hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor UnsafeTlsVersion

Browse Source
This commit is contained in:
Ed Minnix
2023-04-12 12:35:33 -04:00
parent e3f6bc043d
commit e880a5f187
2 changed files with 8 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/src/experimental/Security/CWE/CWE-327/SslLib.qll
View File

@@ -1,18 +1,14 @@
import java
import semmle.code.java.security.Encryption
import semmle.code.java.dataflow.TaintTracking
import DataFlow
import PathGraph
/**
* A taint-tracking configuration for unsafe SSL and TLS versions.
*/
class UnsafeTlsVersionConfig extends TaintTracking::Configuration {
UnsafeTlsVersionConfig() { this = "UnsafeTlsVersion::UnsafeTlsVersionConfig" }
module UnsafeTlsVersionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof UnsafeTlsVersion }
override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof UnsafeTlsVersion }
override predicate isSink(DataFlow::Node sink) {
predicate isSink(DataFlow::Node sink) {
sink instanceof SslContextGetInstanceSink or
sink instanceof CreateSslParametersSink or
sink instanceof SslParametersSetProtocolsSink or
@@ -20,6 +16,8 @@ class UnsafeTlsVersionConfig extends TaintTracking::Configuration {
}
}
module UnsafeTlsVersionFlow = TaintTracking::Global<UnsafeTlsVersionConfig>;
/**
* A sink that sets protocol versions in `SSLContext`,
* i.e `SSLContext.getInstance(protocol)`.

6
java/ql/src/experimental/Security/CWE/CWE-327/UnsafeTlsVersion.ql
View File

@@ -13,9 +13,9 @@
import java
import SslLib
import DataFlow::PathGraph
import UnsafeTlsVersionFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, UnsafeTlsVersionConfig conf
where conf.hasFlowPath(source, sink)
from UnsafeTlsVersionFlow::PathNode source, UnsafeTlsVersionFlow::PathNode sink
where UnsafeTlsVersionFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "$@ is unsafe.", source.getNode(),
source.getNode().asExpr().(StringLiteral).getValue()