mirror of
https://github.com/github/codeql.git
synced 2026-05-14 11:19:27 +02:00
c336a1595d
Introduce a new Models-as-Data sink sub-kind path-injection[read] for models that only read from or inspect a path. The general java/path-injection query and its PathInjectionSanitizer barrier continue to consider both path-injection and path-injection[read] sinks, so no alerts are lost. The java/zipslip query deliberately selects only path-injection sinks, since read-only accesses such as ClassLoader.getResource or FileInputStream are outside the archive extraction threat model. Addresses https://github.com/github/codeql/issues/21606 along the lines proposed on the issue thread: prefer path-injection[read] over a [create] sub-kind so that miscategorizing a sink causes a false positive (easy to spot) rather than a false negative. - shared/mad/codeql/mad/ModelValidation.qll: allow path-injection[...] as a valid sink kind. - java/ql/lib/ext/*.model.yml: relabel the models that PR #12916 migrated from the historical read-file kind (plus the newer ClassLoader resource-lookup variants that share the same read-only semantics). - java/ql/lib/semmle/code/java/security/TaintedPathQuery.qll and PathSanitizer.qll: select both path-injection and path-injection[read] sinks/barriers. - java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll: keep only path-injection, with a comment explaining why path-injection[read] is excluded. - java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipTest.java: add m7 regression covering the Dubbo-style classpath lookup from issue #21606 and assert no alert is produced. - Update TaintedPath.expected for the renamed kinds in the models list. - Add change-notes under java/ql/lib/change-notes and java/ql/src/change-notes.
31 lines
3.0 KiB
YAML
31 lines
3.0 KiB
YAML
extensions:
|
|
- addsTo:
|
|
pack: codeql/java-all
|
|
extensible: sinkModel
|
|
data:
|
|
- ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress)", "", "Argument[0]", "request-forgery", "manual"]
|
|
- ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress,int)", "", "Argument[0]", "request-forgery", "manual"]
|
|
- ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress,int,InetAddress,int)", "", "Argument[0]", "request-forgery", "manual"]
|
|
- ["org.apache.commons.net", "SocketClient", true, "connect", "(String)", "", "Argument[0]", "request-forgery", "manual"]
|
|
- ["org.apache.commons.net", "SocketClient", true, "connect", "(String,int)", "", "Argument[0]", "request-forgery", "df-manual"]
|
|
- ["org.apache.commons.net", "SocketClient", true, "connect", "(String,int,InetAddress,int)", "", "Argument[0]", "request-forgery", "manual"]
|
|
- ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(File,String)", "", "Argument[0]", "path-injection[read]", "df-manual"]
|
|
- ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(File,String,String)", "", "Argument[0]", "path-injection[read]", "df-manual"]
|
|
- ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(String,File,String,String,String)", "", "Argument[1]", "path-injection[read]", "df-manual"]
|
|
- addsTo:
|
|
pack: codeql/java-all
|
|
extensible: sourceModel
|
|
data:
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listDirectories", "()", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listDirectories", "(String)", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "()", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "(String)", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "(String,FTPFileFilter)", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listNames", "()", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "listNames", "(String)", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "()", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "(String)", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "(String,FTPFileFilter)", "", "ReturnValue", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "retrieveFile", "(String,OutputStream)", "", "Argument[1]", "remote", "df-manual"]
|
|
- ["org.apache.commons.net.ftp", "FTPClient", true, "retrieveFileStream", "(String)", "", "ReturnValue", "remote", "df-manual"]
|