hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-01 05:13:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add taint step for setExpression

Browse Source
This commit is contained in:
Tony Torralba
2021-05-13 13:15:51 +02:00
parent 09b40601a7
commit db732918af
2 changed files with 37 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
java/ql/src/semmle/code/java/security/OgnlInjection.qll
View File

@@ -61,6 +61,13 @@ private class TypeNode extends Interface {
}
}
private class TypeExpressionAccessor extends Interface {
TypeExpressionAccessor() {
this.hasQualifiedName("org.apache.commons.ognl.enhance", "ExpressionAccessor") or
this.hasQualifiedName("ognl.enhance", "ExpressionAccessor")
}
}
/**
* Holds if `n1` to `n2` is a dataflow step that converts between `String` and `Object` or `Node`,
* i.e. `Ognl.parseExpression(tainted)` or `Ognl.compileExpression(tainted)`.
@@ -87,15 +94,31 @@ private predicate getAccessorStep(DataFlow::Node n1, DataFlow::Node n2) {
n1.asExpr() = ma.getQualifier() and
n2.asExpr() = ma and
ma.getMethod() = m and
m.getDeclaringType() instanceof TypeNode
m.getDeclaringType().getASupertype*() instanceof TypeNode
|
m.hasName("getAccessor")
)
}
/**
* Holds if `n1` to `n2` is a dataflow step that converts between `Node` and `Accessor`
* in a `setExpression` call, i.e. `accessor.setExpression(tainted)`
*/
private predicate setExpressionStep(DataFlow::Node n1, DataFlow::Node n2) {
exists(MethodAccess ma, Method m |
n1.asExpr() = ma.getArgument(0) and
n2.asExpr() = ma.getQualifier() and
ma.getMethod() = m and
m.getDeclaringType().getASupertype*() instanceof TypeExpressionAccessor
|
m.hasName("setExpression")
)
}
private class DefaultOgnlInjectionAdditionalTaintStep extends OgnlInjectionAdditionalTaintStep {
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
parseCompileExpressionStep(node1, node2) or
getAccessorStep(node1, node2)
getAccessorStep(node1, node2) or
setExpressionStep(node1, node2)
}
}