Skip to content

Commit 8e53da2

Browse files
d10cd10c
committed
Java: convert XSS test to .qlref
1 parent 199eabd commit 8e53da2

File tree

7 files changed

+424
-102
lines changed

7 files changed

+424
-102
lines changed

‎java/ql/test/query-tests/security/CWE-079/semmle/tests/JaxXSS.java

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -12,25 +12,25 @@
1212
public class JaxXSS {
1313

1414
@GET
15-
public static Response specificContentType(boolean safeContentType, boolean chainDirectly, boolean contentTypeFirst, String userControlled) {
15+
public static Response specificContentType(boolean safeContentType, boolean chainDirectly, boolean contentTypeFirst, String userControlled) { // $ Source
1616

1717
Response.ResponseBuilder builder = Response.ok();
1818

1919
if(!safeContentType) {
2020
if(chainDirectly) {
2121
if(contentTypeFirst)
22-
return builder.type(MediaType.TEXT_HTML).entity(userControlled).build(); // $ xss
22+
return builder.type(MediaType.TEXT_HTML).entity(userControlled).build(); // $ Alert
2323
else
24-
return builder.entity(userControlled).type(MediaType.TEXT_HTML).build(); // $ xss
24+
return builder.entity(userControlled).type(MediaType.TEXT_HTML).build(); // $ Alert
2525
}
2626
else {
2727
if(contentTypeFirst) {
2828
Response.ResponseBuilder builder2 = builder.type(MediaType.TEXT_HTML);
29-
return builder2.entity(userControlled).build(); // $ xss
29+
return builder2.entity(userControlled).build(); // $ Alert
3030
}
3131
else {
3232
Response.ResponseBuilder builder2 = builder.entity(userControlled);
33-
return builder2.type(MediaType.TEXT_HTML).build(); // $ xss
33+
return builder2.type(MediaType.TEXT_HTML).build(); // $ Alert
3434
}
3535
}
3636
}
@@ -56,7 +56,7 @@ public static Response specificContentType(boolean safeContentType, boolean chai
5656
}
5757

5858
@GET
59-
public static Response specificContentTypeSetterMethods(int route, boolean safeContentType, String userControlled) {
59+
public static Response specificContentTypeSetterMethods(int route, boolean safeContentType, String userControlled) { // $ Source
6060

6161
// Test the remarkably many routes to setting a content-type in Jax-RS, besides the ResponseBuilder.entity method used above:
6262

@@ -105,39 +105,39 @@ else if(route == 8) {
105105
else {
106106
if(route == 0) {
107107
// via ok, as a string literal:
108-
return Response.ok("text/html").entity(userControlled).build(); // $ xss
108+
return Response.ok("text/html").entity(userControlled).build(); // $ Alert
109109
}
110110
else if(route == 1) {
111111
// via ok, as a string constant:
112-
return Response.ok(MediaType.TEXT_HTML).entity(userControlled).build(); // $ xss
112+
return Response.ok(MediaType.TEXT_HTML).entity(userControlled).build(); // $ Alert
113113
}
114114
else if(route == 2) {
115115
// via ok, as a MediaType constant:
116-
return Response.ok(MediaType.TEXT_HTML_TYPE).entity(userControlled).build(); // $ xss
116+
return Response.ok(MediaType.TEXT_HTML_TYPE).entity(userControlled).build(); // $ Alert
117117
}
118118
else if(route == 3) {
119119
// via ok, as a Variant, via constructor:
120-
return Response.ok(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).entity(userControlled).build(); // $ xss
120+
return Response.ok(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).entity(userControlled).build(); // $ Alert
121121
}
122122
else if(route == 4) {
123123
// via ok, as a Variant, via static method:
124-
return Response.ok(Variant.mediaTypes(MediaType.TEXT_HTML_TYPE).build()).entity(userControlled).build(); // $ xss
124+
return Response.ok(Variant.mediaTypes(MediaType.TEXT_HTML_TYPE).build()).entity(userControlled).build(); // $ Alert
125125
}
126126
else if(route == 5) {
127127
// via ok, as a Variant, via instance method:
128-
return Response.ok(Variant.languages(Locale.UK).mediaTypes(MediaType.TEXT_HTML_TYPE).build()).entity(userControlled).build(); // $ xss
128+
return Response.ok(Variant.languages(Locale.UK).mediaTypes(MediaType.TEXT_HTML_TYPE).build()).entity(userControlled).build(); // $ Alert
129129
}
130130
else if(route == 6) {
131131
// via builder variant, before entity:
132-
return Response.ok().variant(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).entity(userControlled).build(); // $ xss
132+
return Response.ok().variant(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).entity(userControlled).build(); // $ Alert
133133
}
134134
else if(route == 7) {
135135
// via builder variant, after entity:
136-
return Response.ok().entity(userControlled).variant(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).build(); // $ xss
136+
return Response.ok().entity(userControlled).variant(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).build(); // $ Alert
137137
}
138138
else if(route == 8) {
139139
// provide entity via ok, then content-type via builder:
140-
return Response.ok(userControlled).type(MediaType.TEXT_HTML_TYPE).build(); // $ xss
140+
return Response.ok(userControlled).type(MediaType.TEXT_HTML_TYPE).build(); // $ Alert
141141
}
142142
}
143143

@@ -161,28 +161,28 @@ public static Response methodContentTypeSafeStringLiteral(String userControlled)
161161
}
162162

163163
@GET @Produces(MediaType.TEXT_HTML)
164-
public static Response methodContentTypeUnsafe(String userControlled) {
165-
return Response.ok(userControlled).build(); // $ xss
164+
public static Response methodContentTypeUnsafe(String userControlled) { // $ Source
165+
return Response.ok(userControlled).build(); // $ Alert
166166
}
167167

168168
@POST @Produces(MediaType.TEXT_HTML)
169-
public static Response methodContentTypeUnsafePost(String userControlled) {
170-
return Response.ok(userControlled).build(); // $ xss
169+
public static Response methodContentTypeUnsafePost(String userControlled) { // $ Source
170+
return Response.ok(userControlled).build(); // $ Alert
171171
}
172172

173173
@GET @Produces("text/html")
174-
public static Response methodContentTypeUnsafeStringLiteral(String userControlled) {
175-
return Response.ok(userControlled).build(); // $ xss
174+
public static Response methodContentTypeUnsafeStringLiteral(String userControlled) { // $ Source
175+
return Response.ok(userControlled).build(); // $ Alert
176176
}
177177

178178
@GET @Produces({MediaType.TEXT_HTML, MediaType.APPLICATION_JSON})
179-
public static Response methodContentTypeMaybeSafe(String userControlled) {
180-
return Response.ok(userControlled).build(); // $ xss
179+
public static Response methodContentTypeMaybeSafe(String userControlled) { // $ Source
180+
return Response.ok(userControlled).build(); // $ Alert
181181
}
182182

183183
@GET @Produces(MediaType.APPLICATION_JSON)
184-
public static Response methodContentTypeSafeOverriddenWithUnsafe(String userControlled) {
185-
return Response.ok().type(MediaType.TEXT_HTML).entity(userControlled).build(); // $ xss
184+
public static Response methodContentTypeSafeOverriddenWithUnsafe(String userControlled) { // $ Source
185+
return Response.ok().type(MediaType.TEXT_HTML).entity(userControlled).build(); // $ Alert
186186
}
187187

188188
@GET @Produces(MediaType.TEXT_HTML)
@@ -204,27 +204,27 @@ public String testDirectReturn(String userControlled) {
204204
}
205205

206206
@GET @Produces({"text/html"})
207-
public Response overridesWithUnsafe(String userControlled) {
208-
return Response.ok(userControlled).build(); // $ xss
207+
public Response overridesWithUnsafe(String userControlled) { // $ Source
208+
return Response.ok(userControlled).build(); // $ Alert
209209
}
210210

211211
@GET
212-
public Response overridesWithUnsafe2(String userControlled) {
213-
return Response.ok().type(MediaType.TEXT_HTML).entity(userControlled).build(); // $ xss
212+
public Response overridesWithUnsafe2(String userControlled) { // $ Source
213+
return Response.ok().type(MediaType.TEXT_HTML).entity(userControlled).build(); // $ Alert
214214
}
215215
}
216216

217217
@Path("/abc")
218218
@Produces({"text/html"})
219219
public static class ClassContentTypeUnsafe {
220220
@GET
221-
public Response test(String userControlled) {
222-
return Response.ok(userControlled).build(); // $ xss
221+
public Response test(String userControlled) { // $ Source
222+
return Response.ok(userControlled).build(); // $ Alert
223223
}
224224

225225
@GET
226-
public String testDirectReturn(String userControlled) {
227-
return userControlled; // $ xss
226+
public String testDirectReturn(String userControlled) { // $ Source
227+
return userControlled; // $ Alert
228228
}
229229

230230
@GET @Produces({"application/json"})
@@ -239,13 +239,13 @@ public Response overridesWithSafe2(String userControlled) {
239239
}
240240

241241
@GET
242-
public static Response entityWithNoMediaType(String userControlled) {
243-
return Response.ok(userControlled).build(); // $ xss
242+
public static Response entityWithNoMediaType(String userControlled) { // $ Source
243+
return Response.ok(userControlled).build(); // $ Alert
244244
}
245245

246246
@GET
247-
public static String stringWithNoMediaType(String userControlled) {
248-
return userControlled; // $ xss
247+
public static String stringWithNoMediaType(String userControlled) { // $ Source
248+
return userControlled; // $ Alert
249249
}
250250

251251
}

‎java/ql/test/query-tests/security/CWE-079/semmle/tests/JsfXSS.java

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@ public void encodeBegin(FacesContext facesContext, UIComponent component) throws
1818
{
1919
super.encodeBegin(facesContext, component);
2020

21-
Map<String, String> requestParameters = facesContext.getExternalContext().getRequestParameterMap();
21+
Map<String, String> requestParameters = facesContext.getExternalContext().getRequestParameterMap(); // $ Source
2222
String windowId = requestParameters.get("window_id");
2323

2424
ResponseWriter writer = facesContext.getResponseWriter();
2525
writer.write("<script type=\"text/javascript\">");
2626
writer.write("(function(){");
2727
writer.write("dswh.init('" + windowId + "','"
2828
+ "......" + "',"
29-
+ -1 + ",{"); // $ xss
29+
+ -1 + ",{"); // $ Alert
3030
writer.write("});");
3131
writer.write("})();");
3232
writer.write("</script>");
@@ -57,13 +57,13 @@ public void testAllSources(FacesContext facesContext) throws IOException
5757
{
5858
ExternalContext ec = facesContext.getExternalContext();
5959
ResponseWriter writer = facesContext.getResponseWriter();
60-
writer.write(ec.getRequestParameterMap().keySet().iterator().next()); // $ xss
61-
writer.write(ec.getRequestParameterNames().next()); // $ xss
62-
writer.write(ec.getRequestParameterValuesMap().get("someKey")[0]); // $ xss
63-
writer.write(ec.getRequestParameterValuesMap().keySet().iterator().next()); // $ xss
64-
writer.write(ec.getRequestPathInfo()); // $ xss
65-
writer.write(((Cookie)ec.getRequestCookieMap().get("someKey")).getName()); // $ xss
66-
writer.write(ec.getRequestHeaderMap().get("someKey")); // $ xss
67-
writer.write(ec.getRequestHeaderValuesMap().get("someKey")[0]); // $ xss
60+
writer.write(ec.getRequestParameterMap().keySet().iterator().next()); // $ Alert
61+
writer.write(ec.getRequestParameterNames().next()); // $ Alert
62+
writer.write(ec.getRequestParameterValuesMap().get("someKey")[0]); // $ Alert
63+
writer.write(ec.getRequestParameterValuesMap().keySet().iterator().next()); // $ Alert
64+
writer.write(ec.getRequestPathInfo()); // $ Alert
65+
writer.write(((Cookie)ec.getRequestCookieMap().get("someKey")).getName()); // $ Alert
66+
writer.write(ec.getRequestHeaderMap().get("someKey")); // $ Alert
67+
writer.write(ec.getRequestHeaderValuesMap().get("someKey")[0]); // $ Alert
6868
}
6969
}

‎java/ql/test/query-tests/security/CWE-079/semmle/tests/SpringXSS.java

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,17 @@
1313
public class SpringXSS {
1414

1515
@GetMapping
16-
public static ResponseEntity<String> specificContentType(boolean safeContentType, boolean chainDirectly, String userControlled) {
16+
public static ResponseEntity<String> specificContentType(boolean safeContentType, boolean chainDirectly, String userControlled) { // $ Source
1717

1818
ResponseEntity.BodyBuilder builder = ResponseEntity.ok();
1919

2020
if(!safeContentType) {
2121
if(chainDirectly) {
22-
return builder.contentType(MediaType.TEXT_HTML).body(userControlled); // $ xss
22+
return builder.contentType(MediaType.TEXT_HTML).body(userControlled); // $ Alert
2323
}
2424
else {
2525
ResponseEntity.BodyBuilder builder2 = builder.contentType(MediaType.TEXT_HTML);
26-
return builder2.body(userControlled); // $ xss
26+
return builder2.body(userControlled); // $ Alert
2727
}
2828
}
2929
else {
@@ -59,23 +59,23 @@ public static ResponseEntity<String> methodContentTypeSafeStringLiteral(String u
5959
}
6060

6161
@GetMapping(value = "/xyz", produces = MediaType.TEXT_HTML_VALUE)
62-
public static ResponseEntity<String> methodContentTypeUnsafe(String userControlled) {
63-
return ResponseEntity.ok(userControlled); // $ xss
62+
public static ResponseEntity<String> methodContentTypeUnsafe(String userControlled) { // $ Source
63+
return ResponseEntity.ok(userControlled); // $ Alert
6464
}
6565

6666
@GetMapping(value = "/xyz", produces = "text/html")
67-
public static ResponseEntity<String> methodContentTypeUnsafeStringLiteral(String userControlled) {
68-
return ResponseEntity.ok(userControlled); // $ xss
67+
public static ResponseEntity<String> methodContentTypeUnsafeStringLiteral(String userControlled) { // $ Source
68+
return ResponseEntity.ok(userControlled); // $ Alert
6969
}
7070

7171
@GetMapping(value = "/xyz", produces = {MediaType.TEXT_HTML_VALUE, MediaType.APPLICATION_JSON_VALUE})
72-
public static ResponseEntity<String> methodContentTypeMaybeSafe(String userControlled) {
73-
return ResponseEntity.ok(userControlled); // $ xss
72+
public static ResponseEntity<String> methodContentTypeMaybeSafe(String userControlled) { // $ Source
73+
return ResponseEntity.ok(userControlled); // $ Alert
7474
}
7575

7676
@GetMapping(value = "/xyz", produces = MediaType.APPLICATION_JSON_VALUE)
77-
public static ResponseEntity<String> methodContentTypeSafeOverriddenWithUnsafe(String userControlled) {
78-
return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(userControlled); // $ xss
77+
public static ResponseEntity<String> methodContentTypeSafeOverriddenWithUnsafe(String userControlled) { // $ Source
78+
return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(userControlled); // $ Alert
7979
}
8080

8181
@GetMapping(value = "/xyz", produces = MediaType.TEXT_HTML_VALUE)
@@ -84,17 +84,17 @@ public static ResponseEntity<String> methodContentTypeUnsafeOverriddenWithSafe(S
8484
}
8585

8686
@GetMapping(value = "/xyz", produces = {"text/html", "application/json"})
87-
public static ResponseEntity<String> methodContentTypeMaybeSafeStringLiterals(String userControlled, int constructionMethod) {
87+
public static ResponseEntity<String> methodContentTypeMaybeSafeStringLiterals(String userControlled, int constructionMethod) { // $ Source
8888
// Also try out some alternative constructors for the ResponseEntity:
8989
switch(constructionMethod) {
9090
case 0:
91-
return ResponseEntity.ok(userControlled); // $ xss
91+
return ResponseEntity.ok(userControlled); // $ Alert
9292
case 1:
93-
return ResponseEntity.of(Optional.of(userControlled)); // $ xss
93+
return ResponseEntity.of(Optional.of(userControlled)); // $ Alert
9494
case 2:
95-
return ResponseEntity.ok().body(userControlled); // $ xss
95+
return ResponseEntity.ok().body(userControlled); // $ Alert
9696
case 3:
97-
return new ResponseEntity<String>(userControlled, HttpStatus.OK); // $ xss
97+
return new ResponseEntity<String>(userControlled, HttpStatus.OK); // $ Alert
9898
default:
9999
return null;
100100
}
@@ -114,27 +114,27 @@ public String testDirectReturn(String userControlled) {
114114
}
115115

116116
@GetMapping(value = "/xyz", produces = {"text/html"})
117-
public ResponseEntity<String> overridesWithUnsafe(String userControlled) {
118-
return ResponseEntity.ok(userControlled); // $ xss
117+
public ResponseEntity<String> overridesWithUnsafe(String userControlled) { // $ Source
118+
return ResponseEntity.ok(userControlled); // $ Alert
119119
}
120120

121121
@GetMapping(value = "/abc")
122-
public ResponseEntity<String> overridesWithUnsafe2(String userControlled) {
123-
return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(userControlled); // $ xss
122+
public ResponseEntity<String> overridesWithUnsafe2(String userControlled) { // $ Source
123+
return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(userControlled); // $ Alert
124124
}
125125
}
126126

127127
@RestController
128128
@RequestMapping(produces = {"text/html"})
129129
private static class ClassContentTypeUnsafe {
130130
@GetMapping(value = "/abc")
131-
public ResponseEntity<String> test(String userControlled) {
132-
return ResponseEntity.ok(userControlled); // $ xss
131+
public ResponseEntity<String> test(String userControlled) { // $ Source
132+
return ResponseEntity.ok(userControlled); // $ Alert
133133
}
134134

135135
@GetMapping(value = "/abc")
136-
public String testDirectReturn(String userControlled) {
137-
return userControlled; // $ xss
136+
public String testDirectReturn(String userControlled) { // $ Source
137+
return userControlled; // $ Alert
138138
}
139139

140140
@GetMapping(value = "/xyz", produces = {"application/json"})
@@ -149,13 +149,13 @@ public ResponseEntity<String> overridesWithSafe2(String userControlled) {
149149
}
150150

151151
@GetMapping(value = "/abc")
152-
public static ResponseEntity<String> entityWithNoMediaType(String userControlled) {
153-
return ResponseEntity.ok(userControlled); // $ xss
152+
public static ResponseEntity<String> entityWithNoMediaType(String userControlled) { // $ Source
153+
return ResponseEntity.ok(userControlled); // $ Alert
154154
}
155155

156156
@GetMapping(value = "/abc")
157-
public static String stringWithNoMediaType(String userControlled) {
158-
return userControlled; // $ xss
157+
public static String stringWithNoMediaType(String userControlled) { // $ Source
158+
return userControlled; // $ Alert
159159
}
160160

161161
@GetMapping(value = "/abc")

0 commit comments

Comments
 (0)