Skip to content

Commit ce2cab0

Browse files
egregius313egregius313
committed
Move TaintedPath configurations to Query.qll
1 parent 434b1b3 commit ce2cab0

File tree

4 files changed

+110
-110
lines changed

4 files changed

+110
-110
lines changed

‎java/ql/lib/semmle/code/java/security/TaintedPathQuery.qll

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
/** Provides dataflow configurations for tainted path queries. */
2+
3+
import java
4+
import semmle.code.java.frameworks.Networking
5+
import semmle.code.java.dataflow.DataFlow
6+
import semmle.code.java.dataflow.FlowSources
7+
private import semmle.code.java.dataflow.ExternalFlow
8+
import semmle.code.java.security.PathCreation
9+
import semmle.code.java.security.PathSanitizer
10+
11+
/**
12+
* A unit class for adding additional taint steps.
13+
*
14+
* Extend this class to add additional taint steps that should apply to tainted path flow configurations.
15+
*/
16+
class TaintedPathAdditionalTaintStep extends Unit {
17+
abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);
18+
}
19+
20+
private class DefaultTaintedPathAdditionalTaintStep extends TaintedPathAdditionalTaintStep {
21+
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
22+
exists(Argument a |
23+
a = n1.asExpr() and
24+
a.getCall() = n2.asExpr() and
25+
a = any(TaintPreservingUriCtorParam tpp).getAnArgument()
26+
)
27+
}
28+
}
29+
30+
private class TaintPreservingUriCtorParam extends Parameter {
31+
TaintPreservingUriCtorParam() {
32+
exists(Constructor ctor, int idx, int nParams |
33+
ctor.getDeclaringType() instanceof TypeUri and
34+
this = ctor.getParameter(idx) and
35+
nParams = ctor.getNumberOfParameters()
36+
|
37+
// URI(String scheme, String ssp, String fragment)
38+
idx = 1 and nParams = 3
39+
or
40+
// URI(String scheme, String host, String path, String fragment)
41+
idx = [1, 2] and nParams = 4
42+
or
43+
// URI(String scheme, String authority, String path, String query, String fragment)
44+
idx = 2 and nParams = 5
45+
or
46+
// URI(String scheme, String userInfo, String host, int port, String path, String query, String fragment)
47+
idx = 4 and nParams = 7
48+
)
49+
}
50+
}
51+
52+
/**
53+
* A taint-tracking configuration for tracking flow from remote sources to the creation of a path.
54+
*/
55+
module TaintedPathConfig implements DataFlow::ConfigSig {
56+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
57+
58+
predicate isSink(DataFlow::Node sink) {
59+
sink.asExpr() = any(PathCreation p).getAnInput()
60+
or
61+
sinkNode(sink, ["create-file", "read-file"])
62+
}
63+
64+
predicate isBarrier(DataFlow::Node sanitizer) {
65+
sanitizer.getType() instanceof BoxedType or
66+
sanitizer.getType() instanceof PrimitiveType or
67+
sanitizer.getType() instanceof NumberType or
68+
sanitizer instanceof PathInjectionSanitizer
69+
}
70+
71+
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
72+
any(TaintedPathAdditionalTaintStep s).step(n1, n2)
73+
}
74+
}
75+
76+
/** Tracks flow from remote sources to the creation of a path. */
77+
module TaintedPathFlow = TaintTracking::Global<TaintedPathConfig>;
78+
79+
/**
80+
* A taint-tracking configuration for tracking flow from user input to the creation of a path.
81+
*/
82+
module TaintedPathLocalConfig implements DataFlow::ConfigSig {
83+
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
84+
85+
predicate isSink(DataFlow::Node sink) {
86+
sink.asExpr() = any(PathCreation p).getAnInput()
87+
or
88+
sinkNode(sink, "create-file")
89+
}
90+
91+
predicate isBarrier(DataFlow::Node sanitizer) {
92+
sanitizer.getType() instanceof BoxedType or
93+
sanitizer.getType() instanceof PrimitiveType or
94+
sanitizer.getType() instanceof NumberType or
95+
sanitizer instanceof PathInjectionSanitizer
96+
}
97+
98+
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
99+
any(TaintedPathAdditionalTaintStep s).step(n1, n2)
100+
}
101+
}
102+
103+
/** Tracks flow from user input to the creation of a path. */
104+
module TaintedPathLocalFlow = TaintTracking::Global<TaintedPathLocalConfig>;

‎java/ql/src/Security/CWE/CWE-022/TaintedPath.ql

Lines changed: 5 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -14,36 +14,8 @@
1414
*/
1515

1616
import java
17-
import semmle.code.java.dataflow.FlowSources
18-
private import semmle.code.java.dataflow.ExternalFlow
19-
import semmle.code.java.security.PathCreation
20-
import semmle.code.java.security.PathSanitizer
21-
import TaintedPathCommon
22-
23-
module TaintedPathConfig implements DataFlow::ConfigSig {
24-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
25-
26-
predicate isSink(DataFlow::Node sink) {
27-
sink.asExpr() = any(PathCreation p).getAnInput()
28-
or
29-
sinkNode(sink, ["create-file", "read-file"])
30-
}
31-
32-
predicate isBarrier(DataFlow::Node sanitizer) {
33-
sanitizer.getType() instanceof BoxedType or
34-
sanitizer.getType() instanceof PrimitiveType or
35-
sanitizer.getType() instanceof NumberType or
36-
sanitizer instanceof PathInjectionSanitizer
37-
}
38-
39-
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
40-
any(TaintedPathAdditionalTaintStep s).step(n1, n2)
41-
}
42-
}
43-
44-
module TaintedPath = TaintTracking::Global<TaintedPathConfig>;
45-
46-
import TaintedPath::PathGraph
17+
import semmle.code.java.security.TaintedPathQuery
18+
import TaintedPathFlow::PathGraph
4719

4820
/**
4921
* Gets the data-flow node at which to report a path ending at `sink`.
@@ -53,13 +25,13 @@ import TaintedPath::PathGraph
5325
* continue to report there; otherwise we report directly at `sink`.
5426
*/
5527
DataFlow::Node getReportingNode(DataFlow::Node sink) {
56-
TaintedPath::flowTo(sink) and
28+
TaintedPathFlow::flowTo(sink) and
5729
if exists(PathCreation pc | pc.getAnInput() = sink.asExpr())
5830
then result.asExpr() = any(PathCreation pc | pc.getAnInput() = sink.asExpr())
5931
else result = sink
6032
}
6133

62-
from TaintedPath::PathNode source, TaintedPath::PathNode sink
63-
where TaintedPath::flowPath(source, sink)
34+
from TaintedPathFlow::PathNode source, TaintedPathFlow::PathNode sink
35+
where TaintedPathFlow::flowPath(source, sink)
6436
select getReportingNode(sink.getNode()), source, sink, "This path depends on a $@.",
6537
source.getNode(), "user-provided value"

‎java/ql/src/Security/CWE/CWE-022/TaintedPathCommon.qll

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -14,35 +14,7 @@
1414
*/
1515

1616
import java
17-
import semmle.code.java.dataflow.FlowSources
18-
private import semmle.code.java.dataflow.ExternalFlow
19-
import semmle.code.java.security.PathCreation
20-
import semmle.code.java.security.PathSanitizer
21-
import TaintedPathCommon
22-
23-
module TaintedPathLocalConfig implements DataFlow::ConfigSig {
24-
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
25-
26-
predicate isSink(DataFlow::Node sink) {
27-
sink.asExpr() = any(PathCreation p).getAnInput()
28-
or
29-
sinkNode(sink, "create-file")
30-
}
31-
32-
predicate isBarrier(DataFlow::Node sanitizer) {
33-
sanitizer.getType() instanceof BoxedType or
34-
sanitizer.getType() instanceof PrimitiveType or
35-
sanitizer.getType() instanceof NumberType or
36-
sanitizer instanceof PathInjectionSanitizer
37-
}
38-
39-
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
40-
any(TaintedPathAdditionalTaintStep s).step(n1, n2)
41-
}
42-
}
43-
44-
module TaintedPathLocalFlow = TaintTracking::Global<TaintedPathLocalConfig>;
45-
17+
import semmle.code.java.security.TaintedPathQuery
4618
import TaintedPathLocalFlow::PathGraph
4719

4820
/**

0 commit comments

Comments
 (0)