Skip to content

Commit 2ace10f

Browse files
luchua-bcluchua-bc
committed
Use PostUpdateNode for wrapper method calls
1 parent 3151aef commit 2ace10f

File tree

2 files changed

+23
-22
lines changed

2 files changed

+23
-22
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
*/
1010

1111
import java
12+
import DataFlow
1213
import semmle.code.java.frameworks.Jndi
1314
import semmle.code.java.frameworks.Networking
1415
import semmle.code.java.dataflow.TaintTracking
@@ -167,7 +168,9 @@ class BasicAuthFlowConfig extends DataFlow::Configuration {
167168

168169
/** Source of `simple` configuration. */
169170
override predicate isSource(DataFlow::Node src) {
170-
exists(MethodAccess ma | isBasicAuthEnv(ma) and ma.getQualifier() = src.asExpr())
171+
exists(MethodAccess ma |
172+
isBasicAuthEnv(ma) and ma.getQualifier() = src.(PostUpdateNode).getPreUpdateNode().asExpr()
173+
)
171174
}
172175

173176
/** Sink of directory context creation. */
@@ -187,7 +190,9 @@ class SSLFlowConfig extends DataFlow::Configuration {
187190

188191
/** Source of `ssl` configuration. */
189192
override predicate isSource(DataFlow::Node src) {
190-
exists(MethodAccess ma | isSSLEnv(ma) and ma.getQualifier() = src.asExpr())
193+
exists(MethodAccess ma |
194+
isSSLEnv(ma) and ma.getQualifier() = src.(PostUpdateNode).getPreUpdateNode().asExpr()
195+
)
191196
}
192197

193198
/** Sink of directory context creation. */

‎java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.expected‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,57 @@
11
edges
22
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:20:49:20:59 | environment |
3-
| InsecureLdapAuth.java:17:52:17:59 | "simple" : String | InsecureLdapAuth.java:20:49:20:59 | environment |
3+
| InsecureLdapAuth.java:17:3:17:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:20:49:20:59 | environment |
44
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | InsecureLdapAuth.java:34:49:34:59 | environment |
5-
| InsecureLdapAuth.java:31:52:31:59 | "simple" : String | InsecureLdapAuth.java:34:49:34:59 | environment |
6-
| InsecureLdapAuth.java:45:52:45:59 | "simple" : String | InsecureLdapAuth.java:48:49:48:59 | environment |
5+
| InsecureLdapAuth.java:31:3:31:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:34:49:34:59 | environment |
6+
| InsecureLdapAuth.java:45:3:45:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:48:49:48:59 | environment |
77
| InsecureLdapAuth.java:53:20:53:50 | "ldap://ad.your-server.com:636" : String | InsecureLdapAuth.java:63:49:63:59 | environment |
8-
| InsecureLdapAuth.java:59:52:59:59 | "simple" : String | InsecureLdapAuth.java:63:49:63:59 | environment |
9-
| InsecureLdapAuth.java:62:46:62:50 | "ssl" : String | InsecureLdapAuth.java:63:49:63:59 | environment |
8+
| InsecureLdapAuth.java:59:3:59:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:63:49:63:59 | environment |
9+
| InsecureLdapAuth.java:62:3:62:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:63:49:63:59 | environment |
1010
| InsecureLdapAuth.java:68:20:68:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:77:49:77:59 | environment |
11-
| InsecureLdapAuth.java:88:52:88:59 | "simple" : String | InsecureLdapAuth.java:91:49:91:59 | environment |
11+
| InsecureLdapAuth.java:88:3:88:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:91:49:91:59 | environment |
1212
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:105:59:105:69 | environment |
13-
| InsecureLdapAuth.java:102:52:102:59 | "simple" : String | InsecureLdapAuth.java:105:59:105:69 | environment |
13+
| InsecureLdapAuth.java:102:3:102:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:105:59:105:69 | environment |
1414
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:120:49:120:59 | environment |
15-
| InsecureLdapAuth.java:117:58:117:65 | "simple" : String | InsecureLdapAuth.java:120:49:120:59 | environment |
15+
| InsecureLdapAuth.java:117:3:117:13 | environment [post update] : Hashtable | InsecureLdapAuth.java:120:49:120:59 | environment |
1616
| InsecureLdapAuth.java:124:3:124:5 | env [post update] : Hashtable | InsecureLdapAuth.java:137:10:137:20 | environment [post update] : Hashtable |
17-
| InsecureLdapAuth.java:124:38:124:42 | "ssl" : String | InsecureLdapAuth.java:124:3:124:5 | env [post update] : Hashtable |
1817
| InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable | InsecureLdapAuth.java:141:16:141:26 | environment [post update] : Hashtable |
1918
| InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable | InsecureLdapAuth.java:152:16:152:26 | environment [post update] : Hashtable |
20-
| InsecureLdapAuth.java:128:44:128:51 | "simple" : String | InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable |
2119
| InsecureLdapAuth.java:135:20:135:39 | ... + ... : String | InsecureLdapAuth.java:142:50:142:60 | environment |
2220
| InsecureLdapAuth.java:137:10:137:20 | environment [post update] : Hashtable | InsecureLdapAuth.java:142:50:142:60 | environment |
2321
| InsecureLdapAuth.java:141:16:141:26 | environment [post update] : Hashtable | InsecureLdapAuth.java:142:50:142:60 | environment |
2422
| InsecureLdapAuth.java:147:20:147:39 | ... + ... : String | InsecureLdapAuth.java:153:50:153:60 | environment |
2523
| InsecureLdapAuth.java:152:16:152:26 | environment [post update] : Hashtable | InsecureLdapAuth.java:153:50:153:60 | environment |
2624
nodes
2725
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
28-
| InsecureLdapAuth.java:17:52:17:59 | "simple" : String | semmle.label | "simple" : String |
26+
| InsecureLdapAuth.java:17:3:17:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
2927
| InsecureLdapAuth.java:20:49:20:59 | environment | semmle.label | environment |
3028
| InsecureLdapAuth.java:20:49:20:59 | environment | semmle.label | environment |
3129
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | semmle.label | ... + ... : String |
32-
| InsecureLdapAuth.java:31:52:31:59 | "simple" : String | semmle.label | "simple" : String |
30+
| InsecureLdapAuth.java:31:3:31:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
3331
| InsecureLdapAuth.java:34:49:34:59 | environment | semmle.label | environment |
3432
| InsecureLdapAuth.java:34:49:34:59 | environment | semmle.label | environment |
35-
| InsecureLdapAuth.java:45:52:45:59 | "simple" : String | semmle.label | "simple" : String |
33+
| InsecureLdapAuth.java:45:3:45:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
3634
| InsecureLdapAuth.java:48:49:48:59 | environment | semmle.label | environment |
3735
| InsecureLdapAuth.java:53:20:53:50 | "ldap://ad.your-server.com:636" : String | semmle.label | "ldap://ad.your-server.com:636" : String |
38-
| InsecureLdapAuth.java:59:52:59:59 | "simple" : String | semmle.label | "simple" : String |
39-
| InsecureLdapAuth.java:62:46:62:50 | "ssl" : String | semmle.label | "ssl" : String |
36+
| InsecureLdapAuth.java:59:3:59:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
37+
| InsecureLdapAuth.java:62:3:62:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
4038
| InsecureLdapAuth.java:63:49:63:59 | environment | semmle.label | environment |
4139
| InsecureLdapAuth.java:63:49:63:59 | environment | semmle.label | environment |
4240
| InsecureLdapAuth.java:63:49:63:59 | environment | semmle.label | environment |
4341
| InsecureLdapAuth.java:68:20:68:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
4442
| InsecureLdapAuth.java:77:49:77:59 | environment | semmle.label | environment |
45-
| InsecureLdapAuth.java:88:52:88:59 | "simple" : String | semmle.label | "simple" : String |
43+
| InsecureLdapAuth.java:88:3:88:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
4644
| InsecureLdapAuth.java:91:49:91:59 | environment | semmle.label | environment |
4745
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
48-
| InsecureLdapAuth.java:102:52:102:59 | "simple" : String | semmle.label | "simple" : String |
46+
| InsecureLdapAuth.java:102:3:102:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
4947
| InsecureLdapAuth.java:105:59:105:69 | environment | semmle.label | environment |
5048
| InsecureLdapAuth.java:105:59:105:69 | environment | semmle.label | environment |
5149
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
52-
| InsecureLdapAuth.java:117:58:117:65 | "simple" : String | semmle.label | "simple" : String |
50+
| InsecureLdapAuth.java:117:3:117:13 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
5351
| InsecureLdapAuth.java:120:49:120:59 | environment | semmle.label | environment |
5452
| InsecureLdapAuth.java:120:49:120:59 | environment | semmle.label | environment |
5553
| InsecureLdapAuth.java:124:3:124:5 | env [post update] : Hashtable | semmle.label | env [post update] : Hashtable |
56-
| InsecureLdapAuth.java:124:38:124:42 | "ssl" : String | semmle.label | "ssl" : String |
5754
| InsecureLdapAuth.java:128:3:128:5 | env [post update] : Hashtable | semmle.label | env [post update] : Hashtable |
58-
| InsecureLdapAuth.java:128:44:128:51 | "simple" : String | semmle.label | "simple" : String |
5955
| InsecureLdapAuth.java:135:20:135:39 | ... + ... : String | semmle.label | ... + ... : String |
6056
| InsecureLdapAuth.java:137:10:137:20 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |
6157
| InsecureLdapAuth.java:141:16:141:26 | environment [post update] : Hashtable | semmle.label | environment [post update] : Hashtable |

0 commit comments

Comments
 (0)