hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add java.nio.file.Files API checks

Browse Source
This commit is contained in:
Jonathan Leitschuh
2021-01-01 19:32:32 -05:00
parent ecad7534ae
commit bc12e994b0
4 changed files with 103 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure2.ql
View File

@@ -22,14 +22,7 @@ private class MethodFileSystemFileCreation extends Method {
}
}
private class MethodFilesSystemFileCreation extends Method {
MethodFilesSystemFileCreation() {
getDeclaringType().hasQualifiedName("java.nio.file", "Files") and
hasName("write")
}
}
private abstract class FileCreationSink extends DataFlow::Node {}
abstract private class FileCreationSink extends DataFlow::Node { }
private class FileFileCreationSink extends FileCreationSink {
FileFileCreationSink() {
@@ -42,9 +35,17 @@ private class FileFileCreationSink extends FileCreationSink {
private class FilesFileCreationSink extends FileCreationSink {
FilesFileCreationSink() {
exists(MethodAccess ma |
ma.getMethod() instanceof MethodFilesSystemFileCreation and
ma.getArgument(0) = this.asExpr()
exists(FilesVulnerableCreationMethodAccess ma | ma.getArgument(0) = this.asExpr())
}
}
private class FilesVulnerableCreationMethodAccess extends MethodAccess {
FilesVulnerableCreationMethodAccess() {
getMethod().getDeclaringType().hasQualifiedName("java.nio.file", "Files") and
(
getMethod().hasName(["write", "newBufferedWriter", "newOutputStream"])
or
getMethod().hasName(["createFile", "createDirectory", "createDirectories"]) and getNumArgument() = 1
)
}
}
@@ -60,9 +61,7 @@ private class TempDirSystemGetPropertyToCreateConfig extends TaintTracking::Conf
isAdditionalFileTaintStep(node1, node2)
}
override predicate isSink(DataFlow::Node sink) {
sink instanceof FileCreationSink
}
override predicate isSink(DataFlow::Node sink) { sink instanceof FileCreationSink }
}
from DataFlow::PathNode source, DataFlow::PathNode sink, TempDirSystemGetPropertyToCreateConfig conf