hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14515 from atorralba/atorralba/java/spring-csrf-improv

Browse Source 
Java: Improve java/spring-disabled-csrf-protection
This commit is contained in:
Tony Torralba
2023-10-18 17:49:10 +02:00
committed by GitHub
parent 4246ebf9e0 4ecda9cccd
commit da44b13fd4
11 changed files with 79 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
java/ql/lib/semmle/code/java/security/SpringCsrfProtection.qll Normal file
View File

@@ -0,0 +1,20 @@
/** Provides predicates to reason about disabling CSRF protection in Spring. */
import java
/** Holds if `call` disables CSRF protection in Spring. */
predicate disablesSpringCsrfProtection(MethodAccess call) {
call.getMethod().hasName("disable") and
call.getReceiverType()
.hasQualifiedName("org.springframework.security.config.annotation.web.configurers",
"CsrfConfigurer<HttpSecurity>")
or
call.getMethod()
.hasQualifiedName("org.springframework.security.config.annotation.web.builders",
"HttpSecurity", "csrf") and
call.getArgument(0)
.(MemberRefExpr)
.getReferencedCallable()
.hasQualifiedName("org.springframework.security.config.annotation.web.configurers",
"AbstractHttpConfigurer", "disable")
}