hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix bad models, add tests for those

Browse Source
This commit is contained in:
Tony Torralba
2022-09-09 10:08:52 +02:00
parent 6413de6c20
commit d748fb5648
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -627,7 +627,7 @@ module CsvValidation {
"open-url", "jndi-injection", "ldap", "sql", "jdbc-url", "logging", "mvel", "xpath",
"groovy", "xss", "ognl-injection", "intent-start", "pending-intent-sent",
"url-open-stream", "url-redirect", "create-file", "write-file", "set-hostname-verifier",
"header-splitting", "information-leak", "xslt", "jexl", "bean-validation"
"header-splitting", "information-leak", "xslt", "jexl", "bean-validation", "ssti"
] and
not kind.matches("regex-use%") and
not kind.matches("qltest%") and

4
java/ql/lib/semmle/code/java/security/TemplateInjection.qll
View File

@@ -91,9 +91,9 @@ private class TemplateInjectionSinkModels extends SinkModelCsv {
"org.thymeleaf;ITemplateEngine;true;processThrottled;;;Argument[0];ssti;manual",
"org.apache.velocity.app;Velocity;true;evaluate;;;Argument[0];ssti;manual",
"org.apache.velocity.app;Velocity;true;evaluate;;;Argument[3];ssti;manual",
"org.apache.velocity,app;VelocityEngine;true;evaluate;;;Argument[0];ssti;manual",
"org.apache.velocity,app;VelocityEngine;true;evaluate;;;Argument[3];ssti;manual",
"org.apache.velocity.app;Velocity;true;mergeTemplate;;;Argument[2];ssti;manual",
"org.apache.velocity.app;VelocityEngine;true;evaluate;;;Argument[0];ssti;manual",
"org.apache.velocity.app;VelocityEngine;true;evaluate;;;Argument[3];ssti;manual",
"org.apache.velocity.app;VelocityEngine;true;mergeTemplate;;;Argument[2];ssti;manual",
"org.apache.velocity.runtime.resource.util;StringResourceRepository;true;putStringResource;;;Argument[1];ssti;manual",
"org.apache.velocity.runtime;RuntimeServices;true;evaluate;;;Argument[0];ssti;manual",

4
java/ql/test/query-tests/security/CWE-094/VelocitySSTI.java
View File

@@ -86,6 +86,10 @@ public class VelocitySSTI {
StringWriter w = new StringWriter();
VelocityEngine engine = null;
engine.mergeTemplate("testtemplate.vm", "UTF-8", context, w); // $hasTemplateInjection
AbstractContext ctx = null;
ctx.put("key", code);
engine.evaluate(ctx, null, null, null); // $hasTemplateInjection
engine.evaluate(null, null, null, code); // $hasTemplateInjection
}
@GetMapping(value = "bad6")