Skip to content

Commit acb2bbb

Browse files
michaelnebelmichaelnebel
committed
Java: Identify more APIs as supported in the telemetry queries (as QL defined sources).
1 parent 06f987a commit acb2bbb

11 files changed

+143
-23
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ApiSources.qll

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
/** Provides classes representing various flow sources for data flow / taint tracking. */
2+
3+
private import semmle.code.java.dataflow.DataFlow
4+
private import semmle.code.java.dataflow.ExternalFlow
5+
6+
/**
7+
* A data flow source node.
8+
*/
9+
abstract class SourceNode extends DataFlow::Node { }
10+
11+
/**
12+
* Module that adds all API like sources to `SourceNode`, excluding some sources for cryptography based
13+
* queries, and queries where sources are not succifiently defined (eg. using broad method name matching).
14+
*/
15+
private module ApiSources {
16+
private import FlowSources as FlowSources
17+
private import semmle.code.java.security.ArbitraryApkInstallation as ArbitraryApkInstallation
18+
private import semmle.code.java.security.CleartextStorageAndroidDatabaseQuery as CleartextStorageAndroidDatabaseQuery
19+
private import semmle.code.java.security.CleartextStorageAndroidFilesystemQuery as CleartextStorageAndroidFilesystemQuery
20+
private import semmle.code.java.security.CleartextStorageCookieQuery as CleartextStorageCookieQuery
21+
private import semmle.code.java.security.CleartextStorageSharedPrefsQuery as CleartextStorageSharedPrefsQuery
22+
private import semmle.code.java.security.ImplicitPendingIntentsQuery as ImplicitPendingIntentsQuery
23+
private import semmle.code.java.security.ImproperIntentVerificationQuery as ImproperIntentVerificationQuery
24+
private import semmle.code.java.security.InsecureTrustManager as InsecureTrustManager
25+
private import semmle.code.java.security.JWT as Jwt
26+
private import semmle.code.java.security.StackTraceExposureQuery as StackTraceExposureQuery
27+
private import semmle.code.java.security.ZipSlipQuery as ZipSlipQuery
28+
29+
private class FlowSourcesSourceNode extends SourceNode instanceof FlowSources::SourceNode { }
30+
31+
private class ArbitraryApkInstallationSources extends SourceNode instanceof ArbitraryApkInstallation::ExternalApkSource
32+
{ }
33+
34+
private class CleartextStorageAndroidDatabaseQuerySources extends SourceNode instanceof CleartextStorageAndroidDatabaseQuery::LocalDatabaseOpenMethodCallSource
35+
{ }
36+
37+
private class CleartextStorageAndroidFilesystemQuerySources extends SourceNode instanceof CleartextStorageAndroidFilesystemQuery::LocalFileOpenCallSource
38+
{ }
39+
40+
private class CleartextStorageCookieQuerySources extends SourceNode instanceof CleartextStorageCookieQuery::CookieSource
41+
{ }
42+
43+
private class CleartextStorageSharedPrefsQuerySources extends SourceNode instanceof CleartextStorageSharedPrefsQuery::SharedPreferencesEditorMethodCallSource
44+
{ }
45+
46+
private class ImplicitPendingIntentsQuerySources extends SourceNode instanceof ImplicitPendingIntentsQuery::ImplicitPendingIntentSource
47+
{ }
48+
49+
private class ImproperIntentVerificationQuerySources extends SourceNode instanceof ImproperIntentVerificationQuery::VerifiedIntentConfigSource
50+
{ }
51+
52+
private class InsecureTrustManagerSources extends SourceNode instanceof InsecureTrustManager::InsecureTrustManagerSource
53+
{ }
54+
55+
private class JwtSources extends SourceNode instanceof Jwt::JwtParserWithInsecureParseSource { }
56+
57+
private class StackTraceExposureQuerySources extends SourceNode instanceof StackTraceExposureQuery::GetMessageFlowSource
58+
{ }
59+
60+
private class ZipSlipQuerySources extends SourceNode instanceof ZipSlipQuery::ArchiveEntryNameMethodSource
61+
{ }
62+
63+
/**
64+
* Add all models as data sources.
65+
*/
66+
private class SourceNodeExternal extends SourceNode {
67+
SourceNodeExternal() { sourceNode(this, _) }
68+
}
69+
}

‎java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -194,15 +194,17 @@ private class AndroidExternalStorageSource extends RemoteFlowSource {
194194
}
195195

196196
/** Class for `tainted` user input. */
197-
abstract class UserInput extends DataFlow::Node { }
197+
abstract class UserInput extends SourceNode { }
198198

199199
/**
200200
* Input that may be controlled by a remote user.
201201
*/
202-
private class RemoteUserInput extends UserInput instanceof RemoteFlowSource { }
202+
private class RemoteUserInput extends UserInput instanceof RemoteFlowSource {
203+
override string getThreatModel() { result = RemoteFlowSource.super.getThreatModel() }
204+
}
203205

204206
/** A node with input that may be controlled by a local user. */
205-
abstract class LocalUserInput extends UserInput, SourceNode {
207+
abstract class LocalUserInput extends UserInput {
206208
override string getThreatModel() { result = "local" }
207209
}
208210

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,15 @@ private predicate localDatabaseStore(DataFlow::Node database, MethodCall store)
9696
)
9797
}
9898

99+
/**
100+
* A class of local database open method call source nodes.
101+
*/
102+
class LocalDatabaseOpenMethodCallSource extends DataFlow::Node {
103+
LocalDatabaseOpenMethodCallSource() { this.asExpr() instanceof LocalDatabaseOpenMethodCall }
104+
}
105+
99106
private module LocalDatabaseFlowConfig implements DataFlow::ConfigSig {
100-
predicate isSource(DataFlow::Node source) {
101-
source.asExpr() instanceof LocalDatabaseOpenMethodCall
102-
}
107+
predicate isSource(DataFlow::Node source) { source instanceof LocalDatabaseOpenMethodCallSource }
103108

104109
predicate isSink(DataFlow::Node sink) {
105110
localDatabaseInput(sink, _) or

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidFilesystemQuery.qll

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,15 @@ private class CloseFileMethod extends Method {
7979
}
8080
}
8181

82+
/**
83+
* A class of local file open call source nodes.
84+
*/
85+
class LocalFileOpenCallSource extends DataFlow::Node {
86+
LocalFileOpenCallSource() { this.asExpr() instanceof LocalFileOpenCall }
87+
}
88+
8289
private module FilesystemFlowConfig implements DataFlow::ConfigSig {
83-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof LocalFileOpenCall }
90+
predicate isSource(DataFlow::Node src) { src instanceof LocalFileOpenCallSource }
8491

8592
predicate isSink(DataFlow::Node sink) {
8693
filesystemInput(sink, _) or

‎java/ql/lib/semmle/code/java/security/CleartextStorageCookieQuery.qll

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,15 @@ private predicate cookieStore(DataFlow::Node cookie, Expr store) {
3737
)
3838
}
3939

40+
/**
41+
* A class of cookie source nodes.
42+
*/
43+
class CookieSource extends DataFlow::Node {
44+
CookieSource() { this.asExpr() instanceof Cookie }
45+
}
46+
4047
private module CookieToStoreFlowConfig implements DataFlow::ConfigSig {
41-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof Cookie }
48+
predicate isSource(DataFlow::Node src) { src instanceof CookieSource }
4249

4350
predicate isSink(DataFlow::Node sink) { cookieStore(sink, _) }
4451
}

‎java/ql/lib/semmle/code/java/security/CleartextStorageSharedPrefsQuery.qll

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,18 @@ private predicate sharedPreferencesStore(DataFlow::Node editor, MethodCall m) {
6767
editor.asExpr() = m.getQualifier().getUnderlyingExpr()
6868
}
6969

70+
/**
71+
* A shared preferences editor method call source nodes.
72+
*/
73+
class SharedPreferencesEditorMethodCallSource extends DataFlow::Node {
74+
SharedPreferencesEditorMethodCallSource() {
75+
this.asExpr() instanceof SharedPreferencesEditorMethodCall
76+
}
77+
}
78+
7079
/** Flow from `SharedPreferences.Editor` to either a setter or a store method. */
7180
private module SharedPreferencesFlowConfig implements DataFlow::ConfigSig {
72-
predicate isSource(DataFlow::Node src) {
73-
src.asExpr() instanceof SharedPreferencesEditorMethodCall
74-
}
81+
predicate isSource(DataFlow::Node src) { src instanceof SharedPreferencesEditorMethodCallSource }
7582

7683
predicate isSink(DataFlow::Node sink) {
7784
sharedPreferencesInput(sink, _) or

‎java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,18 @@ private class OnReceiveMethod extends Method {
1313
Parameter getIntentParameter() { result = this.getParameter(1) }
1414
}
1515

16+
/**
17+
* A class of verified intent source nodes.
18+
*/
19+
class VerifiedIntentConfigSource extends DataFlow::Node {
20+
VerifiedIntentConfigSource() {
21+
this.asParameter() = any(OnReceiveMethod orm).getIntentParameter()
22+
}
23+
}
24+
1625
/** A configuration to detect whether the `action` of an `Intent` is checked. */
1726
private module VerifiedIntentConfig implements DataFlow::ConfigSig {
18-
predicate isSource(DataFlow::Node src) {
19-
src.asParameter() = any(OnReceiveMethod orm).getIntentParameter()
20-
}
27+
predicate isSource(DataFlow::Node src) { src instanceof VerifiedIntentConfigSource }
2128

2229
predicate isSink(DataFlow::Node sink) {
2330
exists(MethodCall ma |

‎java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ private class PrintStackTraceMethod extends Method {
1919
}
2020

2121
private module ServletWriterSourceToPrintStackTraceMethodFlowConfig implements DataFlow::ConfigSig {
22-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof XssVulnerableWriterSource }
22+
predicate isSource(DataFlow::Node src) { src instanceof XssVulnerableWriterSourceNode }
2323

2424
predicate isSink(DataFlow::Node sink) {
2525
exists(MethodCall ma |
@@ -95,7 +95,10 @@ predicate stringifiedStackFlowsExternally(DataFlow::Node externalExpr, Expr stac
9595
)
9696
}
9797

98-
private class GetMessageFlowSource extends DataFlow::Node {
98+
/**
99+
* A class of get message source nodes.
100+
*/
101+
class GetMessageFlowSource extends DataFlow::Node {
99102
GetMessageFlowSource() {
100103
exists(Method method | this.asExpr().(MethodCall).getMethod() = method |
101104
method.hasName("getMessage") and

‎java/ql/lib/semmle/code/java/security/XSS.qll

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ private class DefaultXssSanitizer extends XssSanitizer {
6262

6363
/** A configuration that tracks data from a servlet writer to an output method. */
6464
private module XssVulnerableWriterSourceToWritingMethodFlowConfig implements DataFlow::ConfigSig {
65-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof XssVulnerableWriterSource }
65+
predicate isSource(DataFlow::Node src) { src instanceof XssVulnerableWriterSourceNode }
6666

6767
predicate isSink(DataFlow::Node sink) {
6868
exists(MethodCall ma |
@@ -105,6 +105,13 @@ class XssVulnerableWriterSource extends MethodCall {
105105
}
106106
}
107107

108+
/**
109+
* A class of xss vulnerable writer source nodes.
110+
*/
111+
class XssVulnerableWriterSourceNode extends DataFlow::Node {
112+
XssVulnerableWriterSourceNode() { this.asExpr() instanceof XssVulnerableWriterSource }
113+
}
114+
108115
/**
109116
* Holds if `s` is an HTTP Content-Type vulnerable to XSS.
110117
*/

‎java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,20 @@ private class ArchiveEntryNameMethod extends Method {
2121
}
2222
}
2323

24+
/**
25+
* A class of entry name method source nodes.
26+
*/
27+
class ArchiveEntryNameMethodSource extends DataFlow::Node {
28+
ArchiveEntryNameMethodSource() {
29+
this.asExpr().(MethodCall).getMethod() instanceof ArchiveEntryNameMethod
30+
}
31+
}
32+
2433
/**
2534
* A taint-tracking configuration for reasoning about unsafe zip file extraction.
2635
*/
2736
module ZipSlipConfig implements DataFlow::ConfigSig {
28-
predicate isSource(DataFlow::Node source) {
29-
source.asExpr().(MethodCall).getMethod() instanceof ArchiveEntryNameMethod
30-
}
37+
predicate isSource(DataFlow::Node source) { source instanceof ArchiveEntryNameMethodSource }
3138

3239
predicate isSink(DataFlow::Node sink) { sink instanceof FileCreationSink }
3340

0 commit comments

Comments
 (0)