Skip to content

Commit b3bdf89

Browse files
haby0haby0
committed
rm VerificationMethodFlowConfig, use springframework-5.2.3 stub
1 parent 77208bc commit b3bdf89

File tree

40 files changed

+346
-866
lines changed

40 files changed

+346
-866
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java

Lines changed: 2 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -105,52 +105,9 @@ public String bad7(HttpServletRequest request) {
105105
return resultStr;
106106
}
107107

108-
@GetMapping(value = "jsonp8")
109-
@ResponseBody
110-
public String bad8(HttpServletRequest request) {
111-
String resultStr = null;
112-
String token = request.getParameter("token");
113-
boolean result = verifToken(token); //Just check.
114-
String jsonpCallback = request.getParameter("jsonpCallback");
115-
String jsonStr = getJsonStr(hashMap);
116-
resultStr = jsonpCallback + "(" + jsonStr + ")";
117-
return resultStr;
118-
}
119-
120-
121-
@GetMapping(value = "jsonp9")
122-
@ResponseBody
123-
public String good1(HttpServletRequest request) {
124-
String resultStr = null;
125-
String referer = request.getParameter("referer");
126-
if (verifReferer(referer)){
127-
String jsonpCallback = request.getParameter("jsonpCallback");
128-
String jsonStr = getJsonStr(hashMap);
129-
resultStr = jsonpCallback + "(" + jsonStr + ")";
130-
return resultStr;
131-
}
132-
return "error";
133-
}
134-
135-
136-
@GetMapping(value = "jsonp10")
137-
@ResponseBody
138-
public String good2(HttpServletRequest request) {
139-
String resultStr = null;
140-
String token = request.getParameter("token");
141-
boolean result = verifToken(token);
142-
if (result){
143-
return "";
144-
}
145-
String jsonpCallback = request.getParameter("jsonpCallback");
146-
String jsonStr = getJsonStr(hashMap);
147-
resultStr = jsonpCallback + "(" + jsonStr + ")";
148-
return resultStr;
149-
}
150-
151108
@RequestMapping(value = "jsonp11")
152109
@ResponseBody
153-
public String good3(HttpServletRequest request) {
110+
public String good1(HttpServletRequest request) {
154111
JSONObject parameterObj = readToJSONObect(request);
155112
String resultStr = null;
156113
String jsonpCallback = request.getParameter("jsonpCallback");
@@ -161,7 +118,7 @@ public String good3(HttpServletRequest request) {
161118

162119
@RequestMapping(value = "jsonp12")
163120
@ResponseBody
164-
public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
121+
public String good2(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
165122
if(null == file){
166123
return "upload file error";
167124
}
@@ -201,18 +158,4 @@ public static String readPostContent(HttpServletRequest request){
201158
public static String getJsonStr(Object result) {
202159
return JSONObject.toJSONString(result);
203160
}
204-
205-
public static boolean verifToken(String token){
206-
if (token != "xxxx"){
207-
return false;
208-
}
209-
return true;
210-
}
211-
212-
public static boolean verifReferer(String str){
213-
if (str != "xxxx"){
214-
return false;
215-
}
216-
return true;
217-
}
218161
}

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,9 @@ When there is a cross-domain problem, this could lead to information leakage.</p
1414
</recommendation>
1515
<example>
1616

17-
<p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad8</code>,
17+
<p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad7</code>,
1818
will cause information leakage when there are cross-domain problems. In a good case, for example, in the <code>good1</code>
19-
method and the <code>good2</code> method, using the <code>verifToken</code> method to do random <code>token</code> verification
20-
solves the problem of information leakage even in the presence of cross-domain access issues.</p>
19+
method and the <code>good2</code> method, When these two methods process the request, there must be a request body in the request, which does not meet the conditions of Jsonp injection.</p>
2120

2221
<sample src="JsonpInjection.java" />
2322

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -7,62 +7,11 @@ import semmle.code.java.dataflow.DataFlow3
77
import semmle.code.java.dataflow.FlowSources
88
import semmle.code.java.frameworks.spring.SpringController
99

10-
/** A data flow configuration tracing flow from the result of a method whose name includes token/auth/referer/origin to an if-statement condition. */
11-
class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
12-
VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
13-
14-
override predicate isSource(DataFlow::Node src) {
15-
exists(MethodAccess ma | ma instanceof BarrierGuard |
16-
(
17-
ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
18-
or
19-
ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
20-
) and
21-
ma = src.asExpr()
22-
)
23-
}
24-
25-
override predicate isSink(DataFlow::Node sink) {
26-
exists(IfStmt is | is.getCondition() = sink.asExpr())
27-
}
28-
}
29-
30-
/**
31-
* Taint-tracking configuration tracing flow from untrusted inputs to an argument of a function whose result is used as an if-statement condition.
32-
*
33-
* For example, in the context `String userControlled = request.getHeader("xyz"); boolean isGood = checkToken(userControlled); if(isGood) { ...`,
34-
* the flow from `checkToken`'s result to the condition of `if(isGood)` matches the configuration `VerificationMethodToIfFlowConfig` above,
35-
* and so the flow from `getHeader(...)` to the argument to `checkToken` matches this configuration.
36-
*/
37-
class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
38-
VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
39-
40-
override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
41-
42-
override predicate isSink(DataFlow::Node sink) {
43-
exists(MethodAccess ma, int i, VerificationMethodToIfFlowConfig vmtifc |
44-
ma instanceof BarrierGuard
45-
|
46-
(
47-
ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
48-
or
49-
ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
50-
) and
51-
ma.getArgument(i) = sink.asExpr() and
52-
vmtifc.hasFlow(exprNode(ma), _)
53-
)
54-
}
55-
}
56-
5710
/**
5811
* A method that is called to handle an HTTP GET request.
5912
*/
6013
abstract class RequestGetMethod extends Method {
6114
RequestGetMethod() {
62-
not exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
63-
vmfc.hasFlow(source, sink) and
64-
any(this).polyCalls*(source.getEnclosingCallable())
65-
) and
6615
not exists(MethodAccess ma |
6716
ma.getMethod() instanceof ServletRequestGetBodyMethod and
6817
any(this).polyCalls*(ma.getEnclosingCallable())

‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpController.java renamed to ‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java

Lines changed: 2 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -105,52 +105,9 @@ public String bad7(HttpServletRequest request) {
105105
return resultStr;
106106
}
107107

108-
@GetMapping(value = "jsonp8")
109-
@ResponseBody
110-
public String bad8(HttpServletRequest request) {
111-
String resultStr = null;
112-
String token = request.getParameter("token");
113-
boolean result = verifToken(token); //Just check.
114-
String jsonpCallback = request.getParameter("jsonpCallback");
115-
String jsonStr = getJsonStr(hashMap);
116-
resultStr = jsonpCallback + "(" + jsonStr + ")";
117-
return resultStr;
118-
}
119-
120-
121-
@GetMapping(value = "jsonp9")
122-
@ResponseBody
123-
public String good1(HttpServletRequest request) {
124-
String resultStr = null;
125-
String referer = request.getParameter("referer");
126-
if (verifReferer(referer)){
127-
String jsonpCallback = request.getParameter("jsonpCallback");
128-
String jsonStr = getJsonStr(hashMap);
129-
resultStr = jsonpCallback + "(" + jsonStr + ")";
130-
return resultStr;
131-
}
132-
return "error";
133-
}
134-
135-
136-
@GetMapping(value = "jsonp10")
137-
@ResponseBody
138-
public String good2(HttpServletRequest request) {
139-
String resultStr = null;
140-
String token = request.getParameter("token");
141-
boolean result = verifToken(token);
142-
if (result){
143-
return "";
144-
}
145-
String jsonpCallback = request.getParameter("jsonpCallback");
146-
String jsonStr = getJsonStr(hashMap);
147-
resultStr = jsonpCallback + "(" + jsonStr + ")";
148-
return resultStr;
149-
}
150-
151108
@RequestMapping(value = "jsonp11")
152109
@ResponseBody
153-
public String good3(HttpServletRequest request) {
110+
public String good1(HttpServletRequest request) {
154111
JSONObject parameterObj = readToJSONObect(request);
155112
String resultStr = null;
156113
String jsonpCallback = request.getParameter("jsonpCallback");
@@ -161,7 +118,7 @@ public String good3(HttpServletRequest request) {
161118

162119
@RequestMapping(value = "jsonp12")
163120
@ResponseBody
164-
public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
121+
public String good2(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
165122
if(null == file){
166123
return "upload file error";
167124
}
@@ -201,18 +158,4 @@ public static String readPostContent(HttpServletRequest request){
201158
public static String getJsonStr(Object result) {
202159
return JSONObject.toJSONString(result);
203160
}
204-
205-
public static boolean verifToken(String token){
206-
if (token != "xxxx"){
207-
return false;
208-
}
209-
return true;
210-
}
211-
212-
public static boolean verifReferer(String str){
213-
if (str != "xxxx"){
214-
return false;
215-
}
216-
return true;
217-
}
218161
}

‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.expected renamed to ‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,8 @@ edges
1313
| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
1414
| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
1515
| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
16-
| JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr |
17-
| JsonpController.java:116:21:116:55 | ... + ... : String | JsonpController.java:117:16:117:24 | resultStr |
18-
| JsonpController.java:129:25:129:59 | ... + ... : String | JsonpController.java:130:20:130:28 | resultStr |
19-
| JsonpController.java:147:21:147:55 | ... + ... : String | JsonpController.java:148:16:148:24 | resultStr |
20-
| JsonpController.java:158:21:158:54 | ... + ... : String | JsonpController.java:159:16:159:24 | resultStr |
21-
| JsonpController.java:173:21:173:54 | ... + ... : String | JsonpController.java:174:16:174:24 | resultStr |
16+
| JsonpController.java:115:21:115:54 | ... + ... : String | JsonpController.java:116:16:116:24 | resultStr |
17+
| JsonpController.java:130:21:130:54 | ... + ... : String | JsonpController.java:131:16:131:24 | resultStr |
2218
nodes
2319
| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
2420
| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
@@ -48,18 +44,10 @@ nodes
4844
| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
4945
| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
5046
| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
51-
| JsonpController.java:114:32:114:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
52-
| JsonpController.java:116:21:116:55 | ... + ... : String | semmle.label | ... + ... : String |
53-
| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
54-
| JsonpController.java:117:16:117:24 | resultStr | semmle.label | resultStr |
55-
| JsonpController.java:129:25:129:59 | ... + ... : String | semmle.label | ... + ... : String |
56-
| JsonpController.java:130:20:130:28 | resultStr | semmle.label | resultStr |
57-
| JsonpController.java:147:21:147:55 | ... + ... : String | semmle.label | ... + ... : String |
58-
| JsonpController.java:148:16:148:24 | resultStr | semmle.label | resultStr |
59-
| JsonpController.java:158:21:158:54 | ... + ... : String | semmle.label | ... + ... : String |
60-
| JsonpController.java:159:16:159:24 | resultStr | semmle.label | resultStr |
61-
| JsonpController.java:173:21:173:54 | ... + ... : String | semmle.label | ... + ... : String |
62-
| JsonpController.java:174:16:174:24 | resultStr | semmle.label | resultStr |
47+
| JsonpController.java:115:21:115:54 | ... + ... : String | semmle.label | ... + ... : String |
48+
| JsonpController.java:116:16:116:24 | resultStr | semmle.label | resultStr |
49+
| JsonpController.java:130:21:130:54 | ... + ... : String | semmle.label | ... + ... : String |
50+
| JsonpController.java:131:16:131:24 | resultStr | semmle.label | resultStr |
6351
#select
6452
| JsonpController.java:37:16:37:24 | resultStr | JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:33:32:33:68 | getParameter(...) | this user input |
6553
| JsonpController.java:46:16:46:24 | resultStr | JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:44:32:44:68 | getParameter(...) | this user input |
@@ -68,4 +56,3 @@ nodes
6856
| JsonpController.java:80:20:80:28 | resultStr | JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:73:32:73:68 | getParameter(...) | this user input |
6957
| JsonpController.java:94:20:94:28 | resultStr | JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:87:32:87:68 | getParameter(...) | this user input |
7058
| JsonpController.java:105:16:105:24 | resultStr | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:101:32:101:68 | getParameter(...) | this user input |
71-
| JsonpController.java:117:16:117:24 | resultStr | JsonpController.java:114:32:114:68 | getParameter(...) : String | JsonpController.java:117:16:117:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:114:32:114:68 | getParameter(...) | this user input |

‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/JsonpInjection.qlref renamed to ‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref

File renamed without changes.

‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithSpringController/options

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)