mirror of
https://github.com/github/codeql.git
synced 2026-05-05 21:55:19 +02:00
Port to ApiGraphs and finish the query
This commit is contained in:
jorgectf
@@ -0,0 +1,39 @@
|
||||
edges
|
||||
| ldap3_remote.py:49:12:49:34 | ControlFlowNode for BinaryExpr | ldap3_remote.py:51:18:51:21 | ControlFlowNode for host |
|
||||
| ldap3_remote.py:88:21:88:27 | ControlFlowNode for request | ldap3_remote.py:88:21:88:32 | ControlFlowNode for Attribute |
|
||||
| ldap3_remote.py:88:21:88:32 | ControlFlowNode for Attribute | ldap3_remote.py:88:21:88:40 | ControlFlowNode for Subscript |
|
||||
| ldap3_remote.py:88:21:88:40 | ControlFlowNode for Subscript | ldap3_remote.py:90:18:90:21 | ControlFlowNode for host |
|
||||
| ldap3_remote.py:101:12:101:49 | ControlFlowNode for BinaryExpr | ldap3_remote.py:102:18:102:21 | ControlFlowNode for host |
|
||||
| ldap3_remote.py:114:12:114:49 | ControlFlowNode for BinaryExpr | ldap3_remote.py:115:18:115:21 | ControlFlowNode for host |
|
||||
| ldap3_remote.py:126:12:126:31 | ControlFlowNode for BinaryExpr | ldap3_remote.py:127:18:127:21 | ControlFlowNode for host |
|
||||
| ldap3_remote.py:138:21:138:27 | ControlFlowNode for request | ldap3_remote.py:138:21:138:32 | ControlFlowNode for Attribute |
|
||||
| ldap3_remote.py:138:21:138:32 | ControlFlowNode for Attribute | ldap3_remote.py:138:21:138:40 | ControlFlowNode for Subscript |
|
||||
| ldap3_remote.py:138:21:138:40 | ControlFlowNode for Subscript | ldap3_remote.py:139:18:139:21 | ControlFlowNode for host |
|
||||
nodes
|
||||
| ldap2_remote.py:45:41:45:60 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| ldap2_remote.py:56:41:56:60 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| ldap3_remote.py:49:12:49:34 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| ldap3_remote.py:51:18:51:21 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| ldap3_remote.py:88:21:88:27 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| ldap3_remote.py:88:21:88:32 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
|
||||
| ldap3_remote.py:88:21:88:40 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
|
||||
| ldap3_remote.py:90:18:90:21 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| ldap3_remote.py:101:12:101:49 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| ldap3_remote.py:102:18:102:21 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| ldap3_remote.py:114:12:114:49 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| ldap3_remote.py:115:18:115:21 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| ldap3_remote.py:126:12:126:31 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| ldap3_remote.py:127:18:127:21 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| ldap3_remote.py:138:21:138:27 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| ldap3_remote.py:138:21:138:32 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
|
||||
| ldap3_remote.py:138:21:138:40 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
|
||||
| ldap3_remote.py:139:18:139:21 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
#select
|
||||
| ldap2_remote.py:45:41:45:60 | ControlFlowNode for BinaryExpr | ldap2_remote.py:45:41:45:60 | ControlFlowNode for BinaryExpr | ldap2_remote.py:45:41:45:60 | ControlFlowNode for BinaryExpr | $@ is authenticated insecurely. | ldap2_remote.py:45:41:45:60 | ControlFlowNode for BinaryExpr | This LDAP host |
|
||||
| ldap2_remote.py:56:41:56:60 | ControlFlowNode for BinaryExpr | ldap2_remote.py:56:41:56:60 | ControlFlowNode for BinaryExpr | ldap2_remote.py:56:41:56:60 | ControlFlowNode for BinaryExpr | $@ is authenticated insecurely. | ldap2_remote.py:56:41:56:60 | ControlFlowNode for BinaryExpr | This LDAP host |
|
||||
| ldap3_remote.py:51:18:51:21 | ControlFlowNode for host | ldap3_remote.py:49:12:49:34 | ControlFlowNode for BinaryExpr | ldap3_remote.py:51:18:51:21 | ControlFlowNode for host | $@ is authenticated insecurely. | ldap3_remote.py:51:18:51:21 | ControlFlowNode for host | This LDAP host |
|
||||
| ldap3_remote.py:90:18:90:21 | ControlFlowNode for host | ldap3_remote.py:88:21:88:27 | ControlFlowNode for request | ldap3_remote.py:90:18:90:21 | ControlFlowNode for host | $@ is authenticated insecurely. | ldap3_remote.py:90:18:90:21 | ControlFlowNode for host | This LDAP host |
|
||||
| ldap3_remote.py:102:18:102:21 | ControlFlowNode for host | ldap3_remote.py:101:12:101:49 | ControlFlowNode for BinaryExpr | ldap3_remote.py:102:18:102:21 | ControlFlowNode for host | $@ is authenticated insecurely. | ldap3_remote.py:102:18:102:21 | ControlFlowNode for host | This LDAP host |
|
||||
| ldap3_remote.py:115:18:115:21 | ControlFlowNode for host | ldap3_remote.py:114:12:114:49 | ControlFlowNode for BinaryExpr | ldap3_remote.py:115:18:115:21 | ControlFlowNode for host | $@ is authenticated insecurely. | ldap3_remote.py:115:18:115:21 | ControlFlowNode for host | This LDAP host |
|
||||
| ldap3_remote.py:127:18:127:21 | ControlFlowNode for host | ldap3_remote.py:126:12:126:31 | ControlFlowNode for BinaryExpr | ldap3_remote.py:127:18:127:21 | ControlFlowNode for host | $@ is authenticated insecurely. | ldap3_remote.py:127:18:127:21 | ControlFlowNode for host | This LDAP host |
|
||||
| ldap3_remote.py:139:18:139:21 | ControlFlowNode for host | ldap3_remote.py:138:21:138:27 | ControlFlowNode for request | ldap3_remote.py:139:18:139:21 | ControlFlowNode for host | $@ is authenticated insecurely. | ldap3_remote.py:139:18:139:21 | ControlFlowNode for host | This LDAP host |
|
||||
@@ -0,0 +1 @@
|
||||
experimental/Security/CWE-522/LDAPInsecureAuth.ql
|
||||
@@ -0,0 +1,66 @@
|
||||
import ldap
|
||||
from flask import request, Flask
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
schema = "ldap://"
|
||||
remote_host = "127.0.0.1"
|
||||
full_host = "ldap://127.0.0.1"
|
||||
|
||||
|
||||
# GOOD
|
||||
|
||||
# SSL through ldap variable option
|
||||
# host from variable + variable
|
||||
|
||||
@app.route("/one")
|
||||
def one():
|
||||
ldap_connection_1 = ldap.initialize(schema + remote_host)
|
||||
ldap_connection_1.set_option(ldap.OPT_X_TLS_DEMAND, True)
|
||||
ldap_connection_1.simple_bind_s('', '')
|
||||
user = ldap_connection_1.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
# SSL through ldap start_tls_s
|
||||
# hardcoded host
|
||||
|
||||
@app.route("/two")
|
||||
def two():
|
||||
ldap_connection_2 = ldap.initialize("ldap://127.0.0.1")
|
||||
ldap_connection_2.start_tls_s()
|
||||
ldap_connection_2.simple_bind_s('', '')
|
||||
user = ldap_connection_2.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
# BAD (not a sink because it's private)
|
||||
|
||||
@app.route("/one_bad")
|
||||
def one_bad():
|
||||
ldap_connection_3 = ldap.initialize(schema + remote_host)
|
||||
ldap_connection_3.set_option(ldap.OPT_X_TLS_DEMAND, False)
|
||||
ldap_connection_3.simple_bind_s('', '')
|
||||
user = ldap_connection_3.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
@app.route("/one_bad_2")
|
||||
def one_bad_2():
|
||||
ldap_connection_4 = ldap.initialize(schema + remote_host)
|
||||
ldap_connection_4.set_option(ldap.OPT_X_TLS_NEVER)
|
||||
ldap_connection_4.simple_bind_s('', '')
|
||||
user = ldap_connection_4.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
# if __name__ == "__main__":
|
||||
# app.run(debug=True)
|
||||
@@ -0,0 +1,66 @@
|
||||
import ldap
|
||||
from flask import request, Flask
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
schema = "ldap://"
|
||||
remote_host = "somethingon.theinternet.com"
|
||||
full_host = "ldap://somethingon.theinternet.com"
|
||||
|
||||
|
||||
# GOOD
|
||||
|
||||
# SSL through ldap variable option
|
||||
# host from variable + variable
|
||||
|
||||
@app.route("/one")
|
||||
def one():
|
||||
ldap_connection_5 = ldap.initialize(schema + remote_host)
|
||||
ldap_connection_5.set_option(ldap.OPT_X_TLS_DEMAND, True)
|
||||
ldap_connection_5.simple_bind_s('', '')
|
||||
user = ldap_connection_5.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
# SSL through ldap start_tls_s
|
||||
# hardcoded host
|
||||
|
||||
@app.route("/two")
|
||||
def two():
|
||||
ldap_connection_6 = ldap.initialize("ldap://somethingon.theinternet.com")
|
||||
ldap_connection_6.start_tls_s()
|
||||
ldap_connection_6.simple_bind_s('', '')
|
||||
user = ldap_connection_6.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
# BAD
|
||||
|
||||
@app.route("/one_bad")
|
||||
def one_bad():
|
||||
ldap_connection_7 = ldap.initialize(schema + remote_host)
|
||||
ldap_connection_7.set_option(ldap.OPT_X_TLS_DEMAND, False)
|
||||
ldap_connection_7.simple_bind_s('', '')
|
||||
user = ldap_connection_7.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
@app.route("/one_bad_2")
|
||||
def one_bad_2():
|
||||
ldap_connection_8 = ldap.initialize(schema + remote_host)
|
||||
ldap_connection_8.set_option(ldap.OPT_X_TLS_NEVER)
|
||||
ldap_connection_8.simple_bind_s('', '')
|
||||
user = ldap_connection_8.search_s(
|
||||
"dn", ldap.SCOPE_SUBTREE, "search_filter")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
# if __name__ == "__main__":
|
||||
# app.run(debug=True)
|
||||
@@ -0,0 +1,105 @@
|
||||
from ldap3 import Server, Connection, ALL
|
||||
from flask import request, Flask
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
schema = "ldap://"
|
||||
partial_host = "127.0.0.1"
|
||||
full_host = "ldap://127.0.0.1"
|
||||
|
||||
|
||||
# hardcoded host
|
||||
|
||||
@app.route("/one")
|
||||
def one():
|
||||
srv = Server("ldap://127.0.0.1", port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# host from variable
|
||||
|
||||
@app.route("/two")
|
||||
def two():
|
||||
srv = Server(full_host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# schema from string + variable
|
||||
|
||||
@app.route("/three")
|
||||
def three():
|
||||
host = "ldap://" + partial_host
|
||||
|
||||
srv = Server(host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# schema from variable + variable
|
||||
|
||||
@app.route("/four")
|
||||
def four():
|
||||
host = schema + partial_host
|
||||
|
||||
srv = Server(host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# schema from string + string
|
||||
|
||||
@app.route("/five")
|
||||
def five():
|
||||
host = "ldap://" + "127.0.0.1"
|
||||
|
||||
srv = Server(host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# schema from variable + hardcoded host
|
||||
|
||||
@app.route("/six")
|
||||
def six():
|
||||
host = schema + "127.0.0.1"
|
||||
|
||||
srv = Server(host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (positional argument)
|
||||
# host from string + variable
|
||||
|
||||
@app.route("/four")
|
||||
def four():
|
||||
host = "ldap://" + partial_host
|
||||
|
||||
srv = Server(host, 1337, True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (argument by name)
|
||||
# host from variable + variable
|
||||
|
||||
@app.route("/five")
|
||||
def five():
|
||||
host = schema + partial_host
|
||||
|
||||
srv = Server(host, port=1337, use_ssl=True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
|
||||
|
||||
# if __name__ == "__main__":
|
||||
# app.run(debug=True)
|
||||
@@ -0,0 +1,146 @@
|
||||
from ldap3 import Server, Connection, ALL
|
||||
from flask import request, Flask
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
schema = "ldap://"
|
||||
remote_host = "somethingon.theinternet.com"
|
||||
full_host = "ldap://somethingon.theinternet.com"
|
||||
|
||||
|
||||
# use_ssl = True (positional argument)
|
||||
# hardcoded host
|
||||
|
||||
@app.route("/one")
|
||||
def one():
|
||||
srv = Server("ldap://somethingon.theinternet.com", port=1337, True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (argument by name)
|
||||
# host from variable
|
||||
|
||||
@app.route("/two")
|
||||
def two():
|
||||
srv = Server(full_host, port=1337, use_ssl=True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (argument by name)
|
||||
# host from RFS
|
||||
|
||||
@app.route("/three")
|
||||
def three():
|
||||
srv = Server(request.args['host'], port=1337, use_ssl=True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (positional argument)
|
||||
# host from string + variable
|
||||
|
||||
@app.route("/four")
|
||||
def four():
|
||||
host = "ldap://" + remote_host
|
||||
|
||||
srv = Server(host, port=1337, True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (argument by name)
|
||||
# host from variable + variable
|
||||
|
||||
@app.route("/five")
|
||||
def five():
|
||||
host = schema + remote_host
|
||||
|
||||
srv = Server(host, port=1337, use_ssl=True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (argument by name)
|
||||
# host from string + RFS
|
||||
|
||||
@app.route("/six")
|
||||
def six():
|
||||
host = "ldap://" + request.args['host']
|
||||
|
||||
srv = Server(host, port=1337, use_ssl=True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# use_ssl = True (positional argument)
|
||||
# host from variable + RFS
|
||||
|
||||
@app.route("/seven")
|
||||
def seven():
|
||||
host = schema + request.args['host']
|
||||
|
||||
srv = Server(host, port=1337, True)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# SSL through special method
|
||||
# host from variable + hardcoded host
|
||||
|
||||
@app.route("/eight")
|
||||
def eight():
|
||||
host = schema + "somethingon.theinternet.com"
|
||||
srv = Server(host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.start_tls() # !
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# No SSL (to test sink)
|
||||
# host from variable + hardcoded host
|
||||
|
||||
@app.route("/nine")
|
||||
def nine():
|
||||
host = schema + "somethingon.theinternet.com"
|
||||
srv = Server(host, port=1337, False)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# No SSL (to test sink)
|
||||
# host from variable + variable
|
||||
|
||||
@app.route("/ten")
|
||||
def ten():
|
||||
host = schema + remote_host
|
||||
srv = Server(host, port=1337, use_ssl=False)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# No SSL (to test sink)
|
||||
# host from variable + RFS
|
||||
|
||||
@app.route("/eleven")
|
||||
def eleven():
|
||||
host = schema + request.args['host']
|
||||
srv = Server(host, port=1337)
|
||||
conn = Connection(srv, "dn", "password")
|
||||
conn.search("dn", "search_filter")
|
||||
return conn.response
|
||||
|
||||
|
||||
# if __name__ == "__main__":
|
||||
# app.run(debug=True)
|
||||
Reference in New Issue
Block a user