Skip to content

Commit 8fe2f4a

Browse files
aschackmullaschackmull
authored
Merge pull request #6034 from owen-mc/java/jax-rs
Improve JAX-WS and JAX-RS models
2 parents b173b41 + 945db01 commit 8fe2f4a

File tree

113 files changed

+8406
-37
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

113 files changed

+8406
-37
lines changed

‎java/change-notes/2021-03-22-jax-rs-improvements.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Added support for detecting XSS via JAX-RS sinks, and propagating tainted data via various container types (e.g. Form, Cookie, MultivaluedMap).

‎java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,9 @@ class MatchesHttpOnlyConfiguration extends TaintTracking2::Configuration {
7474
}
7575
}
7676

77-
/** A class descended from `javax.servlet.http.Cookie` or `javax/jakarta.ws.rs.core.Cookie`. */
77+
/** A class descended from `javax.servlet.http.Cookie`. */
7878
class CookieClass extends RefType {
79-
CookieClass() {
80-
this.getASupertype*()
81-
.hasQualifiedName(["javax.servlet.http", "javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
82-
}
79+
CookieClass() { this.getASupertype*().hasQualifiedName("javax.servlet.http", "Cookie") }
8380
}
8481

8582
/** Holds if `expr` is any boolean-typed expression other than literal `false`. */

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ private module Frameworks {
8181
private import semmle.code.java.frameworks.apache.Lang
8282
private import semmle.code.java.frameworks.guava.Guava
8383
private import semmle.code.java.frameworks.jackson.JacksonSerializability
84+
private import semmle.code.java.frameworks.JaxWS
8485
private import semmle.code.java.security.ResponseSplitting
8586
private import semmle.code.java.security.InformationLeak
8687
private import semmle.code.java.security.XSS

‎java/ql/src/semmle/code/java/frameworks/JavaxAnnotations.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,13 @@ class InterceptorsAnnotation extends Annotation {
137137
* Annotations in the package `javax.jws`.
138138
*/
139139

140+
/**
141+
* A `@javax.jws.WebMethod` annotation.
142+
*/
143+
class WebMethodAnnotation extends Annotation {
144+
WebMethodAnnotation() { this.getType().hasQualifiedName("javax.jws", "WebMethod") }
145+
}
146+
140147
/**
141148
* A `@javax.jws.WebService` annotation.
142149
*/

‎java/ql/src/semmle/code/java/frameworks/JaxWS.qll‎

Lines changed: 586 additions & 23 deletions
Large diffs are not rendered by default.

‎java/ql/src/semmle/code/java/frameworks/guava/Base.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private class GuavaBaseCsv extends SummaryModelCsv {
77
override predicate row(string row) {
88
row =
99
[
10-
//"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
10+
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
1111
"com.google.common.base;Strings;false;emptyToNull;(String);;Argument[0];ReturnValue;value",
1212
"com.google.common.base;Strings;false;nullToEmpty;(String);;Argument[0];ReturnValue;value",
1313
"com.google.common.base;Strings;false;padStart;(String,int,char);;Argument[0];ReturnValue;taint",

‎java/ql/src/semmle/code/java/frameworks/guava/IO.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private class GuavaIoCsv extends SummaryModelCsv {
77
override predicate row(string row) {
88
row =
99
[
10-
//"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
10+
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
1111
"com.google.common.io;BaseEncoding;true;decode;(CharSequence);;Argument[0];ReturnValue;taint",
1212
"com.google.common.io;BaseEncoding;true;decodingStream;(Reader);;Argument[0];ReturnValue;taint",
1313
"com.google.common.io;BaseEncoding;true;decodingSource;(CharSource);;Argument[0];ReturnValue;taint",
@@ -89,7 +89,7 @@ private class GuavaIoSinkCsv extends SinkModelCsv {
8989
override predicate row(string row) {
9090
row =
9191
[
92-
//"package;type;overrides;name;signature;ext;inputspec;kind",
92+
//`namespace; type; subtypes; name; signature; ext; input; kind`
9393
"com.google.common.io;Resources;false;asByteSource;(URL);;Argument[0];url-open-stream",
9494
"com.google.common.io;Resources;false;asCharSource;(URL,Charset);;Argument[0];url-open-stream",
9595
"com.google.common.io;Resources;false;copy;(URL,OutputStream);;Argument[0];url-open-stream",

‎java/ql/src/semmle/code/java/security/UrlRedirect.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,19 @@
22

33
import java
44
import semmle.code.java.dataflow.DataFlow
5+
import semmle.code.java.dataflow.ExternalFlow
56
import semmle.code.java.frameworks.Servlets
67
import semmle.code.java.frameworks.ApacheHttp
8+
private import semmle.code.java.frameworks.JaxWS
79

8-
/** A URL redirection sink */
10+
/** A URL redirection sink. */
911
abstract class UrlRedirectSink extends DataFlow::Node { }
1012

13+
/** A default sink represeting methods susceptible to URL redirection attacks. */
14+
private class DefaultUrlRedirectSink extends UrlRedirectSink {
15+
DefaultUrlRedirectSink() { sinkNode(this, "url-redirect") }
16+
}
17+
1118
/** A Servlet URL redirection sink. */
1219
private class ServletUrlRedirectSink extends UrlRedirectSink {
1320
ServletUrlRedirectSink() {

‎java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,12 @@ edges
55
| SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String | SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie |
66
| SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
77
| SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
8-
| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) |
9-
| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr |
8+
| SensitiveCookieNotHttpOnly.java:52:42:52:113 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) |
9+
| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:113 | new NewCookie(...) : NewCookie |
10+
| SensitiveCookieNotHttpOnly.java:63:37:63:115 | new NewCookie(...) : NewCookie | SensitiveCookieNotHttpOnly.java:64:25:64:39 | accessKeyCookie : NewCookie |
11+
| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:63:37:63:115 | new NewCookie(...) : NewCookie |
12+
| SensitiveCookieNotHttpOnly.java:64:25:64:39 | accessKeyCookie : NewCookie | SensitiveCookieNotHttpOnly.java:64:25:64:50 | toString(...) : String |
13+
| SensitiveCookieNotHttpOnly.java:64:25:64:50 | toString(...) : String | SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr |
1014
| SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
1115
| SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
1216
| SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
@@ -24,9 +28,13 @@ nodes
2428
| SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | semmle.label | "token=" : String |
2529
| SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | semmle.label | ... + ... : String |
2630
| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | semmle.label | ... + ... |
31+
| SensitiveCookieNotHttpOnly.java:52:42:52:113 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
2732
| SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | semmle.label | toString(...) |
2833
| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
34+
| SensitiveCookieNotHttpOnly.java:63:37:63:115 | new NewCookie(...) : NewCookie | semmle.label | new NewCookie(...) : NewCookie |
2935
| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | semmle.label | "session-access-key" : String |
36+
| SensitiveCookieNotHttpOnly.java:64:25:64:39 | accessKeyCookie : NewCookie | semmle.label | accessKeyCookie : NewCookie |
37+
| SensitiveCookieNotHttpOnly.java:64:25:64:50 | toString(...) : String | semmle.label | toString(...) : String |
3038
| SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | semmle.label | keyStr |
3139
| SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | semmle.label | "token=" : String |
3240
| SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | semmle.label | ... + ... : String |

‎java/ql/test/library-tests/dataflow/external-models/sinks.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ class SinkModelTest extends SinkModelCsv {
77
override predicate row(string row) {
88
row =
99
[
10-
//"package;type;overrides;name;signature;ext;spec;kind",
10+
//`namespace; type; subtypes; name; signature; ext; input; kind`
1111
"my.qltest;B;false;sink1;(Object);;Argument[0];qltest",
1212
"my.qltest;B;false;sinkMethod;();;ReturnValue;qltest",
1313
"my.qltest;B$Tag;false;;;Annotated;ReturnValue;qltest-retval",

0 commit comments

Comments
 (0)