Skip to content

Java: Make security-related TaintTracking Configuration public #8676

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aschackmull merged 3 commits into from
Apr 6, 2022
Merged

Java: Make security-related TaintTracking Configuration public #8676

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
abaa71e
Update Sql Injection queries
pwntester Apr 6, 2022
19b8d51
Update CommandLineQuery
pwntester Apr 6, 2022
9ccd0e5
Add QLDocs
pwntester Apr 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,10 @@ import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.ExternalProcess
import semmle.code.java.security.CommandArguments

private class RemoteUserInputToArgumentToExecFlowConfig extends TaintTracking::Configuration {
/**
* A taint-tracking configuration for unvalidated user input that is used to run an external process.
*/
class RemoteUserInputToArgumentToExecFlowConfig extends TaintTracking::Configuration {
RemoteUserInputToArgumentToExecFlowConfig() {
this = "ExecCommon::RemoteUserInputToArgumentToExecFlowConfig"
}
Expand Down
13 changes: 11 additions & 2 deletions .../Security/CWE/CWE-089/SqlInjectionLib.qll → .../code/java/security/SqlInjectionQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,19 @@
/** Definitions used by the queries for database query injection. */
/**
* Provides taint tracking and dataflow configurations to be used in Sql injection queries.
*
* Do not import this from a library file, in order to reduce the risk of
* unintentionally bringing a TaintTracking::Configuration into scope in an unrelated
* query.
*/

import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.QueryInjection

private class QueryInjectionFlowConfig extends TaintTracking::Configuration {
/**
* A taint-tracking configuration for unvalidated user input that is used in SQL queries.
*/
class QueryInjectionFlowConfig extends TaintTracking::Configuration {
QueryInjectionFlowConfig() { this = "SqlInjectionLib::QueryInjectionFlowConfig" }

override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
Expand Down
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

import java
import semmle.code.java.dataflow.FlowSources
import SqlInjectionLib
import semmle.code.java.security.SqlInjectionQuery
import DataFlow::PathGraph

from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink
Expand Down
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-089/SqlTaintedLocal.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

import semmle.code.java.Expr
import semmle.code.java.dataflow.FlowSources
import SqlInjectionLib
import semmle.code.java.security.SqlInjectionQuery
import DataFlow::PathGraph

class LocalUserInputToQueryInjectionFlowConfig extends TaintTracking::Configuration {
Expand Down
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-089/SqlUnescaped.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

import java
import semmle.code.java.security.SqlUnescapedLib
import SqlInjectionLib
import semmle.code.java.security.SqlInjectionQuery

class UncontrolledStringBuilderSource extends DataFlow::ExprNode {
UncontrolledStringBuilderSource() {
Expand Down