Skip to content

Commit 7800ee5

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Fix compilation errors
1 parent 99ca4b3 commit 7800ee5

17 files changed

+162
-178
lines changed

‎java/src/security/CWE-089/MyBatisCommonLib.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
*/
44

55
import java
6-
import semmle.code.xml.MyBatisMapperXML
76
import semmle.code.java.dataflow.FlowSources
87
import semmle.code.java.frameworks.MyBatis
98
import semmle.code.java.frameworks.Properties

‎java/src/security/CWE-089/MyBatisMapperXmlSqlInjection.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
import java
1515
import MyBatisCommonLib
1616
import MyBatisMapperXmlSqlInjectionLib
17-
import semmle.code.xml.MyBatisMapperXML
17+
import semmle.code.java.frameworks.MyBatis
1818
import semmle.code.java.dataflow.FlowSources
1919
private import semmle.code.java.security.Sanitizers
2020
import MyBatisMapperXmlSqlInjectionFlow::PathGraph

‎java/src/security/CWE-089/MyBatisMapperXmlSqlInjectionLib.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*/
44

55
import java
6-
import semmle.code.xml.MyBatisMapperXML
6+
import semmle.code.java.frameworks.MyBatis
77
import semmle.code.java.dataflow.FlowSources
88
import semmle.code.java.frameworks.Properties
99

‎javascript/lib/browserextension/BothSidesRequestForgeryQuery.qll

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,31 +16,30 @@
1616
* A taint tracking configuration for client-side request forgery.
1717
* Server side is disabled since this is in the browser, but the extra models can be enabled for extra coverage
1818
*/
19-
class Configuration extends TaintTracking::Configuration {
20-
Configuration() { this = "ClientSideRequestForgery" }
21-
22-
override predicate isSource(DataFlow::Node source) {
19+
module Config implements DataFlow::ConfigSig {
20+
predicate isSource(DataFlow::Node source) {
2321
exists(Source src |
2422
source = src and
2523
not src.isServerSide()
2624
) or
2725
source instanceof OnMessageExternal or source instanceof OnConnectExternal
2826
}
2927

30-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
28+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3129

32-
override predicate isSanitizer(DataFlow::Node node) {
33-
super.isSanitizer(node) or
30+
predicate isBarrier(DataFlow::Node node) {
3431
node instanceof Sanitizer
3532
}
3633

37-
override predicate isSanitizerOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
34+
predicate isBarrierOut(DataFlow::Node node) { sanitizingPrefixEdge(node, _) }
3835

39-
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
36+
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
4037
isAdditionalRequestForgeryStep(pred, succ)
4138
}
4239
}
4340

41+
module ConfigFlow = TaintTracking::Global<Config>;
42+
4443
class BrowserStep extends DataFlow::SharedFlowStep {
4544
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
4645
(exists (DataFlow::ParameterNode p |

‎javascript/lib/browserextension/BrowserInjectionFieldCustomizations.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,14 @@ private import semmle.javascript.security.dataflow.XssThroughDomCustomizations::
99

1010
module BrowserInjection {
1111

12-
private import DataFlow::FlowLabel
1312
/**
1413
* A data flow source for Chrome API injection vulnerabilities.
1514
*/
1615
abstract class Source extends DataFlow::Node {
1716

1817

1918

20-
DataFlow::FlowLabel getFlowLabel() { result = "BrowserSource" }
19+
string getFlowLabel() { result = "BrowserSource" }
2120
}
2221

2322
/**

‎javascript/lib/browserextension/BrowserInjectionFieldQuery.qll

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import javascript
2+
private import browserextension.BrowserInjectionFieldCustomizations::BrowserInjection
3+
private import semmle.javascript.security.dataflow.XssThroughDomCustomizations::XssThroughDom as XssThroughDom
4+
5+
//private import semmle.javascript.security.dataflow.DomBasedXssCustomizations
6+
//private import semmle.javascript.security.dataflow.XssThroughDomCustomizations::XssThroughDom as XssThroughDom
7+
8+
//private import semmle.javascript.security.dataflow.CodeInjectionCustomizations
9+
10+
module Config implements DataFlow::ConfigSig {
11+
12+
predicate isSource(DataFlow::Node source) {
13+
source instanceof Source
14+
}
15+
16+
predicate isSink(DataFlow::Node sink) {
17+
sink instanceof Sink
18+
}
19+
20+
additional predicate isAdditionalLoadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
21+
(pred = succ) and
22+
((pred instanceof Update and prop = ["url", "openerTabId"])
23+
or
24+
(pred instanceof DownloadsDangerous and prop = ["body", "conflictAction","filename", "url", "method"])
25+
or
26+
(pred instanceof Delete and prop = ["startTime", "endTime", "url"])
27+
//or
28+
//(pred instanceof SetContentSettings and succ instanceof SetContentSettings and prop = any(string s))
29+
//or
30+
//(pred instanceof GetContentSettings and succ instanceof GetContentSettings and prop = any(string s))
31+
//(pred instanceof StorageSet and succ instanceof StorageSet and prop = any(string s))
32+
//or
33+
//(pred instanceof SearchHistory and prop = any(string s))
34+
or
35+
(pred instanceof GetCookie and prop = ["domain", "firstPartyDomain", "name", "url", "session", "path", "storeId"])
36+
or
37+
(pred instanceof UpdateBookmarks and prop= ["title", "url"])
38+
or
39+
(pred = succ and pred instanceof RemoveBrowsingData and prop = ["cookieStoreId", "hostnames", "originTypes", "since"])
40+
or
41+
(pred = succ and pred instanceof AddHistory and prop = ["url"])
42+
or
43+
(pred = succ and pred instanceof CreateWindows and prop = ["url"]))
44+
}
45+
}
46+
47+
module ConfigFlow = TaintTracking::Global<Config>;

‎javascript/lib/browserextension/BrowserInjectionObjectCustomizations.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,14 @@ private import browserextension.BrowserAPI
88

99
module BrowserInjection {
1010

11-
private import DataFlow::FlowLabel
1211
/**
1312
* A data flow source for Chrome API injection vulnerabilities.
1413
*/
1514
abstract class Source extends DataFlow::Node {
1615

1716

1817

19-
DataFlow::FlowLabel getFlowLabel() { result = "BrowserSource" }
18+
string getFlowLabel() { result = "BrowserSource" }
2019
}
2120

2221
/**

‎javascript/lib/browserextension/CodeInjectionQuery.qll

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,30 +17,29 @@
1717
/**
1818
* A taint-tracking configuration for reasoning about code injection vulnerabilities.
1919
*/
20-
class Configuration extends TaintTracking::Configuration {
21-
Configuration() { this = "CodeInjection" }
20+
module Config implements DataFlow::ConfigSig {
21+
predicate isSource(DataFlow::Node source) { source instanceof XssThroughDom::Source}
2222

23-
override predicate isSource(DataFlow::Node source) { source instanceof XssThroughDom::Source}
2423

2524

25+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink}
2626

27-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink}
28-
29-
override predicate isSanitizer(DataFlow::Node node) {
30-
super.isSanitizer(node) or
27+
predicate isBarrier(DataFlow::Node node) {
3128
node instanceof Sanitizer
3229
}
3330

34-
override predicate isAdditionalTaintStep(DataFlow::Node src, DataFlow::Node trg) {
31+
predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node trg) {
3532
// HTML sanitizers are insufficient protection against code injection
3633
src = trg.(HtmlSanitizerCall).getInput()
3734
}
3835

39-
override predicate isAdditionalLoadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
36+
additional predicate isAdditionalLoadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
4037
exists(ExecuteScript ess | ess = pred and ess = succ and prop = ["file", "code"])
4138
}
4239
}
4340

41+
module ConfigFlow = TaintTracking::Global<Config>;
42+
4443
//Browser Extension Models
4544
class ExecuteScriptSink extends Sink instanceof ExecuteScript{}
4645
class ExternalConnect1 extends Source instanceof OnConnectExternal{}

‎javascript/lib/ghsl/InsecureIV.qll

Lines changed: 28 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -2,47 +2,41 @@ import semmle.javascript.dataflow.TaintTracking
22

33
import ghsl.CommandLine
44

5-
class RandomTaintsSourceConfiguration extends TaintTracking::Configuration {
6-
RandomTaintsSourceConfiguration() { this = "RandomTaintsSourceConfiguration" }
5+
module RandomTaintsSourceConfig implements DataFlow::ConfigSig {
6+
predicate isSource(DataFlow::Node source) { isSecureRandom(source) }
77

8-
override predicate isSource(DataFlow::Node source) {
9-
isSecureRandom(source)
10-
}
11-
12-
override predicate isSink(DataFlow::Node sink) {
13-
not isSecureRandom(sink)
14-
}
8+
predicate isSink(DataFlow::Node sink) { not isSecureRandom(sink) }
159
}
1610

17-
class InsecureIVConfiguration extends TaintTracking::Configuration {
18-
InsecureIVConfiguration() { this = "InsecureIVConfiguration" }
11+
module RandomTaintsSourceFlow = TaintTracking::Global<RandomTaintsSourceConfig>;
1912

20-
override predicate isSource(DataFlow::Node source) {
21-
exists(Literal literal|literal.flow() = source)
22-
or
23-
source instanceof DataFlow::ArrayLiteralNode
24-
or
25-
source instanceof RemoteFlowSource
26-
or
27-
source instanceof FileSystemReadAccess
28-
or
29-
source instanceof DatabaseAccess
30-
or
31-
source instanceof CommandLineArgument
32-
or
33-
// an external function that is not a known source of randomness
34-
(
35-
source instanceof ExternalCallWithOutput
36-
and not source instanceof CreateIVArgument
37-
and not source instanceof SecureRandomSource
38-
)
39-
}
13+
module InsecureIVConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) {
15+
exists(Literal literal | literal.flow() = source)
16+
or
17+
source instanceof DataFlow::ArrayLiteralNode
18+
or
19+
source instanceof RemoteFlowSource
20+
or
21+
source instanceof FileSystemReadAccess
22+
or
23+
source instanceof DatabaseAccess
24+
or
25+
source instanceof CommandLineArgument
26+
or
27+
// an external function that is not a known source of randomness
28+
(
29+
source instanceof ExternalCallWithOutput
30+
and not source instanceof CreateIVArgument
31+
and not source instanceof SecureRandomSource
32+
)
33+
}
4034

41-
override predicate isSink(DataFlow::Node sink) {
42-
sink instanceof CreateIVArgument
43-
}
35+
predicate isSink(DataFlow::Node sink) { sink instanceof CreateIVArgument }
4436
}
4537

38+
module InsecureIVFlow = TaintTracking::Global<InsecureIVConfig>;
39+
4640
class ExternalCallWithOutput extends DataFlow::Node {
4741
CallExpr call;
4842

‎javascript/src/audit/CWE-094/BrowserExtensionCodeInjection.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@
1616

1717
import javascript
1818
import browserextension.CodeInjectionQuery
19-
import DataFlow::PathGraph
19+
import ConfigFlow::PathGraph
2020

21-
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
22-
where cfg.hasFlowPath(source, sink)
21+
from ConfigFlow::PathNode source, ConfigFlow::PathNode sink
22+
where ConfigFlow::flowPath(source, sink)
2323
select sink.getNode(), source, sink, sink.getNode().(Sink).getMessagePrefix() + " depends on a $@.",
2424
source.getNode(), "user-provided value"

0 commit comments

Comments
 (0)