hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor HttpsUrlsQuery.qll

Browse Source
This commit is contained in:
Ed Minnix
2023-03-20 16:54:21 -04:00
parent c67b984fff
commit da718610e8
2 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
java/ql/lib/semmle/code/java/security/HttpsUrlsQuery.qll
View File

@@ -6,9 +6,11 @@ import semmle.code.java.frameworks.Networking
import semmle.code.java.security.HttpsUrls
/**
* DEPRECATED: Use `HttpsStringToUrlOpenMethodFlow` instead.
*
* A taint tracking configuration for HTTP connections.
*/
class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
deprecated class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
HttpStringToUrlOpenMethodFlowConfig() { this = "HttpStringToUrlOpenMethodFlowConfig" }
override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HttpStringLiteral }
@@ -23,3 +25,25 @@ class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
}
}
/**
* A taint tracking configuration for HTTP connections.
*/
private module HttpStringToUrlOpenMethodFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HttpStringLiteral }
predicate isSink(DataFlow::Node sink) { sink instanceof UrlOpenSink }
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(HttpUrlsAdditionalTaintStep c).step(node1, node2)
}
predicate isBarrier(DataFlow::Node node) {
node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
}
}
/**
* Detect taint flow of HTTP connections.
*/
module HttpStringToUrlOpenMethodFlow = TaintTracking::Global<HttpStringToUrlOpenMethodFlowConfig>;

6
java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql
View File

@@ -12,9 +12,9 @@
import java
import semmle.code.java.security.HttpsUrlsQuery
import DataFlow::PathGraph
import HttpStringToUrlOpenMethodFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink
where any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
from HttpStringToUrlOpenMethodFlow::PathNode source, HttpStringToUrlOpenMethodFlow::PathNode sink
where HttpStringToUrlOpenMethodFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "URL may have been constructed with HTTP protocol, using $@.",
source.getNode(), "this HTTP URL"