Skip to content

Commit 2296224

Browse files
JLLeitschuhJLLeitschuh
committed
Update InsecureDependencyResolution with code review comments
1 parent f341234 commit 2296224

File tree

4 files changed

+111
-15
lines changed

4 files changed

+111
-15
lines changed

‎java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
* @precision very-high
77
* @id java/maven/non-https-url
88
* @tags security
9+
* external/cwe/cwe-300
910
* external/cwe/cwe-319
1011
* external/cwe/cwe-494
1112
* external/cwe/cwe-829
@@ -15,24 +16,22 @@ import java
1516
import semmle.code.xml.MavenPom
1617

1718
private class DeclaredRepository extends PomElement {
18-
DeclaredRepository() {
19-
this.getName() = "repository" or
20-
this.getName() = "snapshotRepository" or
21-
this.getName() = "pluginRepository"
22-
}
19+
DeclaredRepository() {
20+
this.getName() = "repository" or
21+
this.getName() = "snapshotRepository" or
22+
this.getName() = "pluginRepository"
23+
}
2324

24-
string getUrl() {
25-
result = getAChild("url").(PomElement).getValue()
26-
}
25+
string getUrl() { result = getAChild("url").(PomElement).getValue() }
2726

28-
predicate isInsecureRepositoryUsage() {
29-
getUrl().matches("http://%") or
30-
getUrl().matches("ftp://%")
31-
}
27+
predicate isInsecureRepositoryUsage() {
28+
getUrl().matches("http://%") or
29+
getUrl().matches("ftp://%")
30+
}
3231
}
3332

3433
from DeclaredRepository repository
3534
where repository.isInsecureRepositoryUsage()
36-
select
37-
repository,
38-
"Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository " + repository.getUrl()
35+
select repository,
36+
"Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to repository " +
37+
repository.getUrl()

‎java/ql/test/query-tests/security/CWE-829/semmle/tests/InsecureDependencyResolution.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-829/InsecureDependencyResolution.ql

‎java/ql/test/query-tests/security/CWE-829/semmle/tests/insecure-pom.xml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<!-- Duplicated in java/ql/src/Security/CWE/CWE-829/insecure-pom.xml -->
7+
8+
<modelVersion>4.0.0</modelVersion>
9+
10+
<groupId>com.semmle</groupId>
11+
<artifactId>parent</artifactId>
12+
<version>1.0</version>
13+
<packaging>pom</packaging>
14+
15+
<name>Security Testing</name>
16+
<description>An example of insecure download and upload of dependencies</description>
17+
18+
<distributionManagement>
19+
<repository>
20+
<id>insecure-releases</id>
21+
<name>Insecure Repository Releases</name>
22+
<!-- BAD! Use HTTPS -->
23+
<url>http://insecure-repository.example</url>
24+
</repository>
25+
<snapshotRepository>
26+
<id>insecure-snapshots</id>
27+
<name>Insecure Repository Snapshots</name>
28+
<!-- BAD! Use HTTPS -->
29+
<url>http://insecure-repository.example</url>
30+
</snapshotRepository>
31+
</distributionManagement>
32+
<repositories>
33+
<repository>
34+
<id>insecure</id>
35+
<name>Insecure Repository</name>
36+
<!-- BAD! Use HTTPS -->
37+
<url>http://insecure-repository.example</url>
38+
</repository>
39+
</repositories>
40+
<pluginRepositories>
41+
<pluginRepository>
42+
<id>insecure-plugins</id>
43+
<name>Insecure Repository Releases</name>
44+
<!-- BAD! Use HTTPS -->
45+
<url>http://insecure-repository.example</url>
46+
</pluginRepository>
47+
</pluginRepositories>
48+
</project>

‎java/ql/test/query-tests/security/CWE-829/semmle/tests/secure-pom.xml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<!-- Duplicated in java/ql/src/Security/CWE/CWE-829/secure-pom.xml -->
7+
8+
<modelVersion>4.0.0</modelVersion>
9+
10+
<groupId>com.semmle</groupId>
11+
<artifactId>parent</artifactId>
12+
<version>1.0</version>
13+
<packaging>pom</packaging>
14+
15+
<name>Security Testing</name>
16+
<description>An example of secure download and upload of dependencies</description>
17+
18+
<distributionManagement>
19+
<repository>
20+
<id>insecure-releases</id>
21+
<name>Secure Repository Releases</name>
22+
<!-- GOOD! Use HTTPS -->
23+
<url>https://insecure-repository.example</url>
24+
</repository>
25+
<snapshotRepository>
26+
<id>insecure-snapshots</id>
27+
<name>Secure Repository Snapshots</name>
28+
<!-- GOOD! Use HTTPS -->
29+
<url>https://insecure-repository.example</url>
30+
</snapshotRepository>
31+
</distributionManagement>
32+
<repositories>
33+
<repository>
34+
<id>insecure</id>
35+
<name>Secure Repository</name>
36+
<!-- GOOD! Use HTTPS -->
37+
<url>https://insecure-repository.example</url>
38+
</repository>
39+
</repositories>
40+
<pluginRepositories>
41+
<pluginRepository>
42+
<id>insecure-plugins</id>
43+
<name>Secure Repository Releases</name>
44+
<!-- GOOD! Use HTTPS -->
45+
<url>https://insecure-repository.example</url>
46+
</pluginRepository>
47+
</pluginRepositories>
48+
</project>

0 commit comments

Comments
 (0)