Skip to content
This repository was archived by the owner on Apr 4, 2025. It is now read-only.

Commit 0e6d688

Browse files
GeekMasherGeekMasher
authored
Merge pull request #183 from advanced-security/securingdev-java-cwe-532-dataflow-update
Update CWE-532 using new dataflow API
2 parents 37ee529 + b10f9f5 commit 0e6d688

5 files changed

Lines changed: 67 additions & 11 deletions

File tree

‎java/CWE-532/SensitiveInformation.ql‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,26 @@ import java
1515
import semmle.code.java.dataflow.DataFlow
1616
import semmle.code.java.dataflow.FlowSources
1717
import semmle.code.java.dataflow.TaintTracking2
18-
import DataFlow::PathGraph
18+
//import DataFlow::PathGraph
1919
// Internal
2020
import github.Logging
2121
import github.SensitiveInformation
2222

23-
class SensitiveInformationLoggingConfig extends TaintTracking::Configuration {
24-
SensitiveInformationLoggingConfig() { this = "SensitiveInformationLoggingConfig" }
23+
module SensitiveInformationConfig implements DataFlow::ConfigSig {
24+
predicate isSource(DataFlow::Node source) { source instanceof SensitiveInformationSources }
2525

26-
override predicate isSource(DataFlow::Node source) {
27-
source instanceof SensitiveInformationSources
28-
}
26+
predicate isSink(DataFlow::Node sink) { sink instanceof LoggingMethodsSinks }
2927

30-
override predicate isSink(DataFlow::Node sink) { sink instanceof LoggingMethodsSinks }
28+
predicate isBarrier(DataFlow::Node node) {
29+
exists(Type t | t = node.getType() | t instanceof BoxedType or t instanceof PrimitiveType)
30+
}
3131
}
3232

33+
module SensitiveInformationFlow = TaintTracking::Global<SensitiveInformationConfig>;
34+
import SensitiveInformationFlow::PathGraph //importing the path graph from the module
35+
36+
3337
// ========== Query ==========
34-
from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveInformationLoggingConfig config
35-
where config.hasFlowPath(source, sink)
36-
select sink.getNode(), source, sink, "Sensative data is being logged $@.", source.getNode(),
37-
"user-provided value"
38+
from SensitiveInformationFlow::PathNode source, SensitiveInformationFlow::PathNode sink
39+
where SensitiveInformationFlow::flowPath(source, sink) //using flowPath instead of hasFlowPath
40+
select sink.getNode(), source, sink, "Sensative data is being logged $@.", source.getNode(), "user-provided value"

‎tests/java-tests/CWE-532/SensitiveInformation.expected‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
edges
2+
| SensitiveInformation.java:17:23:17:62 | (...)... : String | SensitiveInformation.java:18:26:18:55 | ... + ... |
3+
| SensitiveInformation.java:17:23:17:62 | (...)... : String | SensitiveInformation.java:19:28:19:31 | attr |
4+
| SensitiveInformation.java:17:23:17:62 | (...)... : String | SensitiveInformation.java:20:66:20:69 | attr : String |
5+
| SensitiveInformation.java:17:31:17:62 | getAttribute(...) : Object | SensitiveInformation.java:17:23:17:62 | (...)... : String |
6+
| SensitiveInformation.java:20:31:20:81 | encodeToString(...) : String | SensitiveInformation.java:26:19:26:30 | responseBody |
7+
| SensitiveInformation.java:20:66:20:69 | attr : String | SensitiveInformation.java:20:66:20:80 | getBytes(...) : byte[] |
8+
| SensitiveInformation.java:20:66:20:80 | getBytes(...) : byte[] | SensitiveInformation.java:20:31:20:81 | encodeToString(...) : String |
9+
nodes
10+
| SensitiveInformation.java:17:23:17:62 | (...)... : String | semmle.label | (...)... : String |
11+
| SensitiveInformation.java:17:31:17:62 | getAttribute(...) : Object | semmle.label | getAttribute(...) : Object |
12+
| SensitiveInformation.java:18:26:18:55 | ... + ... | semmle.label | ... + ... |
13+
| SensitiveInformation.java:19:28:19:31 | attr | semmle.label | attr |
14+
| SensitiveInformation.java:20:31:20:81 | encodeToString(...) : String | semmle.label | encodeToString(...) : String |
15+
| SensitiveInformation.java:20:66:20:69 | attr : String | semmle.label | attr : String |
16+
| SensitiveInformation.java:20:66:20:80 | getBytes(...) : byte[] | semmle.label | getBytes(...) : byte[] |
17+
| SensitiveInformation.java:26:19:26:30 | responseBody | semmle.label | responseBody |
18+
subpaths
19+
#select
20+
| SensitiveInformation.java:18:26:18:55 | ... + ... | SensitiveInformation.java:17:31:17:62 | getAttribute(...) : Object | SensitiveInformation.java:18:26:18:55 | ... + ... | Sensative data is being logged $@. | SensitiveInformation.java:17:31:17:62 | getAttribute(...) | user-provided value |
21+
| SensitiveInformation.java:19:28:19:31 | attr | SensitiveInformation.java:17:31:17:62 | getAttribute(...) : Object | SensitiveInformation.java:19:28:19:31 | attr | Sensative data is being logged $@. | SensitiveInformation.java:17:31:17:62 | getAttribute(...) | user-provided value |
22+
| SensitiveInformation.java:26:19:26:30 | responseBody | SensitiveInformation.java:17:31:17:62 | getAttribute(...) : Object | SensitiveInformation.java:26:19:26:30 | responseBody | Sensative data is being logged $@. | SensitiveInformation.java:17:31:17:62 | getAttribute(...) | user-provided value |

‎tests/java-tests/CWE-532/SensitiveInformation.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
import java.io.IOException;
2+
import java.io.PrintWriter;
3+
import java.util.Base64;
4+
import javax.servlet.ServletException;
5+
import javax.servlet.http.HttpServlet;
6+
import javax.servlet.http.HttpServletRequest;
7+
import javax.servlet.http.HttpServletResponse;
8+
import javax.servlet.http.HttpSession;
9+
10+
public class SensitiveInformation extends HttpServlet {
11+
@Override
12+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
13+
HttpSession session = request.getSession();
14+
String requestBody = request.getReader().readLine();
15+
session.setAttribute("username", requestBody);
16+
// Do something with the request body here
17+
String attr = (String)session.getAttribute("username");
18+
System.out.print("Username is %s" + attr + "\n");
19+
System.out.println(attr);
20+
String responseBody = Base64.getEncoder().encodeToString(attr.getBytes());
21+
// String responseBody = "Encoded username: " + encodedUsername;
22+
response.setContentType("text/plain");
23+
response.setCharacterEncoding("UTF-8");
24+
response.setStatus(HttpServletResponse.SC_OK);
25+
PrintWriter out = response.getWriter();
26+
out.print(responseBody);
27+
out.flush();
28+
}
29+
}

‎tests/java-tests/CWE-532/SensitiveInformation.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
CWE-532/SensitiveInformation.ql

‎tests/java-tests/CWE-532/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../codeql/java/ql/test/stubs/javax-servlet-2.5

0 commit comments

Comments
 (0)