|
13 | 13 | */ |
14 | 14 |
|
15 | 15 | import java |
| 16 | +import semmle.code.java.dataflow.TaintTracking |
16 | 17 | import semmle.code.java.dataflow.ExternalFlow |
17 | 18 | import semmle.code.java.dataflow.FlowSources |
18 | 19 | import semmle.code.java.security.PathCreation |
19 | 20 | import JFinalController |
20 | 21 | import semmle.code.java.security.PathSanitizer |
21 | | -import DataFlow::PathGraph |
| 22 | +import InjectFilePathFlow::PathGraph |
22 | 23 |
|
23 | 24 | private class ActivateModels extends ActiveExperimentalModels { |
24 | 25 | ActivateModels() { this = "file-path-injection" } |
@@ -47,24 +48,24 @@ class NormalizedPathNode extends DataFlow::Node { |
47 | 48 | } |
48 | 49 | } |
49 | 50 |
|
50 | | -class InjectFilePathConfig extends TaintTracking::Configuration { |
51 | | - InjectFilePathConfig() { this = "InjectFilePathConfig" } |
| 51 | +module InjectFilePathConfig implements DataFlow::ConfigSig { |
| 52 | + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } |
52 | 53 |
|
53 | | - override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } |
54 | | - |
55 | | - override predicate isSink(DataFlow::Node sink) { |
| 54 | + predicate isSink(DataFlow::Node sink) { |
56 | 55 | sink.asExpr() = any(PathCreation p).getAnInput() and |
57 | 56 | not sink instanceof NormalizedPathNode |
58 | 57 | } |
59 | 58 |
|
60 | | - override predicate isSanitizer(DataFlow::Node node) { |
| 59 | + predicate isBarrier(DataFlow::Node node) { |
61 | 60 | exists(Type t | t = node.getType() | t instanceof BoxedType or t instanceof PrimitiveType) |
62 | 61 | or |
63 | 62 | node instanceof PathInjectionSanitizer |
64 | 63 | } |
65 | 64 | } |
66 | 65 |
|
67 | | -from DataFlow::PathNode source, DataFlow::PathNode sink, InjectFilePathConfig conf |
68 | | -where conf.hasFlowPath(source, sink) |
| 66 | +module InjectFilePathFlow = TaintTracking::Global<InjectFilePathConfig>; |
| 67 | + |
| 68 | +from InjectFilePathFlow::PathNode source, InjectFilePathFlow::PathNode sink |
| 69 | +where InjectFilePathFlow::flowPath(source, sink) |
69 | 70 | select sink.getNode(), source, sink, "External control of file name or path due to $@.", |
70 | 71 | source.getNode(), "user-provided value" |
0 commit comments