Java: Added a source and a taint step for JexlInjectionConfig

artem-smotrakov · artem-smotrakov · commit 7d2d27394b18 · 2021-01-17T22:28:42.000+01:00
- Added TaintedSpringRequestBody source
- Added returningTaintedDataFromBean() taint step
- Added tests
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
@@ -11,6 +11,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
   JexlInjectionConfig() { this = "JexlInjectionConfig" }
 
   override predicate isSource(DataFlow::Node source) {
+    source instanceof TaintedSpringRequestBody or
     source instanceof RemoteFlowSource or
     source instanceof UserInput or
     source instanceof EnvInput
@@ -22,7 +23,18 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
     creatingTaintedJexlExpression(node1, node2) or
     creatingTaintedJexlTemplate(node1, node2) or
     creatingTaintedJexlScript(node1, node2) or
-    creatingTaintedJexlCallable(node1, node2)
+    creatingTaintedJexlCallable(node1, node2) or
+    returningTaintedDataFromBean(node1, node2)
+  }
+}
+
+/**
+ * A data flow source for parameters that have
+ * a Spring framework annotation indicating remote user input from servlets.
+ */
+class TaintedSpringRequestBody extends DataFlow::Node {
+  TaintedSpringRequestBody() {
+    exists(SpringServletInputAnnotation a | this.asParameter().getAnAnnotation() = a)
   }
 }
 
@@ -119,6 +131,18 @@ predicate creatingTaintedJexlCallable(DataFlow::Node node1, DataFlow::Node node2
   )
 }
 
+/**
+ * Holds if `node1` to `node2` is a dataflow step that returns data from
+ * a tainted bean by calling one of its getters.
+ */
+predicate returningTaintedDataFromBean(DataFlow::Node node1, DataFlow::Node node2) {
+  exists(MethodAccess ma, Method m | ma.getMethod() = m |
+    m instanceof GetterMethod and
+    ma.getQualifier() = node1.asExpr() and
+    ma = node2.asExpr()
+  )
+}
+
 /**
  * Holds if `expr` is a call to one of the methods that execute a Jexl script.
  */
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/Jexl3Injection.java b/java/ql/test/experimental/query-tests/security/CWE-094/Jexl3Injection.java
@@ -4,6 +4,11 @@
 import java.util.function.Consumer;
 
 import org.apache.commons.jexl3.*;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
 
 public class Jexl3Injection {
 
@@ -132,4 +137,58 @@ public static void testWithJxltEngineTemplateEvaluate() throws Exception {
     public static void testWithJexlExpressionCallable() throws Exception {
         testWithSocket(Jexl3Injection::runJexlExpressionViaCallable);
     }
+
+    @PostMapping("/request")
+    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromPathVariable(
+            @PathVariable String expr) {
+
+        runJexlExpression(expr);
+        return ResponseEntity.ok(HttpStatus.OK);
+    }
+
+    @PostMapping("/request")
+    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromRequestBody(
+            @RequestBody Data data) {
+
+        String expr = data.getExpr();
+        runJexlExpression(expr);
+
+        return ResponseEntity.ok(HttpStatus.OK);
+    }
+
+    @PostMapping("/request")
+    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromRequestBodyWithNestedObjects(
+            @RequestBody CustomRequest customRequest) {
+
+        String expr = customRequest.getData().getExpr();
+        runJexlExpression(expr);
+
+        return ResponseEntity.ok(HttpStatus.OK);
+    }
+
+    public static class CustomRequest {
+
+        private Data data;
+
+        CustomRequest(Data data) {
+            this.data = data;
+        }
+
+        public Data getData() {
+            return data;
+        }
+    }
+
+    public static class Data {
+
+        private String expr;
+
+        Data(String expr) {
+            this.expr = expr;
+        }
+
+        public String getExpr() {
+            return expr;
+        }
+    }
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/http/ResponseEntity.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/http/ResponseEntity.java
@@ -9,4 +9,8 @@ public class ResponseEntity<T> extends org.springframework.http.HttpEntity {
 
     // public ResponseEntity(T body, org.springframework.http.HttpStatus status) {
     // }
+
+    public static <T> ResponseEntity<T> ok(T body) {
+        return null;
+    }
  }
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/PathVariable.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/PathVariable.java
@@ -0,0 +1,14 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface PathVariable {
+
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/PostMapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/PostMapping.java
@@ -0,0 +1,16 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+@RequestMapping(method = RequestMethod.POST)
+public @interface PostMapping {
+
+    String[] value() default {};
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestBody.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestBody.java
@@ -0,0 +1,15 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.PARAMETER)
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface RequestBody {
+
+	boolean required() default true;
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
@@ -5,4 +5,7 @@
 @Target(value={ElementType.METHOD,ElementType.TYPE})
 @Retention(value=RetentionPolicy.RUNTIME)
 @Documented
-public @interface RequestMapping { }
+public @interface RequestMapping {
+
+    RequestMethod[] method() default {};
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMethod.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMethod.java
@@ -0,0 +1,6 @@
+package org.springframework.web.bind.annotation;
+
+public enum RequestMethod {
+
+	GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS, TRACE
+}

Original file line number	Diff line number	Diff line change
`@@ -9,4 +9,8 @@ public class ResponseEntity<T> extends org.springframework.http.HttpEntity {`
`9`	`9`
`10`	`10`	`// public ResponseEntity(T body, org.springframework.http.HttpStatus status) {`
`11`	`11`	`// }`
	`12`	`+`
	`13`	`+ public static <T> ResponseEntity<T> ok(T body) {`
	`14`	`+ return null;`
	`15`	`+ }`
`12`	`16`	`}`