Skip to content

Commit babe744

Browse files
luchua-bcluchua-bc
committed
Add SECURITY_PROTOCOL check
1 parent c069a5b commit babe744

File tree

3 files changed

+46
-13
lines changed

3 files changed

+46
-13
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,22 +89,36 @@ predicate isProviderUrlSetter(MethodAccess ma) {
8989
}
9090

9191
/**
92-
* Holds if `ma` sets `java.naming.security.authentication` (also known as `Context.SECURITY_AUTHENTICATION`) to `simple` in some `Hashtable`.
92+
* Holds if `ma` sets `fieldValue` with attribute name `fieldName` to `envValue` in some `Hashtable`.
9393
*/
94-
predicate isSimpleAuthEnv(MethodAccess ma) {
94+
bindingset[fieldName, fieldValue, envValue]
95+
predicate hasEnvWithValue(MethodAccess ma, string fieldName, string fieldValue, string envValue) {
9596
ma.getMethod().getDeclaringType().getAnAncestor() instanceof TypeHashtable and
9697
(ma.getMethod().hasName("put") or ma.getMethod().hasName("setProperty")) and
9798
(
98-
ma.getArgument(0).(CompileTimeConstantExpr).getStringValue() =
99-
"java.naming.security.authentication"
99+
ma.getArgument(0).(CompileTimeConstantExpr).getStringValue() = fieldValue
100100
or
101101
exists(Field f |
102102
ma.getArgument(0) = f.getAnAccess() and
103-
f.hasName("SECURITY_AUTHENTICATION") and
103+
f.hasName(fieldName) and
104104
f.getDeclaringType() instanceof TypeNamingContext
105105
)
106106
) and
107-
ma.getArgument(1).(CompileTimeConstantExpr).getStringValue() = "simple"
107+
ma.getArgument(1).(CompileTimeConstantExpr).getStringValue() = envValue
108+
}
109+
110+
/**
111+
* Holds if `ma` sets `java.naming.security.authentication` (also known as `Context.SECURITY_AUTHENTICATION`) to `simple` in some `Hashtable`.
112+
*/
113+
predicate isSimpleAuthEnv(MethodAccess ma) {
114+
hasEnvWithValue(ma, "SECURITY_AUTHENTICATION", "java.naming.security.authentication", "simple")
115+
}
116+
117+
/**
118+
* Holds if `ma` sets `java.naming.security.protocol` (also known as `Context.SECURITY_PROTOCOL`) to `ssl` in some `Hashtable`.
119+
*/
120+
predicate isSSLEnv(MethodAccess ma) {
121+
hasEnvWithValue(ma, "SECURITY_PROTOCOL", "java.naming.security.protocol", "ssl")
108122
}
109123

110124
/**
@@ -124,6 +138,10 @@ class LdapAuthFlowConfig extends TaintTracking::Configuration {
124138
exists(MethodAccess sma |
125139
sma.getQualifier() = pma.getQualifier().(VarAccess).getVariable().getAnAccess() and
126140
isSimpleAuthEnv(sma)
141+
) and
142+
not exists(MethodAccess sma |
143+
sma.getQualifier() = pma.getQualifier().(VarAccess).getVariable().getAnAccess() and
144+
isSSLEnv(sma)
127145
)
128146
)
129147
}

‎java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.expected‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
edges
22
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:15:41:15:47 | ldapUrl |
33
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | InsecureLdapAuth.java:29:41:29:47 | ldapUrl |
4-
| InsecureLdapAuth.java:81:20:81:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:85:41:85:47 | ldapUrl |
5-
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:100:47:100:53 | ldapUrl |
4+
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:100:41:100:47 | ldapUrl |
5+
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:115:47:115:53 | ldapUrl |
66
nodes
77
| InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
88
| InsecureLdapAuth.java:15:41:15:47 | ldapUrl | semmle.label | ldapUrl |
99
| InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | semmle.label | ... + ... : String |
1010
| InsecureLdapAuth.java:29:41:29:47 | ldapUrl | semmle.label | ldapUrl |
11-
| InsecureLdapAuth.java:81:20:81:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
12-
| InsecureLdapAuth.java:85:41:85:47 | ldapUrl | semmle.label | ldapUrl |
1311
| InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
14-
| InsecureLdapAuth.java:100:47:100:53 | ldapUrl | semmle.label | ldapUrl |
12+
| InsecureLdapAuth.java:100:41:100:47 | ldapUrl | semmle.label | ldapUrl |
13+
| InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | semmle.label | "ldap://ad.your-server.com:389" : String |
14+
| InsecureLdapAuth.java:115:47:115:53 | ldapUrl | semmle.label | ldapUrl |
1515
#select
1616
| InsecureLdapAuth.java:15:41:15:47 | ldapUrl | InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:15:41:15:47 | ldapUrl | Insecure LDAP authentication from $@. | InsecureLdapAuth.java:11:20:11:50 | "ldap://ad.your-server.com:389" | LDAP connection string |
1717
| InsecureLdapAuth.java:29:41:29:47 | ldapUrl | InsecureLdapAuth.java:25:20:25:39 | ... + ... : String | InsecureLdapAuth.java:29:41:29:47 | ldapUrl | Insecure LDAP authentication from $@. | InsecureLdapAuth.java:25:20:25:39 | ... + ... | LDAP connection string |
18-
| InsecureLdapAuth.java:85:41:85:47 | ldapUrl | InsecureLdapAuth.java:81:20:81:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:85:41:85:47 | ldapUrl | Insecure LDAP authentication from $@. | InsecureLdapAuth.java:81:20:81:50 | "ldap://ad.your-server.com:389" | LDAP connection string |
19-
| InsecureLdapAuth.java:100:47:100:53 | ldapUrl | InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:100:47:100:53 | ldapUrl | Insecure LDAP authentication from $@. | InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" | LDAP connection string |
18+
| InsecureLdapAuth.java:100:41:100:47 | ldapUrl | InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:100:41:100:47 | ldapUrl | Insecure LDAP authentication from $@. | InsecureLdapAuth.java:96:20:96:50 | "ldap://ad.your-server.com:389" | LDAP connection string |
19+
| InsecureLdapAuth.java:115:47:115:53 | ldapUrl | InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" : String | InsecureLdapAuth.java:115:47:115:53 | ldapUrl | Insecure LDAP authentication from $@. | InsecureLdapAuth.java:111:20:111:50 | "ldap://ad.your-server.com:389" | LDAP connection string |

‎java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,21 @@ public void testSslLdapAuth(String ldapUserName, String password) {
4848
DirContext dirContext = new InitialDirContext(environment);
4949
}
5050

51+
// GOOD - Test LDAP authentication over SSL.
52+
public void testSslLdapAuth2(String ldapUserName, String password) {
53+
String ldapUrl = "ldap://ad.your-server.com:636";
54+
Hashtable<String, String> environment = new Hashtable<String, String>();
55+
environment.put(Context.INITIAL_CONTEXT_FACTORY,
56+
"com.sun.jndi.ldap.LdapCtxFactory");
57+
environment.put(Context.PROVIDER_URL, ldapUrl);
58+
environment.put(Context.REFERRAL, "follow");
59+
environment.put(Context.SECURITY_AUTHENTICATION, "simple");
60+
environment.put(Context.SECURITY_PRINCIPAL, ldapUserName);
61+
environment.put(Context.SECURITY_CREDENTIALS, password);
62+
environment.put(Context.SECURITY_PROTOCOL, "ssl");
63+
DirContext dirContext = new InitialDirContext(environment);
64+
}
65+
5166
// GOOD - Test LDAP authentication with SASL authentication.
5267
public void testSaslLdapAuth(String ldapUserName, String password) {
5368
String ldapUrl = "ldap://ad.your-server.com:389";

0 commit comments

Comments
 (0)