hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 15:55:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16761 from owen-mc/java/reverse-dns-get-loopback-address

Browse Source 
Java: Exclude loopback address from reverse DNS source
This commit is contained in:
Owen Mansel-Chan
2024-06-14 22:39:55 +01:00
committed by GitHub
parent c0df22950b 9aa0c9f1f3
commit b0afba49a2
3 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2024-06-14-exclude-loopback-from-reverse-dns.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Excluded reverse DNS from the loopback address as a source of untrusted data.

2
java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
View File

@@ -126,7 +126,7 @@ private class ReverseDnsSource extends RemoteFlowSource {
m.getMethod() instanceof ReverseDnsMethod and
not exists(MethodCall l |
(variableStep(l, m.getQualifier()) or l = m.getQualifier()) and
l.getMethod().getName() = "getLocalHost"
(l.getMethod().getName() = "getLocalHost" or l.getMethod().getName() = "getLoopbackAddress")
)
)
}

11
java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.java
View File

@@ -38,7 +38,7 @@ class ConditionalBypassTest {
}
// FALSE NEGATIVE: we have no way of telling that the skipped method is sensitive
if (adminCookie.getValue() == "false") // $ MISSING: $ hasConditionalBypassTest
if (adminCookie.getValue() == "false") // $ MISSING: hasConditionalBypassTest
doReallyImportantSecurityWork();
InetAddress local = InetAddress.getLocalHost();
@@ -49,6 +49,15 @@ class ConditionalBypassTest {
if (Inet4Address.getLocalHost().getCanonicalHostName().equals("localhost")) {
login(user, password);
}
InetAddress loopback = InetAddress.getLoopbackAddress();
// GOOD: reverse DNS on loopback address is fine
if (loopback.getCanonicalHostName().equals("localhost")) {
login(user, password);
}
if (Inet4Address.getLoopbackAddress().getCanonicalHostName().equals("localhost")) {
login(user, password);
}
}
public static void test(String user, String password) {