Skip to content

Commit 35a083a

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: update test cases to use inline expectations
1 parent 2793f28 commit 35a083a

10 files changed

+56
-166
lines changed

‎java/ql/test/query-tests/security/CWE-552/UnsafeLoadSpringResource.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ public String getFileContent1(@RequestParam(name="fileName") String fileName) {
3232
char[] buffer = new char[4096];
3333
StringBuilder out = new StringBuilder();
3434
try {
35-
Reader in = new FileReader(clr.getFilename());
35+
Reader in = new FileReader(clr.getFilename()); // $ hasUnsafeUrlForward (path-inj?)
3636
for (int numRead; (numRead = in.read(buffer, 0, buffer.length)) > 0; ) {
3737
out.append(buffer, 0, numRead);
3838
}
@@ -67,13 +67,13 @@ public String getFileContent1a(@RequestParam(name="fileName") String fileName) {
6767
//BAD: Get resource from ResourceUtils without input validation
6868
public String getFileContent2(@RequestParam(name="fileName") String fileName) {
6969
String content = null;
70-
70+
7171
try {
7272
// A request such as the following can disclose source code and system configuration
7373
// fileName=/etc/hosts
7474
// fileName=file:/etc/hosts
7575
// fileName=/opt/appdir/WEB-INF/views/page.jsp
76-
File file = ResourceUtils.getFile(fileName);
76+
File file = ResourceUtils.getFile(fileName); // $ hasUnsafeUrlForward (path-inj?)
7777
//Read File Content
7878
content = new String(Files.readAllBytes(file.toPath()));
7979
} catch (IOException ie) {
@@ -86,7 +86,7 @@ public String getFileContent2(@RequestParam(name="fileName") String fileName) {
8686
//GOOD: Get resource from ResourceUtils with input path validation
8787
public String getFileContent2a(@RequestParam(name="fileName") String fileName) {
8888
String content = null;
89-
89+
9090
if (fileName.startsWith("/safe_dir") && !fileName.contains("..")) {
9191
try {
9292
File file = ResourceUtils.getFile(fileName);
@@ -113,7 +113,7 @@ public String getFileContent3(@RequestParam(name="fileName") String fileName) {
113113
// fileName=/WEB-INF/views/page.jsp
114114
// fileName=/WEB-INF/classes/com/example/package/SampleController.class
115115
// fileName=file:/etc/hosts
116-
Resource resource = resourceLoader.getResource(fileName);
116+
Resource resource = resourceLoader.getResource(fileName); // $ hasUnsafeUrlForward (path-inj?)
117117

118118
char[] buffer = new char[4096];
119119
StringBuilder out = new StringBuilder();

‎java/ql/test/query-tests/security/CWE-552/UnsafeRequestPath.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,35 +14,35 @@ public class UnsafeRequestPath implements Filter {
1414
private static final String BASE_PATH = "/pages";
1515

1616
@Override
17-
// BAD: Request dispatcher from servlet path without check
17+
// BAD: Request dispatcher from servlet path without check
1818
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
1919
throws IOException, ServletException {
2020
String path = ((HttpServletRequest) request).getServletPath();
2121
// A sample payload "/%57EB-INF/web.xml" can bypass this `startsWith` check
2222
if (path != null && !path.startsWith("/WEB-INF")) {
23-
request.getRequestDispatcher(path).forward(request, response);
23+
request.getRequestDispatcher(path).forward(request, response); // $ hasUnsafeUrlForward
2424
} else {
2525
chain.doFilter(request, response);
2626
}
2727
}
2828

29-
// GOOD: Request dispatcher from servlet path with check
29+
// GOOD: Request dispatcher from servlet path with check
3030
public void doFilter2(ServletRequest request, ServletResponse response, FilterChain chain)
3131
throws IOException, ServletException {
3232
String path = ((HttpServletRequest) request).getServletPath();
33-
33+
3434
if (path.startsWith(BASE_PATH) && !path.contains("..")) {
3535
request.getRequestDispatcher(path).forward(request, response);
3636
} else {
3737
chain.doFilter(request, response);
3838
}
3939
}
4040

41-
// GOOD: Request dispatcher from servlet path with whitelisted string comparison
41+
// GOOD: Request dispatcher from servlet path with whitelisted string comparison
4242
public void doFilter3(ServletRequest request, ServletResponse response, FilterChain chain)
4343
throws IOException, ServletException {
4444
String path = ((HttpServletRequest) request).getServletPath();
45-
45+
4646
if (path.equals("/comaction")) {
4747
request.getRequestDispatcher(path).forward(request, response);
4848
} else {

‎java/ql/test/query-tests/security/CWE-552/UnsafeResourceGet.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
3838
// A sample request /fake.jsp/../WEB-INF/web.xml can load the web.xml file
3939
URL url = sc.getResource(requestUrl);
4040

41-
InputStream in = url.openStream();
41+
InputStream in = url.openStream(); // $ hasUnsafeUrlForward (SSRF)
4242
byte[] buf = new byte[4 * 1024]; // 4K buffer
4343
int bytesRead;
4444
while ((bytesRead = in.read(buf)) != -1) {
@@ -112,7 +112,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
112112
ServletOutputStream out = response.getOutputStream();
113113

114114
// A sample request /fake.jsp/../WEB-INF/web.xml can load the web.xml file
115-
InputStream in = request.getServletContext().getResourceAsStream(requestPath);
115+
InputStream in = request.getServletContext().getResourceAsStream(requestPath); // $ hasUnsafeUrlForward (path-inj?)
116116
byte[] buf = new byte[4 * 1024]; // 4K buffer
117117
int bytesRead;
118118
while ((bytesRead = in.read(buf)) != -1) {
@@ -147,7 +147,7 @@ protected void doHead(HttpServletRequest request, HttpServletResponse response)
147147
// Note the class is in two levels of subpackages and `Class.getResource` starts from its own directory
148148
URL url = getClass().getResource(requestUrl);
149149

150-
InputStream in = url.openStream();
150+
InputStream in = url.openStream(); // $ hasUnsafeUrlForward (SSRF)
151151
byte[] buf = new byte[4 * 1024]; // 4K buffer
152152
int bytesRead;
153153
while ((bytesRead = in.read(buf)) != -1) {
@@ -186,7 +186,7 @@ protected void doPut(HttpServletRequest request, HttpServletResponse response)
186186

187187
// A sample request /fake.jsp/../../../WEB-INF/web.xml can load the web.xml file
188188
// Note the class is in two levels of subpackages and `ClassLoader.getResourceAsStream` starts from its own directory
189-
InputStream in = getClass().getClassLoader().getResourceAsStream(requestPath);
189+
InputStream in = getClass().getClassLoader().getResourceAsStream(requestPath); // $ hasUnsafeUrlForward (path-inj?)
190190
byte[] buf = new byte[4 * 1024]; // 4K buffer
191191
int bytesRead;
192192
while ((bytesRead = in.read(buf)) != -1) {
@@ -223,7 +223,7 @@ protected void doPutBad(HttpServletRequest request, HttpServletResponse response
223223
// Note the class is in two levels of subpackages and `ClassLoader.getResource` starts from its own directory
224224
URL url = getClass().getClassLoader().getResource(requestUrl);
225225

226-
InputStream in = url.openStream();
226+
InputStream in = url.openStream(); // $ hasUnsafeUrlForward (SSRF)
227227
byte[] buf = new byte[4 * 1024]; // 4K buffer
228228
int bytesRead;
229229
while ((bytesRead = in.read(buf)) != -1) {
@@ -242,7 +242,7 @@ protected void doPutBad2(HttpServletRequest request, HttpServletResponse respons
242242

243243
VirtualFile overlay = VFS.getChild(new URI("EAP_HOME/modules/"));
244244
// Do file operations
245-
overlay.getChild(rs.getPath());
245+
overlay.getChild(rs.getPath()); // $ hasUnsafeUrlForward (path-inj?)
246246
} catch (URISyntaxException ue) {
247247
throw new IOException("Cannot parse the URI");
248248
}

‎java/ql/test/query-tests/security/CWE-552/UnsafeResourceGet2.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ public String parameterActionBad1() throws IOException {
1616
Map<String, String> params = fc.getExternalContext().getRequestParameterMap();
1717
String loadUrl = params.get("loadUrl");
1818

19-
InputStreamReader isr = new InputStreamReader(fc.getExternalContext().getResourceAsStream(loadUrl));
19+
InputStreamReader isr = new InputStreamReader(fc.getExternalContext().getResourceAsStream(loadUrl)); // $ hasUnsafeUrlForward (path-inj?)
2020
BufferedReader br = new BufferedReader(isr);
2121
if(br.ready()) {
2222
//Do Stuff
@@ -34,7 +34,7 @@ public String parameterActionBad2() throws IOException {
3434

3535
URL url = fc.getExternalContext().getResource(loadUrl);
3636

37-
InputStream in = url.openStream();
37+
InputStream in = url.openStream(); // $ hasUnsafeUrlForward (SSRF)
3838
//Do Stuff
3939
return "result";
4040
}

‎java/ql/test/query-tests/security/CWE-552/UnsafeServletRequestDispatch.java

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,13 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
2929
rd.forward(request, response);
3030
} else {
3131
ServletContext sc = cfg.getServletContext();
32-
RequestDispatcher rd = sc.getRequestDispatcher(returnURL);
32+
RequestDispatcher rd = sc.getRequestDispatcher(returnURL); // $ hasUnsafeUrlForward
3333
rd.forward(request, response);
3434
}
3535
}
3636

3737
@Override
38-
// BAD: Request dispatcher constructed from `HttpServletRequest` without input validation
38+
// BAD: Request dispatcher constructed from `HttpServletRequest` without input validation
3939
protected void doPost(HttpServletRequest request, HttpServletResponse response)
4040
throws ServletException, IOException {
4141
String action = request.getParameter("action");
@@ -45,7 +45,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
4545
RequestDispatcher rd = request.getRequestDispatcher("/Login.jsp");
4646
rd.forward(request, response);
4747
} else {
48-
RequestDispatcher rd = request.getRequestDispatcher(returnURL);
48+
RequestDispatcher rd = request.getRequestDispatcher(returnURL); // $ hasUnsafeUrlForward
4949
rd.forward(request, response);
5050
}
5151
}
@@ -65,22 +65,22 @@ protected void doPut(HttpServletRequest request, HttpServletResponse response)
6565
}
6666
}
6767

68-
// BAD: Request dispatcher without path traversal check
68+
// BAD: Request dispatcher without path traversal check
6969
protected void doHead2(HttpServletRequest request, HttpServletResponse response)
7070
throws ServletException, IOException {
7171
String path = request.getParameter("path");
7272

73-
// A sample payload "/pages/welcome.jsp/../WEB-INF/web.xml" can bypass the `startsWith` check
74-
// The payload "/pages/welcome.jsp/../../%57EB-INF/web.xml" can bypass the check as well since RequestDispatcher will decode `%57` as `W`
73+
// A sample payload "/pages/welcome.jsp/../WEB-INF/web.xml" can bypass the `startsWith` check
74+
// The payload "/pages/welcome.jsp/../../%57EB-INF/web.xml" can bypass the check as well since RequestDispatcher will decode `%57` as `W`
7575
if (path.startsWith(BASE_PATH)) {
76-
request.getServletContext().getRequestDispatcher(path).include(request, response);
76+
request.getServletContext().getRequestDispatcher(path).include(request, response); // $ hasUnsafeUrlForward
7777
}
7878
}
7979

80-
// GOOD: Request dispatcher with path traversal check
80+
// GOOD: Request dispatcher with path traversal check
8181
protected void doHead3(HttpServletRequest request, HttpServletResponse response)
8282
throws ServletException, IOException {
83-
String path = request.getParameter("path");
83+
String path = request.getParameter("path");
8484

8585
if (path.startsWith(BASE_PATH) && !path.contains("..")) {
8686
request.getServletContext().getRequestDispatcher(path).include(request, response);
@@ -110,7 +110,7 @@ protected void doHead5(HttpServletRequest request, HttpServletResponse response)
110110
Path requestedPath = Paths.get(BASE_PATH).resolve(path).normalize();
111111

112112
if (!requestedPath.startsWith("/WEB-INF") && !requestedPath.startsWith("/META-INF")) {
113-
request.getServletContext().getRequestDispatcher(requestedPath.toString()).forward(request, response);
113+
request.getServletContext().getRequestDispatcher(requestedPath.toString()).forward(request, response); // $ MISSING: hasUnsafeUrlForward
114114
}
115115
}
116116

0 commit comments

Comments
 (0)