Skip to content

Commit 2793f28

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: move config to Query.qll file
1 parent 0d38a96 commit 2793f28

File tree

5 files changed

+105
-46
lines changed

5 files changed

+105
-46
lines changed

‎java/ql/lib/semmle/code/java/Jsf.qll

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Provides classes and predicates for working with the Java Server Faces (JSF).
3+
*/
4+
5+
// TODO: COMBINE WITH EXISTING JSF-RELATED QLL FILES!
6+
import java
7+
8+
/**
9+
* The JSF class `ExternalContext` for processing HTTP requests.
10+
*/
11+
class ExternalContext extends RefType {
12+
ExternalContext() {
13+
this.hasQualifiedName(["javax.faces.context", "jakarta.faces.context"], "ExternalContext")
14+
}
15+
}
16+
17+
/**
18+
* The method `getResource()` declared in JSF `ExternalContext`.
19+
*/
20+
class GetFacesResourceMethod extends Method {
21+
GetFacesResourceMethod() {
22+
this.getDeclaringType().getASupertype*() instanceof ExternalContext and
23+
this.hasName("getResource")
24+
}
25+
}
26+
27+
/**
28+
* The method `getResourceAsStream()` declared in JSF `ExternalContext`.
29+
*/
30+
class GetFacesResourceAsStreamMethod extends Method {
31+
GetFacesResourceAsStreamMethod() {
32+
this.getDeclaringType().getASupertype*() instanceof ExternalContext and
33+
this.hasName("getResourceAsStream")
34+
}
35+
}

‎java/ql/lib/semmle/code/java/SpringResource.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* Provides classes for working with resource loading in Spring.
3+
*/
4+
5+
// TODO: COMBINE WITH EXISTING SPRING-RELATED QLL FILES!
6+
import java
7+
private import semmle.code.java.dataflow.FlowSources
8+
9+
/** A utility class for resolving resource locations to files in the file system in the Spring framework. */
10+
class ResourceUtils extends Class {
11+
ResourceUtils() { this.hasQualifiedName("org.springframework.util", "ResourceUtils") }
12+
}
13+
14+
/**
15+
* A method declared in `org.springframework.util.ResourceUtils` that loads Spring resources.
16+
*/
17+
class GetResourceUtilsMethod extends Method {
18+
GetResourceUtilsMethod() {
19+
this.getDeclaringType().getASupertype*() instanceof ResourceUtils and
20+
this.hasName(["extractArchiveURL", "extractJarFileURL", "getFile", "getURL"])
21+
}
22+
}

‎java/ql/src/Security/CWE/CWE-552/UnsafeUrlForward.qll renamed to ‎java/ql/lib/semmle/code/java/security/UnsafeUrlForward.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
import java
2-
private import experimental.semmle.code.java.frameworks.Jsf
2+
private import semmle.code.java.Jsf
33
private import semmle.code.java.dataflow.ExternalFlow
44
private import semmle.code.java.dataflow.FlowSources
55
private import semmle.code.java.dataflow.StringPrefixes
66
private import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions
7-
private import experimental.semmle.code.java.frameworks.SpringResource
7+
private import semmle.code.java.SpringResource
88

99
/** A sink for unsafe URL forward vulnerabilities. */
1010
abstract class UnsafeUrlForwardSink extends DataFlow::Node { }

‎java/ql/lib/semmle/code/java/security/UnsafeUrlForwardQuery.qll

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
import java
2+
import semmle.code.java.security.UnsafeUrlForward
3+
import semmle.code.java.dataflow.FlowSources
4+
import semmle.code.java.dataflow.TaintTracking
5+
import semmle.code.java.Jsf
6+
import semmle.code.java.security.PathSanitizer
7+
8+
module UnsafeUrlForwardFlowConfig implements DataFlow::ConfigSig {
9+
predicate isSource(DataFlow::Node source) {
10+
source instanceof ThreatModelFlowSource and
11+
not exists(MethodCall ma, Method m | ma.getMethod() = m |
12+
(
13+
m instanceof HttpServletRequestGetRequestUriMethod or
14+
m instanceof HttpServletRequestGetRequestUrlMethod or
15+
m instanceof HttpServletRequestGetPathMethod
16+
) and
17+
ma = source.asExpr()
18+
)
19+
}
20+
21+
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeUrlForwardSink }
22+
23+
predicate isBarrier(DataFlow::Node node) {
24+
node instanceof UnsafeUrlForwardSanitizer or
25+
node instanceof PathInjectionSanitizer
26+
}
27+
28+
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
29+
30+
predicate isAdditionalFlowStep(DataFlow::Node prev, DataFlow::Node succ) {
31+
exists(MethodCall ma |
32+
(
33+
ma.getMethod() instanceof GetServletResourceMethod or
34+
ma.getMethod() instanceof GetFacesResourceMethod or
35+
ma.getMethod() instanceof GetClassResourceMethod or
36+
ma.getMethod() instanceof GetClassLoaderResourceMethod or
37+
ma.getMethod() instanceof GetWildflyResourceMethod
38+
) and
39+
ma.getArgument(0) = prev.asExpr() and
40+
ma = succ.asExpr()
41+
)
42+
}
43+
}
44+
45+
module UnsafeUrlForwardFlow = TaintTracking::Global<UnsafeUrlForwardFlowConfig>;

‎java/ql/src/Security/CWE/CWE-552/UnsafeUrlForward.ql

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -11,52 +11,9 @@
1111
*/
1212

1313
import java
14-
import UnsafeUrlForward
15-
import semmle.code.java.dataflow.FlowSources
16-
import semmle.code.java.dataflow.TaintTracking
17-
import experimental.semmle.code.java.frameworks.Jsf
18-
import semmle.code.java.security.PathSanitizer
14+
import semmle.code.java.security.UnsafeUrlForwardQuery
1915
import UnsafeUrlForwardFlow::PathGraph
2016

21-
module UnsafeUrlForwardFlowConfig implements DataFlow::ConfigSig {
22-
predicate isSource(DataFlow::Node source) {
23-
source instanceof ThreatModelFlowSource and
24-
not exists(MethodCall ma, Method m | ma.getMethod() = m |
25-
(
26-
m instanceof HttpServletRequestGetRequestUriMethod or
27-
m instanceof HttpServletRequestGetRequestUrlMethod or
28-
m instanceof HttpServletRequestGetPathMethod
29-
) and
30-
ma = source.asExpr()
31-
)
32-
}
33-
34-
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeUrlForwardSink }
35-
36-
predicate isBarrier(DataFlow::Node node) {
37-
node instanceof UnsafeUrlForwardSanitizer or
38-
node instanceof PathInjectionSanitizer
39-
}
40-
41-
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
42-
43-
predicate isAdditionalFlowStep(DataFlow::Node prev, DataFlow::Node succ) {
44-
exists(MethodCall ma |
45-
(
46-
ma.getMethod() instanceof GetServletResourceMethod or
47-
ma.getMethod() instanceof GetFacesResourceMethod or
48-
ma.getMethod() instanceof GetClassResourceMethod or
49-
ma.getMethod() instanceof GetClassLoaderResourceMethod or
50-
ma.getMethod() instanceof GetWildflyResourceMethod
51-
) and
52-
ma.getArgument(0) = prev.asExpr() and
53-
ma = succ.asExpr()
54-
)
55-
}
56-
}
57-
58-
module UnsafeUrlForwardFlow = TaintTracking::Global<UnsafeUrlForwardFlowConfig>;
59-
6017
from UnsafeUrlForwardFlow::PathNode source, UnsafeUrlForwardFlow::PathNode sink
6118
where UnsafeUrlForwardFlow::flowPath(source, sink)
6219
select sink.getNode(), source, sink, "Potentially untrusted URL forward due to $@.",

0 commit comments

Comments
 (0)