Skip to content

Commit 9db32f4

Browse files
michaelnebelmichaelnebel
committed
Java: Identify more APIs as supported in the telemetry queries (as QL defined sinks).
1 parent acb2bbb commit 9db32f4

12 files changed

+232
-44
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ApiSinks.qll

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
/** Provides classes representing various flow sinks for data flow / taint tracking. */
2+
3+
private import semmle.code.java.dataflow.DataFlow
4+
private import semmle.code.java.dataflow.ExternalFlow
5+
6+
/**
7+
* A data flow sink node.
8+
*/
9+
abstract class SinkNode extends DataFlow::Node { }
10+
11+
/**
12+
* Module that adds all API like sinks to `SinkNode`, excluding sinks for cryptography based
13+
* queries, and queries where sinks are not succifiently defined (eg. using broad method name matching).
14+
*/
15+
private module ApiSinks {
16+
private import semmle.code.java.security.AndroidSensitiveCommunicationQuery as AndroidSensitiveCommunicationQuery
17+
private import semmle.code.java.security.ArbitraryApkInstallation as ArbitraryApkInstallation
18+
private import semmle.code.java.security.CleartextStorageAndroidDatabaseQuery as CleartextStorageAndroidDatabaseQuery
19+
private import semmle.code.java.security.CleartextStorageAndroidFilesystemQuery as CleartextStorageAndroidFilesystemQuery
20+
private import semmle.code.java.security.CleartextStorageCookieQuery as CleartextStorageCookieQuery
21+
private import semmle.code.java.security.CleartextStorageSharedPrefsQuery as CleartextStorageSharedPrefsQuery
22+
private import semmle.code.java.security.ExternallyControlledFormatStringQuery as ExternallyControlledFormatStringQuery
23+
private import semmle.code.java.security.InsecureBasicAuth as InsecureBasicAuth
24+
private import semmle.code.java.security.IntentUriPermissionManipulation as IntentUriPermissionManipulation
25+
private import semmle.code.java.security.InsecureLdapAuth as InsecureLdapAuth
26+
private import semmle.code.java.security.InsecureTrustManager as InsecureTrustManager
27+
private import semmle.code.java.security.JndiInjection as JndiInjection
28+
private import semmle.code.java.security.JWT as Jwt
29+
private import semmle.code.java.security.OgnlInjection as OgnlInjection
30+
private import semmle.code.java.security.SensitiveResultReceiverQuery as SensitiveResultReceiverQuery
31+
private import semmle.code.java.security.SensitiveUiQuery as SensitiveUiQuery
32+
private import semmle.code.java.security.SpelInjection as SpelInjection
33+
private import semmle.code.java.security.SpelInjectionQuery as SpelInjectionQuery
34+
private import semmle.code.java.security.QueryInjection as QueryInjection
35+
private import semmle.code.java.security.TempDirLocalInformationDisclosureQuery as TempDirLocalInformationDisclosureQuery
36+
private import semmle.code.java.security.UnsafeAndroidAccess as UnsafeAndroidAccess
37+
private import semmle.code.java.security.UnsafeContentUriResolution as UnsafeContentUriResolution
38+
private import semmle.code.java.security.UnsafeDeserializationQuery as UnsafeDeserializationQuery
39+
private import semmle.code.java.security.UrlRedirect as UrlRedirect
40+
private import semmle.code.java.security.WebviewDebuggingEnabledQuery as WebviewDebuggingEnabledQuery
41+
private import semmle.code.java.security.XPath as Xpath
42+
private import semmle.code.java.security.XSS as Xss
43+
44+
private class AndoidIntentRedirectionQuerySinks extends SinkNode instanceof AndroidSensitiveCommunicationQuery::SensitiveCommunicationSink
45+
{ }
46+
47+
private class ArbitraryApkInstallationSinks extends SinkNode instanceof ArbitraryApkInstallation::SetDataSink
48+
{ }
49+
50+
private class CleartextStorageAndroidDatabaseQuerySinks extends SinkNode instanceof CleartextStorageAndroidDatabaseQuery::LocalDatabaseSink
51+
{ }
52+
53+
private class CleartextStorageAndroidFilesystemQuerySinks extends SinkNode instanceof CleartextStorageAndroidFilesystemQuery::LocalFileSink
54+
{ }
55+
56+
private class CleartextStorageCookieQuerySinks extends SinkNode instanceof CleartextStorageCookieQuery::CookieStoreSink
57+
{ }
58+
59+
private class CleartextStorageSharedPrefsQuerySinks extends SinkNode instanceof CleartextStorageSharedPrefsQuery::SharedPreferencesSink
60+
{ }
61+
62+
private class ExternallyControlledFormatStringQuerySinks extends SinkNode instanceof ExternallyControlledFormatStringQuery::StringFormatSink
63+
{ }
64+
65+
private class InsecureBasicAuthSinks extends SinkNode instanceof InsecureBasicAuth::InsecureBasicAuthSink
66+
{ }
67+
68+
private class InsecureTrustManagerSinks extends SinkNode instanceof InsecureTrustManager::InsecureTrustManagerSink
69+
{ }
70+
71+
private class IntentUriPermissionManipulationSinks extends SinkNode instanceof IntentUriPermissionManipulation::IntentUriPermissionManipulationSink
72+
{ }
73+
74+
private class InsecureLdapAuthSinks extends SinkNode instanceof InsecureLdapAuth::InsecureLdapUrlSink
75+
{ }
76+
77+
private class JndiInjectionSinks extends SinkNode instanceof JndiInjection::JndiInjectionSink { }
78+
79+
private class JwtSinks extends SinkNode instanceof Jwt::JwtParserWithInsecureParseSink { }
80+
81+
private class OgnlInjectionSinks extends SinkNode instanceof OgnlInjection::OgnlInjectionSink { }
82+
83+
private class SensitiveResultReceiverQuerySinks extends SinkNode instanceof SensitiveResultReceiverQuery::SensitiveResultReceiverSink
84+
{ }
85+
86+
private class SensitiveUiQuerySinks extends SinkNode instanceof SensitiveUiQuery::TextFieldSink {
87+
}
88+
89+
private class SpelInjectionSinks extends SinkNode instanceof SpelInjection::SpelExpressionEvaluationSink
90+
{ }
91+
92+
private class QueryInjectionSinks extends SinkNode instanceof QueryInjection::QueryInjectionSink {
93+
}
94+
95+
private class TempDirLocalInformationDisclosureSinks extends SinkNode instanceof TempDirLocalInformationDisclosureQuery::MethodFileDirectoryCreationSink
96+
{ }
97+
98+
private class UnsafeAndroidAccessSinks extends SinkNode instanceof UnsafeAndroidAccess::UrlResourceSink
99+
{ }
100+
101+
private class UnsafeContentUriResolutionSinks extends SinkNode instanceof UnsafeContentUriResolution::ContentUriResolutionSink
102+
{ }
103+
104+
private class UnsafeDeserializationQuerySinks extends SinkNode instanceof UnsafeDeserializationQuery::UnsafeDeserializationSink
105+
{ }
106+
107+
private class UrlRedirectSinks extends SinkNode instanceof UrlRedirect::UrlRedirectSink { }
108+
109+
private class WebviewDebugEnabledQuery extends SinkNode instanceof WebviewDebuggingEnabledQuery::WebviewDebugSink
110+
{ }
111+
112+
private class XPathSinks extends SinkNode instanceof Xpath::XPathInjectionSink { }
113+
114+
private class XssSinks extends SinkNode instanceof Xss::XssSink { }
115+
116+
/**
117+
* Add all models as data sinks.
118+
*/
119+
private class SinkNodeExternal extends SinkNode {
120+
SinkNodeExternal() { sinkNode(this, _) }
121+
}
122+
}

‎java/ql/lib/semmle/code/java/security/AndroidSensitiveCommunicationQuery.qll

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -151,17 +151,24 @@ deprecated class SensitiveCommunicationConfig extends TaintTracking::Configurati
151151
}
152152
}
153153

154+
/**
155+
* A class of sensitive communication sink nodes.
156+
*/
157+
class SensitiveCommunicationSink extends DataFlow::Node {
158+
SensitiveCommunicationSink() {
159+
isSensitiveBroadcastSink(this)
160+
or
161+
isStartActivityOrServiceSink(this)
162+
}
163+
}
164+
154165
/**
155166
* Taint configuration tracking flow from variables containing sensitive information to broadcast Intents.
156167
*/
157168
module SensitiveCommunicationConfig implements DataFlow::ConfigSig {
158169
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SensitiveInfoExpr }
159170

160-
predicate isSink(DataFlow::Node sink) {
161-
isSensitiveBroadcastSink(sink)
162-
or
163-
isStartActivityOrServiceSink(sink)
164-
}
171+
predicate isSink(DataFlow::Node sink) { sink instanceof SensitiveCommunicationSink }
165172

166173
/**
167174
* Holds if broadcast doesn't specify receiving package name of the 3rd party app

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -103,13 +103,17 @@ class LocalDatabaseOpenMethodCallSource extends DataFlow::Node {
103103
LocalDatabaseOpenMethodCallSource() { this.asExpr() instanceof LocalDatabaseOpenMethodCall }
104104
}
105105

106+
/**
107+
* A class of local database sink nodes.
108+
*/
109+
class LocalDatabaseSink extends DataFlow::Node {
110+
LocalDatabaseSink() { localDatabaseInput(this, _) or localDatabaseStore(this, _) }
111+
}
112+
106113
private module LocalDatabaseFlowConfig implements DataFlow::ConfigSig {
107114
predicate isSource(DataFlow::Node source) { source instanceof LocalDatabaseOpenMethodCallSource }
108115

109-
predicate isSink(DataFlow::Node sink) {
110-
localDatabaseInput(sink, _) or
111-
localDatabaseStore(sink, _)
112-
}
116+
predicate isSink(DataFlow::Node sink) { sink instanceof LocalDatabaseSink }
113117

114118
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
115119
// Adds a step for tracking databases through field flow, that is, a database is opened and

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidFilesystemQuery.qll

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,20 @@ class LocalFileOpenCallSource extends DataFlow::Node {
8686
LocalFileOpenCallSource() { this.asExpr() instanceof LocalFileOpenCall }
8787
}
8888

89+
/**
90+
* A class of local file sink nodes.
91+
*/
92+
class LocalFileSink extends DataFlow::Node {
93+
LocalFileSink() {
94+
filesystemInput(this, _) or
95+
closesFile(this, _)
96+
}
97+
}
98+
8999
private module FilesystemFlowConfig implements DataFlow::ConfigSig {
90100
predicate isSource(DataFlow::Node src) { src instanceof LocalFileOpenCallSource }
91101

92-
predicate isSink(DataFlow::Node sink) {
93-
filesystemInput(sink, _) or
94-
closesFile(sink, _)
95-
}
102+
predicate isSink(DataFlow::Node sink) { sink instanceof LocalFileSink }
96103

97104
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
98105
// Add nested Writer constructors as extra data flow steps

‎java/ql/lib/semmle/code/java/security/CleartextStorageCookieQuery.qll

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,17 @@ class CookieSource extends DataFlow::Node {
4444
CookieSource() { this.asExpr() instanceof Cookie }
4545
}
4646

47+
/**
48+
* A class of cookie store sink nodes.
49+
*/
50+
class CookieStoreSink extends DataFlow::Node {
51+
CookieStoreSink() { cookieStore(this, _) }
52+
}
53+
4754
private module CookieToStoreFlowConfig implements DataFlow::ConfigSig {
4855
predicate isSource(DataFlow::Node src) { src instanceof CookieSource }
4956

50-
predicate isSink(DataFlow::Node sink) { cookieStore(sink, _) }
57+
predicate isSink(DataFlow::Node sink) { sink instanceof CookieStoreSink }
5158
}
5259

5360
private module CookieToStoreFlow = DataFlow::Global<CookieToStoreFlowConfig>;

‎java/ql/lib/semmle/code/java/security/CleartextStorageSharedPrefsQuery.qll

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,21 @@ class SharedPreferencesEditorMethodCallSource extends DataFlow::Node {
7676
}
7777
}
7878

79+
/**
80+
* A class of shared preferences sink nodes.
81+
*/
82+
class SharedPreferencesSink extends DataFlow::Node {
83+
SharedPreferencesSink() {
84+
sharedPreferencesInput(this, _) or
85+
sharedPreferencesStore(this, _)
86+
}
87+
}
88+
7989
/** Flow from `SharedPreferences.Editor` to either a setter or a store method. */
8090
private module SharedPreferencesFlowConfig implements DataFlow::ConfigSig {
8191
predicate isSource(DataFlow::Node src) { src instanceof SharedPreferencesEditorMethodCallSource }
8292

83-
predicate isSink(DataFlow::Node sink) {
84-
sharedPreferencesInput(sink, _) or
85-
sharedPreferencesStore(sink, _)
86-
}
93+
predicate isSink(DataFlow::Node sink) { sink instanceof SharedPreferencesSink }
8794
}
8895

8996
private module SharedPreferencesFlow = DataFlow::Global<SharedPreferencesFlowConfig>;

‎java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringQuery.qll

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,20 @@ import java
44
private import semmle.code.java.dataflow.FlowSources
55
private import semmle.code.java.StringFormat
66

7+
/**
8+
* A class of string format sink nodes.
9+
*/
10+
class StringFormatSink extends DataFlow::Node {
11+
StringFormatSink() { this.asExpr() = any(StringFormat formatCall).getFormatArgument() }
12+
}
13+
714
/**
815
* A taint-tracking configuration for externally controlled format string vulnerabilities.
916
*/
1017
module ExternallyControlledFormatStringConfig implements DataFlow::ConfigSig {
1118
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
1219

13-
predicate isSink(DataFlow::Node sink) {
14-
sink.asExpr() = any(StringFormat formatCall).getFormatArgument()
15-
}
20+
predicate isSink(DataFlow::Node sink) { sink instanceof StringFormatSink }
1621

1722
predicate isBarrier(DataFlow::Node node) {
1823
node.getType() instanceof NumericType or node.getType() instanceof BooleanType

‎java/ql/lib/semmle/code/java/security/SensitiveResultReceiverQuery.qll

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,15 +50,22 @@ deprecated private class SensitiveResultReceiverConf extends TaintTracking::Conf
5050
}
5151
}
5252

53-
private module SensitiveResultReceiverConfig implements DataFlow::ConfigSig {
54-
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
55-
56-
predicate isSink(DataFlow::Node node) {
53+
/**
54+
* A class of sensitive result receiver sink nodes.
55+
*/
56+
class SensitiveResultReceiverSink extends DataFlow::Node {
57+
SensitiveResultReceiverSink() {
5758
exists(ResultReceiverSendCall call |
5859
untrustedResultReceiverSend(_, call) and
59-
node.asExpr() = call.getSentData()
60+
this.asExpr() = call.getSentData()
6061
)
6162
}
63+
}
64+
65+
private module SensitiveResultReceiverConfig implements DataFlow::ConfigSig {
66+
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
67+
68+
predicate isSink(DataFlow::Node node) { node instanceof SensitiveResultReceiverSink }
6269

6370
predicate allowImplicitRead(DataFlow::Node n, DataFlow::ContentSet c) { isSink(n) and exists(c) }
6471
}

‎java/ql/lib/semmle/code/java/security/SensitiveUiQuery.qll

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,23 @@ private class MaskCall extends MethodCall {
5353
}
5454
}
5555

56-
/** A configuration for tracking sensitive information to text fields. */
57-
private module TextFieldTrackingConfig implements DataFlow::ConfigSig {
58-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof SensitiveExpr }
59-
60-
predicate isSink(DataFlow::Node sink) {
56+
/**
57+
* A class of test field sink nodes.
58+
*/
59+
class TextFieldSink extends DataFlow::Node {
60+
TextFieldSink() {
6161
exists(SetTextCall call |
62-
sink.asExpr() = call.getStringArgument() and
62+
this.asExpr() = call.getStringArgument() and
6363
not setTextCallIsMasked(call)
6464
)
6565
}
66+
}
67+
68+
/** A configuration for tracking sensitive information to text fields. */
69+
private module TextFieldTrackingConfig implements DataFlow::ConfigSig {
70+
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof SensitiveExpr }
71+
72+
predicate isSink(DataFlow::Node sink) { sink instanceof TextFieldSink }
6673

6774
predicate isBarrier(DataFlow::Node node) { node instanceof SimpleTypeSanitizer }
6875

‎java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,17 @@ module TempDirSystemGetPropertyToCreateConfig implements DataFlow::ConfigSig {
153153
module TempDirSystemGetPropertyToCreate =
154154
TaintTracking::Global<TempDirSystemGetPropertyToCreateConfig>;
155155

156+
/**
157+
* A class of method file directory creation sink nodes.
158+
*/
159+
class MethodFileDirectoryCreationSink extends DataFlow::Node {
160+
MethodFileDirectoryCreationSink() {
161+
exists(MethodCall ma | ma.getMethod() instanceof MethodFileDirectoryCreation |
162+
ma.getQualifier() = this.asExpr()
163+
)
164+
}
165+
}
166+
156167
/**
157168
* Configuration that tracks calls to to `mkdir` or `mkdirs` that are are directly on the temp directory system property.
158169
* Examples:
@@ -172,11 +183,7 @@ module TempDirSystemGetPropertyDirectlyToMkdirConfig implements DataFlow::Config
172183
)
173184
}
174185

175-
predicate isSink(DataFlow::Node node) {
176-
exists(MethodCall ma | ma.getMethod() instanceof MethodFileDirectoryCreation |
177-
ma.getQualifier() = node.asExpr()
178-
)
179-
}
186+
predicate isSink(DataFlow::Node node) { node instanceof MethodFileDirectoryCreationSink }
180187

181188
predicate isBarrier(DataFlow::Node sanitizer) {
182189
isFileConstructorArgument(sanitizer.asExpr(), _, _)

0 commit comments

Comments
 (0)