Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ab3772e

Browse files
JLLeitschuhJLLeitschuh
committed
Update JHipster CodeQL query from code review
1 parent 17603c8 commit ab3772e

2 files changed

Lines changed: 19 additions & 17 deletions

File tree

‎java/ql/src/Security/CWE/CWE-338/JHipsterGeneratedPRNG.ql‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,35 +14,37 @@ import semmle.code.java.frameworks.apache.Lang
1414

1515
private class PredictableApacheRandomStringUtilsMethod extends Method {
1616
PredictableApacheRandomStringUtilsMethod() {
17-
this.getDeclaringType() instanceof TypeApacheRandomStringUtils
17+
this.getDeclaringType() instanceof TypeApacheRandomStringUtils and
18+
// The one valid use of this type that uses SecureRandom as a source of data.
19+
not this.getName() = "random"
1820
}
1921
}
2022

2123
private class PredictableApacheRandomStringUtilsMethodAccess extends MethodAccess {
2224
PredictableApacheRandomStringUtilsMethodAccess() {
23-
this.getMethod() instanceof PredictableApacheRandomStringUtilsMethod and
24-
// The one valid use of this type that uses SecureRandom as a source of data.
25-
not this.getMethod().getName() = "random"
25+
this.getMethod() instanceof PredictableApacheRandomStringUtilsMethod
2626
}
2727
}
2828

2929
private class VulnerableJHipsterRandomUtilClass extends Class {
30-
VulnerableJHipsterRandomUtilClass() { getName() = "RandomUtil" }
30+
VulnerableJHipsterRandomUtilClass() {
31+
// The package name that JHipster generated the 'RandomUtil' class in was dynamic. Thus 'hasQualifiedName' can not be used here.
32+
getName() = "RandomUtil"
33+
}
3134
}
3235

3336
private class VulnerableJHipsterRandomUtilMethod extends Method {
3437
VulnerableJHipsterRandomUtilMethod() {
3538
this.getDeclaringType() instanceof VulnerableJHipsterRandomUtilClass and
3639
this.getName().matches("generate%") and
3740
this.getReturnType() instanceof TypeString and
38-
exists(ReturnStmt s, PredictableApacheRandomStringUtilsMethodAccess access |
39-
s = this.getBody().(SingletonBlock).getStmt()
40-
|
41-
s.getResult() = access
41+
exists(ReturnStmt s |
42+
s = this.getBody().(SingletonBlock).getStmt() and
43+
s.getResult() instanceof PredictableApacheRandomStringUtilsMethodAccess
4244
)
4345
}
4446
}
4547

46-
from VulnerableJHipsterRandomUtilMethod the_method
47-
select the_method,
48-
"RandomUtil was generated by JHipster Generator version vulnerable to CVE-2019-16303"
48+
from VulnerableJHipsterRandomUtilMethod method
49+
select method,
50+
"Weak random number generator used in security sensitive method (JHipster CVE-2019-16303)."

‎java/ql/test/query-tests/security/CWE-338/semmle/tests/JHipsterGeneratedPRNG.expected‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
| vulnerable/RandomUtil.java:20:26:20:41 | generatePassword | RandomUtil was generated by JHipster Generator version vulnerable to CVE-2019-16303 |
2-
| vulnerable/RandomUtil.java:29:26:29:46 | generateActivationKey | RandomUtil was generated by JHipster Generator version vulnerable to CVE-2019-16303 |
3-
| vulnerable/RandomUtil.java:38:26:38:41 | generateResetKey | RandomUtil was generated by JHipster Generator version vulnerable to CVE-2019-16303 |
4-
| vulnerable/RandomUtil.java:48:26:48:43 | generateSeriesData | RandomUtil was generated by JHipster Generator version vulnerable to CVE-2019-16303 |
5-
| vulnerable/RandomUtil.java:57:26:57:42 | generateTokenData | RandomUtil was generated by JHipster Generator version vulnerable to CVE-2019-16303 |
1+
| vulnerable/RandomUtil.java:20:26:20:41 | generatePassword | Weak random number generator used in security sensitive method (JHipster CVE-2019-16303). |
2+
| vulnerable/RandomUtil.java:29:26:29:46 | generateActivationKey | Weak random number generator used in security sensitive method (JHipster CVE-2019-16303). |
3+
| vulnerable/RandomUtil.java:38:26:38:41 | generateResetKey | Weak random number generator used in security sensitive method (JHipster CVE-2019-16303). |
4+
| vulnerable/RandomUtil.java:48:26:48:43 | generateSeriesData | Weak random number generator used in security sensitive method (JHipster CVE-2019-16303). |
5+
| vulnerable/RandomUtil.java:57:26:57:42 | generateTokenData | Weak random number generator used in security sensitive method (JHipster CVE-2019-16303). |

0 commit comments

Comments
 (0)