Merge pull request #4603 from pwntester/new_deser_sink

aschackmull · web-flow · commit 45d117b68e3d · 2020-11-05T13:09:15.000+01:00
New UnsafeDeserialization sink and improvements to SnakeYaml sink
diff --git a/java/change-notes/2020-11-04-commonslang-unsafe-deserialization-sinks.md b/java/change-notes/2020-11-04-commonslang-unsafe-deserialization-sinks.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The query "Deserialization of user-controlled data" (`java/unsafe-deserialization`) has been improved to recognize unsafe Apache Commons Lang(3) methods.
+* The SnakeYAML Unsafe Deserialization sink has been improved to recognize `compose` and `composeAll` unsafe methods.
diff --git a/java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll b/java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll
@@ -39,7 +39,7 @@ class SafeSnakeYamlConstruction extends ClassInstanceExpr {
  * The class `org.yaml.snakeyaml.Yaml`.
  */
 class Yaml extends RefType {
-  Yaml() { this.hasQualifiedName("org.yaml.snakeyaml", "Yaml") }
+  Yaml() { this.getASupertype*().hasQualifiedName("org.yaml.snakeyaml", "Yaml") }
 }
 
 private class SafeYamlConstructionFlowConfig extends DataFlow2::Configuration {
@@ -71,7 +71,7 @@ private class SnakeYamlParse extends MethodAccess {
   SnakeYamlParse() {
     exists(Method m |
       m.getDeclaringType() instanceof Yaml and
-      (m.hasName("load") or m.hasName("loadAll") or m.hasName("loadAs") or m.hasName("parse")) and
+      m.hasName(["compose", "composeAll", "load", "loadAll", "loadAs", "parse"]) and
       m = this.getMethod()
     )
   }
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
@@ -10,3 +10,18 @@ class TypeApacheRandomStringUtils extends Class {
     hasQualifiedName("org.apache.commons.lang3", "RandomStringUtils")
   }
 }
+
+/*--- Methods ---*/
+/**
+ * The method `deserialize` in either `org.apache.commons.lang.SerializationUtils`
+ * or `org.apache.commons.lang3.SerializationUtils`.
+ */
+class MethodApacheSerializationUtilsDeserialize extends Method {
+  MethodApacheSerializationUtilsDeserialize() {
+    (
+      this.getDeclaringType().hasQualifiedName("org.apache.commons.lang", "SerializationUtils") or
+      this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "SerializationUtils")
+    ) and
+    this.hasName("deserialize")
+  }
+}
diff --git a/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll b/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
@@ -1,6 +1,7 @@
 import semmle.code.java.frameworks.Kryo
 import semmle.code.java.frameworks.XStream
 import semmle.code.java.frameworks.SnakeYaml
+import semmle.code.java.frameworks.apache.Lang
 
 class ObjectInputStreamReadObjectMethod extends Method {
   ObjectInputStreamReadObjectMethod() {
@@ -71,6 +72,9 @@ predicate unsafeDeserialization(MethodAccess ma, Expr sink) {
     sink = ma.getAnArgument() and
     not exists(SafeKryo sk | sk.hasFlowToExpr(ma.getQualifier()))
     or
+    m instanceof MethodApacheSerializationUtilsDeserialize and
+    sink = ma.getArgument(0)
+    or
     ma instanceof UnsafeSnakeYamlParse and
     sink = ma.getArgument(0)
   )

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+lgtm,codescanning`
	`2`	+* The query "Deserialization of user-controlled data" (`java/unsafe-deserialization`) has been improved to recognize unsafe Apache Commons Lang(3) methods.
	`3`	+* The SnakeYAML Unsafe Deserialization sink has been improved to recognize `compose` and `composeAll` unsafe methods.
Original file line number	Diff line number	Diff line change
`@@ -39,7 +39,7 @@ class SafeSnakeYamlConstruction extends ClassInstanceExpr {`
`39`	`39`	* The class `org.yaml.snakeyaml.Yaml`.
`40`	`40`	`*/`
`41`	`41`	`class Yaml extends RefType {`
`42`		`- Yaml() { this.hasQualifiedName("org.yaml.snakeyaml", "Yaml") }`
	`42`	`+ Yaml() { this.getASupertype*().hasQualifiedName("org.yaml.snakeyaml", "Yaml") }`
`43`	`43`	`}`
`44`	`44`
`45`	`45`	`private class SafeYamlConstructionFlowConfig extends DataFlow2::Configuration {`
`@@ -71,7 +71,7 @@ private class SnakeYamlParse extends MethodAccess {`
`71`	`71`	`SnakeYamlParse() {`
`72`	`72`	`exists(Method m \|`
`73`	`73`	`m.getDeclaringType() instanceof Yaml and`
`74`		`- (m.hasName("load") or m.hasName("loadAll") or m.hasName("loadAs") or m.hasName("parse")) and`
	`74`	`+ m.hasName(["compose", "composeAll", "load", "loadAll", "loadAs", "parse"]) and`
`75`	`75`	`m = this.getMethod()`
`76`	`76`	`)`
`77`	`77`	`}`