Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9b3070a

Browse files
intrigusintrigus
committed
Java: Add JXBrowser disabled certificate query.
1 parent 4bc287e commit 9b3070a

3 files changed

Lines changed: 127 additions & 0 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-295/JXBrowserWithoutCertValidation.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
public static void main(String[] args) {
2+
{
3+
Browser browser = new Browser();
4+
browser.loadURL("https://example.com");
5+
// no further calls
6+
// BAD: The browser ignores any certificate error by default!
7+
}
8+
9+
{
10+
Browser browser = new Browser();
11+
browser.setLoadHandler(new LoadHandler() {
12+
public boolean onLoad(LoadParams params) {
13+
return true;
14+
}
15+
16+
public boolean onCertificateError(CertificateErrorParams params){
17+
return true; // GOOD: This means that loading will be cancelled on certificate errors
18+
}
19+
}); // GOOD: A secure `LoadHandler` is used.
20+
browser.loadURL("https://example.com");
21+
22+
}
23+
}

‎java/ql/src/experimental/Security/CWE/CWE-295/JXBrowserWithoutCertValidation.qhelp‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>JXBrowser is a Java library that allows to embed the Chromium browser inside Java applications.
8+
The version 6.x.x by default ignores any HTTPS certificate errors thereby allowing man-in-the-middle attacks.
9+
</p>
10+
</overview>
11+
12+
<recommendation>
13+
<p>Do either of these:
14+
<li>Update to version 7.x.x as it now correctly rejects certificate errors by default.</li>
15+
<li>Add a custom implementation of the <code>LoadHandler</code> interface whose <code>onCertificateError</code> method always returns <b>true</b> indicating that loading should be cancelled.
16+
Then use the <code>setLoadHandler</code> method with your custom <code>LoadHandler</code> on every <code>Browser</code> you use.</li>
17+
</p>
18+
</recommendation>
19+
20+
<example>
21+
<p>The following two examples show two ways of using a <code>Browser</code>. In the 'BAD' case,
22+
all certificate errors are ignored. In the 'GOOD' case, certificate errors are rejected.</p>
23+
<sample src="JXBrowserWithoutCertValidation.java" />
24+
</example>
25+
26+
<references>
27+
<li>Teamdev:
28+
<a href="https://www.teamdev.com/downloads/jxbrowser/javadoc/com/teamdev/jxbrowser/chromium/LoadHandler.html#onCertificateError-com.teamdev.jxbrowser.chromium.CertificateErrorParams-">
29+
Javadoc for the LoadHandler#onCertificateError method</a>.</li>
30+
</references>
31+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-295/JXBrowserWithoutCertValidation.ql‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/**
2+
* @name JXBrowser with disabled certificate validation
3+
* @description Insecure configuration of JXBrowser disables certificate validation making the app vulnerable to man-in-the-middle attacks.
4+
* @kind problem
5+
* @id java/jxbrowser/disabled-certificate-validation
6+
* @tags security
7+
* external/cwe-295
8+
*/
9+
10+
import java
11+
import semmle.code.java.security.Encryption
12+
import semmle.code.java.dataflow.TaintTracking
13+
14+
/*
15+
* This query is version specific to JXBrowser 6.x.x. The version is indirectly detected.
16+
* In version 6.x.x the `Browser` class is in a different package compared to version 7.x.x.
17+
*/
18+
19+
/** The `com.teamdev.jxbrowser.chromium.Browser` class. */
20+
private class JXBrowser extends RefType {
21+
JXBrowser() { this.hasQualifiedName("com.teamdev.jxbrowser.chromium", "Browser") }
22+
}
23+
24+
/** The `setLoadHandler` method on the `com.teamdev.jxbrowser.chromium.Browser` class. */
25+
private class JXBrowserSetLoadHandler extends Method {
26+
JXBrowserSetLoadHandler() {
27+
this.hasName("setLoadHandler") and this.getDeclaringType() instanceof JXBrowser
28+
}
29+
}
30+
31+
/** The `com.teamdev.jxbrowser.chromium.LoadHandler` interface. */
32+
private class JXBrowserLoadHandler extends RefType {
33+
JXBrowserLoadHandler() { this.hasQualifiedName("com.teamdev.jxbrowser.chromium", "LoadHandler") }
34+
}
35+
36+
private predicate isOnCertificateErrorMethodSafe(Method m) {
37+
forex(ReturnStmt rs | rs.getEnclosingCallable() = m |
38+
rs.getResult().(CompileTimeConstantExpr).getBooleanValue() = true
39+
)
40+
}
41+
42+
/** A class that securely implements the `com.teamdev.jxbrowser.chromium.LoadHandler` interface. */
43+
private class JXBrowserSafeLoadHandler extends RefType {
44+
JXBrowserSafeLoadHandler() {
45+
this.getASupertype() instanceof JXBrowserLoadHandler and
46+
exists(Method m | m.hasName("onCertificateError") and m.getDeclaringType() = this |
47+
isOnCertificateErrorMethodSafe(m)
48+
)
49+
}
50+
}
51+
52+
private class JXBrowserTaintTracking extends TaintTracking::Configuration {
53+
JXBrowserTaintTracking() { this = "JXBrowserTaintTracking" }
54+
55+
override predicate isSource(DataFlow::Node src) {
56+
exists(ClassInstanceExpr newJXBrowser | newJXBrowser.getConstructedType() instanceof JXBrowser |
57+
newJXBrowser = src.asExpr()
58+
)
59+
}
60+
61+
override predicate isSink(DataFlow::Node sink) {
62+
exists(MethodAccess ma | ma.getMethod() instanceof JXBrowserSetLoadHandler |
63+
ma.getArgument(0).getType() instanceof JXBrowserSafeLoadHandler and
64+
ma.getQualifier() = sink.asExpr()
65+
)
66+
}
67+
}
68+
69+
from JXBrowserTaintTracking cfg, DataFlow::Node src
70+
where
71+
cfg.isSource(src) and
72+
not cfg.hasFlow(src, _)
73+
select src, "This JXBrowser instance allows man-in-the-middle attacks."

0 commit comments

Comments
 (0)