Skip to content

Commit 75d5fe6

Browse files
aschackmullaschackmull
authored
Merge pull request github#6090 from atorralba/atorralba/move-httpsurls-tests
Java: Move/tweak some tests
2 parents 96d8fc7 + e2918d5 commit 75d5fe6

File tree

5 files changed

+141
-2
lines changed

5 files changed

+141
-2
lines changed

‎java/ql/test/query-tests/security/CWE-311/CWE-319/HttpsUrls.expected

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
edges
2+
| HttpsUrlsTest.java:23:23:23:31 | "http://" : String | HttpsUrlsTest.java:28:50:28:50 | u |
3+
| HttpsUrlsTest.java:36:23:36:28 | "http" : String | HttpsUrlsTest.java:41:50:41:50 | u |
4+
| HttpsUrlsTest.java:49:23:49:31 | "http://" : String | HttpsUrlsTest.java:55:50:55:50 | u |
5+
| HttpsUrlsTest.java:87:23:87:28 | "http" : String | HttpsUrlsTest.java:92:50:92:50 | u |
6+
nodes
7+
| HttpsUrlsTest.java:23:23:23:31 | "http://" : String | semmle.label | "http://" : String |
8+
| HttpsUrlsTest.java:28:50:28:50 | u | semmle.label | u |
9+
| HttpsUrlsTest.java:36:23:36:28 | "http" : String | semmle.label | "http" : String |
10+
| HttpsUrlsTest.java:41:50:41:50 | u | semmle.label | u |
11+
| HttpsUrlsTest.java:49:23:49:31 | "http://" : String | semmle.label | "http://" : String |
12+
| HttpsUrlsTest.java:55:50:55:50 | u | semmle.label | u |
13+
| HttpsUrlsTest.java:87:23:87:28 | "http" : String | semmle.label | "http" : String |
14+
| HttpsUrlsTest.java:92:50:92:50 | u | semmle.label | u |
15+
#select
16+
| HttpsUrlsTest.java:28:50:28:67 | openConnection(...) | HttpsUrlsTest.java:23:23:23:31 | "http://" : String | HttpsUrlsTest.java:28:50:28:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:23:23:23:31 | "http://" | this source |
17+
| HttpsUrlsTest.java:41:50:41:67 | openConnection(...) | HttpsUrlsTest.java:36:23:36:28 | "http" : String | HttpsUrlsTest.java:41:50:41:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:36:23:36:28 | "http" | this source |
18+
| HttpsUrlsTest.java:55:50:55:67 | openConnection(...) | HttpsUrlsTest.java:49:23:49:31 | "http://" : String | HttpsUrlsTest.java:55:50:55:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:49:23:49:31 | "http://" | this source |
19+
| HttpsUrlsTest.java:92:50:92:67 | openConnection(...) | HttpsUrlsTest.java:87:23:87:28 | "http" : String | HttpsUrlsTest.java:92:50:92:50 | u | URL may have been constructed with HTTP protocol, using $@. | HttpsUrlsTest.java:87:23:87:28 | "http" | this source |

‎java/ql/test/query-tests/security/CWE-311/CWE-319/HttpsUrls.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-319/HttpsUrls.ql

‎java/ql/test/query-tests/security/CWE-311/CWE-319/HttpsUrlsTest.java

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
// Semmle test case for CWE-319: Cleartext Transmission of Sensitive Data
2+
// http://cwe.mitre.org/data/definitions/319.html
3+
package test.cwe319.cwe.examples;
4+
5+
import java.net.URL;
6+
import java.io.*;
7+
import java.rmi.*;
8+
import java.rmi.server.*;
9+
import java.rmi.registry.*;
10+
11+
import javax.net.ssl.HttpsURLConnection;
12+
import javax.rmi.ssl.*;
13+
14+
interface Hello extends java.rmi.Remote {
15+
String sayHello() throws java.rmi.RemoteException;
16+
}
17+
18+
class HelloImpl implements Hello {
19+
public static void main(String[] args) {
20+
try {
21+
// HttpsUrls
22+
{
23+
String protocol = "http://";
24+
URL u = new URL(protocol + "www.secret.example.org/");
25+
// using HttpsURLConnections to enforce SSL is desirable
26+
// BAD: this will give a ClassCastException at runtime, as the
27+
// http URL cannot be used to make an HttpsURLConnection
28+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
29+
hu.setRequestMethod("PUT");
30+
hu.connect();
31+
OutputStream os = hu.getOutputStream();
32+
hu.disconnect();
33+
}
34+
35+
{
36+
String protocol = "http";
37+
URL u = new URL(protocol, "www.secret.example.org", "foo");
38+
// using HttpsURLConnections to enforce SSL is desirable
39+
// BAD: this will give a ClassCastException at runtime, as the
40+
// http URL cannot be used to make an HttpsURLConnection
41+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
42+
hu.setRequestMethod("PUT");
43+
hu.connect();
44+
OutputStream os = hu.getOutputStream();
45+
hu.disconnect();
46+
}
47+
48+
{
49+
String protocol = "http://";
50+
// the second URL overwrites the first, as it has a protocol
51+
URL u = new URL(new URL("https://www.secret.example.org"), protocol + "www.secret.example.org");
52+
// using HttpsURLConnections to enforce SSL is desirable
53+
// BAD: this will give a ClassCastException at runtime, as the
54+
// http URL cannot be used to make an HttpsURLConnection
55+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
56+
hu.setRequestMethod("PUT");
57+
hu.connect();
58+
OutputStream os = hu.getOutputStream();
59+
hu.disconnect();
60+
}
61+
62+
{
63+
String protocol = "https://";
64+
URL u = new URL(protocol + "www.secret.example.org/");
65+
// using HttpsURLConnections to enforce SSL is desirable
66+
// GOOD: open connection to URL using HTTPS
67+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
68+
hu.setRequestMethod("PUT");
69+
hu.connect();
70+
OutputStream os = hu.getOutputStream();
71+
hu.disconnect();
72+
}
73+
74+
{
75+
String protocol = "https";
76+
URL u = new URL(protocol, "www.secret.example.org", "foo");
77+
// using HttpsURLConnections to enforce SSL is desirable
78+
// GOOD: open connection to URL using HTTPS
79+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
80+
hu.setRequestMethod("PUT");
81+
hu.connect();
82+
OutputStream os = hu.getOutputStream();
83+
hu.disconnect();
84+
}
85+
86+
{
87+
String protocol = "http";
88+
URL u = new URL(protocol, "internal-url", "foo");
89+
// FALSE POSITIVE: the query has no way of knowing whether the url will
90+
// resolve to somewhere outside the internal network, where there
91+
// are unlikely to be interception attempts
92+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
93+
hu.setRequestMethod("PUT");
94+
hu.connect();
95+
OutputStream os = hu.getOutputStream();
96+
hu.disconnect();
97+
}
98+
99+
{
100+
String input = "URL is: http://www.secret-example.org";
101+
String url = input.substring(8);
102+
URL u = new URL(url);
103+
// FALSE NEGATIVE: we cannot tell that the substring results in a url
104+
// string
105+
HttpsURLConnection hu = (HttpsURLConnection) u.openConnection();
106+
hu.setRequestMethod("PUT");
107+
hu.connect();
108+
OutputStream os = hu.getOutputStream();
109+
hu.disconnect();
110+
}
111+
} catch (Exception e) {
112+
// fail
113+
}
114+
}
115+
116+
public String sayHello() {
117+
return "Hello";
118+
}
119+
}

‎java/ql/test/query-tests/security/CWE-311/CWE-319/UseSSL.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
| Test.java:11:15:11:41 | getInputStream(...) | Stream using vulnerable non-SSL connection. |
1+
| UseSSLTest.java:11:15:11:41 | getInputStream(...) | Stream using vulnerable non-SSL connection. |

‎java/ql/test/query-tests/security/CWE-311/CWE-319/Test.java renamed to ‎java/ql/test/query-tests/security/CWE-311/CWE-319/UseSSLTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
import javax.net.ssl.HttpsURLConnection;
33
import java.io.*;
44

5-
class Test {
5+
class UseSSLTest {
66
public void m1(HttpURLConnection connection) throws java.io.IOException {
77
InputStream input;
88
if (connection instanceof HttpsURLConnection) {

0 commit comments

Comments
 (0)