[DIFF-INFORMED] Java: InsecureLdapAuth

d10c · d10c · commit 2d734056b157 · 2025-07-17T19:01:56.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-522/InsecureLdapAuth.ql#L21
diff --git a/java/ql/lib/semmle/code/java/security/InsecureLdapAuthQuery.qll b/java/ql/lib/semmle/code/java/security/InsecureLdapAuthQuery.qll
@@ -40,6 +40,10 @@ private module BasicAuthConfig implements DataFlow::ConfigSig {
   }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof InsecureLdapUrlSink }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // used as secondary flow to InsecureLdapUrlFlow in InsecureLdapAuth.ql
+  }
 }
 
 module BasicAuthFlow = DataFlow::Global<BasicAuthConfig>;
@@ -56,6 +60,10 @@ private module RequiresSslConfig implements DataFlow::ConfigSig {
   }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof InsecureLdapUrlSink }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // only used negatively in InsecureLdapAuth.ql
+  }
 }
 
 module RequiresSslFlow = DataFlow::Global<RequiresSslConfig>;

Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,10 @@ private module BasicAuthConfig implements DataFlow::ConfigSig {`
`40`	`40`	`}`
`41`	`41`
`42`	`42`	`predicate isSink(DataFlow::Node sink) { sink instanceof InsecureLdapUrlSink }`
	`43`	`+`
	`44`	`+ predicate observeDiffInformedIncrementalMode() {`
	`45`	`+ none() // used as secondary flow to InsecureLdapUrlFlow in InsecureLdapAuth.ql`
	`46`	`+ }`
`43`	`47`	`}`
`44`	`48`
`45`	`49`	`module BasicAuthFlow = DataFlow::Global<BasicAuthConfig>;`
`@@ -56,6 +60,10 @@ private module RequiresSslConfig implements DataFlow::ConfigSig {`
`56`	`60`	`}`
`57`	`61`
`58`	`62`	`predicate isSink(DataFlow::Node sink) { sink instanceof InsecureLdapUrlSink }`
	`63`	`+`
	`64`	`+ predicate observeDiffInformedIncrementalMode() {`
	`65`	`+ none() // only used negatively in InsecureLdapAuth.ql`
	`66`	`+ }`
`59`	`67`	`}`
`60`	`68`
`61`	`69`	`module RequiresSslFlow = DataFlow::Global<RequiresSslConfig>;`