Merge pull request github#12178 from felickz/main

Java - Adding support for com.microsoft.sqlserver.jdbc.SQLServerDataSource  to CWE-798

Author: atorralba

java/ql/lib/change-notes/2023-02-15-mssql-jdbc-hardcoded-credential-api.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query `java/hardcoded-credential-api-call` now recognizes methods that accept user and password from the SQLServerDataSource class of the Microsoft JDBC Driver for SQL Server.

java/ql/lib/semmle/code/java/security/SensitiveApi.qll

@@ -485,6 +485,10 @@ private predicate otherApiCallableCredentialParam(string s) {
       "com.mongodb.MongoCredential;createCredential(String, String, char[]);2",
       "com.mongodb.MongoCredential;createMongoCRCredential(String, String, char[]);2",
       "com.mongodb.MongoCredential;createPlainCredential(String, String, char[]);2",
-      "com.mongodb.MongoCredential;createScramSha1Credential(String, String, char[]);2"
+      "com.mongodb.MongoCredential;createScramSha1Credential(String, String, char[]);2",
+      "com.microsoft.sqlserver.jdbc.SQLServerDataSource;setUser(String);0",
+      "com.microsoft.sqlserver.jdbc.SQLServerDataSource;setPassword(String);0",
+      "com.microsoft.sqlserver.jdbc.SQLServerDataSource;getConnection(String, String);0",
+      "com.microsoft.sqlserver.jdbc.SQLServerDataSource;getConnection(String, String);1",
     ]
 }

java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedMSSQLCredentials.java

@@ -0,0 +1,10 @@
+import com.microsoft.sqlserver.jdbc.SQLServerDataSource;
+
+public class HardcodedMSSQLCredentials {
+    public static void main(SQLServerDataSource ds) throws Exception {        
+        ds.setUser("Username"); // $ HardcodedCredentialsApiCall      
+        ds.setPassword("password"); // $ HardcodedCredentialsApiCall
+        ds.getConnection("Username", null); // $ HardcodedCredentialsApiCall
+        ds.getConnection(null, "password"); // $ HardcodedCredentialsApiCall
+      }
+}

java/ql/test/query-tests/security/CWE-798/semmle/tests/options

@@ -1 +1 @@
-// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/amazon-aws-sdk-1.11.700:${testdir}/../../../../../stubs/azure-sdk-for-java:${testdir}/../../../../../stubs/shiro-core-1.4.0:${testdir}/../../../../../stubs/jsch-0.1.55:${testdir}/../../../../../stubs/ganymed-ssh-2-260:${testdir}/../../../../../stubs/apache-mina-sshd-2.8.0:${testdir}/../../../../../stubs/sshj-0.33.0:${testdir}/../../../../../stubs/j2ssh-1.5.5:${testdir}/../../../../../stubs/trilead-ssh2-212:${testdir}/../../../../../stubs/apache-commons-net-3.8.0:${testdir}/../../../../../stubs/mongodbClient
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/amazon-aws-sdk-1.11.700:${testdir}/../../../../../stubs/azure-sdk-for-java:${testdir}/../../../../../stubs/shiro-core-1.4.0:${testdir}/../../../../../stubs/jsch-0.1.55:${testdir}/../../../../../stubs/ganymed-ssh-2-260:${testdir}/../../../../../stubs/apache-mina-sshd-2.8.0:${testdir}/../../../../../stubs/sshj-0.33.0:${testdir}/../../../../../stubs/j2ssh-1.5.5:${testdir}/../../../../../stubs/trilead-ssh2-212:${testdir}/../../../../../stubs/apache-commons-net-3.8.0:${testdir}/../../../../../stubs/mongodbClient:${testdir}/../../../../../stubs/mssql-jdbc-12.2.0