diff --git a/java/change-notes/2021-02-23-deprecated-jcenter-bintray.md b/java/change-notes/2021-02-23-deprecated-jcenter-bintray.md new file mode 100644 index 00000000000..375b0379e4f --- /dev/null +++ b/java/change-notes/2021-02-23-deprecated-jcenter-bintray.md @@ -0,0 +1,4 @@ +lgtm,codescanning +* A new query "Depending upon JCenter/Bintray as an artifact repository" + (`java/maven/dependency-upon-bintray`) has been added. + This query finds uses of the deprecated JCenter/Bintray artifact respositories. \ No newline at end of file diff --git a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp new file mode 100644 index 00000000000..dc3ffdd86d4 --- /dev/null +++ b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp @@ -0,0 +1,45 @@ + + + +

Bintray and JCenter are shutting down on February 1st, 2022. +Relying upon repositories that are deprecated or scheduled to be shutdown can have unintended consequences; +for example, artifacts being resolved from a different artifact server or a total failure of the CI build.

+ +

When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge. +Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts +that are being produced. This can be used by attackers to perform a +supply chain attack +against your project's users. +

+ + + + +

Always use the canonical repository for resolving your dependencies.

+ + + + + +

The following example shows locations in a Maven POM file where artifact repository upload/download is configured. +The use of Bintray in any of these locations is not advised. +

+ + + + + +
  • + JFrog blog: + + Into the Sunset on May 1st: Bintray, JCenter, GoCenter, and ChartCenter + +
    • + + + +     +     diff --git a/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql new file mode 100644 index 00000000000..936da80a9d9 --- /dev/null +++ b/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql @@ -0,0 +1,22 @@ +/** + * @name Depending upon JCenter/Bintray as an artifact repository + * @description Using a deprecated artifact repository may eventually give attackers access for a supply chain attack. + * @kind problem + * @problem.severity error + * @precision very-high + * @id java/maven/dependency-upon-bintray + * @tags security + * external/cwe/cwe-1104 + */ + +import java +import semmle.code.xml.MavenPom + +predicate isBintrayRepositoryUsage(DeclaredRepository repository) { + repository.getUrl().matches("%.bintray.com%") +} + +from DeclaredRepository repository +where isBintrayRepositoryUsage(repository) +select repository, + "Downloading or uploading artifacts to deprecated repository " + repository.getUrl() diff --git a/java/ql/src/Security/CWE/CWE-1104/bad-bintray-pom.xml b/java/ql/src/Security/CWE/CWE-1104/bad-bintray-pom.xml new file mode 100644 index 00000000000..d250f86467f --- /dev/null +++ b/java/ql/src/Security/CWE/CWE-1104/bad-bintray-pom.xml @@ -0,0 +1,54 @@ + + + + 4.0.0 + + com.semmle + parent + 1.0 + pom + + Bintray Usage + An example of using bintray to download and upload dependencies + + + + jcenter + JCenter + + https://jcenter.bintray.com + + + jcenter-snapshots + JCenter + + https://jcenter.bintray.com + + + + + jcenter + JCenter + + https://jcenter.bintray.com + + + + + jcenter + JCenter + + https://dl.bintray.com/groovy/maven + + + + + jcenter-plugins + JCenter + + https://jcenter.bintray.com + + + diff --git a/java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql b/java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql index 3899c48cf04..50c2dc1e05e 100644 --- a/java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql +++ b/java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql @@ -15,22 +15,12 @@ import java import semmle.code.xml.MavenPom -private class DeclaredRepository extends PomElement { - DeclaredRepository() { - this.getName() = "repository" or - this.getName() = "snapshotRepository" or - this.getName() = "pluginRepository" - } - - string getUrl() { result = getAChild("url").(PomElement).getValue() } - - predicate isInsecureRepositoryUsage() { - getUrl().regexpMatch("(?i)^(http|ftp)://(?!localhost[:/]).*") - } +predicate isInsecureRepositoryUsage(DeclaredRepository repository) { + repository.getUrl().regexpMatch("(?i)^(http|ftp)://(?!localhost[:/]).*") } from DeclaredRepository repository -where repository.isInsecureRepositoryUsage() +where isInsecureRepositoryUsage(repository) select repository, "Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository " + repository.getUrl() diff --git a/java/ql/src/semmle/code/xml/MavenPom.qll b/java/ql/src/semmle/code/xml/MavenPom.qll index f13680b2b44..7619be3293a 100644 --- a/java/ql/src/semmle/code/xml/MavenPom.qll +++ b/java/ql/src/semmle/code/xml/MavenPom.qll @@ -368,6 +368,19 @@ class PomProperty extends PomElement { PomProperty() { getParent() instanceof PomProperties } } +/** + * An XML element representing any kind of repository declared inside of a Maven POM XML file. + */ +class DeclaredRepository extends PomElement { + DeclaredRepository() { this.getName() = ["repository", "snapshotRepository", "pluginRepository"] } + + /** + * Gets the url for this repository. If the `url` tag is present, this will + * be the string contents of that tag. + */ + string getUrl() { result = getAChild("url").(PomElement).getValue() } +} + /** * A folder that represents a local Maven repository using the standard layout. Any folder called * "repository" with a parent name ".m2" is considered to be a Maven repository. diff --git a/java/ql/test/query-tests/security/CWE-1104/semmle/tests/A.java b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/A.java new file mode 100644 index 00000000000..f7e8cc3b903 --- /dev/null +++ b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/A.java @@ -0,0 +1,2 @@ +public class A { +} diff --git a/java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.expected b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.expected new file mode 100644 index 00000000000..2a7e47d0e65 --- /dev/null +++ b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.expected @@ -0,0 +1,5 @@ +| bad-bintray-pom.xml:17:9:22:22 | repository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com | +| bad-bintray-pom.xml:23:9:28:30 | snapshotRepository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com | +| bad-bintray-pom.xml:31:9:36:22 | repository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com | +| bad-bintray-pom.xml:39:9:44:22 | repository | Downloading or uploading artifacts to deprecated repository https://dl.bintray.com/groovy/maven | +| bad-bintray-pom.xml:47:9:52:28 | pluginRepository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com | diff --git a/java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.qlref b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.qlref new file mode 100644 index 00000000000..9f05b219bfe --- /dev/null +++ b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.qlref @@ -0,0 +1 @@ +Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql diff --git a/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml new file mode 100644 index 00000000000..7e133256428 --- /dev/null +++ b/java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml @@ -0,0 +1,54 @@ + + + + 4.0.0 + + com.semmle + parent + 1.0 + pom + + Bintray Usage Testing + An example of using bintray as a repository + + + + jcenter + JCenter + + https://jcenter.bintray.com + + + jcenter-snapshots + JCenter + + https://jcenter.bintray.com + + + + + jcenter + JCenter + + https://jcenter.bintray.com + + + + + jcenter + JCenter + + https://dl.bintray.com/groovy/maven + + + + + jcenter-plugins + JCenter + + https://jcenter.bintray.com + + +