hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-17 21:14:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: refactor unprotectedDatabaseUpdate

Browse Source
This commit is contained in:
Jami Cogswell
2025-01-08 18:56:50 -05:00
parent 530a77e5a0
commit f3721ebccf
1 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
java/ql/lib/semmle/code/java/security/CsrfUnprotectedRequestTypeQuery.qll
View File

@@ -215,28 +215,32 @@ module CallGraph {
predicate edges(CallPathNode pred, CallPathNode succ) { pred.getASuccessor() = succ }
}
/**
* Holds if `sourceMethod` is an unprotected request handler that reaches a
* `sinkMethodCall` that updates a database.
*/
private predicate unprotectedDatabaseUpdate(CallPathNode sourceMethod, CallPathNode sinkMethodCall) {
sourceMethod.asMethod() instanceof CsrfUnprotectedMethod and
/** Holds if `sourceMethod` is an unprotected request handler. */
private predicate source(CallPathNode sourceMethod) {
sourceMethod.asMethod() instanceof CsrfUnprotectedMethod
}
/** Holds if `sinkMethodCall` updates a database. */
private predicate sink(CallPathNode sinkMethodCall) {
exists(CallPathNode sinkMethod |
sinkMethod.asMethod() instanceof DatabaseUpdateMethod and
sinkMethodCall.getASuccessor() = pragma[only_bind_into](sinkMethod) and
sourceMethod.getASuccessor+() = pragma[only_bind_into](sinkMethodCall) and
sinkMethodCall.getASuccessor() = sinkMethod and
// exclude SQL `execute` calls that do not update database
if
sinkMethod.asMethod() instanceof SqlInjectionDatabaseUpdateMethod and
sinkMethod.asMethod().hasName("execute")
then
exists(SqlExecuteFlow::PathNode executeSink | SqlExecuteFlow::flowPath(_, executeSink) |
sinkMethodCall.asCall() = executeSink.getNode().asExpr().(Argument).getCall()
)
then SqlExecuteFlow::flowToExpr(sinkMethodCall.asCall().getAnArgument())
else any()
)
}
/**
* Holds if `sourceMethod` is an unprotected request handler that reaches a
* `sinkMethodCall` that updates a database.
*/
private predicate unprotectedDatabaseUpdate(CallPathNode sourceMethod, CallPathNode sinkMethodCall) =
doublyBoundedFastTC(CallGraph::edges/2, source/1, sink/1)(sourceMethod, sinkMethodCall)
/**
* Holds if `sourceMethod` is an unprotected request handler that appears to
* change application state based on its name.