hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add a superclass for credential nodes

Browse Source
This commit is contained in:
Ed Minnix
2023-08-22 11:31:14 -04:00
parent 3219edc603
commit ee6cb96d07
2 changed files with 12 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/lib/semmle/code/java/security/HardcodedCredentials.qll
View File

@@ -58,12 +58,7 @@ abstract class CredentialsSink extends Expr {
* credentials. * credentials.
*/ */
class CredentialsApiSink extends CredentialsSink { class CredentialsApiSink extends CredentialsSink {
CredentialsApiSink() { CredentialsApiSink() { this = any(CredentialSinkNode csn).asExpr() }
this = any(PasswordParameter p).asExpr() or
this = any(UsernameParameter p).asExpr() or
this = any(CryptoKeyParameter p).asExpr() or
this = any(CredentialParameter p).asExpr()
}
} }
/** /**

24
java/ql/lib/semmle/code/java/security/SensitiveApi.qll
View File

@@ -6,32 +6,30 @@ import java
private import semmle.code.java.dataflow.DataFlow private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.ExternalFlow private import semmle.code.java.dataflow.ExternalFlow
/**
* A node which represents the use of a credential.
*/
abstract class CredentialSinkNode extends DataFlow::Node { }
/** /**
* A node representing a password being passed to a method. * A node representing a password being passed to a method.
*/ */
class PasswordParameter extends DataFlow::Node { class PasswordSink extends CredentialSinkNode {
PasswordParameter() { sinkNode(this, "credential-password") } PasswordSink() { sinkNode(this, "credential-password") }
} }
/** /**
* A node representing a username being passed to a method. * A node representing a username being passed to a method.
*/ */
class UsernameParameter extends DataFlow::Node { class UsernameSink extends CredentialSinkNode {
UsernameParameter() { sinkNode(this, "credential-username") } UsernameSink() { sinkNode(this, "credential-username") }
} }
/** /**
* A node representing a cryptographic key being passed to a method. * A node representing a cryptographic key being passed to a method.
*/ */
class CryptoKeyParameter extends DataFlow::Node { class CryptoKeySink extends CredentialSinkNode {
CryptoKeyParameter() { sinkNode(this, "crypto-parameter") } CryptoKeySink() { sinkNode(this, "crypto-parameter") }
}
/**
* A node representing a credential being passed to a method.
*/
class CredentialParameter extends DataFlow::Node {
CredentialParameter() { sinkNode(this, "credential-other") }
} }
/** /**