Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3f0b803

Browse files
atorralbaatorralba
committed
Refactored to use CSV sink models
1 parent 1351516 commit 3f0b803

8 files changed

Lines changed: 236 additions & 283 deletions

File tree

‎java/ql/src/Security/CWE/CWE-074/JndiInjection.ql‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,28 @@
1212

1313
import java
1414
import semmle.code.java.dataflow.FlowSources
15-
import JndiInjectionLib
15+
import semmle.code.java.security.JndiInjection
1616
import DataFlow::PathGraph
1717

18+
/**
19+
* A taint-tracking configuration for unvalidated user input that is used in JNDI lookup.
20+
*/
21+
class JndiInjectionFlowConfig extends TaintTracking::Configuration {
22+
JndiInjectionFlowConfig() { this = "JndiInjectionFlowConfig" }
23+
24+
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
25+
26+
override predicate isSink(DataFlow::Node sink) { sink instanceof JndiInjectionSink }
27+
28+
override predicate isSanitizer(DataFlow::Node node) {
29+
node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
30+
}
31+
32+
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
33+
any(JndiInjectionAdditionalTaintStep c).step(node1, node2)
34+
}
35+
}
36+
1837
from DataFlow::PathNode source, DataFlow::PathNode sink, JndiInjectionFlowConfig conf
1938
where conf.hasFlowPath(source, sink)
2039
select sink.getNode(), source, sink, "JNDI lookup might include name from $@.", source.getNode(),

‎java/ql/src/Security/CWE/CWE-074/JndiInjectionLib.qll‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎java/ql/src/experimental/semmle/code/java/frameworks/Jndi.qll‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
11
import java
22

3-
/** The class `javax.naming.InitialContext`. */
4-
class TypeInitialContext extends Class {
5-
TypeInitialContext() { this.hasQualifiedName("javax.naming", "InitialContext") }
6-
}
7-
83
/** The class `javax.naming.CompositeName`. */
94
class TypeCompositeName extends Class {
105
TypeCompositeName() { this.hasQualifiedName("javax.naming", "CompositeName") }
@@ -14,3 +9,25 @@ class TypeCompositeName extends Class {
149
class TypeCompoundName extends Class {
1510
TypeCompoundName() { this.hasQualifiedName("javax.naming", "CompoundName") }
1611
}
12+
13+
/** The class `javax.management.remote.rmi.RMIConnector`. */
14+
class TypeRMIConnector extends Class {
15+
TypeRMIConnector() { this.hasQualifiedName("javax.management.remote.rmi", "RMIConnector") }
16+
}
17+
18+
/** The class `javax.management.remote.JMXConnectorFactory`. */
19+
class TypeJMXConnectorFactory extends Class {
20+
TypeJMXConnectorFactory() {
21+
this.hasQualifiedName("javax.management.remote", "JMXConnectorFactory")
22+
}
23+
}
24+
25+
/** The class `javax.management.remote.JMXServiceURL`. */
26+
class TypeJMXServiceURL extends Class {
27+
TypeJMXServiceURL() { this.hasQualifiedName("javax.management.remote", "JMXServiceURL") }
28+
}
29+
30+
/** The interface `javax.naming.Context`. */
31+
class TypeNamingContext extends Interface {
32+
TypeNamingContext() { this.hasQualifiedName("javax.naming", "Context") }
33+
}

‎java/ql/src/experimental/semmle/code/java/frameworks/Shiro.qll‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎java/ql/src/experimental/semmle/code/java/frameworks/spring/SpringJndi.qll‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ private module Frameworks {
8282
private import semmle.code.java.security.XSS
8383
private import semmle.code.java.security.LdapInjection
8484
private import semmle.code.java.security.XPath
85+
private import semmle.code.java.security.JndiInjection
8586
}
8687

8788
private predicate sourceModelCsv(string row) {

‎java/ql/src/semmle/code/java/security/Jndi.qll‎

Lines changed: 0 additions & 239 deletions
This file was deleted.

0 commit comments

Comments
 (0)