Skip to content

Commit 0651415

Browse files
aschackmullaschackmull
committed
Java: Add XXE tests.
1 parent daad62c commit 0651415

File tree

6 files changed

+187
-1
lines changed

6 files changed

+187
-1
lines changed

‎java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
import java.net.Socket;
2+
3+
import javax.xml.parsers.SAXParser;
4+
import javax.xml.parsers.SAXParserFactory;
5+
import javax.xml.transform.sax.SAXSource;
6+
import javax.xml.bind.JAXBContext;
7+
import javax.xml.bind.Unmarshaller;
8+
9+
import org.xml.sax.InputSource;
10+
import org.xml.sax.XMLReader;
11+
import org.xml.sax.helpers.XMLReaderFactory;
12+
13+
public class SAXSourceTests {
14+
15+
public void unsafeSource(Socket sock) throws Exception {
16+
XMLReader reader = XMLReaderFactory.createXMLReader();
17+
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
18+
JAXBContext jc = JAXBContext.newInstance(Object.class);
19+
Unmarshaller um = jc.createUnmarshaller();
20+
um.unmarshal(source); //unsafe
21+
}
22+
23+
public void explicitlySafeSource1(Socket sock) throws Exception {
24+
XMLReader reader = XMLReaderFactory.createXMLReader();
25+
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
26+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
27+
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
28+
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); //safe
29+
}
30+
31+
public void createdSafeSource(Socket sock) throws Exception {
32+
SAXParserFactory factory = SAXParserFactory.newInstance();
33+
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
34+
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
35+
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
36+
SAXParser parser = factory.newSAXParser();
37+
XMLReader reader = parser.getXMLReader();
38+
SAXSource source = new SAXSource(parser.getXMLReader(), new InputSource(sock.getInputStream())); //safe
39+
SAXSource source2 = new SAXSource(reader, new InputSource(sock.getInputStream())); //safe
40+
}
41+
}

‎java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
import java.net.Socket;
2+
3+
import javax.xml.bind.JAXBContext;
4+
import javax.xml.bind.Unmarshaller;
5+
import javax.xml.parsers.SAXParserFactory;
6+
import javax.xml.transform.Source;
7+
import javax.xml.transform.sax.SAXSource;
8+
9+
import org.xml.sax.InputSource;
10+
11+
public class UnmarshallerTests {
12+
13+
public void safeUnmarshal(Socket sock) throws Exception {
14+
SAXParserFactory spf = SAXParserFactory.newInstance();
15+
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
16+
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
17+
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
18+
JAXBContext jc = JAXBContext.newInstance(Object.class);
19+
Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(sock.getInputStream()));
20+
Unmarshaller um = jc.createUnmarshaller();
21+
um.unmarshal(xmlSource); //safe
22+
}
23+
24+
public void unsafeUnmarshal(Socket sock) throws Exception {
25+
SAXParserFactory spf = SAXParserFactory.newInstance();
26+
JAXBContext jc = JAXBContext.newInstance(Object.class);
27+
Unmarshaller um = jc.createUnmarshaller();
28+
um.unmarshal(sock.getInputStream()); //unsafe
29+
}
30+
}

‎java/ql/test/query-tests/security/CWE-611/XXE.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ edges
22
| DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
33
| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
44
| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
5+
| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source |
56
| SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) |
67
| SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) |
78
| SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) |
@@ -78,6 +79,8 @@ nodes
7879
| SAXReaderTests.java:45:17:45:37 | getInputStream(...) | semmle.label | getInputStream(...) |
7980
| SAXReaderTests.java:53:17:53:37 | getInputStream(...) | semmle.label | getInputStream(...) |
8081
| SAXReaderTests.java:61:17:61:37 | getInputStream(...) | semmle.label | getInputStream(...) |
82+
| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
83+
| SAXSourceTests.java:20:18:20:23 | source | semmle.label | source |
8184
| SchemaTests.java:12:39:12:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
8285
| SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
8386
| SchemaTests.java:25:39:25:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
@@ -163,6 +166,7 @@ nodes
163166
| TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
164167
| TransformerTests.java:141:18:141:70 | new SAXSource(...) | semmle.label | new SAXSource(...) |
165168
| TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
169+
| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | semmle.label | getInputStream(...) |
166170
| XMLReaderTests.java:16:18:16:55 | new InputSource(...) | semmle.label | new InputSource(...) |
167171
| XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
168172
| XMLReaderTests.java:56:18:56:55 | new InputSource(...) | semmle.label | new InputSource(...) |
@@ -220,6 +224,7 @@ nodes
220224
| SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | user input |
221225
| SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | user input |
222226
| SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | user input |
227+
| SAXSourceTests.java:20:18:20:23 | source | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source | Unsafe parsing of XML file from $@. | SAXSourceTests.java:17:62:17:82 | getInputStream(...) | user input |
223228
| SchemaTests.java:12:39:12:77 | new StreamSource(...) | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:12:56:12:76 | getInputStream(...) | user input |
224229
| SchemaTests.java:25:39:25:77 | new StreamSource(...) | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:25:56:25:76 | getInputStream(...) | user input |
225230
| SchemaTests.java:31:39:31:77 | new StreamSource(...) | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:31:56:31:76 | getInputStream(...) | user input |
@@ -267,6 +272,7 @@ nodes
267272
| TransformerTests.java:129:21:129:59 | new StreamSource(...) | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:129:38:129:58 | getInputStream(...) | user input |
268273
| TransformerTests.java:136:21:136:59 | new StreamSource(...) | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:136:38:136:58 | getInputStream(...) | user input |
269274
| TransformerTests.java:141:18:141:70 | new SAXSource(...) | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:141:48:141:68 | getInputStream(...) | user input |
275+
| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | user input |
270276
| XMLReaderTests.java:16:18:16:55 | new InputSource(...) | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:16:34:16:54 | getInputStream(...) | user input |
271277
| XMLReaderTests.java:56:18:56:55 | new InputSource(...) | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:56:34:56:54 | getInputStream(...) | user input |
272278
| XMLReaderTests.java:63:18:63:55 | new InputSource(...) | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:63:34:63:54 | getInputStream(...) | user input |

‎java/ql/test/query-tests/security/CWE-611/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1

‎java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package javax.xml.bind;
2+
3+
import java.util.Map;
4+
5+
abstract public class JAXBContext {
6+
protected JAXBContext() { }
7+
8+
// public static final String JAXB_CONTEXT_FACTORY;
9+
//
10+
// public Binder<Node> createBinder() { return null; }
11+
//
12+
// public Binder<T> createBinder(Class<T> p0) { return null; }
13+
//
14+
// public JAXBIntrospector createJAXBIntrospector() { return null; }
15+
//
16+
// abstract public Marshaller createMarshaller();
17+
18+
abstract public Unmarshaller createUnmarshaller();
19+
20+
// abstract public Validator createValidator();
21+
//
22+
// public void generateSchema(SchemaOutputResolver p0) { }
23+
24+
public static JAXBContext newInstance(Class... p0) { return null; }
25+
26+
public static JAXBContext newInstance(Class<?>[] p0, Map<String,?> p1) { return null; }
27+
28+
public static JAXBContext newInstance(String p0) { return null; }
29+
30+
public static JAXBContext newInstance(String p0, ClassLoader p1) { return null; }
31+
32+
public static JAXBContext newInstance(String p0, ClassLoader p1, Map<String,?> p2) { return null; }
33+
}

‎java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package javax.xml.bind;
2+
3+
import java.net.URL;
4+
import java.io.Reader;
5+
import java.io.InputStream;
6+
import java.io.File;
7+
import javax.xml.transform.Source;
8+
9+
abstract public interface Unmarshaller {
10+
abstract public static class Listener {
11+
public Listener() { }
12+
13+
public void afterUnmarshal(Object p0, Object p1) { }
14+
15+
public void beforeUnmarshal(Object p0, Object p1) { }
16+
}
17+
18+
// abstract public A getAdapter(Class<A> p0);
19+
//
20+
// abstract public AttachmentUnmarshaller getAttachmentUnmarshaller();
21+
//
22+
// abstract public ValidationEventHandler getEventHandler();
23+
//
24+
// abstract public Listener getListener();
25+
26+
abstract public Object getProperty(String p0);
27+
28+
// abstract public Schema getSchema();
29+
//
30+
// abstract public UnmarshallerHandler getUnmarshallerHandler();
31+
32+
abstract public boolean isValidating();
33+
34+
// abstract public void setAdapter(Class<A> p0, A p1);
35+
//
36+
// abstract public void setAdapter(XmlAdapter p0);
37+
//
38+
// abstract public void setAttachmentUnmarshaller(AttachmentUnmarshaller p0);
39+
//
40+
// abstract public void setEventHandler(ValidationEventHandler p0);
41+
//
42+
// abstract public void setListener(Listener p0);
43+
//
44+
// abstract public void setProperty(String p0, Object p1);
45+
//
46+
// abstract public void setSchema(Schema p0);
47+
48+
abstract public void setValidating(boolean p0);
49+
50+
abstract public Object unmarshal(File p0);
51+
52+
abstract public Object unmarshal(InputStream p0);
53+
54+
abstract public Object unmarshal(Reader p0);
55+
56+
abstract public Object unmarshal(URL p0);
57+
58+
// abstract public Object unmarshal(XMLEventReader p0);
59+
//
60+
// abstract public JAXBElement<T> unmarshal(XMLEventReader p0, Class<T> p1);
61+
//
62+
// abstract public Object unmarshal(XMLStreamReader p0);
63+
//
64+
// abstract public JAXBElement<T> unmarshal(XMLStreamReader p0, Class<T> p1);
65+
66+
abstract public Object unmarshal(Source p0);
67+
68+
// abstract public JAXBElement<T> unmarshal(Source p0, Class<T> p1);
69+
//
70+
// abstract public Object unmarshal(Node p0);
71+
//
72+
// abstract public JAXBElement<T> unmarshal(Node p0, Class<T> p1);
73+
//
74+
// abstract public Object unmarshal(InputSource p0);
75+
}
76+

0 commit comments

Comments
 (0)