Skip to content

Commit 11b7032

Browse files
committed
Add Jakarta WS url-open sink
1 parent da1e760 commit 11b7032

File tree

8 files changed

+64
-16
lines changed

8 files changed

+64
-16
lines changed

java/ql/src/semmle/code/java/frameworks/JaxWS.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -789,6 +789,10 @@ private class UriBuilderModel extends SummaryModelCsv {
789789

790790
private class JaxRsUrlOpenSink extends SinkModelCsv {
791791
override predicate row(string row) {
792-
row = ["javax.ws.rs.client;Client;true;target;;;Argument[0];open-url"]
792+
row =
793+
[
794+
"javax.ws.rs.client;Client;true;target;;;Argument[0];open-url",
795+
"jakarta.ws.rs.client;Client;true;target;;;Argument[0];open-url"
796+
]
793797
}
794798
}
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import jakarta.ws.rs.client.*;
2+
import java.io.IOException;
3+
4+
import javax.servlet.ServletException;
5+
import javax.servlet.http.HttpServlet;
6+
import javax.servlet.http.HttpServletRequest;
7+
import javax.servlet.http.HttpServletResponse;
8+
9+
public class JakartaWsSSRF extends HttpServlet {
10+
11+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
12+
throws ServletException, IOException {
13+
Client client = ClientBuilder.newClient();
14+
String url = request.getParameter("url");
15+
client.target(url); // $ SSRF
16+
}
17+
18+
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.2.3:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/servlet-api-2.4/
1+
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.2.3:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/servlet-api-2.4/

java/ql/test/stubs/javax-ws-rs-api-2.1.1/javax/ws/rs/client/Client.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,23 @@
1515
*/
1616

1717
package javax.ws.rs.client;
18-
// import java.net.URI;
18+
import java.net.URI;
1919
import javax.ws.rs.core.Configurable;
20-
// import javax.ws.rs.core.Link;
21-
// import javax.ws.rs.core.UriBuilder;
20+
import javax.ws.rs.core.Link;
21+
import javax.ws.rs.core.UriBuilder;
2222
// import javax.net.ssl.HostnameVerifier;
2323
// import javax.net.ssl.SSLContext;
2424

2525
public interface Client extends Configurable<Client> {
2626
public void close();
2727

28-
// public WebTarget target(String uri);
28+
public WebTarget target(String uri);
2929

30-
// public WebTarget target(URI uri);
30+
public WebTarget target(URI uri);
3131

32-
// public WebTarget target(UriBuilder uriBuilder);
32+
public WebTarget target(UriBuilder uriBuilder);
3333

34-
// public WebTarget target(Link link);
34+
public WebTarget target(Link link);
3535

3636
// public Invocation.Builder invocation(Link link);
3737

java/ql/test/stubs/javax-ws-rs-api-3.0.0/jakarta/ws/rs/client/Client.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,23 @@
1515
*/
1616

1717
package jakarta.ws.rs.client;
18-
// import java.net.URI;
18+
import java.net.URI;
1919
// import javax.net.ssl.HostnameVerifier;
2020
// import javax.net.ssl.SSLContext;
2121
import jakarta.ws.rs.core.Configurable;
22-
// import jakarta.ws.rs.core.Link;
23-
// import jakarta.ws.rs.core.UriBuilder;
22+
import jakarta.ws.rs.core.Link;
23+
import jakarta.ws.rs.core.UriBuilder;
2424

2525
public interface Client extends Configurable<Client> {
2626
public void close();
2727

28-
// public WebTarget target(String uri);
28+
public WebTarget target(String uri);
2929

30-
// public WebTarget target(URI uri);
30+
public WebTarget target(URI uri);
3131

32-
// public WebTarget target(UriBuilder uriBuilder);
32+
public WebTarget target(UriBuilder uriBuilder);
3333

34-
// public WebTarget target(Link link);
34+
public WebTarget target(Link link);
3535

3636
// public Invocation.Builder invocation(Link link);
3737

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package jakarta.ws.rs.client;
2+
3+
public abstract class ClientBuilder implements jakarta.ws.rs.core.Configurable {
4+
5+
protected ClientBuilder() {
6+
}
7+
8+
public static jakarta.ws.rs.client.ClientBuilder newBuilder() {
9+
return null;
10+
}
11+
12+
public static jakarta.ws.rs.client.Client newClient() {
13+
return null;
14+
}
15+
16+
public static jakarta.ws.rs.client.Client newClient(jakarta.ws.rs.core.Configuration configuration) {
17+
return null;
18+
}
19+
}
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
package jakarta.ws.rs.client;
2+
3+
public abstract interface WebTarget extends jakarta.ws.rs.core.Configurable {
4+
}
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
package jakarta.ws.rs.core;
2+
3+
public abstract interface Configuration {}

0 commit comments

Comments
 (0)