Skip to content

Commit 0db7496

Browse files
author
p0wn4j
committed
Add URLClassLoader and Spring WebClient SSRF sinks
1 parent e4af146 commit 0db7496

File tree

8 files changed

+293
-2
lines changed

8 files changed

+293
-2
lines changed

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,12 @@ private predicate sinkModelCsv(string row) {
217217
"java.net;URL;false;openStream;;;Argument[-1];open-url",
218218
"java.net.http;HttpRequest;false;newBuilder;;;Argument[0];open-url",
219219
"java.net.http;HttpRequest$Builder;false;uri;;;Argument[0];open-url",
220+
"java.net;URLClassLoader;false;URLClassLoader;(URL[]);;Argument[0];open-url",
221+
"java.net;URLClassLoader;false;URLClassLoader;(URL[],ClassLoader);;Argument[0];open-url",
222+
"java.net;URLClassLoader;false;URLClassLoader;(URL[],ClassLoader,URLStreamHandlerFactory);;Argument[0];open-url",
223+
"java.net;URLClassLoader;false;URLClassLoader;(String,URL[],ClassLoader);;Argument[1];open-url",
224+
"java.net;URLClassLoader;false;URLClassLoader;(String,URL[],ClassLoader,URLStreamHandlerFactory);;Argument[1];open-url",
225+
"java.net;URLClassLoader;false;newInstance;;;Argument[0];open-url",
220226
// Create file
221227
"java.io;FileOutputStream;false;FileOutputStream;;;Argument[0];create-file",
222228
"java.io;RandomAccessFile;false;RandomAccessFile;;;Argument[0];create-file",

‎java/ql/src/semmle/code/java/frameworks/spring/SpringWebClient.qll

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,9 @@ private class UrlOpenSink extends SinkModelCsv {
4545
"org.springframework.web.client;RestTemplate;false;postForEntity;;;Argument[0];open-url",
4646
"org.springframework.web.client;RestTemplate;false;postForLocation;;;Argument[0];open-url",
4747
"org.springframework.web.client;RestTemplate;false;postForObject;;;Argument[0];open-url",
48-
"org.springframework.web.client;RestTemplate;false;put;;;Argument[0];open-url"
48+
"org.springframework.web.client;RestTemplate;false;put;;;Argument[0];open-url",
49+
"org.springframework.web.reactive.function.client;WebClient;false;create;;;Argument[0];open-url",
50+
"org.springframework.web.reactive.function.client;WebClient$Builder;false;baseUrl;;;Argument[0];open-url"
4951
]
5052
}
5153
}

‎java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
import org.springframework.http.HttpHeaders;
2+
import org.springframework.web.reactive.function.client.WebClient;
3+
import reactor.core.publisher.Mono;
4+
5+
import javax.servlet.ServletException;
6+
import javax.servlet.http.HttpServlet;
7+
import javax.servlet.http.HttpServletRequest;
8+
import javax.servlet.http.HttpServletResponse;
9+
import java.io.IOException;
10+
11+
public class ReactiveWebClientSSRF extends HttpServlet {
12+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
13+
throws ServletException, IOException {
14+
try {
15+
String url = request.getParameter("uri");
16+
WebClient webClient = WebClient.create(url); // $ SSRF
17+
18+
Mono<String> result = webClient.get()
19+
.uri("/")
20+
.retrieve()
21+
.bodyToMono(String.class);
22+
23+
result.block();
24+
} catch (Exception e) {
25+
// Ignore
26+
}
27+
}
28+
29+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
30+
throws ServletException, IOException {
31+
try {
32+
String url = request.getParameter("uri");
33+
WebClient webClient = WebClient.builder()
34+
.defaultHeader("User-Agent", "Java")
35+
.baseUrl(url) // $ SSRF
36+
.build();
37+
38+
39+
Mono<String> result = webClient.get()
40+
.uri("/")
41+
.retrieve()
42+
.bodyToMono(String.class);
43+
44+
result.block();
45+
} catch (Exception e) {
46+
// Ignore
47+
}
48+
}
49+
}

‎java/ql/test/query-tests/security/CWE-918/URLClassLoaderSSRF.java

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
import javax.servlet.ServletException;
2+
import javax.servlet.http.HttpServlet;
3+
import javax.servlet.http.HttpServletRequest;
4+
import javax.servlet.http.HttpServletResponse;
5+
import java.io.IOException;
6+
import java.net.URI;
7+
import java.net.URL;
8+
import java.net.URLClassLoader;
9+
10+
public class URLClassLoaderSSRF extends HttpServlet {
11+
12+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
13+
throws ServletException, IOException {
14+
try {
15+
String url = request.getParameter("uri");
16+
URI uri = new URI(url);
17+
URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}); // $ SSRF
18+
Class<?> test = urlClassLoader.loadClass("test");
19+
} catch (Exception e) {
20+
// Ignore
21+
}
22+
}
23+
24+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
25+
throws ServletException, IOException {
26+
try {
27+
String url = request.getParameter("uri");
28+
URI uri = new URI(url);
29+
URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}, URLClassLoaderSSRF.class.getClassLoader()); // $ SSRF
30+
Class<?> test = urlClassLoader.loadClass("test");
31+
} catch (Exception e) {
32+
// Ignore
33+
}
34+
}
35+
36+
protected void doPut(HttpServletRequest request, HttpServletResponse response)
37+
throws ServletException, IOException {
38+
try {
39+
String url = request.getParameter("uri");
40+
URI uri = new URI(url);
41+
42+
URLStreamHandlerFactory urlStreamHandlerFactory = TomcatURLStreamHandlerFactory.getInstance();
43+
URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}, URLClassLoaderSSRF.class.getClassLoader(), urlStreamHandlerFactory); // $ SSRF
44+
urlClassLoader.findResource("test");
45+
} catch (Exception e) {
46+
// Ignore
47+
}
48+
}
49+
50+
protected void doDelete(HttpServletRequest request, HttpServletResponse response)
51+
throws ServletException, IOException {
52+
try {
53+
String url = request.getParameter("uri");
54+
URI uri = new URI(url);
55+
URLClassLoader urlClassLoader = URLClassLoader.newInstance(new URL[]{uri.toURL()}); // $ SSRF
56+
urlClassLoader.getResourceAsStream("test");
57+
} catch (Exception e) {
58+
// Ignore
59+
}
60+
}
61+
62+
protected void doOptions(HttpServletRequest request, HttpServletResponse response)
63+
throws ServletException, IOException {
64+
try {
65+
String url = request.getParameter("uri");
66+
URI uri = new URI(url);
67+
URLClassLoader urlClassLoader =
68+
new URLClassLoader("testClassLoader",
69+
new URL[]{new URL[]{uri.toURL()}},
70+
URLClassLoaderSSRF.class.getClassLoader()
71+
); // $ SSRF
72+
73+
Class<?> rceTest = urlClassLoader.loadClass("RCETest");
74+
} catch (Exception e) {
75+
// Ignore
76+
}
77+
}
78+
79+
protected void doTrace(HttpServletRequest request, HttpServletResponse response)
80+
throws ServletException, IOException {
81+
try {
82+
String url = request.getParameter("uri");
83+
URI uri = new URI(url);
84+
URLStreamHandlerFactory urlStreamHandlerFactory = TomcatURLStreamHandlerFactory.getInstance();
85+
86+
URLClassLoader urlClassLoader =
87+
new URLClassLoader("testClassLoader",
88+
new URL[]{uri.toURL()},
89+
URLClassLoaderSSRF.class.getClassLoader(),
90+
urlStreamHandlerFactory
91+
); // $ SSRF
92+
93+
Class<?> rceTest = urlClassLoader.loadClass("RCETest");
94+
} catch (Exception e) {
95+
// Ignore
96+
}
97+
}
98+
}

‎java/ql/test/query-tests/security/CWE-918/options

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/servlet-api-2.4/
1+
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/projectreactor-3.4.3/
2+

‎java/ql/test/stubs/projectreactor-3.4.3/reactor/core/publisher/Mono.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/*
2+
* Copyright (c) 2011-Present VMware Inc. or its affiliates, All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package reactor.core.publisher;
17+
18+
public abstract class Mono<T> {
19+
public T block() {
20+
return null;
21+
}
22+
}

‎java/ql/test/stubs/springframework-5.3.8/org/springframework/web/reactive/function/client/DefaultWebClientBuilder.java

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
* Copyright 2002-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.web.reactive.function.client;
18+
19+
final class DefaultWebClientBuilder implements WebClient.Builder {
20+
21+
public DefaultWebClientBuilder() {
22+
}
23+
24+
@Override
25+
public WebClient.Builder baseUrl(String baseUrl) {
26+
return this;
27+
}
28+
29+
@Override
30+
public WebClient.Builder defaultHeader(String header, String... values) {
31+
return this;
32+
}
33+
34+
35+
@Override
36+
public WebClient build() {
37+
return null;
38+
}
39+
40+
}

‎java/ql/test/stubs/springframework-5.3.8/org/springframework/web/reactive/function/client/WebClient.java

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright 2002-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.web.reactive.function.client;
18+
19+
import reactor.core.publisher.Mono;
20+
21+
/**
22+
Spring Reactor WebClient interface stub
23+
*/
24+
public interface WebClient {
25+
26+
RequestHeadersUriSpec<?> get();
27+
RequestHeadersUriSpec<?> head();
28+
RequestBodyUriSpec post();
29+
RequestBodyUriSpec put();
30+
RequestBodyUriSpec patch();
31+
RequestHeadersUriSpec<?> delete();
32+
RequestHeadersUriSpec<?> options();
33+
34+
static WebClient create(String baseUrl) {
35+
return null;
36+
}
37+
38+
static WebClient create() {
39+
return null;
40+
}
41+
42+
static WebClient.Builder builder() {
43+
return null;
44+
}
45+
46+
interface Builder {
47+
Builder baseUrl(String baseUrl);
48+
Builder defaultHeader(String header, String... values);
49+
WebClient build();
50+
}
51+
52+
interface UriSpec<S extends RequestHeadersSpec<?>> {
53+
S uri(String uri, Object... uriVariables);
54+
}
55+
56+
interface RequestBodySpec extends RequestHeadersSpec<RequestBodySpec> {
57+
}
58+
59+
interface RequestBodyUriSpec extends RequestBodySpec, RequestHeadersUriSpec<RequestBodySpec> {
60+
}
61+
62+
interface ResponseSpec {
63+
<T> Mono<T> bodyToMono(Class<T> elementClass);
64+
}
65+
66+
interface RequestHeadersUriSpec<S extends RequestHeadersSpec<S>>
67+
extends UriSpec<S>, RequestHeadersSpec<S> {
68+
}
69+
70+
interface RequestHeadersSpec<S extends RequestHeadersSpec<S>> {
71+
ResponseSpec retrieve();
72+
}
73+
}

0 commit comments

Comments
 (0)