hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 12:16:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactor Revocation checking

Browse Source
This commit is contained in:
Ed Minnix
2023-04-12 13:04:53 -04:00
parent 380888e446
commit ccdd9bce33
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/src/experimental/Security/CWE/CWE-299/DisabledRevocationChecking.ql
View File

@@ -13,8 +13,8 @@
import java import java
import RevocationCheckingLib import RevocationCheckingLib
import DataFlow::PathGraph import DisabledRevocationCheckingFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, DisabledRevocationCheckingConfig config from DisabledRevocationCheckingFlow::PathNode source, DisabledRevocationCheckingFlow::PathNode sink
where config.hasFlowPath(source, sink) where DisabledRevocationCheckingFlow::flowPath(source, sink)
select source.getNode(), source, sink, "This disables revocation checking." select source.getNode(), source, sink, "This disables revocation checking."

12
java/ql/src/experimental/Security/CWE/CWE-299/RevocationCheckingLib.qll
View File

@@ -5,16 +5,16 @@ import DataFlow
/** /**
* A taint-tracking configuration for disabling revocation checking. * A taint-tracking configuration for disabling revocation checking.
*/ */
class DisabledRevocationCheckingConfig extends TaintTracking::Configuration { module DisabledRevocationCheckingConfig implements DataFlow::ConfigSig {
DisabledRevocationCheckingConfig() { this = "DisabledRevocationCheckingConfig" } predicate isSource(DataFlow::Node source) {
source.asExpr().(BooleanLiteral).getBooleanValue() = false
override predicate isSource(DataFlow::Node source) {
exists(BooleanLiteral b | b.getBooleanValue() = false | source.asExpr() = b)
} }
override predicate isSink(DataFlow::Node sink) { sink instanceof SetRevocationEnabledSink } predicate isSink(DataFlow::Node sink) { sink instanceof SetRevocationEnabledSink }
} }
module DisabledRevocationCheckingFlow = TaintTracking::Global<DisabledRevocationCheckingConfig>;
/** /**
* A sink that disables revocation checking, * A sink that disables revocation checking,
* i.e. calling `PKIXParameters.setRevocationEnabled(false)` * i.e. calling `PKIXParameters.setRevocationEnabled(false)`