hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactored cleartext storage libraries

Browse Source
This commit is contained in:
Tony Torralba
2021-08-17 10:35:57 +02:00
parent 93daaf5b5b
commit a30554e97c
7 changed files with 329 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/src/Security/CWE/CWE-312/CleartextStorageClass.ql
View File

@@ -12,15 +12,12 @@
*/
import java
import SensitiveStorage
import semmle.code.java.security.CleartextStorageClassQuery
from SensitiveSource data, ClassStore s, Expr input, Expr store
where
input = s.getAnInput() and
store = s.getAStore() and
data.flowsToCached(input) and
// Exclude results in test code.
not testMethod(store.getEnclosingCallable()) and
not testMethod(data.getEnclosingCallable())
data.flowsToCached(input)
select store, "Storable class $@ containing $@ is stored here. Data was added $@.", s, s.toString(),
data, "sensitive data", input, "here"

7
java/ql/src/Security/CWE/CWE-312/CleartextStorageCookie.ql
View File

@@ -11,15 +11,12 @@
*/
import java
import SensitiveStorage
import semmle.code.java.security.CleartextStorageCookieQuery
from SensitiveSource data, Cookie s, Expr input, Expr store
where
input = s.getAnInput() and
store = s.getAStore() and
data.flowsToCached(input) and
// Exclude results in test code.
not testMethod(store.getEnclosingCallable()) and
not testMethod(data.getEnclosingCallable())
data.flowsToCached(input)
select store, "Cookie $@ containing $@ is stored here. Data was added $@.", s, s.toString(), data,
"sensitive data", input, "here"

7
java/ql/src/Security/CWE/CWE-312/CleartextStorageProperties.ql
View File

@@ -11,15 +11,12 @@
*/
import java
import SensitiveStorage
import semmle.code.java.security.CleartextStoragePropertiesQuery
from SensitiveSource data, Properties s, Expr input, Expr store
where
input = s.getAnInput() and
store = s.getAStore() and
data.flowsToCached(input) and
// Exclude results in test code.
not testMethod(store.getEnclosingCallable()) and
not testMethod(data.getEnclosingCallable())
data.flowsToCached(input)
select store, "'Properties' class $@ containing $@ is stored here. Data was added $@.", s,
s.toString(), data, "sensitive data", input, "here"