hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java SSRF query: document RequestForgeryAdditionalTaintStep and use Unit not string for a supertype.

Browse Source
This commit is contained in:
Chris Smowton
2021-04-16 11:18:57 +01:00
parent 575198a0e4
commit 960a903185
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/src/semmle/code/java/security/RequestForgery.qll
View File

@@ -1,3 +1,5 @@
/** Provides classes to reason about Server-side Request Forgery attacks. */
import java
import semmle.code.java.frameworks.Networking
import semmle.code.java.frameworks.ApacheHttp
@@ -8,16 +10,21 @@ import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.StringFormat
abstract class RequestForgeryAdditionalTaintStep extends string {
bindingset[this]
RequestForgeryAdditionalTaintStep() { any() }
/**
* A unit class for adding additional taint steps that are specific to Server-side
* Request Forgery (SSRF) attacks.
*
* Extend this class to add additional taint steps to the SSRF query.
*/
class RequestForgeryAdditionalTaintStep extends Unit {
/**
* Holds if the step from `pred` to `succ` should be considered a taint
* step for Server-side Request Forgery.
*/
abstract predicate propagatesTaint(DataFlow::Node pred, DataFlow::Node succ);
}
private class DefaultRequestForgeryAdditionalTaintStep extends RequestForgeryAdditionalTaintStep {
DefaultRequestForgeryAdditionalTaintStep() { this = "DefaultRequestForgeryAdditionalTaintStep" }
override predicate propagatesTaint(DataFlow::Node pred, DataFlow::Node succ) {
// propagate to a URI when its host is assigned to
exists(UriCreation c | c.getHostArg() = pred.asExpr() | succ.asExpr() = c)