Skip to content

Commit bfa9324

Browse files
JLLeitschuhJLLeitschuh
committed
CWE-1104: Maven POM dependence upon Bintray/JCenter
1 parent 7fef1a8 commit bfa9324

File tree

7 files changed

+194
-0
lines changed

7 files changed

+194
-0
lines changed

‎java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p><a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">Bintray and JCenter are shutting down on May 1st, 20201</a>.
7+
Relying upon repositories that are deprecated or slated to be shutdown can have unintended consequences;
8+
for example, artifacts being resolved from different artifact server or total breakage of the CI build.</p>
9+
10+
<p>When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge.
11+
Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts
12+
that are being produced. This can be used by attackers to perform a
13+
<a href="https://en.wikipedia.org/wiki/Supply_chain_attack">Supply chain attack</a>
14+
against your project's users.
15+
</p>
16+
17+
</overview>
18+
<recommendation>
19+
20+
<p>Always use the cononical repository for resolving your dependencies.</p>
21+
22+
</recommendation>
23+
24+
<example>
25+
26+
<p>This examples show examples of locations in Maven POM files where artifact repository upload/download is configured.
27+
The use of Bintray in any of these locaitons is not advised.
28+
</p>
29+
30+
<sample src="bad-bintray-pom.xml" />
31+
32+
</example>
33+
<references>
34+
<li>
35+
Blog:
36+
<a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">
37+
Into the Sunset on May 1st: Bintray, JCenter, GoCenter, and ChartCenter
38+
</a>
39+
</li>
40+
41+
<!-- LocalWords: CWE maven dependencies artifact jcenter bintray
42+
-->
43+
44+
</references>
45+
</qhelp>

‎java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* @name Depending upon JCenter/Bintray as an artifact repository
3+
* @description JCenter & Bintray are deprecated
4+
* @kind problem
5+
* @problem.severity error
6+
* @precision very-high
7+
* @id java/maven/dependency-upon-bintray
8+
* @tags security
9+
* external/cwe/cwe-1104
10+
*/
11+
12+
import java
13+
import semmle.code.xml.MavenPom
14+
15+
private class DeclaredRepository extends PomElement {
16+
DeclaredRepository() {
17+
this.getName() = "repository" or
18+
this.getName() = "snapshotRepository" or
19+
this.getName() = "pluginRepository"
20+
}
21+
22+
string getUrl() { result = getAChild("url").(PomElement).getValue() }
23+
24+
predicate isBintrayRepositoryUsage() {
25+
getUrl().matches("%.bintray.com%")
26+
}
27+
}
28+
29+
from DeclaredRepository repository
30+
where repository.isBintrayRepositoryUsage()
31+
select repository,
32+
"Downloading or uploading artifacts to deprecated repository " +
33+
repository.getUrl()

‎java/ql/src/Security/CWE/CWE-1104/bad-bintray-pom.xml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>com.semmle</groupId>
9+
<artifactId>parent</artifactId>
10+
<version>1.0</version>
11+
<packaging>pom</packaging>
12+
13+
<name>Bintray Usage</name>
14+
<description>An example of using bintray to download and upload dependencies</description>
15+
16+
<distributionManagement>
17+
<repository>
18+
<id>jcenter</id>
19+
<name>JCenter</name>
20+
<!-- BAD! Don't use JCenter -->
21+
<url>https://jcenter.bintray.com</url>
22+
</repository>
23+
<snapshotRepository>
24+
<id>jcenter-snapshots</id>
25+
<name>JCenter</name>
26+
<!-- BAD! Don't use JCenter -->
27+
<url>https://jcenter.bintray.com</url>
28+
</snapshotRepository>
29+
</distributionManagement>
30+
<repositories>
31+
<repository>
32+
<id>jcenter</id>
33+
<name>JCenter</name>
34+
<!-- BAD! Don't use JCenter -->
35+
<url>https://jcenter.bintray.com</url>
36+
</repository>
37+
</repositories>
38+
<repositories>
39+
<repository>
40+
<id>jcenter</id>
41+
<name>JCenter</name>
42+
<!-- BAD! Don't use Bintray -->
43+
<url>https://dl.bintray.com/groovy/maven</url>
44+
</repository>
45+
</repositories>
46+
<pluginRepositories>
47+
<pluginRepository>
48+
<id>jcenter-plugins</id>
49+
<name>JCenter</name>
50+
<!-- BAD! Don't use JCenter -->
51+
<url>https://jcenter.bintray.com</url>
52+
</pluginRepository>
53+
</pluginRepositories>
54+
</project>

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/A.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
public class A {
2+
}

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
| bad-bintray-pom.xml:17:9:22:22 | repository | Downloading or uploading artifacts to depricated repository https://jcenter.bintray.com |
2+
| bad-bintray-pom.xml:23:9:28:30 | snapshotRepository | Downloading or uploading artifacts to depricated repository https://jcenter.bintray.com |
3+
| bad-bintray-pom.xml:31:9:36:22 | repository | Downloading or uploading artifacts to depricated repository https://jcenter.bintray.com |
4+
| bad-bintray-pom.xml:39:9:44:22 | repository | Downloading or uploading artifacts to depricated repository https://dl.bintray.com/groovy/maven |
5+
| bad-bintray-pom.xml:47:9:52:28 | pluginRepository | Downloading or uploading artifacts to depricated repository https://jcenter.bintray.com |

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>com.semmle</groupId>
9+
<artifactId>parent</artifactId>
10+
<version>1.0</version>
11+
<packaging>pom</packaging>
12+
13+
<name>Bintray Usage Testing</name>
14+
<description>An example of using bintray as a repository</description>
15+
16+
<distributionManagement>
17+
<repository>
18+
<id>jcenter</id>
19+
<name>JCenter</name>
20+
<!-- BAD! Don't use JCenter -->
21+
<url>https://jcenter.bintray.com</url>
22+
</repository>
23+
<snapshotRepository>
24+
<id>jcenter-snapshots</id>
25+
<name>JCenter</name>
26+
<!-- BAD! Don't use JCenter -->
27+
<url>https://jcenter.bintray.com</url>
28+
</snapshotRepository>
29+
</distributionManagement>
30+
<repositories>
31+
<repository>
32+
<id>jcenter</id>
33+
<name>JCenter</name>
34+
<!-- BAD! Don't use JCenter -->
35+
<url>https://jcenter.bintray.com</url>
36+
</repository>
37+
</repositories>
38+
<repositories>
39+
<repository>
40+
<id>jcenter</id>
41+
<name>JCenter</name>
42+
<!-- BAD! Don't use Bintray -->
43+
<url>https://dl.bintray.com/groovy/maven</url>
44+
</repository>
45+
</repositories>
46+
<pluginRepositories>
47+
<pluginRepository>
48+
<id>jcenter-plugins</id>
49+
<name>JCenter</name>
50+
<!-- BAD! Don't use JCenter -->
51+
<url>https://jcenter.bintray.com</url>
52+
</pluginRepository>
53+
</pluginRepositories>
54+
</project>

0 commit comments

Comments
 (0)