hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Convert unsafe URL opening sinks to CSV format

Browse Source
This commit is contained in:
Tamas Vajk
2021-03-30 09:31:38 +02:00
parent 716568ebd1
commit b9ce1aefc0
2 changed files with 10 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
View File

@@ -13,6 +13,7 @@ import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.frameworks.Networking
import DataFlow::PathGraph
private import semmle.code.java.dataflow.ExternalFlow
class HTTPString extends StringLiteral {
HTTPString() {
@@ -30,26 +31,12 @@ class HTTPString extends StringLiteral {
}
}
class URLOpenMethod extends Method {
URLOpenMethod() {
this.getDeclaringType().getQualifiedName() = "java.net.URL" and
(
this.getName() = "openConnection" or
this.getName() = "openStream"
)
}
}
class HTTPStringToURLOpenMethodFlowConfig extends TaintTracking::Configuration {
HTTPStringToURLOpenMethodFlowConfig() { this = "HttpsUrls::HTTPStringToURLOpenMethodFlowConfig" }
override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HTTPString }
override predicate isSink(DataFlow::Node sink) {
exists(MethodAccess m |
sink.asExpr() = m.getQualifier() and m.getMethod() instanceof URLOpenMethod
)
}
override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "open-url") }
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(UrlConstructorCall u |

9
java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -184,7 +184,14 @@ private predicate sourceModelCsv(string row) {
]
}
private predicate sinkModelCsv(string row) { none() }
private predicate sinkModelCsv(string row) {
row =
[
// Open URL
"java.net;URL;false;openConnection;;;Argument[-1];open-url",
"java.net;URL;false;openStream;;;Argument[-1];open-url"
]
}
private predicate summaryModelCsv(string row) {
row =