Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4e3791d

Browse files
luchua-bcluchua-bc
committed
Remove LoadCredentialsConfiguration and update qldoc
1 parent 1349bf7 commit 4e3791d

2 files changed

Lines changed: 8 additions & 52 deletions

File tree

‎java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll‎

Lines changed: 3 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -40,68 +40,24 @@ predicate isNotCleartextCredentials(string value) {
4040
value.toLowerCase().matches(possibleSecretName())
4141
}
4242

43-
/** The credentials configuration property. */
43+
/** A configuration property that appears to contain a cleartext secret. */
4444
class CredentialsConfig extends ConfigPair {
4545
CredentialsConfig() {
4646
this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
4747
not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
4848
not isNotCleartextCredentials(this.getValueElement().getValue().trim())
4949
}
5050

51+
/** Gets the whitespace-trimmed name of this property. */
5152
string getName() { result = this.getNameElement().getName().trim() }
5253

54+
/** Gets the whitespace-trimmed value of this property. */
5355
string getValue() { result = this.getValueElement().getValue().trim() }
5456

5557
/** Returns a description of this vulnerability. */
5658
string getConfigDesc() {
57-
exists(
58-
// getProperty(...)
59-
LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink, MethodAccess ma
60-
|
61-
this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
62-
cc.hasFlow(source, sink) and
63-
ma.getArgument(0) = sink.asExpr() and
64-
result = "Plaintext credentials " + this.getName() + " are loaded in Java Properties " + ma
65-
)
66-
or
67-
exists(
68-
// @Value("${mail.password}")
69-
Annotation a
70-
|
71-
a.getType().hasQualifiedName("org.springframework.beans.factory.annotation", "Value") and
72-
a.getAValue().(CompileTimeConstantExpr).getStringValue() = "${" + this.getName() + "}" and
73-
result = "Plaintext credentials " + this.getName() + " are loaded in Spring annotation " + a
74-
)
75-
or
76-
not exists(LoadCredentialsConfiguration cc, DataFlow::Node source, DataFlow::Node sink |
77-
this.getName() = source.asExpr().(CompileTimeConstantExpr).getStringValue() and
78-
cc.hasFlow(source, sink)
79-
) and
80-
not exists(Annotation a |
81-
a.getType().hasQualifiedName("org.springframework.beans.factory.annotation", "Value") and
82-
a.getAValue().(CompileTimeConstantExpr).getStringValue() = "${" + this.getName() + "}"
83-
) and
8459
result =
8560
"Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
8661
" in properties file"
8762
}
8863
}
89-
90-
/**
91-
* A dataflow configuration tracking flow of cleartext credentials stored in a properties file
92-
* to a `Properties.getProperty(...)` method call.
93-
*/
94-
class LoadCredentialsConfiguration extends DataFlow::Configuration {
95-
LoadCredentialsConfiguration() { this = "LoadCredentialsConfiguration" }
96-
97-
override predicate isSource(DataFlow::Node source) {
98-
exists(CredentialsConfig cc |
99-
source.asExpr().(CompileTimeConstantExpr).getStringValue() = cc.getName()
100-
)
101-
}
102-
103-
override predicate isSink(DataFlow::Node sink) {
104-
sink.asExpr() =
105-
any(MethodAccess ma | ma.getMethod() instanceof PropertiesGetPropertyMethod).getArgument(0)
106-
}
107-
}

‎java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password are loaded in Java Properties getProperty(...) |
2-
| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password are loaded in Java Properties getProperty(...) |
3-
| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password are loaded in Spring annotation Value |
4-
| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key are loaded in Java Properties getProperty(...) |
5-
| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key are loaded in Java Properties getProperty(...) |
1+
| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password have cleartext value mysecpass in properties file |
2+
| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password have cleartext value Passw0rd@123 in properties file |
3+
| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password have cleartext value MysecPWxWa@1993 in properties file |
4+
| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key have cleartext value AKMAMQPBYMCD6YSAYCBA in properties file |
5+
| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key have cleartext value 8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k in properties file |

0 commit comments

Comments
 (0)