hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add thymeleaf steps

Browse Source
This commit is contained in:
Tony Torralba
2022-09-12 17:01:16 +02:00
parent 79a32f1a3e
commit f412f433bf
8 changed files with 97 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -117,6 +117,7 @@ private module Frameworks {
private import semmle.code.java.frameworks.Retrofit
private import semmle.code.java.frameworks.Stream
private import semmle.code.java.frameworks.Strings
private import semmle.code.java.frameworks.Thymeleaf
private import semmle.code.java.frameworks.ratpack.Ratpack
private import semmle.code.java.frameworks.ratpack.RatpackExec
private import semmle.code.java.frameworks.spring.SpringCache

16
java/ql/lib/semmle/code/java/frameworks/Thymeleaf.qll Normal file
View File

@@ -0,0 +1,16 @@
/**
* Provides classes and predicates for working with the Thymeleaf template engine.
*/
import java
private import semmle.code.java.dataflow.ExternalFlow
private class ThymeleafSummaryModels extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual",
"org.thymeleaf;TemplateSpec;false;getTemplate;;;Argument[-1];ReturnValue;taint;manual",
]
}
}

61
java/ql/test/library-tests/frameworks/thymeleaf/Test.java Normal file
View File

@@ -0,0 +1,61 @@
package generatedtest;
import java.util.Map;
import java.util.Set;
import org.thymeleaf.TemplateSpec;
import org.thymeleaf.templatemode.TemplateMode;
// Test case generated by GenerateFlowTestCase.ql
public class Test {
Object source() { return null; }
void sink(Object o) { }
public void test() throws Exception {
{
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
TemplateSpec out = null;
String in = (String)source();
out = new TemplateSpec(in, (Map)null);
sink(out); // $ hasTaintFlow
}
{
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
TemplateSpec out = null;
String in = (String)source();
out = new TemplateSpec(in, (Set)null, (String)null, (Map)null);
sink(out); // $ hasTaintFlow
}
{
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
TemplateSpec out = null;
String in = (String)source();
out = new TemplateSpec(in, (Set)null, (TemplateMode)null, (Map)null);
sink(out); // $ hasTaintFlow
}
{
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
TemplateSpec out = null;
String in = (String)source();
out = new TemplateSpec(in, (String)null);
sink(out); // $ hasTaintFlow
}
{
// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
TemplateSpec out = null;
String in = (String)source();
out = new TemplateSpec(in, (TemplateMode)null);
sink(out); // $ hasTaintFlow
}
{
// "org.thymeleaf;TemplateSpec;false;getTemplate;;;Argument[-1];ReturnValue;taint;manual"
String out = null;
TemplateSpec in = (TemplateSpec)source();
out = in.getTemplate();
sink(out); // $ hasTaintFlow
}
}
}

1
java/ql/test/library-tests/frameworks/thymeleaf/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/thymeleaf-3.0.14

0
java/ql/test/library-tests/frameworks/thymeleaf/test.expected Normal file
View File

2
java/ql/test/library-tests/frameworks/thymeleaf/test.ql Normal file
View File

@@ -0,0 +1,2 @@
import java
import TestUtilities.InlineFlowTest

10
java/ql/test/query-tests/security/CWE-094/PebbleSSTI.java
View File

@@ -15,17 +15,15 @@ public class PebbleSSTI {
@GetMapping(value = "bad1")
public void bad1(HttpServletRequest request) {
String code = request.getParameter("code");
String templateName = request.getParameter("templateName");
PebbleEngine engine = new PebbleEngine.Builder().build();
// public PebbleTemplate getTemplate(String templateName)
PebbleTemplate compiledTemplate = engine.getTemplate(code); // $hasTemplateInjection
PebbleTemplate compiledTemplate = engine.getTemplate(templateName); // $hasTemplateInjection
}
@GetMapping(value = "bad2")
public void bad2(HttpServletRequest request) {
String code = request.getParameter("code");
String templateName = request.getParameter("templateName");
PebbleEngine engine = new PebbleEngine.Builder().build();
// public PebbleTemplate getLiteralTemplate(String templateName)
PebbleTemplate compiledTemplate = engine.getLiteralTemplate(code); // $hasTemplateInjection
PebbleTemplate compiledTemplate = engine.getLiteralTemplate(templateName); // $hasTemplateInjection
}
}

17
java/ql/test/query-tests/security/CWE-094/ThymeleafSSTI.java
View File

@@ -9,22 +9,29 @@ import java.io.FileWriter;
import java.io.Reader;
import java.io.StringReader;
import java.io.Writer;
import java.util.Set;
import org.thymeleaf.*;
import org.thymeleaf.context.Context;
@Controller
public class ThymeleafSSTI {
String sourceName = "sourceName";
@GetMapping(value = "bad1")
public void bad1(HttpServletRequest request) {
String code = request.getParameter("code");
Context ctx = new Context();
try {
FileWriter fw = new FileWriter(new File("as"));
TemplateEngine templateEngine = new TemplateEngine();
templateEngine.process(code, ctx, fw); // $hasTemplateInjection
templateEngine.process(code, (Set<String>) null, (Context) null); // $hasTemplateInjection
templateEngine.process(code, (Set<String>) null, (Context) null, (Writer) null); // $hasTemplateInjection
templateEngine.process(code, (Context) null); // $hasTemplateInjection
templateEngine.process(code, (Context) null, (Writer) null); // $hasTemplateInjection
templateEngine.processThrottled(code, (Set<String>) null, (Context) null); // $hasTemplateInjection
templateEngine.processThrottled(code, (Context) null); // $hasTemplateInjection
TemplateSpec spec = new TemplateSpec(code, "");
templateEngine.process(spec, (Context) null); // $hasTemplateInjection
templateEngine.process(spec, (Context) null, (Writer) null); // $hasTemplateInjection
templateEngine.processThrottled(spec, (Context) null); // $hasTemplateInjection
} catch (Exception e) {
}
}