hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-13 10:49:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use isRequestGetParamMethod as the source

Browse Source
This commit is contained in:
luchua-bc
2021-01-26 04:41:44 +00:00
parent 3d26e5b8a4
commit fee0b94cd4
2 changed files with 39 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
View File

@@ -25,12 +25,29 @@ class SensitiveInfoExpr extends Expr {
/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
private predicate isGetServletMethod(Method m) { isServletMethod(m) and m.getName() = "doGet" }
/** The `doGet` method of `HttpServlet`. */
class DoGetServletMethod extends Method {
DoGetServletMethod() { isGetServletMethod(this) }
}
/** Holds if `ma` is called from the `doGet` method of `HttpServlet`. */
predicate isServletGetCall(MethodAccess ma) {
ma.getEnclosingCallable() instanceof DoGetServletMethod
or
exists(Method pm, MethodAccess pma |
ma.getEnclosingCallable() = pm and
pma.getMethod() = pm and
isServletGetCall(pma)
)
}
/** Source of GET servlet requests. */
class GetHttpRequestSource extends DataFlow::ExprNode {
GetHttpRequestSource() {
exists(Method m |
isGetServletMethod(m) and
m.getParameter(0).getAnAccess() = this.asExpr()
class RequestGetParamSource extends DataFlow::ExprNode {
RequestGetParamSource() {
exists(MethodAccess ma |
isRequestGetParamMethod(ma) and
ma = this.asExpr() and
isServletGetCall(ma)
)
}
}
@@ -39,14 +56,14 @@ class GetHttpRequestSource extends DataFlow::ExprNode {
class SensitiveGetQueryConfiguration extends TaintTracking::Configuration {
SensitiveGetQueryConfiguration() { this = "SensitiveGetQueryConfiguration" }
override predicate isSource(DataFlow::Node source) { source instanceof GetHttpRequestSource }
override predicate isSource(DataFlow::Node source) { source instanceof RequestGetParamSource }
override predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof SensitiveInfoExpr }
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(MethodAccess ma |
isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
)
/** Holds if the node is in a servlet method other than `doGet`. */
override predicate isSanitizer(DataFlow::Node node) {
isServletMethod(node.getEnclosingCallable()) and
not isGetServletMethod(node.getEnclosingCallable())
}
}