hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

*)add CWE-652 test case

Browse Source
This commit is contained in:
haby0
2021-01-27 10:14:33 +08:00
parent 42f55e1ebe
commit b76854a384
23 changed files with 322 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected Normal file
View File

@@ -0,0 +1,19 @@
edges
| XQueryInjection.java:26:37:26:65 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:27:35:27:38 | xqpe |
| XQueryInjection.java:41:37:41:65 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:42:35:42:38 | xqpe |
| XQueryInjection.java:53:37:53:64 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:54:35:54:38 | xqpe |
| XQueryInjection.java:66:37:66:62 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:67:35:67:38 | xqpe |
nodes
| XQueryInjection.java:26:37:26:65 | prepareExpression(...) : XQPreparedExpression | semmle.label | prepareExpression(...) : XQPreparedExpression |
| XQueryInjection.java:27:35:27:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:41:37:41:65 | prepareExpression(...) : XQPreparedExpression | semmle.label | prepareExpression(...) : XQPreparedExpression |
| XQueryInjection.java:42:35:42:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:53:37:53:64 | prepareExpression(...) : XQPreparedExpression | semmle.label | prepareExpression(...) : XQPreparedExpression |
| XQueryInjection.java:54:35:54:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:66:37:66:62 | prepareExpression(...) : XQPreparedExpression | semmle.label | prepareExpression(...) : XQPreparedExpression |
| XQueryInjection.java:67:35:67:38 | xqpe | semmle.label | xqpe |
#select
| XQueryInjection.java:27:35:27:38 | xqpe | XQueryInjection.java:26:37:26:65 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:27:35:27:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:26:37:26:65 | prepareExpression(...) | this user input |
| XQueryInjection.java:42:35:42:38 | xqpe | XQueryInjection.java:41:37:41:65 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:42:35:42:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:41:37:41:65 | prepareExpression(...) | this user input |
| XQueryInjection.java:54:35:54:38 | xqpe | XQueryInjection.java:53:37:53:64 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:54:35:54:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:53:37:53:64 | prepareExpression(...) | this user input |
| XQueryInjection.java:67:35:67:38 | xqpe | XQueryInjection.java:66:37:66:62 | prepareExpression(...) : XQPreparedExpression | XQueryInjection.java:67:35:67:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:66:37:66:62 | prepareExpression(...) | this user input |

87
java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.java Normal file
View File

@@ -0,0 +1,87 @@
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import javax.servlet.http.HttpServletRequest;
import javax.xml.namespace.QName;
import javax.xml.xquery.XQConnection;
import javax.xml.xquery.XQDataSource;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQItemType;
import javax.xml.xquery.XQPreparedExpression;
import javax.xml.xquery.XQResultSequence;
import net.sf.saxon.xqj.SaxonXQDataSource;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
@Controller
public class XQueryInjection {
@RequestMapping
public void testRequestbad(HttpServletRequest request) throws Exception {
String name = request.getParameter("name");
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name + "'] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
XQResultSequence result = xqpe.executeQuery();
while (result.next()){
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testStringtbad(@RequestParam String nameStr) throws XQException {
String name = nameStr;
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name + "'] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
XQResultSequence result = xqpe.executeQuery();
while (result.next()){
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testInputStreambad(HttpServletRequest request) throws Exception {
InputStream name = request.getInputStream();
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
XQPreparedExpression xqpe = conn.prepareExpression(name);
XQResultSequence result = xqpe.executeQuery();
while (result.next()){
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testReaderbad(HttpServletRequest request) throws Exception {
InputStream name = request.getInputStream();
BufferedReader br = new BufferedReader(new InputStreamReader(name));
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
XQPreparedExpression xqpe = conn.prepareExpression(br);
XQResultSequence result = xqpe.executeQuery();
while (result.next()){
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void good(HttpServletRequest request) throws XQException {
String name = request.getParameter("name");
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "declare variable $name as xs:string external;"
+ " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
xqpe.bindString(new QName("name"), name, conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
XQResultSequence result = xqpe.executeQuery();
while (result.next()){
System.out.println(result.getItemAsString(null));
}
}
}

1
java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-652/XQueryInjection.ql

1
java/ql/test/experimental/query-tests/security/CWE-652/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/saxon-xqj-9.x/:${testdir}/../../../../stubs/springframework-5.2.3/

19
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQConnection.java Normal file
View File

@@ -0,0 +1,19 @@
package javax.xml.xquery;
import java.io.InputStream;
import java.io.Reader;
public interface XQConnection extends XQDataFactory {
XQPreparedExpression prepareExpression(String var1) throws XQException;
XQPreparedExpression prepareExpression(String var1, XQStaticContext var2) throws XQException;
XQPreparedExpression prepareExpression(Reader var1) throws XQException;
XQPreparedExpression prepareExpression(Reader var1, XQStaticContext var2) throws XQException;
XQPreparedExpression prepareExpression(InputStream var1) throws XQException;
XQPreparedExpression prepareExpression(InputStream var1, XQStaticContext var2) throws XQException;
}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataFactory.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQDataFactory {
XQItemType createAtomicType(int var1) throws XQException;
}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataSource.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQDataSource {
XQConnection getConnection() throws XQException;
}

7
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDynamicContext.java Normal file
View File

@@ -0,0 +1,7 @@
package javax.xml.xquery;
import javax.xml.namespace.QName;
public interface XQDynamicContext {
void bindString(QName var1, String var2, XQItemType var3) throws XQException;
}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQException.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public class XQException extends Exception {}

7
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemAccessor.java Normal file
View File

@@ -0,0 +1,7 @@
package javax.xml.xquery;
import java.util.Properties;
public interface XQItemAccessor {
String getItemAsString(Properties var1) throws XQException;
}

68
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemType.java Normal file
View File

@@ -0,0 +1,68 @@
package javax.xml.xquery;
public interface XQItemType extends XQSequenceType {
int XQITEMKIND_ATOMIC = 1;
int XQITEMKIND_ATTRIBUTE = 2;
int XQITEMKIND_COMMENT = 3;
int XQITEMKIND_DOCUMENT = 4;
int XQITEMKIND_DOCUMENT_ELEMENT = 5;
int XQITEMKIND_DOCUMENT_SCHEMA_ELEMENT = 6;
int XQITEMKIND_ELEMENT = 7;
int XQITEMKIND_ITEM = 8;
int XQITEMKIND_NODE = 9;
int XQITEMKIND_PI = 10;
int XQITEMKIND_TEXT = 11;
int XQITEMKIND_SCHEMA_ELEMENT = 12;
int XQITEMKIND_SCHEMA_ATTRIBUTE = 13;
int XQBASETYPE_UNTYPED = 1;
int XQBASETYPE_ANYTYPE = 2;
int XQBASETYPE_ANYSIMPLETYPE = 3;
int XQBASETYPE_ANYATOMICTYPE = 4;
int XQBASETYPE_UNTYPEDATOMIC = 5;
int XQBASETYPE_DAYTIMEDURATION = 6;
int XQBASETYPE_YEARMONTHDURATION = 7;
int XQBASETYPE_ANYURI = 8;
int XQBASETYPE_BASE64BINARY = 9;
int XQBASETYPE_BOOLEAN = 10;
int XQBASETYPE_DATE = 11;
int XQBASETYPE_INT = 12;
int XQBASETYPE_INTEGER = 13;
int XQBASETYPE_SHORT = 14;
int XQBASETYPE_LONG = 15;
int XQBASETYPE_DATETIME = 16;
int XQBASETYPE_DECIMAL = 17;
int XQBASETYPE_DOUBLE = 18;
int XQBASETYPE_DURATION = 19;
int XQBASETYPE_FLOAT = 20;
int XQBASETYPE_GDAY = 21;
int XQBASETYPE_GMONTH = 22;
int XQBASETYPE_GMONTHDAY = 23;
int XQBASETYPE_GYEAR = 24;
int XQBASETYPE_GYEARMONTH = 25;
int XQBASETYPE_HEXBINARY = 26;
int XQBASETYPE_NOTATION = 27;
int XQBASETYPE_QNAME = 28;
int XQBASETYPE_STRING = 29;
int XQBASETYPE_TIME = 30;
int XQBASETYPE_BYTE = 31;
int XQBASETYPE_NONPOSITIVE_INTEGER = 32;
int XQBASETYPE_NONNEGATIVE_INTEGER = 33;
int XQBASETYPE_NEGATIVE_INTEGER = 34;
int XQBASETYPE_POSITIVE_INTEGER = 35;
int XQBASETYPE_UNSIGNED_LONG = 36;
int XQBASETYPE_UNSIGNED_INT = 37;
int XQBASETYPE_UNSIGNED_SHORT = 38;
int XQBASETYPE_UNSIGNED_BYTE = 39;
int XQBASETYPE_NORMALIZED_STRING = 40;
int XQBASETYPE_TOKEN = 41;
int XQBASETYPE_LANGUAGE = 42;
int XQBASETYPE_NAME = 43;
int XQBASETYPE_NCNAME = 44;
int XQBASETYPE_NMTOKEN = 45;
int XQBASETYPE_ID = 46;
int XQBASETYPE_IDREF = 47;
int XQBASETYPE_ENTITY = 48;
int XQBASETYPE_IDREFS = 49;
int XQBASETYPE_ENTITIES = 50;
int XQBASETYPE_NMTOKENS = 51;
}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQPreparedExpression.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQPreparedExpression extends XQDynamicContext {
XQResultSequence executeQuery() throws XQException;
}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQResultSequence.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public interface XQResultSequence extends XQSequence {}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequence.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQSequence extends XQItemAccessor {
boolean next() throws XQException;
}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequenceType.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public interface XQSequenceType {}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQStaticContext.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public interface XQStaticContext {}

6
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/Configuration.java Normal file
View File

@@ -0,0 +1,6 @@
package net.sf.saxon;
import java.io.Serializable;
public class Configuration implements Serializable, SourceResolver {}

3
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/SourceResolver.java Normal file
View File

@@ -0,0 +1,3 @@
package net.sf.saxon;
public interface SourceResolver {}

3
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/Closable.java Normal file
View File

@@ -0,0 +1,3 @@
package net.sf.saxon.xqj;
public abstract class Closable {}

41
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQConnection.java Normal file
View File

@@ -0,0 +1,41 @@
package net.sf.saxon.xqj;
import java.io.Reader;
import net.sf.saxon.Configuration;
import javax.xml.xquery.XQConnection;
import javax.xml.xquery.XQPreparedExpression;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQStaticContext;
import java.io.InputStream;
public class SaxonXQConnection extends SaxonXQDataFactory implements XQConnection {
private SaxonXQStaticContext staticContext;
SaxonXQConnection(SaxonXQDataSource dataSource) {
}
public XQPreparedExpression prepareExpression(InputStream xquery) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(InputStream xquery, XQStaticContext properties) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(Reader xquery) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(Reader xquery, XQStaticContext properties){
return null;
}
public XQPreparedExpression prepareExpression(String xquery) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(String xquery, XQStaticContext properties) throws XQException {
return null;
}
}

11
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataFactory.java Normal file
View File

@@ -0,0 +1,11 @@
package net.sf.saxon.xqj;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQDataFactory;
import javax.xml.xquery.XQItemType;
public abstract class SaxonXQDataFactory extends Closable implements XQDataFactory {
public XQItemType createAtomicType(int baseType) throws XQException {
return null;
}
}

12
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataSource.java Normal file
View File

@@ -0,0 +1,12 @@
package net.sf.saxon.xqj;
import javax.xml.xquery.XQDataSource;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQConnection;
public class SaxonXQDataSource implements XQDataSource {
public XQConnection getConnection() throws XQException {
return new SaxonXQConnection(this);
}
}

5
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQStaticContext.java Normal file
View File

@@ -0,0 +1,5 @@
package net.sf.saxon.xqj;
import javax.xml.xquery.XQStaticContext;
public class SaxonXQStaticContext implements XQStaticContext {}