Skip to content

Commit 390abdc

Browse files
GeekMasherGeekMasher
committed
feat: Update CMDi Queries and tests
1 parent 0a2dbd3 commit 390abdc

7 files changed

+71
-41
lines changed

‎java/src/security/CWE-078/CommandInjectionRuntimeExec.ql‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,21 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
2020

2121
module Flow2 = TaintTracking::Global<ExecTaint::ExecTaintConfiguration>;
2222

23-
module FlowGraph =
24-
DataFlow::MergePathGraph<Flow::PathNode, Flow2::PathNode, Flow::PathGraph, Flow2::PathGraph>;
25-
26-
import FlowGraph::PathGraph
27-
28-
from FlowGraph::PathNode source, FlowGraph::PathNode sink
23+
from
24+
Flow::PathNode sourceExec, Flow::PathNode sinkExec, Flow2::PathNode sourceTaint,
25+
Flow2::PathNode sinkTaint, MethodCall call
2926
where
30-
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
31-
Flow2::flowPath(source.asPathNode2(), sink.asPathNode2())
32-
select sink, source, sink,
27+
call.getMethod() instanceof RuntimeExecMethod and
28+
(
29+
// this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
30+
Flow::flowPath(sourceExec, sinkExec) and
31+
sinkExec.getNode().asExpr() = call.getArgument(0)
32+
) and
33+
(
34+
// it is tainted by untrusted user input
35+
Flow2::flowPath(sourceTaint, sinkTaint) and
36+
sinkTaint.getNode().asExpr() = call.getAnArgument()
37+
)
38+
select sinkExec, sourceExec, sinkExec,
3339
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
34-
source, source.toString(), source.getNode(), source.toString()
40+
sourceTaint, sourceTaint.toString(), sourceExec.getNode(), sourceExec.toString()

‎java/src/security/CWE-078/CommandInjectionRuntimeExecLocal.ql‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,21 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
2121

2222
module Flow2 = TaintTracking::Global<ExecTaint::ExecTaintConfiguration>;
2323

24-
module FlowGraph =
25-
DataFlow::MergePathGraph<Flow::PathNode, Flow2::PathNode, Flow::PathGraph, Flow2::PathGraph>;
26-
27-
import FlowGraph::PathGraph
28-
29-
from FlowGraph::PathNode source, FlowGraph::PathNode sink
24+
from
25+
Flow::PathNode sourceExec, Flow::PathNode sinkExec, Flow2::PathNode sourceTaint,
26+
Flow2::PathNode sinkTaint, MethodCall call
3027
where
31-
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
32-
Flow2::flowPath(source.asPathNode2(), sink.asPathNode2())
33-
select sink, source, sink,
28+
call.getMethod() instanceof RuntimeExecMethod and
29+
(
30+
// this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
31+
Flow::flowPath(sourceExec, sinkExec) and
32+
sinkExec.getNode().asExpr() = call.getArgument(0)
33+
) and
34+
(
35+
// it is tainted by untrusted user input
36+
Flow2::flowPath(sourceTaint, sinkTaint) and
37+
sinkTaint.getNode().asExpr() = call.getAnArgument()
38+
)
39+
select sinkExec, sourceExec, sinkExec,
3440
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
35-
source, source.toString(), source.getNode(), source.toString()
41+
sourceTaint, sourceTaint.toString(), sourceExec.getNode(), sourceExec.toString()

‎java/src/security/CWE-078/CommandInjectionRuntimeExecTest.ql‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,21 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
2222

2323
module Flow2 = TaintTracking::Global<ExecTaint::ExecTaintConfiguration>;
2424

25-
module FlowGraph =
26-
DataFlow::MergePathGraph<Flow::PathNode, Flow2::PathNode, Flow::PathGraph, Flow2::PathGraph>;
27-
28-
from FlowGraph::PathNode source, FlowGraph::PathNode sink
25+
from
26+
Flow::PathNode sourceExec, Flow::PathNode sinkExec, Flow2::PathNode sourceTaint,
27+
Flow2::PathNode sinkTaint, MethodCall call
2928
where
30-
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
31-
Flow2::flowPath(source.asPathNode2(), sink.asPathNode2())
32-
select sink,
29+
call.getMethod() instanceof RuntimeExecMethod and
30+
(
31+
// this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
32+
Flow::flowPath(sourceExec, sinkExec) and
33+
sinkExec.getNode().asExpr() = call.getArgument(0)
34+
) and
35+
(
36+
// it is tainted by untrusted user input
37+
Flow2::flowPath(sourceTaint, sinkTaint) and
38+
sinkTaint.getNode().asExpr() = call.getAnArgument()
39+
)
40+
select sinkExec,
3341
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
34-
source, source.toString(), source, source.toString()
42+
sourceExec, sourceExec.toString(), sourceExec, sourceExec.toString()

‎java/src/security/CWE-078/CommandInjectionRuntimeExecTestPath.ql‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,21 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
2222

2323
module Flow2 = TaintTracking::Global<ExecTaint::ExecTaintConfiguration>;
2424

25-
module FlowGraph =
26-
DataFlow::MergePathGraph<Flow::PathNode, Flow2::PathNode, Flow::PathGraph, Flow2::PathGraph>;
27-
28-
import FlowGraph::PathGraph
29-
30-
from FlowGraph::PathNode source, FlowGraph::PathNode sink
25+
from
26+
Flow::PathNode sourceExec, Flow::PathNode sinkExec, Flow2::PathNode sourceTaint,
27+
Flow2::PathNode sinkTaint, MethodCall call
3128
where
32-
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
33-
Flow2::flowPath(source.asPathNode2(), sink.asPathNode2())
34-
select sink, source, sink,
29+
call.getMethod() instanceof RuntimeExecMethod and
30+
(
31+
// this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
32+
Flow::flowPath(sourceExec, sinkExec) and
33+
sinkExec.getNode().asExpr() = call.getArgument(0)
34+
) and
35+
(
36+
// it is tainted by untrusted user input
37+
Flow2::flowPath(sourceTaint, sinkTaint) and
38+
sinkTaint.getNode().asExpr() = call.getArgument(0)
39+
)
40+
select sinkExec,
3541
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
36-
source, source.toString(), source.getNode(), source.toString()
42+
sourceExec, sourceExec.toString(), sourceExec, sourceExec.toString()

‎java/test/security/CWE-078/CommandInjectionRuntimeExec.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:22:39:22:51 | commandArray1 | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:21:51:21:59 | "/bin/sh" | "/bin/sh" | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:16:29:16:41 | args | args |
2-
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:30:39:30:51 | commandArray2 | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:26:32:26:40 | "/bin/sh" | "/bin/sh" | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:16:29:16:41 | args | args |
3-
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:34:17:37:40 | toArray(...) | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:35:48:35:56 | "/bin/sh" | "/bin/sh" | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:16:29:16:41 | args | args |
1+
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:22:39:22:51 | commandArray1 | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:21:51:21:59 | "/bin/sh" : String | "/bin/sh" : String | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:21:51:21:59 | "/bin/sh" : String | "/bin/sh" : String |
2+
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:30:39:30:51 | commandArray2 | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:26:32:26:40 | "/bin/sh" : String | "/bin/sh" : String | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:26:32:26:40 | "/bin/sh" : String | "/bin/sh" : String |
3+
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:34:17:37:40 | toArray(...) | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:35:48:35:56 | "/bin/sh" : String | "/bin/sh" : String | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:35:48:35:56 | "/bin/sh" : String | "/bin/sh" : String |

‎java/test/security/CWE-078/CommandInjectionRuntimeExecPath.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:22:39:22:51 | commandArray1 | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:21:51:21:59 | "/bin/sh" : String | "/bin/sh" : String | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:21:51:21:59 | "/bin/sh" : String | "/bin/sh" : String |
2+
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:30:39:30:51 | commandArray2 | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:26:32:26:40 | "/bin/sh" : String | "/bin/sh" : String | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:26:32:26:40 | "/bin/sh" : String | "/bin/sh" : String |
3+
| src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:34:17:37:40 | toArray(...) | Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@' | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:35:48:35:56 | "/bin/sh" : String | "/bin/sh" : String | src/main/java/com/github/githubsecuritylab/command_injection_test/Main.java:35:48:35:56 | "/bin/sh" : String | "/bin/sh" : String |

‎java/test/security/CWE-078/CommandInjectionRuntimeExecPath.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-078/CommandInjectionRuntimeExecTestPath.ql

0 commit comments

Comments
 (0)