hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Trust Boundary Work

Browse Source
This commit is contained in:
Ed Minnix
2023-07-19 16:39:09 -04:00
parent 2aba425464
commit f58590c6a9
5 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/semmle/code/java/frameworks/Servlets.qll
View File

@@ -397,3 +397,7 @@ class GetServletResourceAsStreamMethod extends Method {
this.hasName("getResourceAsStream")
}
}
class HttpServletSession extends RefType {
HttpServletSession() { this.hasQualifiedName("javax.servlet.http", "HttpSession") }
}

11
java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
View File

@@ -24,6 +24,8 @@ class TrustBoundaryViolationSink extends DataFlow::Node {
TrustBoundaryViolationSink() { sinkNode(this, "trust-boundary") }
}
abstract class TrustBoundaryValidationSanitizer extends DataFlow::Node { }
/**
* Taint tracking for data that crosses a trust boundary.
*/
@@ -34,6 +36,15 @@ module TrustBoundaryConfig implements DataFlow::ConfigSig {
n2.asExpr().(MethodAccess).getQualifier() = n1.asExpr()
}
predicate isBarrier(DataFlow::Node node) {
node instanceof TrustBoundaryValidationSanitizer or
node.getType() instanceof HttpServletSession or
node.asExpr()
.(MethodAccess)
.getMethod()
.hasQualifiedName("javax.servlet.http", "HttpServletRequest", "getMethod")
}
predicate isSink(DataFlow::Node sink) { sink instanceof TrustBoundaryViolationSink }
}