Skip to content

Commit 6b3bc42

Browse files
smowtonsmowton
committed
Add JAX-RS XSS tests
1 parent b3c186c commit 6b3bc42

File tree

4 files changed

+412
-35
lines changed

4 files changed

+412
-35
lines changed

‎java/ql/test/query-tests/security/CWE-079/semmle/tests/JaxXSS.java

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
import javax.ws.rs.GET;
2+
import javax.ws.rs.POST;
3+
import javax.ws.rs.Path;
4+
import javax.ws.rs.Produces;
5+
import javax.ws.rs.core.MediaType;
6+
import javax.ws.rs.core.Response;
7+
import javax.ws.rs.core.Variant;
8+
9+
import java.util.Locale;
10+
11+
@Path("")
12+
public class JaxXSS {
13+
14+
@GET
15+
public static Response specificContentType(boolean safeContentType, boolean chainDirectly, boolean contentTypeFirst, String userControlled) {
16+
17+
Response.ResponseBuilder builder = Response.ok();
18+
19+
if(!safeContentType) {
20+
if(chainDirectly) {
21+
if(contentTypeFirst)
22+
return builder.type(MediaType.TEXT_HTML).entity(userControlled).build(); // $xss
23+
else
24+
return builder.entity(userControlled).type(MediaType.TEXT_HTML).build(); // $xss
25+
}
26+
else {
27+
if(contentTypeFirst) {
28+
Response.ResponseBuilder builder2 = builder.type(MediaType.TEXT_HTML);
29+
return builder2.entity(userControlled).build(); // $xss
30+
}
31+
else {
32+
Response.ResponseBuilder builder2 = builder.entity(userControlled);
33+
return builder2.type(MediaType.TEXT_HTML).build(); // $xss
34+
}
35+
}
36+
}
37+
else {
38+
if(chainDirectly) {
39+
if(contentTypeFirst)
40+
return builder.type(MediaType.APPLICATION_JSON).entity(userControlled).build(); // $xss
41+
else
42+
return builder.entity(userControlled).type(MediaType.APPLICATION_JSON).build(); // $xss
43+
}
44+
else {
45+
if(contentTypeFirst) {
46+
Response.ResponseBuilder builder2 = builder.type(MediaType.APPLICATION_JSON);
47+
return builder2.entity(userControlled).build(); // $xss
48+
}
49+
else {
50+
Response.ResponseBuilder builder2 = builder.entity(userControlled);
51+
return builder2.type(MediaType.APPLICATION_JSON).build(); // $xss
52+
}
53+
}
54+
}
55+
56+
}
57+
58+
@GET
59+
public static Response specificContentTypeSetterMethods(int route, boolean safeContentType, String userControlled) {
60+
61+
// Test the remarkably many routes to setting a content-type in Jax-RS, besides the ResponseBuilder.entity method used above:
62+
63+
if(safeContentType) {
64+
if(route == 0) {
65+
// via ok, as a string literal:
66+
return Response.ok(userControlled, "application/json").build(); // $SPURIOUS: xss
67+
}
68+
else if(route == 1) {
69+
// via ok, as a string constant:
70+
return Response.ok(userControlled, MediaType.APPLICATION_JSON).build(); // $SPURIOUS: xss
71+
}
72+
else if(route == 2) {
73+
// via ok, as a MediaType constant:
74+
return Response.ok(userControlled, MediaType.APPLICATION_JSON_TYPE).build(); // $SPURIOUS: xss
75+
}
76+
else if(route == 3) {
77+
// via ok, as a Variant, via constructor:
78+
return Response.ok(userControlled, new Variant(MediaType.APPLICATION_JSON_TYPE, "language", "encoding")).build(); // $SPURIOUS: xss
79+
}
80+
else if(route == 4) {
81+
// via ok, as a Variant, via static method:
82+
return Response.ok(userControlled, Variant.mediaTypes(MediaType.APPLICATION_JSON_TYPE).build().get(0)).build(); // $SPURIOUS: xss
83+
}
84+
else if(route == 5) {
85+
// via ok, as a Variant, via instance method:
86+
return Response.ok(userControlled, Variant.languages(Locale.UK).mediaTypes(MediaType.APPLICATION_JSON_TYPE).build().get(0)).build(); // $SPURIOUS: xss
87+
}
88+
else if(route == 6) {
89+
// via builder variant, before entity:
90+
return Response.ok().variant(new Variant(MediaType.APPLICATION_JSON_TYPE, "language", "encoding")).entity(userControlled).build(); // $SPURIOUS: xss
91+
}
92+
else if(route == 7) {
93+
// via builder variant, after entity:
94+
return Response.ok().entity(userControlled).variant(new Variant(MediaType.APPLICATION_JSON_TYPE, "language", "encoding")).build(); // $SPURIOUS: xss
95+
}
96+
else if(route == 8) {
97+
// provide entity via ok, then content-type via builder:
98+
return Response.ok(userControlled).type(MediaType.APPLICATION_JSON_TYPE).build(); // $SPURIOUS: xss
99+
}
100+
}
101+
else {
102+
if(route == 0) {
103+
// via ok, as a string literal:
104+
return Response.ok("text/html").entity(userControlled).build(); // $xss
105+
}
106+
else if(route == 1) {
107+
// via ok, as a string constant:
108+
return Response.ok(MediaType.TEXT_HTML).entity(userControlled).build(); // $xss
109+
}
110+
else if(route == 2) {
111+
// via ok, as a MediaType constant:
112+
return Response.ok(MediaType.TEXT_HTML_TYPE).entity(userControlled).build(); // $xss
113+
}
114+
else if(route == 3) {
115+
// via ok, as a Variant, via constructor:
116+
return Response.ok(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).entity(userControlled).build(); // $xss
117+
}
118+
else if(route == 4) {
119+
// via ok, as a Variant, via static method:
120+
return Response.ok(Variant.mediaTypes(MediaType.TEXT_HTML_TYPE).build()).entity(userControlled).build(); // $xss
121+
}
122+
else if(route == 5) {
123+
// via ok, as a Variant, via instance method:
124+
return Response.ok(Variant.languages(Locale.UK).mediaTypes(MediaType.TEXT_HTML_TYPE).build()).entity(userControlled).build(); // $xss
125+
}
126+
else if(route == 6) {
127+
// via builder variant, before entity:
128+
return Response.ok().variant(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).entity(userControlled).build(); // $xss
129+
}
130+
else if(route == 7) {
131+
// via builder variant, after entity:
132+
return Response.ok().entity(userControlled).variant(new Variant(MediaType.TEXT_HTML_TYPE, "language", "encoding")).build(); // $xss
133+
}
134+
else if(route == 8) {
135+
// provide entity via ok, then content-type via builder:
136+
return Response.ok(userControlled).type(MediaType.TEXT_HTML_TYPE).build(); // $xss
137+
}
138+
}
139+
140+
return null;
141+
142+
}
143+
144+
@GET @Produces(MediaType.APPLICATION_JSON)
145+
public static Response methodContentTypeSafe(String userControlled) {
146+
return Response.ok(userControlled).build();
147+
}
148+
149+
@POST @Produces(MediaType.APPLICATION_JSON)
150+
public static Response methodContentTypeSafePost(String userControlled) {
151+
return Response.ok(userControlled).build();
152+
}
153+
154+
@GET @Produces("application/json")
155+
public static Response methodContentTypeSafeStringLiteral(String userControlled) {
156+
return Response.ok(userControlled).build();
157+
}
158+
159+
@GET @Produces(MediaType.TEXT_HTML)
160+
public static Response methodContentTypeUnsafe(String userControlled) {
161+
return Response.ok(userControlled).build(); // $MISSING: xss
162+
}
163+
164+
@POST @Produces(MediaType.TEXT_HTML)
165+
public static Response methodContentTypeUnsafePost(String userControlled) {
166+
return Response.ok(userControlled).build(); // $MISSING: xss
167+
}
168+
169+
@GET @Produces("text/html")
170+
public static Response methodContentTypeUnsafeStringLiteral(String userControlled) {
171+
return Response.ok(userControlled).build(); // $MISSING: xss
172+
}
173+
174+
@GET @Produces({MediaType.TEXT_HTML, MediaType.APPLICATION_JSON})
175+
public static Response methodContentTypeMaybeSafe(String userControlled) {
176+
return Response.ok(userControlled).build(); // $MISSING: xss
177+
}
178+
179+
@GET @Produces(MediaType.APPLICATION_JSON)
180+
public static Response methodContentTypeSafeOverriddenWithUnsafe(String userControlled) {
181+
return Response.ok().type(MediaType.TEXT_HTML).entity(userControlled).build(); // $MISSING: xss
182+
}
183+
184+
@GET @Produces(MediaType.TEXT_HTML)
185+
public static Response methodContentTypeUnsafeOverriddenWithSafe(String userControlled) {
186+
return Response.ok().type(MediaType.APPLICATION_JSON).entity(userControlled).build();
187+
}
188+
189+
@Path("/abc")
190+
@Produces({"application/json"})
191+
private static class ClassContentTypeSafe {
192+
@GET
193+
public Response test(String userControlled) {
194+
return Response.ok(userControlled).build();
195+
}
196+
197+
@GET
198+
public String testDirectReturn(String userControlled) {
199+
return userControlled;
200+
}
201+
202+
@GET @Produces({"text/html"})
203+
public Response overridesWithUnsafe(String userControlled) {
204+
return Response.ok(userControlled).build(); // $MISSING: xss
205+
}
206+
207+
@GET
208+
public Response overridesWithUnsafe2(String userControlled) {
209+
return Response.ok().type(MediaType.TEXT_HTML).entity(userControlled).build(); // $MISSING: xss
210+
}
211+
}
212+
213+
@Path("/abc")
214+
@Produces({"text/html"})
215+
private static class ClassContentTypeUnsafe {
216+
@GET
217+
public Response test(String userControlled) {
218+
return Response.ok(userControlled).build(); // $MISSING: xss
219+
}
220+
221+
@GET
222+
public String testDirectReturn(String userControlled) {
223+
return userControlled; // $MISSING: xss
224+
}
225+
226+
@GET @Produces({"application/json"})
227+
public Response overridesWithSafe(String userControlled) {
228+
return Response.ok(userControlled).build();
229+
}
230+
231+
@GET
232+
public Response overridesWithSafe2(String userControlled) {
233+
return Response.ok().type(MediaType.APPLICATION_JSON).entity(userControlled).build();
234+
}
235+
}
236+
237+
@GET
238+
public static Response entityWithNoMediaType(String userControlled) {
239+
return Response.ok(userControlled).build(); // $xss
240+
}
241+
242+
@GET
243+
public static String stringWithNoMediaType(String userControlled) {
244+
return userControlled; // $xss
245+
}
246+
247+
}

‎java/ql/test/query-tests/security/CWE-079/semmle/tests/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/javax-ws-rs-api-2.1.1/

‎java/ql/test/stubs/javax-ws-rs-api-2.1.1/javax/ws/rs/Produces.java

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,48 @@
1616

1717
package javax.ws.rs;
1818

19+
import java.lang.annotation.Documented;
20+
import java.lang.annotation.ElementType;
21+
import java.lang.annotation.Inherited;
22+
import java.lang.annotation.Retention;
23+
import java.lang.annotation.RetentionPolicy;
24+
import java.lang.annotation.Target;
25+
26+
/**
27+
* Defines the media type(s) that the methods of a resource class or
28+
* {@link javax.ws.rs.ext.MessageBodyWriter} can produce.
29+
* If not specified then a container will assume that any type can be produced.
30+
* Method level annotations override a class level annotation. A container
31+
* is responsible for ensuring that the method invoked is capable of producing
32+
* one of the media types requested in the HTTP request. If no such method is
33+
* available the container must respond with a HTTP "406 Not Acceptable" as
34+
* specified by RFC 2616.
35+
*
36+
* <p>A method for which there is a single-valued {@code @Produces}
37+
* is not required to set the media type of representations that it produces:
38+
* the container will use the value of the {@code @Produces} when
39+
* sending a response.</p>
40+
*
41+
* @author Paul Sandoz
42+
* @author Marc Hadley
43+
* @see javax.ws.rs.ext.MessageBodyWriter
44+
* @since 1.0
45+
*/
46+
@Inherited
47+
@Target({ElementType.TYPE, ElementType.METHOD})
48+
@Retention(RetentionPolicy.RUNTIME)
49+
@Documented
1950
public @interface Produces {
51+
52+
/**
53+
* A list of media types. Each entry may specify a single type or consist
54+
* of a comma separated list of types, with any leading or trailing white-spaces
55+
* in a single type entry being ignored. For example:
56+
* <pre>
57+
* {"image/jpeg, image/gif ", " image/png"}
58+
* </pre>
59+
* Use of the comma-separated form allows definition of a common string constant
60+
* for use on multiple targets.
61+
*/
2062
String[] value() default "*/*";
21-
}
63+
}

0 commit comments

Comments
 (0)