Skip to content

Commit fc6af04

Browse files
atorralbaatorralba
committed
Moved from experimental
1 parent 92ffd8c commit fc6af04

File tree

11 files changed

+113
-114
lines changed

11 files changed

+113
-114
lines changed

java/ql/src/experimental/Security/CWE/CWE-094/SaferSpelExpressionEvaluation.java renamed to java/ql/src/Security/CWE/CWE-094/SaferSpelExpressionEvaluation.java

File renamed without changes.

java/ql/src/experimental/Security/CWE/CWE-094/SpelInjection.qhelp renamed to java/ql/src/Security/CWE/CWE-094/SpelInjection.qhelp

File renamed without changes.

java/ql/src/experimental/Security/CWE/CWE-094/SpelInjection.ql renamed to java/ql/src/Security/CWE/CWE-094/SpelInjection.ql

File renamed without changes.

java/ql/src/experimental/Security/CWE/CWE-094/SpelInjectionLib.qll renamed to java/ql/src/Security/CWE/CWE-094/SpelInjectionLib.qll

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,7 @@ import SpringFrameworkLib
1010
class ExpressionInjectionConfig extends TaintTracking::Configuration {
1111
ExpressionInjectionConfig() { this = "ExpressionInjectionConfig" }
1212

13-
override predicate isSource(DataFlow::Node source) {
14-
source instanceof RemoteFlowSource or
15-
source instanceof WebRequestSource
16-
}
13+
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1714

1815
override predicate isSink(DataFlow::Node sink) { sink instanceof ExpressionEvaluationSink }
1916

‎java/ql/src/Security/CWE/CWE-094/SpringFrameworkLib.qll‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
import java
2+
import semmle.code.java.dataflow.DataFlow
3+
4+
/**
5+
* Methods that trigger evaluation of an expression.
6+
*/
7+
class ExpressionEvaluationMethod extends Method {
8+
ExpressionEvaluationMethod() {
9+
getDeclaringType() instanceof Expression and
10+
(
11+
hasName("getValue") or
12+
hasName("getValueTypeDescriptor") or
13+
hasName("getValueType") or
14+
hasName("setValue")
15+
)
16+
}
17+
}
18+
19+
/**
20+
* Holds if `node1` to `node2` is a dataflow step that converts `PropertyValues`
21+
* to an array of `PropertyValue`, i.e. `tainted.getPropertyValues()`.
22+
*/
23+
predicate getPropertyValuesStep(DataFlow::Node node1, DataFlow::Node node2) {
24+
exists(MethodAccess ma, Method m | m = ma.getMethod() |
25+
node1.asExpr() = ma.getQualifier() and
26+
node2.asExpr() = ma and
27+
m.getDeclaringType() instanceof PropertyValues and
28+
m.hasName("getPropertyValues")
29+
)
30+
}
31+
32+
/**
33+
* Holds if `node1` to `node2` is a dataflow step that constructs `MutablePropertyValues`,
34+
* i.e. `new MutablePropertyValues(tainted)`.
35+
*/
36+
predicate createMutablePropertyValuesStep(DataFlow::Node node1, DataFlow::Node node2) {
37+
exists(ConstructorCall cc | cc.getConstructedType() instanceof MutablePropertyValues |
38+
node1.asExpr() = cc.getAnArgument() and
39+
node2.asExpr() = cc
40+
)
41+
}
42+
43+
/**
44+
* Holds if `node1` to `node2` is a dataflow step that returns a name of `PropertyValue`,
45+
* i.e. `tainted.getName()`.
46+
*/
47+
predicate getPropertyNameStep(DataFlow::Node node1, DataFlow::Node node2) {
48+
exists(MethodAccess ma, Method m | m = ma.getMethod() |
49+
node1.asExpr() = ma.getQualifier() and
50+
node2.asExpr() = ma and
51+
m.getDeclaringType() instanceof PropertyValue and
52+
m.hasName("getName")
53+
)
54+
}
55+
56+
/**
57+
* Holds if `node1` to `node2` is a dataflow step that converts `MutablePropertyValues`
58+
* to a list of `PropertyValue`, i.e. `tainted.getPropertyValueList()`.
59+
*/
60+
predicate getPropertyValueListStep(DataFlow::Node node1, DataFlow::Node node2) {
61+
exists(MethodAccess ma, Method m | m = ma.getMethod() |
62+
node1.asExpr() = ma.getQualifier() and
63+
node2.asExpr() = ma and
64+
m.getDeclaringType() instanceof MutablePropertyValues and
65+
m.hasName("getPropertyValueList")
66+
)
67+
}
68+
69+
/**
70+
* Holds if `node1` to `node2` is one of the dataflow steps that propagate
71+
* tainted data via Spring properties.
72+
*/
73+
predicate springPropertiesStep(DataFlow::Node node1, DataFlow::Node node2) {
74+
createMutablePropertyValuesStep(node1, node2) or
75+
getPropertyNameStep(node1, node2) or
76+
getPropertyValuesStep(node1, node2) or
77+
getPropertyValueListStep(node1, node2)
78+
}
79+
80+
class PropertyValue extends RefType {
81+
PropertyValue() { hasQualifiedName("org.springframework.beans", "PropertyValue") }
82+
}
83+
84+
class PropertyValues extends RefType {
85+
PropertyValues() { hasQualifiedName("org.springframework.beans", "PropertyValues") }
86+
}
87+
88+
class MutablePropertyValues extends RefType {
89+
MutablePropertyValues() { hasQualifiedName("org.springframework.beans", "MutablePropertyValues") }
90+
}
91+
92+
class SimpleEvaluationContext extends RefType {
93+
SimpleEvaluationContext() {
94+
hasQualifiedName("org.springframework.expression.spel.support", "SimpleEvaluationContext")
95+
}
96+
}
97+
98+
class SimpleEvaluationContextBuilder extends RefType {
99+
SimpleEvaluationContextBuilder() {
100+
hasQualifiedName("org.springframework.expression.spel.support",
101+
"SimpleEvaluationContext$Builder")
102+
}
103+
}
104+
105+
class Expression extends RefType {
106+
Expression() { hasQualifiedName("org.springframework.expression", "Expression") }
107+
}
108+
109+
class ExpressionParser extends RefType {
110+
ExpressionParser() { hasQualifiedName("org.springframework.expression", "ExpressionParser") }
111+
}

java/ql/src/experimental/Security/CWE/CWE-094/UnsafeSpelExpressionEvaluation.java renamed to java/ql/src/Security/CWE/CWE-094/UnsafeSpelExpressionEvaluation.java

File renamed without changes.

‎java/ql/src/experimental/Security/CWE/CWE-094/SpringFrameworkLib.qll‎

Lines changed: 0 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,6 @@
11
import java
22
import semmle.code.java.dataflow.DataFlow
33

4-
/**
5-
* Methods that trigger evaluation of an expression.
6-
*/
7-
class ExpressionEvaluationMethod extends Method {
8-
ExpressionEvaluationMethod() {
9-
getDeclaringType() instanceof Expression and
10-
(
11-
hasName("getValue") or
12-
hasName("getValueTypeDescriptor") or
13-
hasName("getValueType") or
14-
hasName("setValue")
15-
)
16-
}
17-
}
18-
194
/**
205
* `WebRequest` interface is a source of tainted data.
216
*/
@@ -37,100 +22,6 @@ class WebRequestSource extends DataFlow::Node {
3722
}
3823
}
3924

40-
/**
41-
* Holds if `node1` to `node2` is a dataflow step that converts `PropertyValues`
42-
* to an array of `PropertyValue`, i.e. `tainted.getPropertyValues()`.
43-
*/
44-
predicate getPropertyValuesStep(DataFlow::Node node1, DataFlow::Node node2) {
45-
exists(MethodAccess ma, Method m | m = ma.getMethod() |
46-
node1.asExpr() = ma.getQualifier() and
47-
node2.asExpr() = ma and
48-
m.getDeclaringType() instanceof PropertyValues and
49-
m.hasName("getPropertyValues")
50-
)
51-
}
52-
53-
/**
54-
* Holds if `node1` to `node2` is a dataflow step that constructs `MutablePropertyValues`,
55-
* i.e. `new MutablePropertyValues(tainted)`.
56-
*/
57-
predicate createMutablePropertyValuesStep(DataFlow::Node node1, DataFlow::Node node2) {
58-
exists(ConstructorCall cc | cc.getConstructedType() instanceof MutablePropertyValues |
59-
node1.asExpr() = cc.getAnArgument() and
60-
node2.asExpr() = cc
61-
)
62-
}
63-
64-
/**
65-
* Holds if `node1` to `node2` is a dataflow step that returns a name of `PropertyValue`,
66-
* i.e. `tainted.getName()`.
67-
*/
68-
predicate getPropertyNameStep(DataFlow::Node node1, DataFlow::Node node2) {
69-
exists(MethodAccess ma, Method m | m = ma.getMethod() |
70-
node1.asExpr() = ma.getQualifier() and
71-
node2.asExpr() = ma and
72-
m.getDeclaringType() instanceof PropertyValue and
73-
m.hasName("getName")
74-
)
75-
}
76-
77-
/**
78-
* Holds if `node1` to `node2` is a dataflow step that converts `MutablePropertyValues`
79-
* to a list of `PropertyValue`, i.e. `tainted.getPropertyValueList()`.
80-
*/
81-
predicate getPropertyValueListStep(DataFlow::Node node1, DataFlow::Node node2) {
82-
exists(MethodAccess ma, Method m | m = ma.getMethod() |
83-
node1.asExpr() = ma.getQualifier() and
84-
node2.asExpr() = ma and
85-
m.getDeclaringType() instanceof MutablePropertyValues and
86-
m.hasName("getPropertyValueList")
87-
)
88-
}
89-
90-
/**
91-
* Holds if `node1` to `node2` is one of the dataflow steps that propagate
92-
* tainted data via Spring properties.
93-
*/
94-
predicate springPropertiesStep(DataFlow::Node node1, DataFlow::Node node2) {
95-
createMutablePropertyValuesStep(node1, node2) or
96-
getPropertyNameStep(node1, node2) or
97-
getPropertyValuesStep(node1, node2) or
98-
getPropertyValueListStep(node1, node2)
99-
}
100-
101-
class PropertyValue extends RefType {
102-
PropertyValue() { hasQualifiedName("org.springframework.beans", "PropertyValue") }
103-
}
104-
105-
class PropertyValues extends RefType {
106-
PropertyValues() { hasQualifiedName("org.springframework.beans", "PropertyValues") }
107-
}
108-
109-
class MutablePropertyValues extends RefType {
110-
MutablePropertyValues() { hasQualifiedName("org.springframework.beans", "MutablePropertyValues") }
111-
}
112-
113-
class SimpleEvaluationContext extends RefType {
114-
SimpleEvaluationContext() {
115-
hasQualifiedName("org.springframework.expression.spel.support", "SimpleEvaluationContext")
116-
}
117-
}
118-
119-
class SimpleEvaluationContextBuilder extends RefType {
120-
SimpleEvaluationContextBuilder() {
121-
hasQualifiedName("org.springframework.expression.spel.support",
122-
"SimpleEvaluationContext$Builder")
123-
}
124-
}
125-
12625
class WebRequest extends RefType {
12726
WebRequest() { hasQualifiedName("org.springframework.web.context.request", "WebRequest") }
12827
}
129-
130-
class Expression extends RefType {
131-
Expression() { hasQualifiedName("org.springframework.expression", "Expression") }
132-
}
133-
134-
class ExpressionParser extends RefType {
135-
ExpressionParser() { hasQualifiedName("org.springframework.expression", "ExpressionParser") }
136-
}

‎java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.qlref‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected renamed to java/ql/test/query-tests/security/CWE-094/SpelInjection.expected

File renamed without changes.

java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.java renamed to java/ql/test/query-tests/security/CWE-094/SpelInjection.java

File renamed without changes.

0 commit comments

Comments
 (0)