hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 18:10:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4799 from joefarebrother/xxe-fp

Browse Source 
Java: Fix false positive in the XXE query
This commit is contained in:
yo-h
2020-12-09 12:08:20 -05:00
committed by GitHub
parent 48a9521df9 732542adcb
commit f95c480b51
3 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/change-notes/2020-12-09-xxe-fp-fix.md Normal file
View File

@@ -0,0 +1,4 @@
lgtm,codescanning
* The query "Resolving XML external entity in user-controlled data" (`java/xxe`) has been improved to report fewer false positives when a `SAXParserFactory` is configured safely.

4
java/ql/src/semmle/code/java/security/XmlParsers.qll
View File

@@ -481,6 +481,10 @@ class SAXParserFactoryConfig extends ParserConfig {
class SafeSAXParserFactory extends VarAccess {
SafeSAXParserFactory() {
exists(Variable v | v = this.getVariable() |
exists(SAXParserFactoryConfig config | config.getQualifier() = v.getAnAccess() |
config.enables(singleSafeConfig())
)
or
exists(SAXParserFactoryConfig config | config.getQualifier() = v.getAnAccess() |
config
.disables(any(ConstantStringExpr s |

10
java/ql/test/query-tests/security/CWE-611/SAXParserTests.java
View File

@@ -2,7 +2,7 @@ import java.net.Socket;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import javax.xml.XMLConstants;
import org.xml.sax.helpers.DefaultHandler;
public class SAXParserTests {
@@ -72,4 +72,12 @@ public class SAXParserTests {
SAXParser parser = factory.newSAXParser();
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
}
public void safeParser2(Socket sock) throws Exception {
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
SAXParser parser = factory.newSAXParser();
parser.parse(sock.getInputStream(), new DefaultHandler()); //safe
}
}