Improve documentation of csv sink models

tamasvajk · tamasvajk · commit 7134eb9079e7 · 2021-04-22T11:37:41.000+02:00
diff --git a/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql b/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
@@ -124,7 +124,7 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {
     source.asExpr().(MethodAccess).getMethod() instanceof ArchiveEntryNameMethod
   }
 
-  override predicate isSink(Node sink) { sinkNode(sink, "create-file") }
+  override predicate isSink(Node sink) { sink instanceof FileCreationSink }
 
   override predicate isAdditionalTaintStep(Node n1, Node n2) {
     filePathStep(n1, n2) or fileTaintStep(n1, n2)
@@ -146,6 +146,13 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {
   }
 }
 
+/**
+ * A sink that represents a file creation, such as a file write, copy or move operation.
+ */
+private class FileCreationSink extends DataFlow::Node {
+  FileCreationSink() { sinkNode(this, "create-file") }
+}
+
 from PathNode source, PathNode sink
 where any(ZipSlipConfiguration c).hasFlowPath(source, sink)
 select source.getNode(), source, sink,
diff --git a/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql b/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
@@ -60,7 +60,15 @@ class BeanValidationConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "bean-validation") }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof BeanValidationSink }
+}
+
+/**
+ * A bean validation sink, such as method `buildConstraintViolationWithTemplate`
+ * declared on a subtype of `javax.validation.ConstraintValidatorContext`.
+ */
+private class BeanValidationSink extends DataFlow::Node {
+  BeanValidationSink() { sinkNode(this, "bean-validation") }
 }
 
 from BeanValidationConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
diff --git a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
@@ -50,7 +50,7 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {
     source.asExpr().(ClassInstanceExpr).getConstructedType() instanceof TrustAllHostnameVerifier
   }
 
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "set-hostname-verifier") }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof HostnameVerifierSink }
 
   override predicate isBarrier(DataFlow::Node barrier) {
     // ignore nodes that are in functions that intentionally disable hostname verification
@@ -78,6 +78,13 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {
   }
 }
 
+/**
+ * A sink that sets the `HostnameVerifier` on `HttpsURLConnection`.
+ */
+private class HostnameVerifierSink extends DataFlow::Node {
+  HostnameVerifierSink() { sinkNode(this, "set-hostname-verifier") }
+}
+
 bindingset[result]
 private string getAFlagName() {
   result
diff --git a/java/ql/src/semmle/code/java/security/XSS.qll b/java/ql/src/semmle/code/java/security/XSS.qll
@@ -29,6 +29,7 @@ class XssAdditionalTaintStep extends Unit {
   abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
 }
 
+/** CSV sink models representing methods susceptible to XSS attacks. */
 private class DefaultXssSinkModel extends SinkModelCsv {
   override predicate row(string row) {
     row =

Original file line number	Diff line number	Diff line change
`@@ -124,7 +124,7 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {`
`124`	`124`	`source.asExpr().(MethodAccess).getMethod() instanceof ArchiveEntryNameMethod`
`125`	`125`	`}`
`126`	`126`
`127`		`- override predicate isSink(Node sink) { sinkNode(sink, "create-file") }`
	`127`	`+ override predicate isSink(Node sink) { sink instanceof FileCreationSink }`
`128`	`128`
`129`	`129`	`override predicate isAdditionalTaintStep(Node n1, Node n2) {`
`130`	`130`	`filePathStep(n1, n2) or fileTaintStep(n1, n2)`
`@@ -146,6 +146,13 @@ class ZipSlipConfiguration extends TaintTracking::Configuration {`
`146`	`146`	`}`
`147`	`147`	`}`
`148`	`148`
	`149`	`+/**`
	`150`	`+ * A sink that represents a file creation, such as a file write, copy or move operation.`
	`151`	`+ */`
	`152`	`+private class FileCreationSink extends DataFlow::Node {`
	`153`	`+ FileCreationSink() { sinkNode(this, "create-file") }`
	`154`	`+}`
	`155`	`+`
`149`	`156`	`from PathNode source, PathNode sink`
`150`	`157`	`where any(ZipSlipConfiguration c).hasFlowPath(source, sink)`
`151`	`158`	`select source.getNode(), source, sink,`
Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,7 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {`
`50`	`50`	`source.asExpr().(ClassInstanceExpr).getConstructedType() instanceof TrustAllHostnameVerifier`
`51`	`51`	`}`
`52`	`52`
`53`		`- override predicate isSink(DataFlow::Node sink) { sinkNode(sink, "set-hostname-verifier") }`
	`53`	`+ override predicate isSink(DataFlow::Node sink) { sink instanceof HostnameVerifierSink }`
`54`	`54`
`55`	`55`	`override predicate isBarrier(DataFlow::Node barrier) {`
`56`	`56`	`// ignore nodes that are in functions that intentionally disable hostname verification`
`@@ -78,6 +78,13 @@ class TrustAllHostnameVerifierConfiguration extends DataFlow::Configuration {`
`78`	`78`	`}`
`79`	`79`	`}`
`80`	`80`
	`81`	`+/**`
	`82`	+ * A sink that sets the `HostnameVerifier` on `HttpsURLConnection`.
	`83`	`+ */`
	`84`	`+private class HostnameVerifierSink extends DataFlow::Node {`
	`85`	`+ HostnameVerifierSink() { sinkNode(this, "set-hostname-verifier") }`
	`86`	`+}`
	`87`	`+`
`81`	`88`	`bindingset[result]`
`82`	`89`	`private string getAFlagName() {`
`83`	`90`	`result`
Original file line number	Diff line number	Diff line change
`@@ -29,6 +29,7 @@ class XssAdditionalTaintStep extends Unit {`
`29`	`29`	`abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);`
`30`	`30`	`}`
`31`	`31`
	`32`	`+/** CSV sink models representing methods susceptible to XSS attacks. */`
`32`	`33`	`private class DefaultXssSinkModel extends SinkModelCsv {`
`33`	`34`	`override predicate row(string row) {`
`34`	`35`	`row =`