Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit cb73911

Browse files
egregius313egregius313
committed
Refactor MyBatis queries
1 parent d528c84 commit cb73911

3 files changed

Lines changed: 34 additions & 34 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-089/MyBatisAnnotationSqlInjection.ql‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,27 +13,24 @@
1313
*/
1414

1515
import java
16-
import DataFlow::PathGraph
1716
import MyBatisCommonLib
1817
import MyBatisAnnotationSqlInjectionLib
1918
import semmle.code.java.dataflow.FlowSources
19+
import semmle.code.java.dataflow.TaintTracking
20+
import MyBatisAnnotationSqlInjectionFlow::PathGraph
2021

21-
private class MyBatisAnnotationSqlInjectionConfiguration extends TaintTracking::Configuration {
22-
MyBatisAnnotationSqlInjectionConfiguration() { this = "MyBatis annotation sql injection" }
22+
private module MyBatisAnnotationSqlInjectionConfig implements DataFlow::ConfigSig {
23+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
2324

24-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
25+
predicate isSink(DataFlow::Node sink) { sink instanceof MyBatisAnnotatedMethodCallArgument }
2526

26-
override predicate isSink(DataFlow::Node sink) {
27-
sink instanceof MyBatisAnnotatedMethodCallArgument
28-
}
29-
30-
override predicate isSanitizer(DataFlow::Node node) {
27+
predicate isBarrier(DataFlow::Node node) {
3128
node.getType() instanceof PrimitiveType or
3229
node.getType() instanceof BoxedType or
3330
node.getType() instanceof NumberType
3431
}
3532

36-
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
33+
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
3734
exists(MethodAccess ma |
3835
ma.getMethod().getDeclaringType() instanceof TypeObject and
3936
ma.getMethod().getName() = "toString" and
@@ -43,12 +40,15 @@ private class MyBatisAnnotationSqlInjectionConfiguration extends TaintTracking::
4340
}
4441
}
4542

43+
private module MyBatisAnnotationSqlInjectionFlow =
44+
TaintTracking::Global<MyBatisAnnotationSqlInjectionConfig>;
45+
4646
from
47-
MyBatisAnnotationSqlInjectionConfiguration cfg, DataFlow::PathNode source,
48-
DataFlow::PathNode sink, IbatisSqlOperationAnnotation isoa, MethodAccess ma,
49-
string unsafeExpression
47+
MyBatisAnnotationSqlInjectionFlow::PathNode source,
48+
MyBatisAnnotationSqlInjectionFlow::PathNode sink, IbatisSqlOperationAnnotation isoa,
49+
MethodAccess ma, string unsafeExpression
5050
where
51-
cfg.hasFlowPath(source, sink) and
51+
MyBatisAnnotationSqlInjectionFlow::flowPath(source, sink) and
5252
ma.getAnArgument() = sink.getNode().asExpr() and
5353
myBatisSqlOperationAnnotationFromMethod(ma.getMethod(), isoa) and
5454
unsafeExpression = getAMybatisAnnotationSqlValue(isoa) and

‎java/ql/src/experimental/Security/CWE/CWE-089/MyBatisCommonLib.qll‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,23 +17,23 @@ private predicate propertiesKey(DataFlow::Node prop, string key) {
1717
}
1818

1919
/** A data flow configuration tracing flow from ibatis `Configuration.getVariables()` to a store into a `Properties` object. */
20-
private class PropertiesFlowConfig extends DataFlow2::Configuration {
21-
PropertiesFlowConfig() { this = "PropertiesFlowConfig" }
22-
23-
override predicate isSource(DataFlow::Node src) {
20+
private module PropertiesFlowConfig implements DataFlow::ConfigSig {
21+
predicate isSource(DataFlow::Node src) {
2422
exists(MethodAccess ma | ma.getMethod() instanceof IbatisConfigurationGetVariablesMethod |
2523
src.asExpr() = ma
2624
)
2725
}
2826

29-
override predicate isSink(DataFlow::Node sink) { propertiesKey(sink, _) }
27+
predicate isSink(DataFlow::Node sink) { propertiesKey(sink, _) }
3028
}
3129

30+
private module PropertiesFlow = DataFlow::Global<PropertiesFlowConfig>;
31+
3232
/** Gets a `Properties` key that may map onto a Mybatis `Configuration` variable. */
3333
string getAMybatisConfigurationVariableKey() {
34-
exists(PropertiesFlowConfig conf, DataFlow::Node n |
34+
exists(DataFlow::Node n |
3535
propertiesKey(n, result) and
36-
conf.hasFlowTo(n)
36+
PropertiesFlow::flowTo(n)
3737
)
3838
}
3939

‎java/ql/src/experimental/Security/CWE/CWE-089/MyBatisMapperXmlSqlInjection.ql‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,28 +13,24 @@
1313
*/
1414

1515
import java
16-
import DataFlow::PathGraph
1716
import MyBatisCommonLib
1817
import MyBatisMapperXmlSqlInjectionLib
1918
import semmle.code.xml.MyBatisMapperXML
2019
import semmle.code.java.dataflow.FlowSources
20+
import MyBatisMapperXmlSqlInjectionFlow::PathGraph
2121

22-
private class MyBatisMapperXmlSqlInjectionConfiguration extends TaintTracking::Configuration {
23-
MyBatisMapperXmlSqlInjectionConfiguration() { this = "MyBatis mapper xml sql injection" }
22+
private module MyBatisMapperXmlSqlInjectionConfig implements DataFlow::ConfigSig {
23+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
2424

25-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
25+
predicate isSink(DataFlow::Node sink) { sink instanceof MyBatisMapperMethodCallAnArgument }
2626

27-
override predicate isSink(DataFlow::Node sink) {
28-
sink instanceof MyBatisMapperMethodCallAnArgument
29-
}
30-
31-
override predicate isSanitizer(DataFlow::Node node) {
27+
predicate isBarrier(DataFlow::Node node) {
3228
node.getType() instanceof PrimitiveType or
3329
node.getType() instanceof BoxedType or
3430
node.getType() instanceof NumberType
3531
}
3632

37-
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
33+
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
3834
exists(MethodAccess ma |
3935
ma.getMethod().getDeclaringType() instanceof TypeObject and
4036
ma.getMethod().getName() = "toString" and
@@ -44,11 +40,15 @@ private class MyBatisMapperXmlSqlInjectionConfiguration extends TaintTracking::C
4440
}
4541
}
4642

43+
private module MyBatisMapperXmlSqlInjectionFlow =
44+
TaintTracking::Global<MyBatisMapperXmlSqlInjectionConfig>;
45+
4746
from
48-
MyBatisMapperXmlSqlInjectionConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink,
49-
MyBatisMapperXmlElement mmxe, MethodAccess ma, string unsafeExpression
47+
MyBatisMapperXmlSqlInjectionFlow::PathNode source,
48+
MyBatisMapperXmlSqlInjectionFlow::PathNode sink, MyBatisMapperXmlElement mmxe, MethodAccess ma,
49+
string unsafeExpression
5050
where
51-
cfg.hasFlowPath(source, sink) and
51+
MyBatisMapperXmlSqlInjectionFlow::flowPath(source, sink) and
5252
ma.getAnArgument() = sink.getNode().asExpr() and
5353
myBatisMapperXmlElementFromMethod(ma.getMethod(), mmxe) and
5454
unsafeExpression = getAMybatisXmlSetValue(mmxe) and

0 commit comments

Comments
 (0)