hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8410 from joefarebrother/sensitive-logging

Browse Source 
Java: Promote Sensitive Logging query
This commit is contained in:
Joe Farebrother
2022-03-14 14:50:26 +00:00
committed by GitHub
parent 9f02ca0db2 ca8237b9de
commit d4b5eed3e4
10 changed files with 79 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.java
View File

@@ -1,18 +0,0 @@
public static void main(String[] args) {
{
private static final Logger logger = LogManager.getLogger(SensitiveInfoLog.class);
String password = "Pass@0rd";
// BAD: user password is written to debug log
logger.debug("User password is "+password);
}
{
private static final Logger logger = LogManager.getLogger(SensitiveInfoLog.class);
String password = "Pass@0rd";
// GOOD: user password is never written to debug log
}
}

26
java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.qhelp
View File

@@ -1,26 +0,0 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Third-party logging utilities like Log4J and SLF4J are widely used in Java projects. When sensitive information is written to logs without properly set logging levels, it is accessible to potential attackers who can use it to gain access to
file storage.</p>
</overview>
<recommendation>
<p>Do not write secrets into the log files and enforce proper logging level control.</p>
</recommendation>
<example>
<p>The following example shows two ways of logging sensitive information. In the 'BAD' case,
the credentials are simply written to a debug log. In the 'GOOD' case, the credentials are never written to debug logs.</p>
<sample src="SensitiveInfoLog.java" />
</example>
<references>
<li>
<a href="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html">OWASP Logging Guide</a>
</li>
</references>
</qhelp>

49
java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql
View File

@@ -1,49 +0,0 @@
/**
* @name Insertion of sensitive information into log files
* @description Writing sensitive information to log files can give valuable
* guidance to an attacker or expose sensitive user information.
* @kind path-problem
* @problem.severity warning
* @precision medium
* @id java/sensitiveinfo-in-logfile
* @tags security
* external/cwe/cwe-532
*/
import java
import semmle.code.java.dataflow.ExternalFlow
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.SensitiveActions
import DataFlow
import PathGraph
/**
* Gets a regular expression for matching names of variables that indicate the value being held may contain sensitive information
*/
private string getACredentialRegex() { result = "(?i)(.*username|url).*" }
/** Variable keeps sensitive information judging by its name * */
class CredentialExpr extends Expr {
CredentialExpr() {
exists(Variable v | this = v.getAnAccess() |
v.getName().regexpMatch([getCommonSensitiveInfoRegex(), getACredentialRegex()])
)
}
}
class LoggerConfiguration extends DataFlow::Configuration {
LoggerConfiguration() { this = "Logger Configuration" }
override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof CredentialExpr }
override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "logging") }
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
TaintTracking::localTaintStep(node1, node2)
}
}
from LoggerConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Outputting $@ to log.", source.getNode(),
"sensitive information"