Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4c7d476

Browse files
smehta23smehta23
committed
[JAVA] Partial Path Traversal Vuln Query
1 parent c4c3a52 commit 4c7d476

5 files changed

Lines changed: 260 additions & 0 deletions

File tree

‎java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.expected‎

Whitespace-only changes.

‎java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* @name Partial Path Traversal Vulnerability
3+
* @description A misuse of the String `startsWith` method as a guard to protect against path traversal is insufficient.
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 9.3
7+
* @precision high
8+
* @id java/partial-path-traversal
9+
* @tags security
10+
* external/cwe/cwe-023
11+
*/
12+
13+
import java
14+
15+
16+
class MethodStringStartsWith extends Method {
17+
MethodStringStartsWith() {
18+
this.hasName("startsWith")
19+
}
20+
}
21+
22+
from MethodAccess ma
23+
where ma.getMethod() instanceof MethodStringStartsWith
24+
select ma, "Partial Path Traversal Vulnerability due to insufficient guard against path traversal"

‎java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversal.expected‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| PartialPathTraversalTest.java:10:14:10:73 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
2+
| PartialPathTraversalTest.java:17:9:17:72 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
3+
| PartialPathTraversalTest.java:29:14:29:58 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
4+
| PartialPathTraversalTest.java:35:14:35:63 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
5+
| PartialPathTraversalTest.java:42:14:42:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
6+
| PartialPathTraversalTest.java:49:14:49:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
7+
| PartialPathTraversalTest.java:53:14:53:65 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
8+
| PartialPathTraversalTest.java:61:14:61:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
9+
| PartialPathTraversalTest.java:64:14:64:65 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
10+
| PartialPathTraversalTest.java:75:14:75:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
11+
| PartialPathTraversalTest.java:94:14:94:63 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
12+
| PartialPathTraversalTest.java:102:14:102:63 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
13+
| PartialPathTraversalTest.java:105:14:105:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
14+
| PartialPathTraversalTest.java:150:9:150:43 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
15+
| PartialPathTraversalTest.java:173:14:173:63 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
16+
| PartialPathTraversalTest.java:191:18:191:87 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |
17+
| PartialPathTraversalTest.java:209:14:209:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal |

‎java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversal.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-023/PartialPathTraversal.ql

‎java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversalTest.java‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
import java.io.IOException;
2+
import java.io.File;
3+
import java.io.InputStream;
4+
import static java.io.File.separatorChar;
5+
import java.nio.file.Files;
6+
7+
8+
public class PartialPathTraversalTest {
9+
public void esapiExample(File dir, File parent) throws IOException {
10+
if (!dir.getCanonicalPath().startsWith(parent.getCanonicalPath())) {
11+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
12+
}
13+
}
14+
15+
@SuppressWarnings("ResultOfMethodCallIgnored")
16+
void foo1(File dir, File parent) throws IOException {
17+
(dir.getCanonicalPath()).startsWith((parent.getCanonicalPath()));
18+
}
19+
20+
void foo2(File dir, File parent) throws IOException {
21+
dir.getCanonicalPath();
22+
if ("potato".startsWith(parent.getCanonicalPath())) {
23+
System.out.println("Hello!");
24+
}
25+
}
26+
27+
void foo3(File dir, File parent) throws IOException {
28+
String parentPath = parent.getCanonicalPath();
29+
if (!dir.getCanonicalPath().startsWith(parentPath)) {
30+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
31+
}
32+
}
33+
34+
void foo4(File dir) throws IOException {
35+
if (!dir.getCanonicalPath().startsWith("/usr" + "/dir")) {
36+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
37+
}
38+
}
39+
40+
void foo5(File dir, File parent) throws IOException {
41+
String canonicalPath = dir.getCanonicalPath();
42+
if (!canonicalPath.startsWith(parent.getCanonicalPath())) {
43+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
44+
}
45+
}
46+
47+
void foo6(File dir, File parent) throws IOException {
48+
String canonicalPath = dir.getCanonicalPath();
49+
if (!canonicalPath.startsWith(parent.getCanonicalPath())) {
50+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
51+
}
52+
String canonicalPath2 = dir.getCanonicalPath();
53+
if (!canonicalPath2.startsWith(parent.getCanonicalPath())) {
54+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
55+
}
56+
}
57+
58+
void foo7(File dir, File parent) throws IOException {
59+
String canonicalPath = dir.getCanonicalPath();
60+
String canonicalPath2 = dir.getCanonicalPath();
61+
if (!canonicalPath.startsWith(parent.getCanonicalPath())) {
62+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
63+
}
64+
if (!canonicalPath2.startsWith(parent.getCanonicalPath())) {
65+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
66+
}
67+
}
68+
69+
File getChild() {
70+
return null;
71+
}
72+
73+
void foo8(File parent) throws IOException {
74+
String canonicalPath = getChild().getCanonicalPath();
75+
if (!canonicalPath.startsWith(parent.getCanonicalPath())) {
76+
throw new IOException("Invalid directory: " + getChild().getCanonicalPath());
77+
}
78+
}
79+
80+
void foo9(File dir, File parent) throws IOException {
81+
if (!dir.getCanonicalPath().startsWith(parent.getCanonicalPath() + File.separator)) {
82+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
83+
}
84+
}
85+
86+
void foo10(File dir, File parent) throws IOException {
87+
if (!dir.getCanonicalPath().startsWith(parent.getCanonicalPath() + File.separatorChar)) {
88+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
89+
}
90+
}
91+
92+
void foo11(File dir, File parent) throws IOException {
93+
String parentCanonical = parent.getCanonicalPath();
94+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
95+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
96+
}
97+
}
98+
99+
void foo12(File dir, File parent) throws IOException {
100+
String parentCanonical = parent.getCanonicalPath();
101+
String parentCanonical2 = parent.getCanonicalPath();
102+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
103+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
104+
}
105+
if (!dir.getCanonicalPath().startsWith(parentCanonical2)) {
106+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
107+
}
108+
}
109+
110+
void foo13(File dir, File parent) throws IOException {
111+
String parentCanonical = parent.getCanonicalPath() + File.separatorChar;
112+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
113+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
114+
}
115+
}
116+
117+
void foo14(File dir, File parent) throws IOException {
118+
String parentCanonical = parent.getCanonicalPath() + separatorChar;
119+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
120+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
121+
}
122+
}
123+
124+
void foo15(File dir, File parent) throws IOException {
125+
String parentCanonical = parent.getCanonicalPath() + File.separatorChar;
126+
String parentCanonical2 = parent.getCanonicalPath() + File.separatorChar;
127+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
128+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
129+
}
130+
if (!dir.getCanonicalPath().startsWith(parentCanonical2)) {
131+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
132+
}
133+
}
134+
135+
void foo16(File dir, File parent) throws IOException {
136+
String parentCanonical = parent.getCanonicalPath() + File.separator;
137+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
138+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
139+
}
140+
}
141+
142+
@SuppressWarnings({
143+
"IfStatementWithIdenticalBranches",
144+
"MismatchedStringCase",
145+
"UnusedAssignment",
146+
"ResultOfMethodCallIgnored"
147+
})
148+
void foo17(File dir, File parent, boolean branch) throws IOException {
149+
String parentCanonical = null;
150+
"test ".startsWith("somethingElse");
151+
if (branch) {
152+
parentCanonical = parent.getCanonicalPath() + File.separatorChar;
153+
} else {
154+
parentCanonical = parent.getCanonicalPath() + File.separatorChar;
155+
}
156+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
157+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
158+
}
159+
}
160+
161+
void foo18(File dir, File parent, boolean branch) throws IOException {
162+
String parentCanonical = parent.getCanonicalPath();
163+
if (branch) {
164+
parentCanonical = parent.getCanonicalPath() + File.separatorChar;
165+
}
166+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
167+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
168+
}
169+
}
170+
171+
void foo19(File dir, File parent) throws IOException {
172+
String parentCanonical = parent.getCanonicalPath() + "/potato";
173+
if (!dir.getCanonicalPath().startsWith(parentCanonical)) {
174+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
175+
}
176+
}
177+
178+
private File cacheDir;
179+
180+
InputStream foo20(String... path) {
181+
StringBuilder sb = new StringBuilder();
182+
sb.append(cacheDir.getAbsolutePath());
183+
for (String p : path) {
184+
sb.append(File.separatorChar);
185+
sb.append(p);
186+
}
187+
sb.append(".gz");
188+
String filePath = sb.toString();
189+
File encodedFile = new File(filePath);
190+
try {
191+
if (!encodedFile.getCanonicalPath().startsWith(cacheDir.getCanonicalPath())) {
192+
return null;
193+
}
194+
return Files.newInputStream(encodedFile.toPath());
195+
} catch (Exception e) {
196+
return null;
197+
}
198+
}
199+
200+
void foo21(File dir, File parent) throws IOException {
201+
String parentCanonical = parent.getCanonicalPath();
202+
if (!dir.getCanonicalPath().startsWith(parentCanonical + File.separator)) {
203+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
204+
}
205+
}
206+
207+
void foo22(File dir, File dir2, File parent, boolean conditional) throws IOException {
208+
String canonicalPath = conditional ? dir.getCanonicalPath() : dir2.getCanonicalPath();
209+
if (!canonicalPath.startsWith(parent.getCanonicalPath())) {
210+
throw new IOException("Invalid directory: " + dir.getCanonicalPath());
211+
}
212+
}
213+
214+
public void doesNotFlag() {
215+
"hello".startsWith("goodbye");
216+
}
217+
218+
}

0 commit comments

Comments
 (0)