*/
private module OgnlInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof OgnlInjectionSink }
predicate isBarrier(DataFlow::Node node) {
node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(OgnlInjectionAdditionalTaintStep c).step(node1, node2)
}
}
/** Tracks flow of unvalidated user input that is used in OGNL EL evaluation. */
module OgnlInjectionFlow = TaintTracking::Make<OgnlInjectionFlowConfig>;

6
java/ql/src/Security/CWE/CWE-917/OgnlInjection.ql
View File

@@ -13,9 +13,9 @@
import java
import semmle.code.java.security.OgnlInjectionQuery
import DataFlow::PathGraph
import OgnlInjectionFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, OgnlInjectionFlowConfig conf
where conf.hasFlowPath(source, sink)
from OgnlInjectionFlow::PathNode source, OgnlInjectionFlow::PathNode sink
where OgnlInjectionFlow::hasFlowPath(source, sink)
select sink.getNode(), source, sink, "OGNL Expression Language statement depends on a $@.",
source.getNode(), "user-provided value"

2
java/ql/test/query-tests/security/CWE-917/OgnlInjectionTest.ql
View File

@@ -9,7 +9,7 @@ class OgnlInjectionTest extends InlineExpectationsTest {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasOgnlInjection" and
exists(DataFlow::Node sink, OgnlInjectionFlowConfig conf | conf.hasFlowTo(sink) |
exists(DataFlow::Node sink | OgnlInjectionFlow::hasFlowTo(sink) |
sink.getLocation() = location and
element = sink.toString() and
value = ""