Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 590b9d8

Browse files
luchua-bcluchua-bc
committed
Standardize the query and update qldoc
1 parent e99cee4 commit 590b9d8

6 files changed

Lines changed: 17 additions & 13 deletions

File tree

‎java/ql/lib/semmle/code/java/frameworks/Servlets.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,7 @@ class RequestDispatchMethod extends Method {
381381
/**
382382
* The interface `javax.servlet.ServletContext`.
383383
*/
384-
library class ServletContext extends RefType {
384+
class ServletContext extends RefType {
385385
ServletContext() { this.hasQualifiedName("javax.servlet", "ServletContext") }
386386
}
387387

‎java/ql/src/experimental/Security/CWE/CWE-552/UnsafeResourceGet.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// BAD: no URI validation
2-
URL url = servletContext.getResource(requestUrl);
2+
URL url = request.getServletContext().getResource(requestUrl);
33
url = getClass().getResource(requestUrl);
44
InputStream in = url.openStream();
55

@@ -13,4 +13,6 @@
1313
}
1414

1515
Path path = Paths.get(requestUrl).normalize().toRealPath();
16-
URL url = sc.getResource(path.toString());
16+
if (path.startsWith("/trusted")) {
17+
URL url = request.getServletContext().getResource(path.toString());
18+
}

‎java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ file exposure attacks. It also shows how to remedy the problem by validating the
5454
<li>Micro Focus:
5555
<a href="https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.file_disclosure_j2ee">File Disclosure: J2EE</a>
5656
</li>
57-
<li>
58-
<a href="https://vuldb.com/?id.81084">Apache Tomcat 6.0/7.0/8.0/9.0 Servletcontext Getresource/getresourceasstream/getresourcepaths Path Traversal</a>
57+
<li>CVE-2015-5174:
58+
<a href="https://vuldb.com/?id.81084">Apache Tomcat 6.0/7.0/8.0/9.0 Servletcontext getResource/getResourceAsStream/getResourcePaths Path Traversal</a>
5959
</li>
6060
</references>
6161
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import java
1414
import UnsafeUrlForward
1515
import semmle.code.java.dataflow.FlowSources
1616
import semmle.code.java.dataflow.TaintTracking
17+
import experimental.semmle.code.java.frameworks.Jsf
1718
import experimental.semmle.code.java.PathSanitizer
1819
import DataFlow::PathGraph
1920

‎java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qll‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ private import experimental.semmle.code.java.frameworks.Jsf
33
private import semmle.code.java.dataflow.ExternalFlow
44
private import semmle.code.java.dataflow.FlowSources
55
private import semmle.code.java.dataflow.StringPrefixes
6+
private import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions
67

78
/** A sink for unsafe URL forward vulnerabilities. */
89
abstract class UnsafeUrlForwardSink extends DataFlow::Node { }
@@ -23,31 +24,31 @@ private class RequestDispatcherSink extends UnsafeUrlForwardSink {
2324
/** The `getResource` method of `Class`. */
2425
class GetClassResourceMethod extends Method {
2526
GetClassResourceMethod() {
26-
this.getSourceDeclaration().getDeclaringType().hasQualifiedName("java.lang", "Class") and
27+
this.getDeclaringType() instanceof TypeClass and
2728
this.hasName("getResource")
2829
}
2930
}
3031

3132
/** The `getResourceAsStream` method of `Class`. */
3233
class GetClassResourceAsStreamMethod extends Method {
3334
GetClassResourceAsStreamMethod() {
34-
this.getSourceDeclaration().getDeclaringType().hasQualifiedName("java.lang", "Class") and
35+
this.getDeclaringType() instanceof TypeClass and
3536
this.hasName("getResourceAsStream")
3637
}
3738
}
3839

3940
/** The `getResource` method of `ClassLoader`. */
4041
class GetClassLoaderResourceMethod extends Method {
4142
GetClassLoaderResourceMethod() {
42-
this.getDeclaringType().hasQualifiedName("java.lang", "ClassLoader") and
43+
this.getDeclaringType() instanceof ClassLoaderClass and
4344
this.hasName("getResource")
4445
}
4546
}
4647

4748
/** The `getResourceAsStream` method of `ClassLoader`. */
4849
class GetClassLoaderResourceAsStreamMethod extends Method {
4950
GetClassLoaderResourceAsStreamMethod() {
50-
this.getDeclaringType().hasQualifiedName("java.lang", "ClassLoader") and
51+
this.getDeclaringType() instanceof ClassLoaderClass and
5152
this.hasName("getResourceAsStream")
5253
}
5354
}
@@ -73,8 +74,8 @@ class VirtualFile extends RefType {
7374
}
7475

7576
/** The JBoss method `getChild` of `FileResourceManager`. */
76-
class GetVirtualFileMethod extends Method {
77-
GetVirtualFileMethod() {
77+
class GetVirtualFileChildMethod extends Method {
78+
GetVirtualFileChildMethod() {
7879
this.getDeclaringType().getASupertype*() instanceof VirtualFile and
7980
this.hasName("getChild")
8081
}
@@ -91,7 +92,7 @@ private class GetResourceSink extends UnsafeUrlForwardSink {
9192
ma.getMethod() instanceof GetFacesResourceAsStreamMethod or
9293
ma.getMethod() instanceof GetClassResourceAsStreamMethod or
9394
ma.getMethod() instanceof GetClassLoaderResourceAsStreamMethod or
94-
ma.getMethod() instanceof GetVirtualFileMethod
95+
ma.getMethod() instanceof GetVirtualFileChildMethod
9596
) and
9697
ma.getArgument(0) = this.asExpr()
9798
)

‎java/ql/src/experimental/semmle/code/java/frameworks/Jsf.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
import semmle.code.java.Type
66

77
/**
8-
* The JSF class `FacesContext` for processing HTTP requests.
8+
* The JSF class `ExternalContext` for processing HTTP requests.
99
*/
1010
class ExternalContext extends RefType {
1111
ExternalContext() {

0 commit comments

Comments
 (0)