hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 07:45:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move ESAPI models into the Weak Randomness query

Browse Source 
These models don't need to apply to all queries. So instead they are
better suited to be within the weak randomness query itself.
This commit is contained in:
Ed Minnix
2023-11-07 16:49:13 -05:00
parent 7f3995f524
commit b9d2a26e6e
6 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/lib/ext/org.owasp.esapi.model.yml
View File

@@ -3,5 +3,4 @@ extensions:
pack: codeql/java-all
extensible: summaryModel
data:
- ["org.owasp.esapi", "Encoder", true, "encodeForHTML", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["org.owasp.esapi", "Encoder", true, "encodeForBase64", "(byte[],boolean)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["org.owasp.esapi", "Encoder", true, "encodeForHTML", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

8
java/ql/lib/semmle/code/java/security/WeakRandomnessQuery.qll
View File

@@ -79,6 +79,14 @@ module WeakRandomnessConfig implements DataFlow::ConfigSig {
n1.asExpr() = n2.asExpr().(BinaryExpr).getAnOperand()
or
n1.asExpr() = n2.asExpr().(UnaryExpr).getExpr()
or
exists(MethodCall mc, string methodName |
mc.getMethod().hasQualifiedName("org.owasp.esapi", "Encoder", methodName) and
methodName.matches("encode%")
|
n1.asExpr() = mc.getArgument(0) and
n2.asExpr() = mc
)
}
}

5
java/ql/test/query-tests/security/CWE-330/WeakRandomCookies.java
View File

@@ -8,6 +8,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.Cookie;
import org.apache.commons.lang3.RandomStringUtils;
import org.owasp.esapi.Encoder;
public class WeakRandomCookies extends HttpServlet {
HttpServletResponse response;
@@ -20,9 +21,11 @@ public class WeakRandomCookies extends HttpServlet {
Cookie cookie = new Cookie("name", Integer.toString(c));
response.addCookie(cookie); // $hasWeakRandomFlow
Encoder enc = null;
int c2 = r.nextInt();
String value = enc.encodeForHTML(Integer.toString(c2));
// BAD: The cookie value may be predictable.
Cookie cookie2 = new Cookie("name" + c2, "value");
Cookie cookie2 = new Cookie("name", value);
response.addCookie(cookie2); // $hasWeakRandomFlow
byte[] bytes = new byte[16];

2
java/ql/test/query-tests/security/CWE-330/options
View File

@@ -1 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/apache-commons-lang3-3.7
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/apache-commons-lang3-3.7:${testdir}/../../../stubs/esapi-2.0.1

2
java/ql/test/stubs/esapi-2.0.1/org/owasp/esapi/Encoder.java generated
View File

@@ -2,4 +2,6 @@ package org.owasp.esapi;
public interface Encoder {
String encodeForLDAP(String input);
String encodeForHTML(String untrustedData);
}

1
java/ql/test/stubs/esapi-2.0.1/org/owasp/esapi/reference/DefaultEncoder.java generated
View File

@@ -5,4 +5,5 @@ import org.owasp.esapi.Encoder;
public class DefaultEncoder implements Encoder {
public static Encoder getInstance() { return null; }
public String encodeForLDAP(String input) { return null; }
public String encodeForHTML(String untrustedData) { return null; }
}