Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0775d35

Browse files
haby0haby0
committed
update VerificationMethodFlowConfig, add if test
1 parent 3df23ee commit 0775d35

10 files changed

Lines changed: 362 additions & 293 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,6 @@ public class JsonpInjection {
2626
hashMap.put("password","123456");
2727
}
2828

29-
private String name = null;
30-
31-
3229
@GetMapping(value = "jsonp1")
3330
@ResponseBody
3431
public String bad1(HttpServletRequest request) {
@@ -77,7 +74,6 @@ public void bad5(HttpServletRequest request,
7774
PrintWriter pw = null;
7875
Gson gson = new Gson();
7976
String result = gson.toJson(hashMap);
80-
8177
String resultStr = null;
8278
pw = response.getWriter();
8379
resultStr = jsonpCallback + "(" + result + ")";
@@ -109,13 +105,25 @@ public String bad7(HttpServletRequest request) {
109105
return resultStr;
110106
}
111107

112-
113108
@GetMapping(value = "jsonp8")
114109
@ResponseBody
115-
public String good1(HttpServletRequest request) {
110+
public String bad8(HttpServletRequest request) {
116111
String resultStr = null;
117112
String token = request.getParameter("token");
118-
if (verifToken(token)){
113+
boolean result = verifToken(token); //Just check.
114+
String jsonpCallback = request.getParameter("jsonpCallback");
115+
String jsonStr = getJsonStr(hashMap);
116+
resultStr = jsonpCallback + "(" + jsonStr + ")";
117+
return resultStr;
118+
}
119+
120+
121+
@GetMapping(value = "jsonp9")
122+
@ResponseBody
123+
public String good1(HttpServletRequest request) {
124+
String resultStr = null;
125+
String referer = request.getParameter("referer");
126+
if (verifReferer(referer)){
119127
String jsonpCallback = request.getParameter("jsonpCallback");
120128
String jsonStr = getJsonStr(hashMap);
121129
resultStr = jsonpCallback + "(" + jsonStr + ")";
@@ -125,7 +133,7 @@ public String good1(HttpServletRequest request) {
125133
}
126134

127135

128-
@GetMapping(value = "jsonp9")
136+
@GetMapping(value = "jsonp10")
129137
@ResponseBody
130138
public String good2(HttpServletRequest request) {
131139
String resultStr = null;
@@ -140,7 +148,7 @@ public String good2(HttpServletRequest request) {
140148
return resultStr;
141149
}
142150

143-
@RequestMapping(value = "jsonp10")
151+
@RequestMapping(value = "jsonp11")
144152
@ResponseBody
145153
public String good3(HttpServletRequest request) {
146154
JSONObject parameterObj = readToJSONObect(request);
@@ -151,7 +159,7 @@ public String good3(HttpServletRequest request) {
151159
return resultStr;
152160
}
153161

154-
@RequestMapping(value = "jsonp11")
162+
@RequestMapping(value = "jsonp12")
155163
@ResponseBody
156164
public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
157165
if(null == file){
@@ -200,4 +208,11 @@ public static boolean verifToken(String token){
200208
}
201209
return true;
202210
}
211+
212+
public static boolean verifReferer(String str){
213+
if (str != "xxxx"){
214+
return false;
215+
}
216+
return true;
217+
}
203218
}

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ When there is a cross-domain problem, the problem of sensitive information leaka
1414
</recommendation>
1515
<example>
1616

17-
<p>The following examples show the bad case and the good case respectively. Bad case, such as <code>bad1</code> to <code>bad7</code>,
17+
<p>The following examples show the bad case and the good case respectively. Bad case, such as <code>bad1</code> to <code>bad8</code>,
1818
will cause information leakage problems when there are cross-domain problems. In a good case, for example, in the <code>good1</code>
1919
method and the <code>good2</code> method, use the <code>verifToken</code> method to do the random <code>token</code> Verification can
2020
solve the problem of information leakage caused by cross-domain.</p>

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -18,20 +18,18 @@ import DataFlow::PathGraph
1818

1919
/** Determine whether there is a verification method for the remote streaming source data flow path method. */
2020
predicate existsFilterVerificationMethod() {
21-
exists(MethodAccess ma, Node existsNode, Method m |
22-
ma.getMethod() instanceof VerificationMethodClass and
23-
existsNode.asExpr() = ma and
24-
m = getACallingCallableOrSelf(existsNode.getEnclosingCallable()) and
21+
exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc, Method m |
22+
vmfc.hasFlow(source, sink) and
23+
m = getACallingCallableOrSelf(source.getEnclosingCallable()) and
2524
isDoFilterMethod(m)
2625
)
2726
}
2827

2928
/** Determine whether there is a verification method for the remote streaming source data flow path method. */
3029
predicate existsServletVerificationMethod(Node checkNode) {
31-
exists(MethodAccess ma, Node existsNode |
32-
ma.getMethod() instanceof VerificationMethodClass and
33-
existsNode.asExpr() = ma and
34-
getACallingCallableOrSelf(existsNode.getEnclosingCallable()) =
30+
exists(DataFlow::Node source, DataFlow::Node sink, VerificationMethodFlowConfig vmfc |
31+
vmfc.hasFlow(source, sink) and
32+
getACallingCallableOrSelf(source.getEnclosingCallable()) =
3533
getACallingCallableOrSelf(checkNode.getEnclosingCallable())
3634
)
3735
}
@@ -40,13 +38,14 @@ predicate existsServletVerificationMethod(Node checkNode) {
4038
class RequestResponseFlowConfig extends TaintTracking::Configuration {
4139
RequestResponseFlowConfig() { this = "RequestResponseFlowConfig" }
4240

43-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
44-
45-
override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
41+
override predicate isSource(DataFlow::Node source) {
42+
source instanceof RemoteFlowSource and
43+
getACallingCallableOrSelf(source.getEnclosingCallable()) instanceof RequestGetMethod
44+
}
4645

47-
/** Eliminate the method of calling the node is not the get method. */
48-
override predicate isSanitizer(DataFlow::Node node) {
49-
not getACallingCallableOrSelf(node.getEnclosingCallable()) instanceof RequestGetMethod
46+
override predicate isSink(DataFlow::Node sink) {
47+
sink instanceof XssSink and
48+
getACallingCallableOrSelf(sink.getEnclosingCallable()) instanceof RequestGetMethod
5049
}
5150

5251
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {

‎java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll‎

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,30 +3,47 @@ import DataFlow
33
import JsonStringLib
44
import semmle.code.java.security.XSS
55
import semmle.code.java.dataflow.DataFlow
6+
import semmle.code.java.dataflow.DataFlow3
67
import semmle.code.java.dataflow.FlowSources
78
import semmle.code.java.frameworks.spring.SpringController
89

9-
/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
10-
class VerificationMethodFlowConfig extends TaintTracking::Configuration {
11-
VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
10+
/** A data flow configuration is tracing flow from the access to the authentication method of token/auth/referer/origin to if condition. */
11+
class VerificationMethodToIfFlowConfig extends DataFlow3::Configuration {
12+
VerificationMethodToIfFlowConfig() { this = "VerificationMethodToIfFlowConfig" }
1213

13-
override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
14+
override predicate isSource(DataFlow::Node src) {
15+
exists(MethodAccess ma, BarrierGuard bg | ma = bg |
16+
(
17+
ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
18+
or
19+
ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
20+
) and
21+
ma = src.asExpr()
22+
)
23+
}
1424

1525
override predicate isSink(DataFlow::Node sink) {
16-
exists(MethodAccess ma |
17-
ma.getMethod().getAParameter().getName().regexpMatch("(?i).*(token|auth|referer|origin).*") and
18-
ma.getAnArgument() = sink.asExpr()
19-
)
26+
exists(IfStmt is | is.getCondition() = sink.asExpr())
2027
}
2128
}
2229

23-
/** The parameter names of this method are token/auth/referer/origin. */
24-
class VerificationMethodClass extends Method {
25-
VerificationMethodClass() {
26-
exists(MethodAccess ma, VerificationMethodFlowConfig vmfc, Node node |
27-
this = ma.getMethod() and
28-
node.asExpr() = ma.getAnArgument() and
29-
vmfc.hasFlowTo(node)
30+
/** Taint-tracking configuration tracing flow from untrusted inputs to verification of remote user input. */
31+
class VerificationMethodFlowConfig extends TaintTracking2::Configuration {
32+
VerificationMethodFlowConfig() { this = "VerificationMethodFlowConfig" }
33+
34+
override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
35+
36+
override predicate isSink(DataFlow::Node sink) {
37+
exists(MethodAccess ma, BarrierGuard bg, int i, VerificationMethodToIfFlowConfig vmtifc |
38+
ma = bg
39+
|
40+
(
41+
ma.getMethod().getParameter(i).getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
42+
or
43+
ma.getMethod().getName().regexpMatch("(?i).*(token|auth|referer|origin).*")
44+
) and
45+
ma.getArgument(i) = sink.asExpr() and
46+
vmtifc.hasFlow(exprNode(ma), _)
3047
)
3148
}
3249
}

‎java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjectionWithFilter/JsonpController.java‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,6 @@ public class JsonpController {
2626
hashMap.put("password","123456");
2727
}
2828

29-
private String name = null;
30-
31-
3229
@GetMapping(value = "jsonp1")
3330
@ResponseBody
3431
public String bad1(HttpServletRequest request) {
@@ -77,7 +74,6 @@ public void bad5(HttpServletRequest request,
7774
PrintWriter pw = null;
7875
Gson gson = new Gson();
7976
String result = gson.toJson(hashMap);
80-
8177
String resultStr = null;
8278
pw = response.getWriter();
8379
resultStr = jsonpCallback + "(" + result + ")";
@@ -109,13 +105,25 @@ public String bad7(HttpServletRequest request) {
109105
return resultStr;
110106
}
111107

112-
113108
@GetMapping(value = "jsonp8")
114109
@ResponseBody
115-
public String good1(HttpServletRequest request) {
110+
public String bad8(HttpServletRequest request) {
116111
String resultStr = null;
117112
String token = request.getParameter("token");
118-
if (verifToken(token)){
113+
boolean result = verifToken(token); //Just check.
114+
String jsonpCallback = request.getParameter("jsonpCallback");
115+
String jsonStr = getJsonStr(hashMap);
116+
resultStr = jsonpCallback + "(" + jsonStr + ")";
117+
return resultStr;
118+
}
119+
120+
121+
@GetMapping(value = "jsonp9")
122+
@ResponseBody
123+
public String good1(HttpServletRequest request) {
124+
String resultStr = null;
125+
String referer = request.getParameter("referer");
126+
if (verifReferer(referer)){
119127
String jsonpCallback = request.getParameter("jsonpCallback");
120128
String jsonStr = getJsonStr(hashMap);
121129
resultStr = jsonpCallback + "(" + jsonStr + ")";
@@ -125,7 +133,7 @@ public String good1(HttpServletRequest request) {
125133
}
126134

127135

128-
@GetMapping(value = "jsonp9")
136+
@GetMapping(value = "jsonp10")
129137
@ResponseBody
130138
public String good2(HttpServletRequest request) {
131139
String resultStr = null;
@@ -140,7 +148,7 @@ public String good2(HttpServletRequest request) {
140148
return resultStr;
141149
}
142150

143-
@RequestMapping(value = "jsonp10")
151+
@RequestMapping(value = "jsonp11")
144152
@ResponseBody
145153
public String good3(HttpServletRequest request) {
146154
JSONObject parameterObj = readToJSONObect(request);
@@ -151,7 +159,7 @@ public String good3(HttpServletRequest request) {
151159
return resultStr;
152160
}
153161

154-
@RequestMapping(value = "jsonp11")
162+
@RequestMapping(value = "jsonp12")
155163
@ResponseBody
156164
public String good4(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
157165
if(null == file){
@@ -200,4 +208,11 @@ public static boolean verifToken(String token){
200208
}
201209
return true;
202210
}
211+
212+
public static boolean verifReferer(String str){
213+
if (str != "xxxx"){
214+
return false;
215+
}
216+
return true;
217+
}
203218
}

0 commit comments

Comments
 (0)