Skip to content

Commit 540b839

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: add more tests
1 parent 9932085 commit 540b839

File tree

5 files changed

+139
-10
lines changed

5 files changed

+139
-10
lines changed

‎java/ql/lib/ext/org.apache.hc.core5.http.impl.io.model.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6+
# ! `DefaultClassicHttpRequestFactory` extends Object, no subclasses, implements `HttpRequestFactory`; HAS javadocs
67
- ["org.apache.hc.core5.http.impl.io", "DefaultClassicHttpRequestFactory", True, "newHttpRequest", "(String,String)", "", "Argument[1]", "%-url", "manual"]
78
- ["org.apache.hc.core5.http.impl.io", "DefaultClassicHttpRequestFactory", True, "newHttpRequest", "(String,URI)", "", "Argument[1]", "%-url", "manual"]

‎java/ql/lib/ext/org.apache.hc.core5.http.impl.nio.model.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6+
# ! `DefaultHttpRequestFactory` extends Object, no subclasses; implements `HttpRequestFactory`; HAS javadocs
67
- ["org.apache.hc.core5.http.impl.nio", "DefaultHttpRequestFactory", True, "newHttpRequest", "(String,String)", "", "Argument[1]", "%-url", "manual"]
78
- ["org.apache.hc.core5.http.impl.nio", "DefaultHttpRequestFactory", True, "newHttpRequest", "(String,URI)", "", "Argument[1]", "%-url", "manual"]

‎java/ql/lib/ext/org.apache.hc.core5.http.io.support.model.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6+
# ! ClassicRequestBuilder extends Object>AbstractMessageBuilder>AbstractRequestBuilder, no subclasses; does not really have javadocs
67
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "delete", "(String)", "", "Argument[0]", "%-url", "manual"]
78
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "delete", "(URI)", "", "Argument[0]", "%-url", "manual"]
89
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "get", "(String)", "", "Argument[0]", "%-url", "manual"]
@@ -17,7 +18,7 @@ extensions:
1718
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "post", "(URI)", "", "Argument[0]", "%-url", "manual"]
1819
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "put", "(String)", "", "Argument[0]", "%-url", "manual"]
1920
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "put", "(URI)", "", "Argument[0]", "%-url", "manual"]
20-
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "setHttpHost", "", "", "Argument[0]", "%-url", "manual"] # ! ModelType: sink, Notes: possibly subtyped by AbstractRequestBuilder
21+
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "setHttpHost", "(HttpHost)", "", "Argument[0]", "%-url", "manual"] # ! possibly subtyped by AbstractRequestBuilder
2122
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "setUri", "(String)", "", "Argument[0]", "%-url", "manual"]
2223
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "setUri", "(URI)", "", "Argument[0]", "%-url", "manual"]
2324
- ["org.apache.hc.core5.http.io.support", "ClassicRequestBuilder", True, "trace", "(String)", "", "Argument[0]", "%-url", "manual"]

‎java/ql/lib/ext/org.apache.hc.core5.http.message.model.yml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,19 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["org.apache.hc.core5.http.message", "BasicClassicHttpRequest", True, "BasicClassicHttpRequest", "(Method,HttpHost,String)", "", "Argument[1]", "%-url", "manual"] # ! ModelType: sink, Notes:
6+
# ! BasicClassicHttpRequest extends Object>HeaderGroup>BasicHttpRequest, implements Serializable, ClassicHttpRequest, HttpEntityContainer, HttpMessage, HttpRequest, MessageHeaders; has javadocs
7+
- ["org.apache.hc.core5.http.message", "BasicClassicHttpRequest", True, "BasicClassicHttpRequest", "(Method,HttpHost,String)", "", "Argument[1]", "%-url", "manual"]
78
- ["org.apache.hc.core5.http.message", "BasicClassicHttpRequest", True, "BasicClassicHttpRequest", "(Method,URI)", "", "Argument[1]", "%-url", "manual"]
8-
- ["org.apache.hc.core5.http.message", "BasicClassicHttpRequest", True, "BasicClassicHttpRequest", "(String,HttpHost,String)", "", "Argument[1]", "%-url", "manual"] # ! ModelType: sink, Notes:
9+
- ["org.apache.hc.core5.http.message", "BasicClassicHttpRequest", True, "BasicClassicHttpRequest", "(String,HttpHost,String)", "", "Argument[1]", "%-url", "manual"]
910
- ["org.apache.hc.core5.http.message", "BasicClassicHttpRequest", True, "BasicClassicHttpRequest", "(String,URI)", "", "Argument[1]", "%-url", "manual"]
10-
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "BasicHttpRequest", "(Method,HttpHost,String)", "", "Argument[1]", "%-url", "manual"] # ! ModelType: sink, Notes:
11+
# ! BasicHttpRequest extends Object>HeaderGroup, subclass is BasicClassicHttpRequest, implements Serializable, HttpMessage, HttpRequest, MessageHeaders; has javadocs
12+
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "BasicHttpRequest", "(Method,HttpHost,String)", "", "Argument[1]", "%-url", "manual"]
1113
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "BasicHttpRequest", "(Method,URI)", "", "Argument[1]", "%-url", "manual"]
12-
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "BasicHttpRequest", "(String,HttpHost,String)", "", "Argument[1]", "%-url", "manual"] # ! ModelType: sink, Notes:
14+
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "BasicHttpRequest", "(String,HttpHost,String)", "", "Argument[1]", "%-url", "manual"]
1315
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "BasicHttpRequest", "(String,URI)", "", "Argument[1]", "%-url", "manual"]
14-
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "setUri", "", "", "Argument[0]", "%-url", "manual"]
15-
- ["org.apache.hc.core5.http.message", "HttpRequestWrapper", True, "setUri", "", "", "Argument[0]", "%-url", "manual"]
16-
- ["org.apache.hc.core5.http.message", "RequestLine", True, "RequestLine", "(String,String,ProtocolVersion)", "", "Argument[1]", "%-url", "manual"] # ! already a taint step
16+
- ["org.apache.hc.core5.http.message", "BasicHttpRequest", True, "setUri", "(URI)", "", "Argument[0]", "%-url", "manual"]
17+
# ! HttpRequestWrapper extends Object>AbstractMessageWrapper, no subclasses, implements HttpMessage, HttpRequest, MessageHeaders; has javadocs
18+
- ["org.apache.hc.core5.http.message", "HttpRequestWrapper", True, "setUri", "(URI)", "", "Argument[0]", "%-url", "manual"]
1719

1820
- addsTo:
1921
pack: codeql/java-all

‎java/ql/test/query-tests/security/CWE-918/ApacheHttp5SSRF.java

Lines changed: 126 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,17 @@
2929
import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase;
3030

3131
import org.apache.hc.client5.http.fluent.Request;
32-
// import org.apache.hc.client5.http.protocol.RedirectLocations;
33-
// import org.apache.hc.client5.http.utils.URIUtils;
32+
33+
import org.apache.hc.core5.http.impl.bootstrap.HttpAsyncRequester;
34+
import org.apache.hc.core5.http.impl.io.DefaultClassicHttpRequestFactory;
35+
import org.apache.hc.core5.http.impl.nio.DefaultHttpRequestFactory;
36+
37+
import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
38+
39+
import org.apache.hc.core5.http.message.BasicClassicHttpRequest;
40+
import org.apache.hc.core5.http.message.BasicHttpRequest;
41+
import org.apache.hc.core5.http.message.HttpRequestWrapper;
42+
3443

3544
public class ApacheHttp5SSRF extends HttpServlet {
3645

@@ -285,4 +294,119 @@ protected void doGet3(HttpServletRequest request, HttpServletResponse response)
285294
// TODO: handle exception
286295
}
287296
}
297+
298+
// org.apache.hc.core5.http.impl.bootstrap
299+
// org.apache.hc.core5.http.impl.io
300+
// org.apache.hc.core5.http.impl.nio
301+
protected void doGet4(HttpServletRequest request, HttpServletResponse response)
302+
throws ServletException, IOException {
303+
try {
304+
305+
String uriSink = request.getParameter("uri");
306+
URI uri = new URI(uriSink);
307+
308+
String hostSink = request.getParameter("host");
309+
HttpHost host = new HttpHost(hostSink);
310+
311+
// org.apache.hc.core5.http.impl.bootstrap
312+
//AsyncRequesterBootstrap asyncReq = new AsyncRequesterBootstrap();
313+
HttpAsyncRequester httpAsyncReq = new HttpAsyncRequester(null, null, null, null, null, null);
314+
httpAsyncReq.connect(host, null); // $ SSRF
315+
httpAsyncReq.connect(host, null, null, null); // $ SSRF
316+
317+
// org.apache.hc.core5.http.impl.io
318+
DefaultClassicHttpRequestFactory defClassicHttpReqFact = new DefaultClassicHttpRequestFactory();
319+
defClassicHttpReqFact.newHttpRequest("method", uri.toString()); // $ SSRF
320+
defClassicHttpReqFact.newHttpRequest("method", uri); // $ SSRF
321+
322+
// org.apache.hc.core5.http.impl.nio
323+
DefaultHttpRequestFactory defHttpReqFact = new DefaultHttpRequestFactory();
324+
defHttpReqFact.newHttpRequest("method", uri.toString()); // $ SSRF
325+
defHttpReqFact.newHttpRequest("method", uri); // $ SSRF
326+
327+
} catch (Exception e) {
328+
// TODO: handle exception
329+
}
330+
}
331+
332+
// org.apache.hc.core5.http.io.support
333+
protected void doGet5(HttpServletRequest request, HttpServletResponse response)
334+
throws ServletException, IOException {
335+
try {
336+
337+
String uriSink = request.getParameter("uri");
338+
URI uri = new URI(uriSink);
339+
340+
String hostSink = request.getParameter("host");
341+
HttpHost host = new HttpHost(hostSink);
342+
343+
// org.apache.hc.core5.http.io.support.ClassicRequestBuilder
344+
ClassicRequestBuilder.delete(uri.toString()); // $ SSRF
345+
ClassicRequestBuilder.delete(uri); // $ SSRF
346+
347+
ClassicRequestBuilder.get(uri.toString()); // $ SSRF
348+
ClassicRequestBuilder.get(uri); // $ SSRF
349+
350+
ClassicRequestBuilder.head(uri.toString()); // $ SSRF
351+
ClassicRequestBuilder.head(uri); // $ SSRF
352+
353+
ClassicRequestBuilder.options(uri.toString()); // $ SSRF
354+
ClassicRequestBuilder.options(uri); // $ SSRF
355+
356+
ClassicRequestBuilder.patch(uri.toString()); // $ SSRF
357+
ClassicRequestBuilder.patch(uri); // $ SSRF
358+
359+
ClassicRequestBuilder.post(uri.toString()); // $ SSRF
360+
ClassicRequestBuilder.post(uri); // $ SSRF
361+
362+
ClassicRequestBuilder.put(uri.toString()); // $ SSRF
363+
ClassicRequestBuilder.put(uri); // $ SSRF
364+
365+
ClassicRequestBuilder.get().setHttpHost(host); // $ SSRF
366+
367+
ClassicRequestBuilder.get().setUri(uri.toString()); // $ SSRF
368+
ClassicRequestBuilder.get().setUri(uri); // $ SSRF
369+
370+
ClassicRequestBuilder.trace(uri.toString()); // $ SSRF
371+
ClassicRequestBuilder.trace(uri); // $ SSRF
372+
373+
} catch (Exception e) {
374+
// TODO: handle exception
375+
}
376+
}
377+
378+
// org.apache.hc.core5.http.message
379+
protected void doGet6(HttpServletRequest request, HttpServletResponse response)
380+
throws ServletException, IOException {
381+
try {
382+
383+
String uriSink = request.getParameter("uri");
384+
URI uri = new URI(uriSink);
385+
386+
String hostSink = request.getParameter("host");
387+
HttpHost host = new HttpHost(hostSink);
388+
389+
// BasicClassicHttpRequest
390+
new BasicClassicHttpRequest(Method.CONNECT, host, "path"); // $ SSRF
391+
new BasicClassicHttpRequest(Method.CONNECT, uri); // $ SSRF
392+
new BasicClassicHttpRequest("method", host, "path"); // $ SSRF
393+
new BasicClassicHttpRequest("method", uri); // $ SSRF
394+
395+
// BasicHttpRequest
396+
new BasicHttpRequest(Method.CONNECT, host, "path"); // $ SSRF
397+
new BasicHttpRequest(Method.CONNECT, uri); // $ SSRF
398+
new BasicHttpRequest("method", host, "path"); // $ SSRF
399+
new BasicHttpRequest("method", uri); // $ SSRF
400+
BasicHttpRequest bhr = new BasicHttpRequest("method", "path");
401+
bhr.setUri(uri); // $ SSRF
402+
403+
// HttpRequestWrapper
404+
HttpRequestWrapper hrw = new HttpRequestWrapper(null);
405+
hrw.setUri(uri); // $ SSRF
406+
407+
} catch (Exception e) {
408+
// TODO: handle exception
409+
}
410+
}
411+
288412
}

0 commit comments

Comments
 (0)