hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use InlineExpectationsTest

Browse Source
This commit is contained in:
Tony Torralba
2021-06-02 12:15:26 +02:00
parent b30c92e69e
commit d476459727
5 changed files with 52 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
java/ql/test/query-tests/security/CWE-094/MvelInjection.expected
View File

@@ -1,67 +0,0 @@
edges
| MvelInjection.java:29:54:29:65 | read(...) : String | MvelInjection.java:30:28:30:37 | expression |
| MvelInjection.java:34:58:34:69 | read(...) : String | MvelInjection.java:36:5:36:13 | statement |
| MvelInjection.java:34:58:34:69 | read(...) : String | MvelInjection.java:37:5:37:13 | statement |
| MvelInjection.java:41:58:41:69 | read(...) : String | MvelInjection.java:43:5:43:14 | expression |
| MvelInjection.java:48:7:48:18 | read(...) : String | MvelInjection.java:49:5:49:14 | expression |
| MvelInjection.java:53:20:53:31 | read(...) : String | MvelInjection.java:57:5:57:18 | compiledScript |
| MvelInjection.java:53:20:53:31 | read(...) : String | MvelInjection.java:60:21:60:26 | script |
| MvelInjection.java:65:58:65:69 | read(...) : String | MvelInjection.java:68:5:68:10 | script |
| MvelInjection.java:77:40:77:51 | read(...) : String | MvelInjection.java:77:7:77:52 | compileTemplate(...) |
| MvelInjection.java:81:54:81:65 | read(...) : String | MvelInjection.java:82:29:82:46 | compile(...) |
| MvelInjection.java:86:58:86:69 | read(...) : String | MvelInjection.java:88:32:88:41 | expression |
| MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:94:15:94:16 | is : InputStream |
| MvelInjection.java:94:15:94:16 | is : InputStream | MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] |
| MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] | MvelInjection.java:95:14:95:36 | new String(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:25:15:25:26 | read(...) |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:29:54:29:65 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:34:58:34:69 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:41:58:41:69 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:48:7:48:18 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:53:20:53:31 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:65:58:65:69 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:72:26:72:37 | read(...) |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:77:40:77:51 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:81:54:81:65 | read(...) : String |
| MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:86:58:86:69 | read(...) : String |
nodes
| MvelInjection.java:25:15:25:26 | read(...) | semmle.label | read(...) |
| MvelInjection.java:29:54:29:65 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:30:28:30:37 | expression | semmle.label | expression |
| MvelInjection.java:34:58:34:69 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:36:5:36:13 | statement | semmle.label | statement |
| MvelInjection.java:37:5:37:13 | statement | semmle.label | statement |
| MvelInjection.java:41:58:41:69 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:43:5:43:14 | expression | semmle.label | expression |
| MvelInjection.java:48:7:48:18 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:49:5:49:14 | expression | semmle.label | expression |
| MvelInjection.java:53:20:53:31 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:57:5:57:18 | compiledScript | semmle.label | compiledScript |
| MvelInjection.java:60:21:60:26 | script | semmle.label | script |
| MvelInjection.java:65:58:65:69 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:68:5:68:10 | script | semmle.label | script |
| MvelInjection.java:72:26:72:37 | read(...) | semmle.label | read(...) |
| MvelInjection.java:77:7:77:52 | compileTemplate(...) | semmle.label | compileTemplate(...) |
| MvelInjection.java:77:40:77:51 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:81:54:81:65 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:82:29:82:46 | compile(...) | semmle.label | compile(...) |
| MvelInjection.java:86:58:86:69 | read(...) : String | semmle.label | read(...) : String |
| MvelInjection.java:88:32:88:41 | expression | semmle.label | expression |
| MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
| MvelInjection.java:94:15:94:16 | is : InputStream | semmle.label | is : InputStream |
| MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
| MvelInjection.java:95:14:95:36 | new String(...) : String | semmle.label | new String(...) : String |
#select
| MvelInjection.java:25:15:25:26 | read(...) | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:25:15:25:26 | read(...) | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:30:28:30:37 | expression | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:30:28:30:37 | expression | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:36:5:36:13 | statement | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:36:5:36:13 | statement | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:37:5:37:13 | statement | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:37:5:37:13 | statement | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:43:5:43:14 | expression | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:43:5:43:14 | expression | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:49:5:49:14 | expression | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:49:5:49:14 | expression | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:57:5:57:18 | compiledScript | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:57:5:57:18 | compiledScript | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:60:21:60:26 | script | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:60:21:60:26 | script | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:68:5:68:10 | script | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:68:5:68:10 | script | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:72:26:72:37 | read(...) | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:72:26:72:37 | read(...) | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:77:7:77:52 | compileTemplate(...) | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:77:7:77:52 | compileTemplate(...) | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:82:29:82:46 | compile(...) | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:82:29:82:46 | compile(...) | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
| MvelInjection.java:88:32:88:41 | expression | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:88:32:88:41 | expression | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |

1
java/ql/test/query-tests/security/CWE-094/MvelInjection.qlref
View File

@@ -1 +0,0 @@
Security/CWE/CWE-094/MvelInjection.ql

0
java/ql/test/query-tests/security/CWE-094/MvelInjectionTest.expected Normal file
View File

33
java/ql/test/query-tests/security/CWE-094/MvelInjection.java → java/ql/test/query-tests/security/CWE-094/MvelInjectionTest.java
View File

@@ -19,34 +19,34 @@ import org.mvel2.templates.CompiledTemplate;
import org.mvel2.templates.TemplateCompiler; import org.mvel2.templates.TemplateCompiler;
import org.mvel2.templates.TemplateRuntime; import org.mvel2.templates.TemplateRuntime;
public class MvelInjection { public class MvelInjectionTest {
public static void testWithMvelEval(Socket socket) throws IOException { public static void testWithMvelEval(Socket socket) throws IOException {
MVEL.eval(read(socket)); MVEL.eval(read(socket)); // $hasMvelInjection
} }
public static void testWithMvelCompileAndExecute(Socket socket) throws IOException { public static void testWithMvelCompileAndExecute(Socket socket) throws IOException {
Serializable expression = MVEL.compileExpression(read(socket)); Serializable expression = MVEL.compileExpression(read(socket));
MVEL.executeExpression(expression); MVEL.executeExpression(expression); // $hasMvelInjection
} }
public static void testWithExpressionCompiler(Socket socket) throws IOException { public static void testWithExpressionCompiler(Socket socket) throws IOException {
ExpressionCompiler compiler = new ExpressionCompiler(read(socket)); ExpressionCompiler compiler = new ExpressionCompiler(read(socket));
ExecutableStatement statement = compiler.compile(); ExecutableStatement statement = compiler.compile();
statement.getValue(new Object(), new ImmutableDefaultFactory()); statement.getValue(new Object(), new ImmutableDefaultFactory()); // $hasMvelInjection
statement.getValue(new Object(), new Object(), new ImmutableDefaultFactory()); statement.getValue(new Object(), new Object(), new ImmutableDefaultFactory()); // $hasMvelInjection
} }
public static void testWithCompiledExpressionGetDirectValue(Socket socket) throws IOException { public static void testWithCompiledExpressionGetDirectValue(Socket socket) throws IOException {
ExpressionCompiler compiler = new ExpressionCompiler(read(socket)); ExpressionCompiler compiler = new ExpressionCompiler(read(socket));
CompiledExpression expression = compiler.compile(); CompiledExpression expression = compiler.compile();
expression.getDirectValue(new Object(), new ImmutableDefaultFactory()); expression.getDirectValue(new Object(), new ImmutableDefaultFactory()); // $hasMvelInjection
} }
public static void testCompiledAccExpressionGetValue(Socket socket) throws IOException { public static void testCompiledAccExpressionGetValue(Socket socket) throws IOException {
CompiledAccExpression expression = new CompiledAccExpression( CompiledAccExpression expression =
read(socket).toCharArray(), Object.class, new ParserContext()); new CompiledAccExpression(read(socket).toCharArray(), Object.class, new ParserContext());
expression.getValue(new Object(), new ImmutableDefaultFactory()); expression.getValue(new Object(), new ImmutableDefaultFactory()); // $hasMvelInjection
} }
public static void testMvelScriptEngineCompileAndEvaluate(Socket socket) throws Exception { public static void testMvelScriptEngineCompileAndEvaluate(Socket socket) throws Exception {
@@ -54,10 +54,10 @@ public class MvelInjection {
MvelScriptEngine engine = new MvelScriptEngine(); MvelScriptEngine engine = new MvelScriptEngine();
CompiledScript compiledScript = engine.compile(input); CompiledScript compiledScript = engine.compile(input);
compiledScript.eval(); compiledScript.eval(); // $hasMvelInjection
Serializable script = engine.compiledScript(input); Serializable script = engine.compiledScript(input);
engine.evaluate(script, new SimpleScriptContext()); engine.evaluate(script, new SimpleScriptContext()); // $hasMvelInjection
} }
public static void testMvelCompiledScriptCompileAndEvaluate(Socket socket) throws Exception { public static void testMvelCompiledScriptCompileAndEvaluate(Socket socket) throws Exception {
@@ -65,27 +65,26 @@ public class MvelInjection {
ExpressionCompiler compiler = new ExpressionCompiler(read(socket)); ExpressionCompiler compiler = new ExpressionCompiler(read(socket));
ExecutableStatement statement = compiler.compile(); ExecutableStatement statement = compiler.compile();
MvelCompiledScript script = new MvelCompiledScript(engine, statement); MvelCompiledScript script = new MvelCompiledScript(engine, statement);
script.eval(new SimpleScriptContext()); script.eval(new SimpleScriptContext()); // $hasMvelInjection
} }
public static void testTemplateRuntimeEval(Socket socket) throws Exception { public static void testTemplateRuntimeEval(Socket socket) throws Exception {
TemplateRuntime.eval(read(socket), new HashMap()); TemplateRuntime.eval(read(socket), new HashMap()); // $hasMvelInjection
} }
public static void testTemplateRuntimeCompileTemplateAndExecute(Socket socket) throws Exception { public static void testTemplateRuntimeCompileTemplateAndExecute(Socket socket) throws Exception {
TemplateRuntime.execute( TemplateRuntime.execute(TemplateCompiler.compileTemplate(read(socket)), new HashMap()); // $hasMvelInjection
TemplateCompiler.compileTemplate(read(socket)), new HashMap());
} }
public static void testTemplateRuntimeCompileAndExecute(Socket socket) throws Exception { public static void testTemplateRuntimeCompileAndExecute(Socket socket) throws Exception {
TemplateCompiler compiler = new TemplateCompiler(read(socket)); TemplateCompiler compiler = new TemplateCompiler(read(socket));
TemplateRuntime.execute(compiler.compile(), new HashMap()); TemplateRuntime.execute(compiler.compile(), new HashMap()); // $hasMvelInjection
} }
public static void testMvelRuntimeExecute(Socket socket) throws Exception { public static void testMvelRuntimeExecute(Socket socket) throws Exception {
ExpressionCompiler compiler = new ExpressionCompiler(read(socket)); ExpressionCompiler compiler = new ExpressionCompiler(read(socket));
CompiledExpression expression = compiler.compile(); CompiledExpression expression = compiler.compile();
MVELRuntime.execute(false, expression, new Object(), new ImmutableDefaultFactory()); MVELRuntime.execute(false, expression, new Object(), new ImmutableDefaultFactory()); // $hasMvelInjection
} }
public static String read(Socket socket) throws IOException { public static String read(Socket socket) throws IOException {

36
java/ql/test/query-tests/security/CWE-094/MvelInjectionTest.ql Normal file
View File

@@ -0,0 +1,36 @@
import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.MvelInjection
import TestUtilities.InlineExpectationsTest
class Conf extends TaintTracking::Configuration {
Conf() { this = "test:cwe:mvel-injection" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof MvelEvaluationSink }
override predicate isSanitizer(DataFlow::Node sanitizer) {
sanitizer instanceof MvelInjectionSanitizer
}
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
any(MvelInjectionAdditionalTaintStep c).step(node1, node2)
}
}
class HasMvelInjectionTest extends InlineExpectationsTest {
HasMvelInjectionTest() { this = "HasMvelInjectionTest" }
override string getARelevantTag() { result = "hasMvelInjection" }
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasMvelInjection" and
exists(DataFlow::Node src, DataFlow::Node sink, Conf conf | conf.hasFlow(src, sink) |
sink.getLocation() = location and
element = sink.toString() and
value = ""
)
}
}