Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b62e9dc

Browse files
smowtonsmowton
committed
Convert tests to inline expectations and fix one bug revealed doing so
Specifically Apache sshd defines its sensitive api calls on an inherited interface, and they need to be described that way for us to pick them up.
1 parent ddb0846 commit b62e9dc

30 files changed

Lines changed: 131 additions & 401 deletions

java/ql/lib/semmle/code/java/security/HardcodedCredentialsSourceCall.qll renamed to java/ql/lib/semmle/code/java/security/HardcodedCredentialsSourceCallQuery.qll

File renamed without changes.

‎java/ql/lib/semmle/code/java/security/SensitiveApi.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -442,8 +442,8 @@ private predicate otherApiCallableCredentialParam(string s) {
442442
"com.jcraft.jsch.JSch;getSession(String, String, int);0",
443443
"com.jcraft.jsch.JSch;getSession(String, String);0",
444444
"ch.ethz.ssh2.Connection;authenticateWithPassword(String, String);0",
445-
"org.apache.sshd.client.SshClient;connect(String, String, int);0",
446-
"org.apache.sshd.client.SshClient;connect(String, SocketAddress);0",
445+
"org.apache.sshd.client.session.ClientSessionCreator;connect(String, String, int);0",
446+
"org.apache.sshd.client.session.ClientSessionCreator;connect(String, SocketAddress);0",
447447
"net.schmizz.sshj.SSHClient;authPassword(String, char[]);0",
448448
"net.schmizz.sshj.SSHClient;authPassword(String, String);0",
449449
"com.sshtools.j2ssh.authentication.SshAuthenticationClient;setUsername(String);0",

‎java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsSourceCall.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*/
1212

1313
import java
14-
import semmle.code.java.security.HardcodedCredentialsSourceCall
14+
import semmle.code.java.security.HardcodedCredentialsSourceCallQuery
1515
import DataFlow::PathGraph
1616

1717
from

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/CredentialsTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ public static void main(String[] args) throws SQLException {
1010
String url = "jdbc:mysql://localhost/test";
1111
String u = "admin"; // hard-coded credential (flow source)
1212

13-
DriverManager.getConnection(url, u, p); // sensitive call (flow target)
13+
DriverManager.getConnection(url, u, p); // $ HardcodedCredentialsApiCall
1414
test(url, u, p);
1515
}
1616

1717
public static void test(String url, String v, String q) throws SQLException {
18-
DriverManager.getConnection(url, v, q); // sensitive call (flow target)
18+
DriverManager.getConnection(url, v, q); // $ HardcodedCredentialsApiCall
1919
}
2020
}

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/FileCredentialTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ public static void main(String[] args) throws SQLException, IOException {
1515

1616
String p = readText(new File(file));
1717

18-
DriverManager.getConnection("", "admin", p); // sensitive call (flow target)
18+
DriverManager.getConnection("", "admin", p); // $ HardcodedCredentialsApiCall
1919
test(url, u, p);
2020
}
2121

2222
public static void test(String url, String v, String q) throws SQLException {
23-
DriverManager.getConnection(url, v, q); // sensitive call (flow target)
23+
DriverManager.getConnection(url, v, q); // $ HardcodedCredentialsApiCall
2424
}
2525

2626
public static String readText(File f) throws IOException

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedAWSCredentials.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
public class HardcodedAWSCredentials {
55
public static void main(String[] args) {
66
//BAD: Hardcoded credentials for connecting to AWS services
7-
//To fix the problem, use other approaches including AWS credentials file, environment variables, or instance/container credentials instead
8-
AWSCredentials creds = new BasicAWSCredentials("ACCESS_KEY", "SECRET_KEY");
7+
//To fix the problem, use other approaches including AWS credentials file, environment variables, or instance/container credentials instead
8+
AWSCredentials creds = new BasicAWSCredentials("ACCESS_KEY", "SECRET_KEY"); // $ HardcodedCredentialsApiCall
99
}
1010
}

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedApacheFtpCredentials.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ public class HardcodedApacheFtpCredentials {
66
public static void main(FTPClient client) {
77
// BAD: Hardcoded credentials used for the session username and/or password.
88
try {
9-
client.login("username", "password");
10-
client.login("username", "password", "blah");
9+
client.login("username", "password"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
10+
client.login("username", "password", "blah"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
1111
} catch(IOException e) { }
1212
}
1313
}

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedApacheSshdCredentials.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
public class HardcodedApacheSshdCredentials {
66
public static void main(SshClient client, AbstractClientSession session) {
77
// BAD: Hardcoded credentials used for the session username and/or password.
8-
client.connect("Username", "hostname", 22);
9-
client.connect("Username", null);
10-
session.addPasswordIdentity("password");
8+
client.connect("Username", "hostname", 22); // $ HardcodedCredentialsApiCall
9+
client.connect("Username", null); // $ HardcodedCredentialsApiCall
10+
session.addPasswordIdentity("password"); // $ HardcodedCredentialsApiCall
1111
}
1212
}

‎java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedAzureCredentials.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ public class HardcodedAzureCredentials {
1515
public void testHardcodedUsernamePassword(String input) {
1616
UsernamePasswordCredential usernamePasswordCredential = new UsernamePasswordCredentialBuilder()
1717
.clientId(clientId)
18-
.username(username)
19-
.password(clientSecret)
18+
.username(username) // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
19+
.password(clientSecret) // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
2020
.build();
2121

2222
SecretClient client = new SecretClientBuilder()
@@ -43,7 +43,7 @@ public void testEnvironmentUsernamePassword(String input) {
4343
public void testHardcodedClientSecret(String input) {
4444
ClientSecretCredential defaultCredential = new ClientSecretCredentialBuilder()
4545
.clientId(clientId)
46-
.clientSecret(clientSecret)
46+
.clientSecret(clientSecret) // $ HardcodedCredentialsApiCall
4747
.tenantId(tenantId)
4848
.build();
4949
}

0 commit comments

Comments
 (0)