hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

*)add JsonHijacking ql query

Browse Source
This commit is contained in:
haby0
2021-02-18 18:11:10 +08:00
parent 88263cb89e
commit 8119fd2ad1
18 changed files with 553 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.expected Normal file
View File

@@ -0,0 +1,48 @@
edges
| JsonHijacking.java:28:32:28:68 | getParameter(...) : String | JsonHijacking.java:33:16:33:24 | resultStr |
| JsonHijacking.java:32:21:32:54 | ... + ... : String | JsonHijacking.java:33:16:33:24 | resultStr |
| JsonHijacking.java:40:32:40:68 | getParameter(...) : String | JsonHijacking.java:44:16:44:24 | resultStr |
| JsonHijacking.java:42:21:42:80 | ... + ... : String | JsonHijacking.java:44:16:44:24 | resultStr |
| JsonHijacking.java:51:32:51:68 | getParameter(...) : String | JsonHijacking.java:54:16:54:24 | resultStr |
| JsonHijacking.java:53:21:53:55 | ... + ... : String | JsonHijacking.java:54:16:54:24 | resultStr |
| JsonHijacking.java:61:32:61:68 | getParameter(...) : String | JsonHijacking.java:64:16:64:24 | resultStr |
| JsonHijacking.java:63:21:63:54 | ... + ... : String | JsonHijacking.java:64:16:64:24 | resultStr |
| JsonHijacking.java:72:32:72:68 | getParameter(...) : String | JsonHijacking.java:80:20:80:28 | resultStr |
| JsonHijacking.java:79:21:79:54 | ... + ... : String | JsonHijacking.java:80:20:80:28 | resultStr |
| JsonHijacking.java:88:32:88:68 | getParameter(...) : String | JsonHijacking.java:95:20:95:28 | resultStr |
| JsonHijacking.java:94:21:94:54 | ... + ... : String | JsonHijacking.java:95:20:95:28 | resultStr |
| JsonHijacking.java:102:32:102:68 | getParameter(...) : String | JsonHijacking.java:113:16:113:24 | resultStr |
nodes
| JsonHijacking.java:28:32:28:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:32:21:32:54 | ... + ... : String | semmle.label | ... + ... : String |
| JsonHijacking.java:33:16:33:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:33:16:33:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:40:32:40:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:42:21:42:80 | ... + ... : String | semmle.label | ... + ... : String |
| JsonHijacking.java:44:16:44:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:44:16:44:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:51:32:51:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:53:21:53:55 | ... + ... : String | semmle.label | ... + ... : String |
| JsonHijacking.java:54:16:54:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:54:16:54:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:61:32:61:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:63:21:63:54 | ... + ... : String | semmle.label | ... + ... : String |
| JsonHijacking.java:64:16:64:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:64:16:64:24 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:72:32:72:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
| JsonHijacking.java:80:20:80:28 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:80:20:80:28 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:88:32:88:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:94:21:94:54 | ... + ... : String | semmle.label | ... + ... : String |
| JsonHijacking.java:95:20:95:28 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:95:20:95:28 | resultStr | semmle.label | resultStr |
| JsonHijacking.java:102:32:102:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JsonHijacking.java:113:16:113:24 | resultStr | semmle.label | resultStr |
#select
| JsonHijacking.java:33:16:33:24 | resultStr | JsonHijacking.java:28:32:28:68 | getParameter(...) : String | JsonHijacking.java:33:16:33:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:28:32:28:68 | getParameter(...) | this user input |
| JsonHijacking.java:44:16:44:24 | resultStr | JsonHijacking.java:40:32:40:68 | getParameter(...) : String | JsonHijacking.java:44:16:44:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:40:32:40:68 | getParameter(...) | this user input |
| JsonHijacking.java:54:16:54:24 | resultStr | JsonHijacking.java:51:32:51:68 | getParameter(...) : String | JsonHijacking.java:54:16:54:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:51:32:51:68 | getParameter(...) | this user input |
| JsonHijacking.java:64:16:64:24 | resultStr | JsonHijacking.java:61:32:61:68 | getParameter(...) : String | JsonHijacking.java:64:16:64:24 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:61:32:61:68 | getParameter(...) | this user input |
| JsonHijacking.java:80:20:80:28 | resultStr | JsonHijacking.java:72:32:72:68 | getParameter(...) : String | JsonHijacking.java:80:20:80:28 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:72:32:72:68 | getParameter(...) | this user input |
| JsonHijacking.java:95:20:95:28 | resultStr | JsonHijacking.java:88:32:88:68 | getParameter(...) : String | JsonHijacking.java:95:20:95:28 | resultStr | Json Hijacking query might include code from $@. | JsonHijacking.java:88:32:88:68 | getParameter(...) | this user input |

119
java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.java Normal file
View File

@@ -0,0 +1,119 @@
import com.alibaba.fastjson.JSONObject;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.gson.Gson;
import java.io.PrintWriter;
import java.util.HashMap;
import java.util.Random;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class JsonHijacking {
private static HashMap hashMap = new HashMap();
static {
hashMap.put("username","admin");
hashMap.put("password","123456");
}
@GetMapping(value = "jsonp1")
@ResponseBody
public String bad1(HttpServletRequest request) {
String resultStr = null;
String jsonpCallback = request.getParameter("jsonpCallback");
Gson gson = new Gson();
String result = gson.toJson(hashMap);
resultStr = jsonpCallback + "(" + result + ")";
return resultStr;
}
@GetMapping(value = "jsonp2")
@ResponseBody
public String bad2(HttpServletRequest request) {
String resultStr = null;
String jsonpCallback = request.getParameter("jsonpCallback");
resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
return resultStr;
}
@GetMapping(value = "jsonp3")
@ResponseBody
public String bad3(HttpServletRequest request) {
String resultStr = null;
String jsonpCallback = request.getParameter("jsonpCallback");
String jsonStr = getJsonStr(hashMap);
resultStr = jsonpCallback + "(" + jsonStr + ")";
return resultStr;
}
@GetMapping(value = "jsonp4")
@ResponseBody
public String bad4(HttpServletRequest request) {
String resultStr = null;
String jsonpCallback = request.getParameter("jsonpCallback");
String restr = JSONObject.toJSONString(hashMap);
resultStr = jsonpCallback + "(" + restr + ");";
return resultStr;
}
@GetMapping(value = "jsonp5")
@ResponseBody
public void bad5(HttpServletRequest request,
HttpServletResponse response) throws Exception {
response.setContentType("application/json");
String jsonpCallback = request.getParameter("jsonpCallback");
PrintWriter pw = null;
Gson gson = new Gson();
String result = gson.toJson(hashMap);
String resultStr = null;
pw = response.getWriter();
resultStr = jsonpCallback + "(" + result + ")";
pw.println(resultStr);
}
@GetMapping(value = "jsonp6")
@ResponseBody
public void bad6(HttpServletRequest request,
HttpServletResponse response) throws Exception {
response.setContentType("application/json");
String jsonpCallback = request.getParameter("jsonpCallback");
PrintWriter pw = null;
ObjectMapper mapper = new ObjectMapper();
String result = mapper.writeValueAsString(hashMap);
String resultStr = null;
pw = response.getWriter();
resultStr = jsonpCallback + "(" + result + ")";
pw.println(resultStr);
}
@GetMapping(value = "jsonp7")
@ResponseBody
public String good(HttpServletRequest request) {
String resultStr = null;
String jsonpCallback = request.getParameter("jsonpCallback");
String val = "";
Random random = new Random();
for (int i = 0; i < 10; i++) {
val += String.valueOf(random.nextInt(10));
}
// good
jsonpCallback = jsonpCallback + "_" + val;
String jsonStr = getJsonStr(hashMap);
resultStr = jsonpCallback + "(" + jsonStr + ")";
return resultStr;
}
public static String getJsonStr(Object result) {
return JSONObject.toJSONString(result);
}
}

1
java/ql/test/experimental/query-tests/security/CWE-352/JsonHijacking.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-352/JsonHijacking.ql

1
java/ql/test/experimental/query-tests/security/CWE-352/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../stubs/gson-2.8.6/:${testdir}/../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../stubs/springframework-5.2.3/:${testdir}/../../../../stubs/spring-context-5.3.2/:${testdir}/../../../../stubs/spring-web-5.3.2/:${testdir}/../../../../stubs/spring-core-5.3.2/

4
java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
View File

@@ -26,6 +26,10 @@ import com.alibaba.fastjson.parser.*;
import com.alibaba.fastjson.parser.deserializer.ParseProcess;
public abstract class JSON {
public static String toJSONString(Object object) {
return null;
}
public static Object parse(String text) {
return null;
}

14
java/ql/test/stubs/spring-context-5.3.2/org/springframework/stereotype/Controller.java Normal file
View File

@@ -0,0 +1,14 @@
package org.springframework.stereotype;
import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
@Target({ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface Controller {
String value() default "";
}

BIN
java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.class Normal file
View File

Binary file not shown.

10
java/ql/test/stubs/spring-core-5.3.2/org/springframework/core/annotation/AliasFor.java Normal file
View File

@@ -0,0 +1,10 @@
package org.springframework.core.annotation;
public @interface AliasFor {
@AliasFor("attribute")
String value() default "";
@AliasFor("value")
String attribute() default "";
}

BIN
java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.class Normal file
View File

Binary file not shown.

19
java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/GetMapping.java Normal file
View File

@@ -0,0 +1,19 @@
package org.springframework.web.bind.annotation;
import org.springframework.core.annotation.AliasFor;
@RequestMapping
public @interface GetMapping {
String name() default "";
String[] value() default {};
String[] path() default {};
String[] params() default {};
String[] consumes() default {};
String[] produces() default {};
}

13
java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/RequestMapping.java Normal file
View File

@@ -0,0 +1,13 @@
package org.springframework.web.bind.annotation;
import org.springframework.core.annotation.AliasFor;
public @interface RequestMapping {
String name() default "";
@AliasFor("path")
String[] value() default {};
@AliasFor("value")
String[] path() default {};
}

BIN
java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.class Normal file
View File

Binary file not shown.

4
java/ql/test/stubs/spring-web-5.3.2/org/springframework/web/bind/annotation/ResponseBody.java Normal file
View File

@@ -0,0 +1,4 @@
package org.springframework.web.bind.annotation;
public @interface ResponseBody {
}