Skip to content

Commit 3ea1af3

Browse files
atorralbaatorralba
committed
Refactor into separate libraries
1 parent 7f15177 commit 3ea1af3

File tree

6 files changed

+299
-61
lines changed

6 files changed

+299
-61
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ private module Frameworks {
9292
private import semmle.code.java.frameworks.JaxWS
9393
private import semmle.code.java.frameworks.JoddJson
9494
private import semmle.code.java.frameworks.JsonJava
95+
private import semmle.code.java.frameworks.Logging
9596
private import semmle.code.java.frameworks.Objects
9697
private import semmle.code.java.frameworks.Optional
9798
private import semmle.code.java.frameworks.Stream

‎java/ql/lib/semmle/code/java/frameworks/Logging.qll

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
/** Provides classes and predicates to reason about logging. */
2+
3+
import java
4+
import semmle.code.java.dataflow.ExternalFlow
5+
6+
private class LoggingSummaryModels extends SummaryModelCsv {
7+
override predicate row(string row) {
8+
row =
9+
[
10+
"org.apache.logging.log4j;Logger;true;entry;(Object[]);;Argument[0];ReturnValue;taint",
11+
"org.apache.logging.log4j;Logger;true;traceEntry;(Message);;Argument[0];ReturnValue;taint",
12+
"org.apache.logging.log4j;Logger;true;traceEntry;(String,Object[]);;Argument[0..1];ReturnValue;taint",
13+
"org.apache.logging.log4j;Logger;true;traceEntry;(String,Supplier);;Argument[0..1];ReturnValue;taint",
14+
"org.apache.logging.log4j;Logger;true;traceEntry;(Supplier);;Argument[0];ReturnValue;taint",
15+
"org.apache.logging.log4j;Logger;true;traceExit;(EntryMessage,Object);;Argument[1];ReturnValue;value",
16+
"org.apache.logging.log4j;Logger;true;traceExit;(Message,Object);;Argument[1];ReturnValue;value",
17+
"org.apache.logging.log4j;Logger;true;traceExit;(Object);;Argument[0];ReturnValue;value",
18+
"org.apache.logging.log4j;Logger;true;traceExit;(String,Object);;Argument[1];ReturnValue;value",
19+
"org.slf4j.spi.LoggingEventBuilder;true;addArgument;;;Argument[1];Argument[-1];taint",
20+
"org.slf4j.spi.LoggingEventBuilder;true;addArgument;;;Argument[-1];ReturnValue;value",
21+
"org.slf4j.spi.LoggingEventBuilder;true;addKeyValue;;;Argument[1];Argument[-1];taint",
22+
"org.slf4j.spi.LoggingEventBuilder;true;addKeyValue;;;Argument[-1];ReturnValue;value",
23+
"org.slf4j.spi.LoggingEventBuilder;true;addMarker;;;Argument[-1];ReturnValue;value",
24+
"org.slf4j.spi.LoggingEventBuilder;true;setCause;;;Argument[-1];ReturnValue;value",
25+
"java.util.logging;LogRecord;false;LogRecord;;;Argument[1];Argument[-1];taint"
26+
]
27+
}
28+
}
29+
30+
private string jBossLogger() { result = "org.jboss.logging;" + ["BasicLogger", "Logger"] }
31+
32+
private class LoggingSinkModels extends SinkModelCsv {
33+
override predicate row(string row) {
34+
row =
35+
[
36+
// org.apache.log4j.Category
37+
"org.apache.log4j;Category;true;assertLog;;;Argument[1];logging",
38+
"org.apache.log4j;Category;true;debug;;;Argument[0];logging",
39+
"org.apache.log4j;Category;true;error;;;Argument[0];logging",
40+
"org.apache.log4j;Category;true;fatal;;;Argument[0];logging",
41+
"org.apache.log4j;Category;true;forcedLog;;;Argument[2];logging",
42+
"org.apache.log4j;Category;true;info;;;Argument[0];logging",
43+
"org.apache.log4j;Category;true;l7dlog;(Priority,String,Object[],Throwable);;Argument[2];logging",
44+
"org.apache.log4j;Category;true;log;(Priority,Object);;Argument[1];logging",
45+
"org.apache.log4j;Category;true;log;(String,Priority,Object,Throwable);;Argument[2];logging",
46+
"org.apache.log4j;Category;true;warn;;;Argument[0];logging",
47+
// org.apache.logging.log4j.Logger
48+
"org.apache.logging.log4j;Logger;true;" +
49+
[["debug", "error", "fatal", "info", "trace", "warn"] + ";(", "log;(Level,"] +
50+
[
51+
"CharSequence);;Argument[0];logging", "CharSequence,Throwable);;Argument[0];logging",
52+
"Marker,CharSequence);;Argument[1];logging",
53+
"Marker,CharSequence,Throwable);;Argument[1];logging",
54+
"Marker,Message);;Argument[1];logging", "Marker,MessageSupplier);;Argument[1];logging",
55+
"Marker,MessageSupplier,Throwable);;Argument[1];logging",
56+
"Marker,Object);;Argument[1];logging", "Marker,Object,Throwable);;Argument[1];logging",
57+
"Marker,String);;Argument[1];logging",
58+
"Marker,String,Object[]);;Argument[1..2];logging",
59+
"Marker,String,Object);;Argument[1..2];logging",
60+
"Marker,String,Object,Object);;Argument[1..3];logging",
61+
"Marker,String,Object,Object,Object);;Argument[1..4];logging",
62+
"Marker,String,Object,Object,Object,Object);;Argument[1..5];logging",
63+
"Marker,String,Object,Object,Object,Object,Object);;Argument[1..6];logging",
64+
"Marker,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];logging",
65+
"Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];logging",
66+
"Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];logging",
67+
"Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];logging",
68+
"Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];logging",
69+
"Marker,String,Supplier);;Argument[1..2];logging",
70+
"Marker,String,Throwable);;Argument[1];logging",
71+
"Marker,Supplier);;Argument[1];logging",
72+
"Marker,Supplier,Throwable);;Argument[1];logging", ";(Message);;Argument[0];logging",
73+
"MessageSupplier);;Argument[0];logging",
74+
"MessageSupplier,Throwable);;Argument[0];logging",
75+
"Message,Throwable);;Argument[0];logging", ";(Object);;Argument[0];logging",
76+
"Object,Throwable);;Argument[0];logging", ";(String);;Argument[0];logging",
77+
"String,Object[]);;Argument[0..1];logging", "String,Object);;Argument[0..1];logging",
78+
"String,Object,Object);;Argument[0..2];logging",
79+
"String,Object,Object,Object);;Argument[0..3];logging",
80+
"String,Object,Object,Object,Object);;Argument[0..4];logging",
81+
"String,Object,Object,Object,Object,Object);;Argument[0..5];logging",
82+
"String,Object,Object,Object,Object,Object,Object);;Argument[0..6];logging",
83+
"String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];logging",
84+
"String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];logging",
85+
"String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];logging",
86+
"String,Supplier);;Argument[0..1];logging", "String,Throwable);;Argument[0];logging",
87+
"Supplier);;Argument[0];logging", "Supplier,Throwable);;Argument[0];logging"
88+
], "org.apache.logging.log4j;Logger;true;entry;(Object[]);;Argument[0];logging",
89+
"org.apache.logging.log4j;Logger;true;logMessage;(Level,Marker,String,StackTraceElement,Message,Throwable);;Argument[4];logging",
90+
"org.apache.logging.log4j;Logger;true;printf;(Level,Marker,String,Object[]);;Argument[2..3];logging",
91+
"org.apache.logging.log4j;Logger;true;printf;(Level,String,Object[]);;Argument[1..2];logging",
92+
"org.apache.logging.log4j;Logger;true;traceEntry;(Message);;Argument[0];logging",
93+
"org.apache.logging.log4j;Logger;true;traceEntry;(String,Object[]);;Argument[0..1];logging",
94+
"org.apache.logging.log4j;Logger;true;traceEntry;(String,Supplier);;Argument[0..1];logging",
95+
"org.apache.logging.log4j;Logger;true;traceEntry;(Supplier);;Argument[0];logging",
96+
"org.apache.logging.log4j;Logger;true;traceExit;(EntryMessage);;Argument[0];logging",
97+
"org.apache.logging.log4j;Logger;true;traceExit;(EntryMessage,Object);;Argument[0..1];logging",
98+
"org.apache.logging.log4j;Logger;true;traceExit;(Message,Object);;Argument[0..1];logging",
99+
"org.apache.logging.log4j;Logger;true;traceExit;(Object);;Argument[0];logging",
100+
"org.apache.logging.log4j;Logger;true;traceExit;(String,Object);;Argument[0..1];logging",
101+
// org.apache.logging.log4j.LogBuilder
102+
"org.apache.logging.log4j;LogBuilder;true;log;(CharSequence);;Argument[0];logging",
103+
"org.apache.logging.log4j;LogBuilder;true;log;(Message);;Argument[0];logging",
104+
"org.apache.logging.log4j;LogBuilder;true;log;(Object);;Argument[0];logging",
105+
"org.apache.logging.log4j;LogBuilder;true;log;(String);;Argument[0];logging",
106+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object[]);;Argument[0..1];logging",
107+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object);;Argument[0..1];logging",
108+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object);;Argument[0..2];logging",
109+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object);;Argument[0..3];logging",
110+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object);;Argument[0..4];logging",
111+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object);;Argument[0..5];logging",
112+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];logging",
113+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];logging",
114+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];logging",
115+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];logging",
116+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];logging",
117+
"org.apache.logging.log4j;LogBuilder;true;log;(String,Supplier);;Argument[0..1];logging",
118+
"org.apache.logging.log4j;LogBuilder;true;log;(Supplier);;Argument[0];logging",
119+
// org.apache.commons.logging.Log
120+
"org.apache.commons.logging;Log;true;" +
121+
["debug", "error", "fatal", "info", "trace", "warn"] + ";;;Argument[0];logging",
122+
// org.jboss.logging.BasicLogger and org.jboss.logging.Logger
123+
// (org.jboss.logging.Logger does not implement BasicLogger in some implementations like JBoss Application Server 4.0.4)
124+
jBossLogger() + ";true;" +
125+
[["debug", "error", "fatal", "info", "trace", "warn"] + ";(", "log;(Level,"] +
126+
[
127+
"Object);;Argument[0];logging", ";(Object,Object[]);;Argument[0..1];logging",
128+
"Object,Object[],Throwable);;Argument[0..1];logging",
129+
"Object,Throwable);;Argument[0];logging",
130+
"String,Object,Object[],Throwable);;Argument[1..2];logging",
131+
"String,Object,Throwable);;Argument[1];logging"
132+
],
133+
jBossLogger() + ";true;log;(String,Level,Object,Object[],Throwable);;Argument[2..3];logging",
134+
jBossLogger() + ";true;" +
135+
[
136+
["debug", "error", "fatal", "info", "trace", "warn"] + ["f", "v"] + ";(",
137+
"log" + ["f", "v"] + ";(Level,"
138+
] +
139+
[
140+
"String,Object[]);;Argument[0..1];logging", "String,Object);;Argument[0..1];logging",
141+
"String,Object,Object);;Argument[0..2];logging",
142+
"String,Object,Object,Object);;Argument[0..3];logging",
143+
"String,Object,Object,Object,Object);;Argument[0..4];logging",
144+
"Throwable,String,Object);;Argument[1..2];logging",
145+
"Throwable,String,Object,Object);;Argument[1..3];logging",
146+
"Throwable,String,Object,Object,Object);;Argument[0..4];logging",
147+
],
148+
jBossLogger() + ";true;log" + ["f", "v"] +
149+
[
150+
";(String,Level,Throwable,String,Object[]);;Argument[3..4];logging",
151+
";(String,Level,Throwable,String,Object);;Argument[3..4];logging",
152+
";(String,Level,Throwable,String,Object,Object);;Argument[3..5];logging",
153+
";(String,Level,Throwable,String,Object,Object,Object);;Argument[3..6];logging"
154+
],
155+
// org.slf4j.spi.LoggingEventBuilder
156+
"org.slf4j.spi;LoggingEventBuilder;true;log;;;Argument[0];logging",
157+
"org.slf4j.spi;LoggingEventBuilder;true;log;(String,Object);;Argument[1];logging",
158+
"org.slf4j.spi;LoggingEventBuilder;true;log;(String,Object[]);;Argument[1];logging",
159+
"org.slf4j.spi;LoggingEventBuilder;true;log;(String,Object,Object);;Argument[1..2];logging",
160+
"org.slf4j;Logger;true;" + ["debug", "error", "info", "trace", "warn"] +
161+
[
162+
";(String);;Argument[0];logging", ";(String,Object);;Argument[0..1];logging",
163+
";(String,Object[]);;Argument[0..1];logging",
164+
";(String,Object,Object);;Argument[0..2];logging",
165+
";(String,Throwable);;Argument[0];logging", ";(Marker,String);;Argument[1];logging",
166+
";(Marker,String,Object);;Argument[1..2];logging",
167+
";(Marker,String,Object[]);;Argument[1..2];logging",
168+
";(Marker,String,Object[],Object);;Argument[1..3];logging",
169+
";(Marker,String,Object[],Object,Object);;Argument[1..4];logging"
170+
],
171+
// org.slf4j.Logger
172+
"org.scijava.log;Logger;true;alwaysLog;(int,Object,Throwable);;Argument[1];logging",
173+
"org.scijava.log;Logger;true;" +
174+
[["debug", "error", "info", "trace", "warn"] + ";(", "log;(int,"] +
175+
["Object);;Argument[0];logging", "Object,Throwable);;Argument[0];logging"],
176+
// com.google.common.flogger.LoggingApi
177+
"com.google.common.flogger;LoggingApi;true;log;" +
178+
[
179+
";;;Argument[0];logging", "(String,Object);;Argument[1]",
180+
"(String,Object,Object);;Argument[1..2]",
181+
"(String,Object,Object,Object);;Argument[1..3]", "(String,Object,boolean);;Argument[1]",
182+
"(String,Object,char);;Argument[1]", "(String,Object,byte);;Argument[1]",
183+
"(String,Object,short);;Argument[1]", "(String,Object,int);;Argument[1]",
184+
"(String,Object,long);;Argument[1]", "(String,Object,float);;Argument[1]",
185+
"(String,Object,double);;Argument[1]", "(String,boolean,Object);;Argument[2]",
186+
"(String,char,Object);;Argument[2]", "(String,byte,Object);;Argument[2]",
187+
"(String,short,Object);;Argument[2]", "(String,int,Object);;Argument[2]",
188+
"(String,long,Object);;Argument[2]", "(String,float,Object);;Argument[2]",
189+
"(String,double,Object);;Argument[2]"
190+
] + ";logging",
191+
// java.lang.System$Logger
192+
"java.lang;System$Logger;true;log;" +
193+
[
194+
"(Level,Object);;Argument[1]", "(Level,String);;Argument[1]",
195+
"(Level,String,Object[]);;Argument[1..2]", "(Level,String,Throwable);;Argument[1]",
196+
"(Level,String,Supplier);;Argument[1..2]",
197+
"(Level,String,Supplier,Throwable);;Argument[1..2]",
198+
"(Level,ResourceBundle,String,Object[]);;Argument[2..3]",
199+
"(Level,ResourceBundle,String,Throwable);;Argument[2]"
200+
] + ";logging",
201+
// java.util.logging.Logger
202+
"java.util.logging;Logger;true;" +
203+
["config", "fine", "finer", "finest", "info", "severe", "warning"] +
204+
";;;Argument[0];logging",
205+
"java.util.logging;Logger;true;entering;(String,String);;Argument[0..1];logging",
206+
"java.util.logging;Logger;true;entering;(String,String,Object);;Argument[0..2];logging",
207+
"java.util.logging;Logger;true;entering;(String,String,Object[]);;Argument[0..2];logging",
208+
"java.util.logging;Logger;true;exiting;(String,String);;Argument[0..1];logging",
209+
"java.util.logging;Logger;true;exiting;(String,String,Object);;Argument[0..2];logging",
210+
"java.util.logging;Logger;true;log;(Level,String);;Argument[1];logging",
211+
"java.util.logging;Logger;true;log;(Level,String,Object);;Argument[1..2];logging",
212+
"java.util.logging;Logger;true;log;(Level,String,Object[]);;Argument[1..2];logging",
213+
"java.util.logging;Logger;true;log;(Level,String,Throwable);;Argument[1];logging",
214+
"java.util.logging;Logger;true;log;(Level,Supplier);;Argument[1];logging",
215+
"java.util.logging;Logger;true;log;(Level,Throwable,Supplier);;Argument[2];logging",
216+
"java.util.logging;Logger;true;log;(LogRecord);;Argument[1];logging",
217+
"java.util.logging;Logger;true;logp;(Level,String,String,String);;Argument[1..3];logging",
218+
"java.util.logging;Logger;true;logp;(Level,String,String,String,Object);;Argument[1..4];logging",
219+
"java.util.logging;Logger;true;logp;(Level,String,String,String,Object[]);;Argument[1..4];logging",
220+
"java.util.logging;Logger;true;logp;(Level,String,String,String,Object[]);;Argument[1..4];logging",
221+
"java.util.logging;Logger;true;logp;(Level,String,String,String,Throwable);;Argument[1..3];logging",
222+
"java.util.logging;Logger;true;logp;(Level,String,String,Supplier);;Argument[1..3];logging",
223+
"java.util.logging;Logger;true;logp;(Level,String,String,Throwable,Supplier);;Argument[1..2];logging",
224+
"java.util.logging;Logger;true;logp;(Level,String,String,Throwable,Supplier);;Argument[4];logging",
225+
"java.util.logging;Logger;true;logrb;(Level,String,String,ResourceBundle,String,Object[]);;Argument[1..2];logging",
226+
"java.util.logging;Logger;true;logrb;(Level,String,String,ResourceBundle,String,Object[]);;Argument[4..5];logging",
227+
"java.util.logging;Logger;true;logrb;(Level,String,String,ResourceBundle,String,Throwable);;Argument[1..2];logging",
228+
"java.util.logging;Logger;true;logrb;(Level,String,String,ResourceBundle,String,Throwable);;Argument[3];logging",
229+
"java.util.logging;Logger;true;logrb;(Level,String,String,String,String);;Argument[1..4];logging",
230+
"java.util.logging;Logger;true;logrb;(Level,String,String,String,String,Object);;Argument[1..5];logging",
231+
"java.util.logging;Logger;true;logrb;(Level,String,String,String,String,Object[]);;Argument[1..5];logging",
232+
"java.util.logging;Logger;true;logrb;(Level,String,String,String,String,Throwable);;Argument[1..4];logging",
233+
// android.util.Log
234+
"android.util;Log;true;" + ["d", "v", "i", "w", "e", "wtf"] + ";;;Argument[1];logging"
235+
]
236+
}
237+
}

‎java/ql/lib/semmle/code/java/security/LogInjection.qll

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/** Provides classes and predicates related to Log Injection vulnerabilities. */
2+
3+
import java
4+
import semmle.code.java.dataflow.DataFlow
5+
import semmle.code.java.dataflow.ExternalFlow
6+
7+
/** A data flow sink for unvalidated user input that is used to log messages. */
8+
abstract class LogInjectionSink extends DataFlow::Node { }
9+
10+
/**
11+
* A node that sanitizes a message before logging to avoid log injection.
12+
*/
13+
abstract class LogInjectionSanitizer extends DataFlow::Node { }
14+
15+
/**
16+
* A unit class for adding additional taint steps.
17+
*
18+
* Extend this class to add additional taint steps that should apply to the `LogInjectionConfiguration`.
19+
*/
20+
class LogInjectionAdditionalTaintStep extends Unit {
21+
/**
22+
* Holds if the step from `node1` to `node2` should be considered a taint
23+
* step for the `LogInjectionConfiguration` configuration.
24+
*/
25+
abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
26+
}
27+
28+
private class DefaultLogInjectionSink extends LogInjectionSink {
29+
DefaultLogInjectionSink() { sinkNode(this, "logging") }
30+
}
31+
32+
private class DefaultLogInjectionSanitizer extends LogInjectionSanitizer {
33+
DefaultLogInjectionSanitizer() {
34+
this.getType() instanceof BoxedType or this.getType() instanceof PrimitiveType
35+
}
36+
}

0 commit comments

Comments
 (0)