hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11549 from mbaluda/mbaluda/insecure-cookie

Browse Source 
Java: Support interprocedural setting of cookie security
This commit is contained in:
Tony Torralba
2022-12-07 12:14:46 +01:00
committed by GitHub
parent 321a2f5a73 8422df1c43
commit cabce5fb36
3 changed files with 38 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2022-12-05-insecure-cookie-global-flow.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The query `java/insecure-cookie` now uses global dataflow to track secure cookies being set to the HTTP response object.

35
java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql
View File

@@ -26,18 +26,31 @@ predicate isSafeSecureCookieSetting(Expr e) {
)
}
class SecureCookieConfiguration extends DataFlow::Configuration {
SecureCookieConfiguration() { this = "SecureCookieConfiguration" }
override predicate isSource(DataFlow::Node source) {
exists(MethodAccess ma, Method m | ma.getMethod() = m |
m.getDeclaringType() instanceof TypeCookie and
m.getName() = "setSecure" and
source.asExpr() = ma.getQualifier() and
forex(DataFlow::Node argSource |
DataFlow::localFlow(argSource, DataFlow::exprNode(ma.getArgument(0))) and
not DataFlow::localFlowStep(_, argSource)
|
isSafeSecureCookieSetting(argSource.asExpr())
)
)
}
override predicate isSink(DataFlow::Node sink) {
sink.asExpr() =
any(MethodAccess add | add.getMethod() instanceof ResponseAddCookieMethod).getArgument(0)
}
}
from MethodAccess add
where
add.getMethod() instanceof ResponseAddCookieMethod and
not exists(Variable cookie, MethodAccess m |
add.getArgument(0) = cookie.getAnAccess() and
m.getMethod().getName() = "setSecure" and
forex(DataFlow::Node argSource |
DataFlow::localFlow(argSource, DataFlow::exprNode(m.getArgument(0))) and
not DataFlow::localFlowStep(_, argSource)
|
isSafeSecureCookieSetting(argSource.asExpr())
) and
m.getQualifier() = cookie.getAnAccess()
)
not any(SecureCookieConfiguration df).hasFlowToExpr(add.getArgument(0))
select add, "Cookie is added to response without the 'secure' flag being set."

10
java/ql/test/query-tests/security/CWE-311/CWE-614/semmle/tests/Test.java
View File

@@ -84,5 +84,15 @@ class Test {
response.addCookie(cookie);
}
{
// GOOD: set secure flag in call to `createSecureCookie`
response.addCookie(createSecureCookie());
}
}
private static Cookie createSecureCookie() {
Cookie cookie = new Cookie("secret", "fakesecret");
cookie.setSecure(constTrue);
return cookie;
}
}