Skip to content

Commit e76a1f7

Browse files
d10cd10c
committed
Java: UnsafeCertTrust (+ convert test to qlref)
1 parent 6987334 commit e76a1f7

File tree

5 files changed

+37
-42
lines changed

5 files changed

+37
-42
lines changed

‎java/ql/lib/semmle/code/java/security/UnsafeCertTrustQuery.qll

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,16 @@ module SslEndpointIdentificationFlowConfig implements DataFlow::ConfigSig {
1515

1616
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof SslUnsafeCertTrustSanitizer }
1717

18-
predicate observeDiffInformedIncrementalMode() {
19-
any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 21 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql@22:8:22:18)
20-
}
18+
predicate observeDiffInformedIncrementalMode() { any() }
2119

22-
Location getASelectedSourceLocation(DataFlow::Node source) {
23-
none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 21 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql@22:8:22:18)
24-
}
20+
Location getASelectedSourceLocation(DataFlow::Node source) { none() }
2521

2622
Location getASelectedSinkLocation(DataFlow::Node sink) {
27-
none() // TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 21 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql@22:8:22:18)
23+
exists(Expr unsafeTrust | result = unsafeTrust.getLocation() |
24+
unsafeTrust instanceof RabbitMQEnableHostnameVerificationNotSet
25+
or
26+
sink.asExpr() = unsafeTrust
27+
)
2828
}
2929
}
3030

‎java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.expected

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
| UnsafeCertTrustTest.java:24:3:24:11 | sslEngine | Unsafe configuration of trusted certificates. |
2+
| UnsafeCertTrustTest.java:25:3:25:11 | sslEngine | Unsafe configuration of trusted certificates. |
3+
| UnsafeCertTrustTest.java:26:3:26:11 | sslEngine | Unsafe configuration of trusted certificates. |
4+
| UnsafeCertTrustTest.java:35:3:35:11 | sslEngine | Unsafe configuration of trusted certificates. |
5+
| UnsafeCertTrustTest.java:36:3:36:11 | sslEngine | Unsafe configuration of trusted certificates. |
6+
| UnsafeCertTrustTest.java:37:3:37:11 | sslEngine | Unsafe configuration of trusted certificates. |
7+
| UnsafeCertTrustTest.java:64:3:64:8 | socket | Unsafe configuration of trusted certificates. |
8+
| UnsafeCertTrustTest.java:74:3:74:8 | socket | Unsafe configuration of trusted certificates. |
9+
| UnsafeCertTrustTest.java:84:3:84:8 | socket | Unsafe configuration of trusted certificates. |
10+
| UnsafeCertTrustTest.java:91:3:91:8 | socket | Unsafe configuration of trusted certificates. |
11+
| UnsafeCertTrustTest.java:141:3:141:8 | socket | Unsafe configuration of trusted certificates. |
12+
| UnsafeCertTrustTest.java:153:4:153:60 | useSslProtocol(...) | Unsafe configuration of trusted certificates. |
13+
| UnsafeCertTrustTest.java:157:4:157:70 | setSslContextFactory(...) | Unsafe configuration of trusted certificates. |

‎java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.java

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ public void testSSLEngineEndpointIdSetNull() throws Exception {
2121
SSLParameters sslParameters = sslEngine.getSSLParameters();
2222
sslParameters.setEndpointIdentificationAlgorithm(null);
2323
sslEngine.setSSLParameters(sslParameters);
24-
sslEngine.beginHandshake(); // $hasUnsafeCertTrust
25-
sslEngine.wrap(new ByteBuffer[] {}, null); // $hasUnsafeCertTrust
26-
sslEngine.unwrap(null, null, 0, 0); // $hasUnsafeCertTrust
24+
sslEngine.beginHandshake(); // $ Alert
25+
sslEngine.wrap(new ByteBuffer[] {}, null); // $ Alert
26+
sslEngine.unwrap(null, null, 0, 0); // $ Alert
2727
}
2828

2929
public void testSSLEngineEndpointIdSetEmpty() throws Exception {
@@ -32,9 +32,9 @@ public void testSSLEngineEndpointIdSetEmpty() throws Exception {
3232
SSLParameters sslParameters = sslEngine.getSSLParameters();
3333
sslParameters.setEndpointIdentificationAlgorithm("");
3434
sslEngine.setSSLParameters(sslParameters);
35-
sslEngine.beginHandshake(); // $hasUnsafeCertTrust
36-
sslEngine.wrap(new ByteBuffer[] {}, null); // $hasUnsafeCertTrust
37-
sslEngine.unwrap(null, null, 0, 0); // $hasUnsafeCertTrust
35+
sslEngine.beginHandshake(); // $ Alert
36+
sslEngine.wrap(new ByteBuffer[] {}, null); // $ Alert
37+
sslEngine.unwrap(null, null, 0, 0); // $ Alert
3838
}
3939

4040
public void testSSLEngineEndpointIdSafe() throws Exception {
@@ -61,7 +61,7 @@ public void testSSLSocketEndpointIdNotSet() throws Exception {
6161
SSLContext sslContext = SSLContext.getInstance("TLS");
6262
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
6363
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
64-
socket.getOutputStream(); // $hasUnsafeCertTrust
64+
socket.getOutputStream(); // $ Alert
6565
}
6666

6767
public void testSSLSocketEndpointIdSetNull() throws Exception {
@@ -71,7 +71,7 @@ public void testSSLSocketEndpointIdSetNull() throws Exception {
7171
SSLParameters sslParameters = socket.getSSLParameters();
7272
sslParameters.setEndpointIdentificationAlgorithm(null);
7373
socket.setSSLParameters(sslParameters);
74-
socket.getOutputStream(); // $hasUnsafeCertTrust
74+
socket.getOutputStream(); // $ Alert
7575
}
7676

7777
public void testSSLSocketEndpointIdSetEmpty() throws Exception {
@@ -81,14 +81,14 @@ public void testSSLSocketEndpointIdSetEmpty() throws Exception {
8181
SSLParameters sslParameters = socket.getSSLParameters();
8282
sslParameters.setEndpointIdentificationAlgorithm("");
8383
socket.setSSLParameters(sslParameters);
84-
socket.getOutputStream(); // $hasUnsafeCertTrust
84+
socket.getOutputStream(); // $ Alert
8585
}
8686

8787
public void testSSLSocketEndpointIdAfterConnecting() throws Exception {
8888
SSLContext sslContext = SSLContext.getInstance("TLS");
8989
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
9090
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
91-
socket.getOutputStream(); // $hasUnsafeCertTrust
91+
socket.getOutputStream(); // $ Alert
9292
SSLParameters sslParameters = socket.getSSLParameters();
9393
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
9494
socket.setSSLParameters(sslParameters);
@@ -138,7 +138,7 @@ public void testSSLSocketEndpointIdSafeWithSanitizerInCast(boolean safe) throws
138138
SSLParameters sslParameters = sslSocket.getSSLParameters();
139139
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
140140
sslSocket.setSSLParameters(sslParameters);
141-
socket.getOutputStream(); // $ SPURIOUS: hasUnsafeCertTrust
141+
socket.getOutputStream(); // $ SPURIOUS: Alert
142142
}
143143

144144
public void testSocketEndpointIdNotSet() throws Exception {
@@ -150,11 +150,11 @@ public void testSocketEndpointIdNotSet() throws Exception {
150150
public void testRabbitMQFactoryEnableHostnameVerificationNotSet() throws Exception {
151151
{
152152
ConnectionFactory connectionFactory = new ConnectionFactory();
153-
connectionFactory.useSslProtocol(SSLContext.getDefault()); // $hasUnsafeCertTrust
153+
connectionFactory.useSslProtocol(SSLContext.getDefault()); // $ Alert
154154
}
155155
{
156156
ConnectionFactory connectionFactory = new ConnectionFactory();
157-
connectionFactory.setSslContextFactory(new TestSslContextFactory()); // $hasUnsafeCertTrust
157+
connectionFactory.setSslContextFactory(new TestSslContextFactory()); // $ Alert
158158
}
159159
}
160160

‎java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.ql

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.qlref

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: Security/CWE/CWE-273/UnsafeCertTrust.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

0 commit comments

Comments
 (0)