Skip to content

Commit ff0dacf

Browse files
luchua-bcluchua-bc
committed
Optimize the TaintTracking
1 parent b65a033 commit ff0dacf

File tree

3 files changed

+94
-76
lines changed

3 files changed

+94
-76
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql

Lines changed: 26 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,14 @@ import semmle.code.java.frameworks.Networking
1313
import semmle.code.java.dataflow.TaintTracking
1414
import DataFlow::PathGraph
1515

16+
/**
17+
* Gets a regular expression for matching private hosts, which only matches the host portion therefore checking for port is not necessary.
18+
*/
19+
private string getPrivateHostRegex() {
20+
result =
21+
"(?i)localhost(?:[:/?#].*)?|127\\.0\\.0\\.1(?:[:/?#].*)?|10(?:\\.[0-9]+){3}(?:[:/?#].*)?|172\\.16(?:\\.[0-9]+){2}(?:[:/?#].*)?|192.168(?:\\.[0-9]+){2}(?:[:/?#].*)?|\\[0:0:0:0:0:0:0:1\\](?:[:/?#].*)?|\\[::1\\](?:[:/?#].*)?"
22+
}
23+
1624
/**
1725
* The Java class `org.apache.http.client.methods.HttpRequestBase`. Popular subclasses include `HttpGet`, `HttpPost`, and `HttpPut`.
1826
* And the Java class `org.apache.http.message.BasicHttpRequest`.
@@ -35,16 +43,17 @@ class URLConstructor extends ClassInstanceExpr {
3543
predicate hasHttpStringArg() {
3644
this.getConstructor().getParameter(0).getType() instanceof TypeString and
3745
(
38-
// URLs constructed with the string constructor `URL(String spec)`
39-
this.getConstructor().getNumberOfParameters() = 1 and
40-
this.getArgument(0) instanceof HttpString // First argument contains the whole spec.
41-
or
4246
// URLs constructed with any of the three string constructors below:
4347
// `URL(String protocol, String host, int port, String file)`,
4448
// `URL(String protocol, String host, int port, String file, URLStreamHandler handler)`,
4549
// `URL(String protocol, String host, String file)`
4650
this.getConstructor().getNumberOfParameters() > 1 and
47-
concatHttpString(getArgument(0), this.getArgument(1)) // First argument contains the protocol part and the second argument contains the host part.
51+
concatHttpString(getArgument(0), this.getArgument(1))
52+
or
53+
// First argument contains the protocol part and the second argument contains the host part.
54+
// URLs constructed with the string constructor `URL(String spec)`
55+
this.getConstructor().getNumberOfParameters() = 1 and
56+
this.getArgument(0) instanceof HttpString // First argument contains the whole spec.
4857
)
4958
}
5059
}
@@ -57,32 +66,29 @@ class URIConstructor extends ClassInstanceExpr {
5766

5867
predicate hasHttpStringArg() {
5968
(
60-
this.getNumArgument() = 1 // `URI(String str)`
69+
this.getNumArgument() = 1 and
70+
this.getArgument(0) instanceof HttpString // `URI(String str)`
6171
or
6272
this.getNumArgument() = 4 and
6373
concatHttpString(this.getArgument(0), this.getArgument(1)) // `URI(String scheme, String host, String path, String fragment)`
6474
or
75+
this.getNumArgument() = 5 and
76+
concatHttpString(this.getArgument(0), this.getArgument(1)) // `URI(String scheme, String authority, String path, String query, String fragment)` without user-info in authority
77+
or
6578
this.getNumArgument() = 7 and
6679
concatHttpString(this.getArgument(0), this.getArgument(2)) // `URI(String scheme, String userInfo, String host, int port, String path, String query, String fragment)`
6780
)
6881
}
6982
}
7083

71-
/**
72-
* Gets a regular expression for matching private hosts.
73-
*/
74-
private string getPrivateHostRegex() {
75-
result = "(?i)localhost([:/].*)?|127\\.0\\.0\\.1([:/].*)?|10(\\.[0-9]+){3}([:/].*)?|172\\.16(\\.[0-9]+){2}([:/].*)?|192.168(\\.[0-9]+){2}([:/].*)?|\\[0:0:0:0:0:0:0:1\\]([:/].*)?|\\[::1\\]([:/].*)?"
76-
}
77-
7884
/**
7985
* String of HTTP URLs not in private domains.
8086
*/
8187
class HttpStringLiteral extends StringLiteral {
8288
HttpStringLiteral() {
8389
// Match URLs with the HTTP protocol and without private IP addresses to reduce false positives.
8490
exists(string s | this.getRepresentedString() = s |
85-
s.regexpMatch("(?i)http://[a-zA-Z0-9].*") and
91+
s.regexpMatch("(?i)http://[\\[a-zA-Z0-9].*") and
8692
not s.substring(7, s.length()).regexpMatch(getPrivateHostRegex())
8793
)
8894
}
@@ -121,15 +127,7 @@ class HttpString extends Expr {
121127
HttpString() {
122128
this instanceof HttpStringLiteral
123129
or
124-
this.(VarAccess).getVariable().getAnAssignedValue() instanceof HttpStringLiteral
125-
or
126130
concatHttpString(this.(AddExpr).getLeftOperand(), this.(AddExpr).getRightOperand())
127-
or
128-
concatHttpString(this.(AddExpr).getLeftOperand().(AddExpr).getLeftOperand(),
129-
this.(AddExpr).getLeftOperand().(AddExpr).getRightOperand())
130-
or
131-
concatHttpString(this.(AddExpr).getLeftOperand(),
132-
this.(AddExpr).getRightOperand().(AddExpr).getLeftOperand()) // First two elements of a string concatenated from an arbitrary number of elements.
133131
}
134132
}
135133

@@ -170,16 +168,15 @@ predicate apacheHttpRequest(DataFlow::Node node1, DataFlow::Node node2) {
170168
)
171169
}
172170

173-
/** Constructors of `URI` */
171+
/** `URI` methods */
174172
predicate createURI(DataFlow::Node node1, DataFlow::Node node2) {
175-
exists(URIConstructor cc |
173+
exists(URIConstructor cc | // new URI
176174
node2.asExpr() = cc and
177-
cc.getArgument(0) = node1.asExpr() and
178-
cc.hasHttpStringArg()
175+
cc.getArgument(0) = node1.asExpr()
179176
)
180177
or
181178
exists(
182-
StaticMethodAccess ma // URI.create
179+
StaticMethodAccess ma // URI.create
183180
|
184181
ma.getMethod().getDeclaringType().hasQualifiedName("java.net", "URI") and
185182
ma.getMethod().hasName("create") and
@@ -192,8 +189,7 @@ predicate createURI(DataFlow::Node node1, DataFlow::Node node2) {
192189
predicate createURL(DataFlow::Node node1, DataFlow::Node node2) {
193190
exists(URLConstructor cc |
194191
node2.asExpr() = cc and
195-
cc.getArgument(0) = node1.asExpr() and
196-
cc.hasHttpStringArg()
192+
cc.getArgument(0) = node1.asExpr()
197193
)
198194
}
199195

@@ -257,4 +253,4 @@ class BasicAuthFlowConfig extends TaintTracking::Configuration {
257253
from DataFlow::PathNode source, DataFlow::PathNode sink, BasicAuthFlowConfig config
258254
where config.hasFlowPath(source, sink)
259255
select sink.getNode(), source, sink, "Insecure basic authentication from $@.", source.getNode(),
260-
"this user input"
256+
"HTTP url"

‎java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected

Lines changed: 32 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,43 @@
11
edges
22
| InsecureBasicAuth.java:20:39:20:52 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post |
3-
| InsecureBasicAuth.java:20:39:20:81 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post |
4-
| InsecureBasicAuth.java:35:9:35:61 | "http://dashboardHost:dashboardPort/payment/retrieve" : String | InsecureBasicAuth.java:38:3:38:5 | get |
5-
| InsecureBasicAuth.java:36:29:36:31 | url : String | InsecureBasicAuth.java:38:3:38:5 | get |
3+
| InsecureBasicAuth.java:35:19:35:73 | "http://www.example.com:dashboardPort/payment/retrieve" : String | InsecureBasicAuth.java:38:3:38:5 | get |
64
| InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:54:3:54:6 | post |
7-
| InsecureBasicAuth.java:46:50:46:55 | uriStr : String | InsecureBasicAuth.java:54:3:54:6 | post |
8-
| InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:70:3:70:6 | post |
9-
| InsecureBasicAuth.java:62:56:62:61 | uriStr : String | InsecureBasicAuth.java:70:3:70:6 | post |
10-
| InsecureBasicAuth.java:77:19:77:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:87:3:87:6 | post |
11-
| InsecureBasicAuth.java:78:58:78:63 | uriStr : String | InsecureBasicAuth.java:87:3:87:6 | post |
12-
| InsecureBasicAuth.java:94:19:94:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:98:28:98:67 | (...)... : URLConnection |
13-
| InsecureBasicAuth.java:97:21:97:26 | urlStr : String | InsecureBasicAuth.java:98:28:98:67 | (...)... : URLConnection |
14-
| InsecureBasicAuth.java:98:28:98:67 | (...)... : URLConnection | InsecureBasicAuth.java:101:3:101:6 | conn |
15-
| InsecureBasicAuth.java:113:21:113:28 | protocol : String | InsecureBasicAuth.java:114:28:114:67 | (...)... : URLConnection |
16-
| InsecureBasicAuth.java:114:28:114:67 | (...)... : URLConnection | InsecureBasicAuth.java:117:3:117:6 | conn |
5+
| InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:71:3:71:6 | post |
6+
| InsecureBasicAuth.java:78:47:78:52 | "http" : String | InsecureBasicAuth.java:86:3:86:6 | post |
7+
| InsecureBasicAuth.java:93:19:93:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:102:3:102:6 | post |
8+
| InsecureBasicAuth.java:109:19:109:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:119:3:119:6 | post |
9+
| InsecureBasicAuth.java:126:19:126:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:130:28:130:67 | (...)... : URLConnection |
10+
| InsecureBasicAuth.java:130:28:130:67 | (...)... : URLConnection | InsecureBasicAuth.java:133:3:133:6 | conn |
11+
| InsecureBasicAuth.java:145:21:145:28 | protocol : String | InsecureBasicAuth.java:146:28:146:67 | (...)... : URLConnection |
12+
| InsecureBasicAuth.java:146:28:146:67 | (...)... : URLConnection | InsecureBasicAuth.java:149:3:149:6 | conn |
1713
nodes
1814
| InsecureBasicAuth.java:20:39:20:52 | ... + ... : String | semmle.label | ... + ... : String |
19-
| InsecureBasicAuth.java:20:39:20:81 | ... + ... : String | semmle.label | ... + ... : String |
2015
| InsecureBasicAuth.java:28:3:28:6 | post | semmle.label | post |
21-
| InsecureBasicAuth.java:35:9:35:61 | "http://dashboardHost:dashboardPort/payment/retrieve" : String | semmle.label | "http://dashboardHost:dashboardPort/payment/retrieve" : String |
22-
| InsecureBasicAuth.java:36:29:36:31 | url : String | semmle.label | url : String |
16+
| InsecureBasicAuth.java:35:19:35:73 | "http://www.example.com:dashboardPort/payment/retrieve" : String | semmle.label | "http://www.example.com:dashboardPort/payment/retrieve" : String |
2317
| InsecureBasicAuth.java:38:3:38:5 | get | semmle.label | get |
2418
| InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
25-
| InsecureBasicAuth.java:46:50:46:55 | uriStr : String | semmle.label | uriStr : String |
2619
| InsecureBasicAuth.java:54:3:54:6 | post | semmle.label | post |
2720
| InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
28-
| InsecureBasicAuth.java:62:56:62:61 | uriStr : String | semmle.label | uriStr : String |
29-
| InsecureBasicAuth.java:70:3:70:6 | post | semmle.label | post |
30-
| InsecureBasicAuth.java:77:19:77:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
31-
| InsecureBasicAuth.java:78:58:78:63 | uriStr : String | semmle.label | uriStr : String |
32-
| InsecureBasicAuth.java:87:3:87:6 | post | semmle.label | post |
33-
| InsecureBasicAuth.java:94:19:94:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
34-
| InsecureBasicAuth.java:97:21:97:26 | urlStr : String | semmle.label | urlStr : String |
35-
| InsecureBasicAuth.java:98:28:98:67 | (...)... : URLConnection | semmle.label | (...)... : URLConnection |
36-
| InsecureBasicAuth.java:101:3:101:6 | conn | semmle.label | conn |
37-
| InsecureBasicAuth.java:113:21:113:28 | protocol : String | semmle.label | protocol : String |
38-
| InsecureBasicAuth.java:114:28:114:67 | (...)... : URLConnection | semmle.label | (...)... : URLConnection |
39-
| InsecureBasicAuth.java:117:3:117:6 | conn | semmle.label | conn |
21+
| InsecureBasicAuth.java:71:3:71:6 | post | semmle.label | post |
22+
| InsecureBasicAuth.java:78:47:78:52 | "http" : String | semmle.label | "http" : String |
23+
| InsecureBasicAuth.java:86:3:86:6 | post | semmle.label | post |
24+
| InsecureBasicAuth.java:93:19:93:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
25+
| InsecureBasicAuth.java:102:3:102:6 | post | semmle.label | post |
26+
| InsecureBasicAuth.java:109:19:109:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
27+
| InsecureBasicAuth.java:119:3:119:6 | post | semmle.label | post |
28+
| InsecureBasicAuth.java:126:19:126:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
29+
| InsecureBasicAuth.java:130:28:130:67 | (...)... : URLConnection | semmle.label | (...)... : URLConnection |
30+
| InsecureBasicAuth.java:133:3:133:6 | conn | semmle.label | conn |
31+
| InsecureBasicAuth.java:145:21:145:28 | protocol : String | semmle.label | protocol : String |
32+
| InsecureBasicAuth.java:146:28:146:67 | (...)... : URLConnection | semmle.label | (...)... : URLConnection |
33+
| InsecureBasicAuth.java:149:3:149:6 | conn | semmle.label | conn |
4034
#select
41-
| InsecureBasicAuth.java:28:3:28:6 | post | InsecureBasicAuth.java:20:39:20:52 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:20:39:20:52 | ... + ... | this user input |
42-
| InsecureBasicAuth.java:28:3:28:6 | post | InsecureBasicAuth.java:20:39:20:81 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:20:39:20:81 | ... + ... | this user input |
43-
| InsecureBasicAuth.java:38:3:38:5 | get | InsecureBasicAuth.java:35:9:35:61 | "http://dashboardHost:dashboardPort/payment/retrieve" : String | InsecureBasicAuth.java:38:3:38:5 | get | Insecure basic authentication from $@. | InsecureBasicAuth.java:35:9:35:61 | "http://dashboardHost:dashboardPort/payment/retrieve" | this user input |
44-
| InsecureBasicAuth.java:38:3:38:5 | get | InsecureBasicAuth.java:36:29:36:31 | url : String | InsecureBasicAuth.java:38:3:38:5 | get | Insecure basic authentication from $@. | InsecureBasicAuth.java:36:29:36:31 | url | this user input |
45-
| InsecureBasicAuth.java:54:3:54:6 | post | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:54:3:54:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | this user input |
46-
| InsecureBasicAuth.java:54:3:54:6 | post | InsecureBasicAuth.java:46:50:46:55 | uriStr : String | InsecureBasicAuth.java:54:3:54:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:46:50:46:55 | uriStr | this user input |
47-
| InsecureBasicAuth.java:70:3:70:6 | post | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:70:3:70:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | this user input |
48-
| InsecureBasicAuth.java:70:3:70:6 | post | InsecureBasicAuth.java:62:56:62:61 | uriStr : String | InsecureBasicAuth.java:70:3:70:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:62:56:62:61 | uriStr | this user input |
49-
| InsecureBasicAuth.java:87:3:87:6 | post | InsecureBasicAuth.java:77:19:77:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:87:3:87:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:77:19:77:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | this user input |
50-
| InsecureBasicAuth.java:87:3:87:6 | post | InsecureBasicAuth.java:78:58:78:63 | uriStr : String | InsecureBasicAuth.java:87:3:87:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:78:58:78:63 | uriStr | this user input |
51-
| InsecureBasicAuth.java:101:3:101:6 | conn | InsecureBasicAuth.java:94:19:94:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:101:3:101:6 | conn | Insecure basic authentication from $@. | InsecureBasicAuth.java:94:19:94:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | this user input |
52-
| InsecureBasicAuth.java:101:3:101:6 | conn | InsecureBasicAuth.java:97:21:97:26 | urlStr : String | InsecureBasicAuth.java:101:3:101:6 | conn | Insecure basic authentication from $@. | InsecureBasicAuth.java:97:21:97:26 | urlStr | this user input |
53-
| InsecureBasicAuth.java:117:3:117:6 | conn | InsecureBasicAuth.java:113:21:113:28 | protocol : String | InsecureBasicAuth.java:117:3:117:6 | conn | Insecure basic authentication from $@. | InsecureBasicAuth.java:113:21:113:28 | protocol | this user input |
35+
| InsecureBasicAuth.java:28:3:28:6 | post | InsecureBasicAuth.java:20:39:20:52 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:20:39:20:52 | ... + ... | HTTP url |
36+
| InsecureBasicAuth.java:38:3:38:5 | get | InsecureBasicAuth.java:35:19:35:73 | "http://www.example.com:dashboardPort/payment/retrieve" : String | InsecureBasicAuth.java:38:3:38:5 | get | Insecure basic authentication from $@. | InsecureBasicAuth.java:35:19:35:73 | "http://www.example.com:dashboardPort/payment/retrieve" | HTTP url |
37+
| InsecureBasicAuth.java:54:3:54:6 | post | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:54:3:54:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | HTTP url |
38+
| InsecureBasicAuth.java:71:3:71:6 | post | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:71:3:71:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | HTTP url |
39+
| InsecureBasicAuth.java:86:3:86:6 | post | InsecureBasicAuth.java:78:47:78:52 | "http" : String | InsecureBasicAuth.java:86:3:86:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:78:47:78:52 | "http" | HTTP url |
40+
| InsecureBasicAuth.java:102:3:102:6 | post | InsecureBasicAuth.java:93:19:93:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:102:3:102:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:93:19:93:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | HTTP url |
41+
| InsecureBasicAuth.java:119:3:119:6 | post | InsecureBasicAuth.java:109:19:109:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:119:3:119:6 | post | Insecure basic authentication from $@. | InsecureBasicAuth.java:109:19:109:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | HTTP url |
42+
| InsecureBasicAuth.java:133:3:133:6 | conn | InsecureBasicAuth.java:126:19:126:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:133:3:133:6 | conn | Insecure basic authentication from $@. | InsecureBasicAuth.java:126:19:126:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" | HTTP url |
43+
| InsecureBasicAuth.java:149:3:149:6 | conn | InsecureBasicAuth.java:145:21:145:28 | protocol : String | InsecureBasicAuth.java:149:3:149:6 | conn | Insecure basic authentication from $@. | InsecureBasicAuth.java:145:21:145:28 | protocol | HTTP url |

0 commit comments

Comments
 (0)