hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move tests back from internal repo

Browse Source
This commit is contained in:
Tony Torralba
2021-06-16 10:09:44 +02:00
parent 847faf536d
commit e2918d55b5
5 changed files with 141 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/test/query-tests/security/CWE-311/CWE-319/HttpsUrls.expected Normal file
View File

@@ -0,0 +1,19 @@
edges
| HttpsUrlsTest.java:23:23:23:31 | "http://" : String | HttpsUrlsTest.java:28:50:28:50 | u |
| HttpsUrlsTest.java:36:23:36:28 | "http" : String | HttpsUrlsTest.java:41:50:41:50 | u |
| HttpsUrlsTest.java:49:23:49:31 | "http://" : String | HttpsUrlsTest.java:55:50:55:50 | u |
| HttpsUrlsTest.java:87:23:87:28 | "http" : String | HttpsUrlsTest.java:92:50:92:50 | u |
nodes
| HttpsUrlsTest.java:23:23:23:31 | "http://" : String | semmle.label | "http://" : String |
| HttpsUrlsTest.java:28:50:28:50 | u | semmle.label | u |
| HttpsUrlsTest.java:36:23:36:28 | "http" : String | semmle.label | "http" : String |
| HttpsUrlsTest.java:41:50:41:50 | u | semmle.label | u |
| HttpsUrlsTest.java:49:23:49:31 | "http://" : String | semmle.label | "http://" : String |
| HttpsUrlsTest.java:55:50:55:50 | u | semmle.label | u |
| HttpsUrlsTest.java:87:23:87:28 | "http" : String | semmle.label | "http" : String |
| HttpsUrlsTest.java:92:50:92:50 | u | semmle.label | u |
#select
| HttpsUrlsTest.java:28:50:28:67 | openConnection(...) | HttpsUrlsTest.java:23:23:23:31 | "http://" : String | HttpsUrlsTest.java:28:50:28:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:23:23:23:31 | "http://" | this source |
| HttpsUrlsTest.java:41:50:41:67 | openConnection(...) | HttpsUrlsTest.java:36:23:36:28 | "http" : String | HttpsUrlsTest.java:41:50:41:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:36:23:36:28 | "http" | this source |
| HttpsUrlsTest.java:55:50:55:67 | openConnection(...) | HttpsUrlsTest.java:49:23:49:31 | "http://" : String | HttpsUrlsTest.java:55:50:55:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:49:23:49:31 | "http://" | this source |
| HttpsUrlsTest.java:92:50:92:67 | openConnection(...) | HttpsUrlsTest.java:87:23:87:28 | "http" : String | HttpsUrlsTest.java:92:50:92:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:87:23:87:28 | "http" | this source |

1
java/ql/test/query-tests/security/CWE-311/CWE-319/HttpsUrls.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-319/HttpsUrls.ql

119
java/ql/test/query-tests/security/CWE-311/CWE-319/HttpsUrlsTest.java Normal file
View File

@@ -0,0 +1,119 @@
// Semmle test case for CWE-319: Cleartext Transmission of Sensitive Data
// http://cwe.mitre.org/data/definitions/319.html
package test.cwe319.cwe.examples;
import java.net.URL;
import java.io.*;
import java.rmi.*;
import java.rmi.server.*;
import java.rmi.registry.*;
import javax.net.ssl.HttpsURLConnection;
import javax.rmi.ssl.*;
interface Hello extends java.rmi.Remote {
String sayHello() throws java.rmi.RemoteException;
}
class HelloImpl implements Hello {
public static void main(String[] args) {
try {
// HttpsUrls
{
String protocol = "http://";
URL u = new URL(protocol + "www.secret.example.org/");
// using HttpsURLConnections to enforce SSL is desirable
// BAD: this will give a ClassCastException at runtime, as the
// http URL cannot be used to make an HttpsURLConnection
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
{
String protocol = "http";
URL u = new URL(protocol, "www.secret.example.org", "foo");
// using HttpsURLConnections to enforce SSL is desirable
// BAD: this will give a ClassCastException at runtime, as the
// http URL cannot be used to make an HttpsURLConnection
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
{
String protocol = "http://";
// the second URL overwrites the first, as it has a protocol
URL u = new URL(new URL("https://www.secret.example.org"), protocol + "www.secret.example.org");
// using HttpsURLConnections to enforce SSL is desirable
// BAD: this will give a ClassCastException at runtime, as the
// http URL cannot be used to make an HttpsURLConnection
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
{
String protocol = "https://";
URL u = new URL(protocol + "www.secret.example.org/");
// using HttpsURLConnections to enforce SSL is desirable
// GOOD: open connection to URL using HTTPS
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
{
String protocol = "https";
URL u = new URL(protocol, "www.secret.example.org", "foo");
// using HttpsURLConnections to enforce SSL is desirable
// GOOD: open connection to URL using HTTPS
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
{
String protocol = "http";
URL u = new URL(protocol, "internal-url", "foo");
// FALSE POSITIVE: the query has no way of knowing whether the url will
// resolve to somewhere outside the internal network, where there
// are unlikely to be interception attempts
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
{
String input = "URL is: http://www.secret-example.org";
String url = input.substring(8);
URL u = new URL(url);
// FALSE NEGATIVE: we cannot tell that the substring results in a url
// string
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
} catch (Exception e) {
// fail
}
}
public String sayHello() {
return "Hello";
}
}

2
java/ql/test/query-tests/security/CWE-311/CWE-319/UseSSL.expected
View File

@@ -1 +1 @@
| Test.java:11:15:11:41 | getInputStream(...) | Stream using vulnerable non-SSL connection. |
| UseSSLTest.java:11:15:11:41 | getInputStream(...) | Stream using vulnerable non-SSL connection. |

2
java/ql/test/query-tests/security/CWE-311/CWE-319/Test.java → java/ql/test/query-tests/security/CWE-311/CWE-319/UseSSLTest.java
View File

@@ -2,7 +2,7 @@ import java.net.HttpURLConnection;
import javax.net.ssl.HttpsURLConnection;
import java.io.*;
class Test {
class UseSSLTest {
public void m1(HttpURLConnection connection) throws java.io.IOException {
InputStream input;
if (connection instanceof HttpsURLConnection) {