hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-02 08:12:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8357 from p0wn4j/jdbc-url-ssrf-sink

Browse Source 
Java: Add JDBC connection SSRF sinks
This commit is contained in:
Chris Smowton
2022-03-14 13:27:34 +00:00
committed by GitHub
parent 0bf4ce7cf1 b351d5bc2f
commit 9f02ca0db2
20 changed files with 1110 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -131,6 +131,8 @@ private module Frameworks {
private import semmle.code.java.security.XPath
private import semmle.code.java.security.XsltInjection
private import semmle.code.java.frameworks.Jdbc
private import semmle.code.java.frameworks.Jdbi
private import semmle.code.java.frameworks.HikariCP
private import semmle.code.java.frameworks.SpringJdbc
private import semmle.code.java.frameworks.MyBatis
private import semmle.code.java.frameworks.Hibernate

17
java/ql/lib/semmle/code/java/frameworks/HikariCP.qll Normal file
View File

@@ -0,0 +1,17 @@
/**
* Definitions of sinks in the Hikari Connection Pool library.
*/
import java
import semmle.code.java.dataflow.ExternalFlow
private class SsrfSinkCsv extends SinkModelCsv {
override predicate row(string row) {
row =
[
//"package;type;overrides;name;signature;ext;spec;kind"
"com.zaxxer.hikari;HikariConfig;false;HikariConfig;(Properties);;Argument[0];jdbc-url",
"com.zaxxer.hikari;HikariConfig;false;setJdbcUrl;(String);;Argument[0];jdbc-url"
]
}
}

13
java/ql/lib/semmle/code/java/frameworks/Jdbc.qll
View File

@@ -52,3 +52,16 @@ private class SqlSinkCsv extends SinkModelCsv {
]
}
}
private class SsrfSinkCsv extends SinkModelCsv {
override predicate row(string row) {
row =
[
//"package;type;overrides;name;signature;ext;spec;kind"
"java.sql;DriverManager;false;getConnection;(String);;Argument[0];jdbc-url",
"java.sql;DriverManager;false;getConnection;(String,Properties);;Argument[0];jdbc-url",
"java.sql;DriverManager;false;getConnection;(String,String,String);;Argument[0];jdbc-url",
"java.sql;Driver;false;connect;(String,Properties);;Argument[0];jdbc-url"
]
}
}

21
java/ql/lib/semmle/code/java/frameworks/Jdbi.qll Normal file
View File

@@ -0,0 +1,21 @@
/**
* Definitions of sinks in the JDBI library.
*/
import java
import semmle.code.java.dataflow.ExternalFlow
private class SsrfSinkCsv extends SinkModelCsv {
override predicate row(string row) {
row =
[
//"package;type;overrides;name;signature;ext;spec;kind"
"org.jdbi.v3.core;Jdbi;false;create;(String);;Argument[0];jdbc-url",
"org.jdbi.v3.core;Jdbi;false;create;(String,Properties);;Argument[0];jdbc-url",
"org.jdbi.v3.core;Jdbi;false;create;(String,String,String);;Argument[0];jdbc-url",
"org.jdbi.v3.core;Jdbi;false;open;(String);;Argument[0];jdbc-url",
"org.jdbi.v3.core;Jdbi;false;open;(String,Properties);;Argument[0];jdbc-url",
"org.jdbi.v3.core;Jdbi;false;open;(String,String,String);;Argument[0];jdbc-url"
]
}
}

14
java/ql/lib/semmle/code/java/frameworks/SpringJdbc.qll
View File

@@ -37,3 +37,17 @@ private class SqlSinkCsv extends SinkModelCsv {
]
}
}
private class SsrfSinkCsv extends SinkModelCsv {
override predicate row(string row) {
row =
[
//"package;type;overrides;name;signature;ext;spec;kind"
"org.springframework.boot.jdbc;DataSourceBuilder;false;url;(String);;Argument[0];jdbc-url",
"org.springframework.jdbc.datasource;AbstractDriverBasedDataSource;false;setUrl;(String);;Argument[0];jdbc-url",
"org.springframework.jdbc.datasource;DriverManagerDataSource;false;DriverManagerDataSource;(String);;Argument[0];jdbc-url",
"org.springframework.jdbc.datasource;DriverManagerDataSource;false;DriverManagerDataSource;(String,String,String);;Argument[0];jdbc-url",
"org.springframework.jdbc.datasource;DriverManagerDataSource;false;DriverManagerDataSource;(String,Properties);;Argument[0];jdbc-url"
]
}
}

19
java/ql/lib/semmle/code/java/security/RequestForgery.qll
View File

@@ -7,6 +7,7 @@ import semmle.code.java.frameworks.spring.Spring
import semmle.code.java.frameworks.JaxWS
import semmle.code.java.frameworks.javase.Http
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.frameworks.Properties
private import semmle.code.java.dataflow.StringPrefixes
private import semmle.code.java.dataflow.ExternalFlow
@@ -33,6 +34,20 @@ private class DefaultRequestForgeryAdditionalTaintStep extends RequestForgeryAdd
}
}
private class TypePropertiesRequestForgeryAdditionalTaintStep extends RequestForgeryAdditionalTaintStep {
override predicate propagatesTaint(DataFlow::Node pred, DataFlow::Node succ) {
exists(MethodAccess ma |
// Properties props = new Properties();
// props.setProperty("jdbcUrl", tainted);
// Propagate tainted value to the qualifier `props`
ma.getMethod() instanceof PropertiesSetPropertyMethod and
ma.getArgument(0).(CompileTimeConstantExpr).getStringValue() = "jdbcUrl" and
pred.asExpr() = ma.getArgument(1) and
succ.asExpr() = ma.getQualifier()
)
}
}
/** A data flow sink for server-side request forgery (SSRF) vulnerabilities. */
abstract class RequestForgerySink extends DataFlow::Node { }
@@ -40,6 +55,10 @@ private class UrlOpenSinkAsRequestForgerySink extends RequestForgerySink {
UrlOpenSinkAsRequestForgerySink() { sinkNode(this, "open-url") }
}
private class JdbcUrlSinkAsRequestForgerySink extends RequestForgerySink {
JdbcUrlSinkAsRequestForgerySink() { sinkNode(this, "jdbc-url") }
}
/** A sanitizer for request forgery vulnerabilities. */
abstract class RequestForgerySanitizer extends DataFlow::Node { }