Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2d1278e

Browse files
atorralbaatorralba
committed
Consider setStartTLSRequired for Apache SimpleEmail
1 parent baffb0e commit 2d1278e

3 files changed

Lines changed: 63 additions & 32 deletions

File tree

‎java/ql/src/semmle/code/java/security/Mail.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ predicate isInsecureMailPropertyConfig(VarAccess propertiesVarAccess) {
3333
* Holds if `ma` enables TLS/SSL with Apache Email.
3434
*/
3535
predicate enablesEmailSsl(MethodAccess ma) {
36-
ma.getMethod().hasName("setSSLOnConnect") and
36+
ma.getMethod().hasName(["setSSLOnConnect", "setStartTLSRequired"]) and
3737
ma.getMethod().getDeclaringType() instanceof ApacheEmail and
3838
ma.getArgument(0).(BooleanLiteral).getBooleanValue() = true
3939
}

‎java/ql/test/query-tests/security/CWE-297/InsecureJavaMailTest.java‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,6 @@
44
import javax.mail.PasswordAuthentication;
55
import javax.mail.Session;
66

7-
import org.apache.commons.mail.DefaultAuthenticator;
8-
import org.apache.commons.mail.Email;
9-
import org.apache.commons.mail.SimpleEmail;
10-
11-
import java.util.Properties;
12-
137
class InsecureJavaMailTest {
148
public void testJavaMail() {
159
final Properties properties = new Properties();
@@ -46,30 +40,5 @@ protected PasswordAuthentication getPasswordAuthentication() {
4640
final Session session = Session.getInstance(properties, authenticator); // Safe
4741
}
4842

49-
public void testSimpleMail() throws Exception {
50-
Email email = new SimpleEmail();
51-
email.setHostName("config.hostName");
52-
email.setSmtpPort(25);
53-
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
54-
email.setSSLOnConnect(true); // $hasInsecureJavaMail
55-
email.setFrom("fromAddress");
56-
email.setSubject("subject");
57-
email.setMsg("body");
58-
email.addTo("toAddress");
59-
email.send();
60-
}
6143

62-
public void testSecureSimpleMail() throws Exception {
63-
Email email = new SimpleEmail();
64-
email.setHostName("config.hostName");
65-
email.setSmtpPort(25);
66-
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
67-
email.setSSLOnConnect(true); // Safe
68-
email.setSSLCheckServerIdentity(true);
69-
email.setFrom("fromAddress");
70-
email.setSubject("subject");
71-
email.setMsg("body");
72-
email.addTo("toAddress");
73-
email.send();
74-
}
7544
}

‎java/ql/test/query-tests/security/CWE-297/InsecureSimpleEmailTest.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
import org.apache.commons.mail.DefaultAuthenticator;
2+
import org.apache.commons.mail.Email;
3+
import org.apache.commons.mail.SimpleEmail;
4+
5+
public class InsecureSimpleEmailTest {
6+
public void test() throws Exception {
7+
// with setSSLOnConnect
8+
{
9+
Email email = new SimpleEmail();
10+
email.setHostName("config.hostName");
11+
email.setSmtpPort(25);
12+
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
13+
email.setSSLOnConnect(true); // $hasInsecureJavaMail
14+
email.setFrom("fromAddress");
15+
email.setSubject("subject");
16+
email.setMsg("body");
17+
email.addTo("toAddress");
18+
email.send();
19+
}
20+
// with setStartTLSRequired
21+
{
22+
Email email = new SimpleEmail();
23+
email.setHostName("config.hostName");
24+
email.setSmtpPort(25);
25+
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
26+
email.setStartTLSRequired(true); // $hasInsecureJavaMail
27+
email.setFrom("fromAddress");
28+
email.setSubject("subject");
29+
email.setMsg("body");
30+
email.addTo("toAddress");
31+
email.send();
32+
}
33+
// safe with setSSLOnConnect
34+
{
35+
Email email = new SimpleEmail();
36+
email.setHostName("config.hostName");
37+
email.setSmtpPort(25);
38+
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
39+
email.setSSLOnConnect(true); // Safe
40+
email.setSSLCheckServerIdentity(true);
41+
email.setFrom("fromAddress");
42+
email.setSubject("subject");
43+
email.setMsg("body");
44+
email.addTo("toAddress");
45+
email.send();
46+
}
47+
// safe with setStartTLSRequired
48+
{
49+
Email email = new SimpleEmail();
50+
email.setHostName("config.hostName");
51+
email.setSmtpPort(25);
52+
email.setAuthenticator(new DefaultAuthenticator("config.username", "config.password"));
53+
email.setStartTLSRequired(true); // Safe
54+
email.setSSLCheckServerIdentity(true);
55+
email.setFrom("fromAddress");
56+
email.setSubject("subject");
57+
email.setMsg("body");
58+
email.addTo("toAddress");
59+
email.send();
60+
}
61+
}
62+
}

0 commit comments

Comments
 (0)