Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f6d42bd

Browse files
author
Sebastian Bauersfeld
committed
Allow blacklist sanitizers.
1 parent 11f527e commit f6d42bd

3 files changed

Lines changed: 44 additions & 4 deletions

File tree

‎java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,16 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
3131
or
3232
node.getType() instanceof BoxedType
3333
or
34-
exists(MethodAccess ma |
35-
ma.getMethod().hasQualifiedName("java.lang", "String", "replaceAll") and
36-
ma.getArgument(0).(StringLiteral).getValue().matches("%[^%") and
37-
node.asExpr() = ma
34+
exists(MethodAccess ma, string methodName, CompileTimeConstantExpr target |
35+
node.asExpr() = ma and
36+
ma.getMethod().hasQualifiedName("java.lang", "String", methodName) and
37+
target = ma.getArgument(0) and
38+
(
39+
methodName = "replace" and target.getIntValue() = [10, 13]
40+
or
41+
methodName = "replaceAll" and
42+
target.getStringValue().regexpMatch(".*([\n\r]|\\[\\^[^\\]\r\n]*\\]).*")
43+
)
3844
)
3945
}
4046
}

‎java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,20 @@
11
edges
22
| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | ResponseSplitting.java:23:23:23:28 | cookie |
33
| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie |
4+
| ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:27 | t : String |
5+
| ResponseSplitting.java:59:27:59:27 | t : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) |
46
nodes
57
| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
68
| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
79
| ResponseSplitting.java:23:23:23:28 | cookie | semmle.label | cookie |
810
| ResponseSplitting.java:28:38:28:72 | getParameter(...) | semmle.label | getParameter(...) |
911
| ResponseSplitting.java:29:38:29:72 | getParameter(...) | semmle.label | getParameter(...) |
12+
| ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | semmle.label | getParameter(...) : String |
13+
| ResponseSplitting.java:59:27:59:27 | t : String | semmle.label | t : String |
14+
| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | semmle.label | replaceFirst(...) |
1015
subpaths
1116
#select
1217
| ResponseSplitting.java:23:23:23:28 | cookie | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:22:39:22:66 | getParameter(...) | user-provided value |
1318
| ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:28:38:28:72 | getParameter(...) | user-provided value |
1419
| ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:29:38:29:72 | getParameter(...) | user-provided value |
20+
| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:53:14:53:48 | getParameter(...) | user-provided value |

‎java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,4 +48,32 @@ public void addCookieName(HttpServletResponse response, Cookie cookie) {
4848
Cookie cookie2 = new Cookie("name", cookie.getName());
4949
response.addCookie(cookie2);
5050
}
51+
52+
public void sanitizerTests(HttpServletRequest request, HttpServletResponse response){
53+
String t = request.getParameter("contentType");
54+
55+
// GOOD: whitelist-based sanitization
56+
response.setHeader("h", t.replaceAll("[^a-zA-Z]", ""));
57+
58+
// BAD: not replacing all problematic characters
59+
response.setHeader("h", t.replaceFirst("[^a-zA-Z]", ""));
60+
61+
// GOOD: replace all line breaks
62+
response.setHeader("h", t.replace('\n', ' ').replace('\r', ' '));
63+
64+
// FALSE NEGATIVE: replace only some line breaks
65+
response.setHeader("h", t.replace('\n', ' '));
66+
67+
// FALSE NEGATIVE: replace only some line breaks
68+
response.setHeader("h", t.replaceAll("\r", ""));
69+
70+
// GOOD: replace all linebreaks with a simple regex
71+
response.setHeader("h", t.replaceAll("\n", "").replaceAll("\r", ""));
72+
73+
// GOOD: replace all linebreaks with a complex regex
74+
response.setHeader("h", t.replaceAll("[\n\r]", ""));
75+
76+
// GOOD: replace all linebreaks with a complex regex
77+
response.setHeader("h", t.replaceAll("something|[a\nb\rc]+|somethingelse", ""));
78+
}
5179
}

0 commit comments

Comments
 (0)