Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f910fd4

Browse files
JLLeitschuhJLLeitschuh
committed
Remove path flow tracking in 'TempDirLocalInformationDisclosureFromMethodCall'
1 parent e4c017e commit f910fd4

5 files changed

Lines changed: 57 additions & 40 deletions

‎java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosureFromMethodCall.ql‎

Lines changed: 14 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -12,48 +12,28 @@
1212

1313
import TempDirUtils
1414

15-
/**
16-
* All `java.io.File::createTempFile` methods.
17-
*/
18-
class MethodFileCreateTempFile extends Method {
19-
MethodFileCreateTempFile() {
20-
this.getDeclaringType() instanceof TypeFile and
21-
this.hasName("createTempFile")
22-
}
15+
abstract class MethodAccessInsecureFileCreation extends MethodAccess {
16+
/**
17+
* Docstring describing the file system type (ie. file, directory, ect...) returned.
18+
*/
19+
abstract string getFileSystemType();
2320
}
2421

25-
class TempDirSystemGetPropertyToAnyConfig extends TaintTracking::Configuration {
26-
TempDirSystemGetPropertyToAnyConfig() { this = "TempDirSystemGetPropertyToAnyConfig" }
27-
28-
override predicate isSource(DataFlow::Node source) {
29-
source.asExpr() instanceof MethodAccessSystemGetPropertyTempDirTainted
30-
}
31-
32-
override predicate isSink(DataFlow::Node source) { any() }
33-
34-
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
35-
isAdditionalFileTaintStep(node1, node2)
36-
}
37-
}
38-
39-
abstract class MethodAccessInsecureFileCreation extends MethodAccess { }
40-
4122
/**
4223
* Insecure calls to `java.io.File::createTempFile`.
4324
*/
4425
class MethodAccessInsecureFileCreateTempFile extends MethodAccessInsecureFileCreation {
4526
MethodAccessInsecureFileCreateTempFile() {
4627
this.getMethod() instanceof MethodFileCreateTempFile and
4728
(
48-
this.getNumArgument() = 2 or
29+
this.getNumArgument() = 2
30+
or
4931
// Vulnerablilty exists when the last argument is `null`
50-
getArgument(2) instanceof NullLiteral or
51-
// There exists a flow from the 'java.io.tmpdir' system property to this argument
52-
exists(TempDirSystemGetPropertyToAnyConfig config |
53-
config.hasFlowTo(DataFlow::exprNode(getArgument(2)))
54-
)
32+
getArgument(2) instanceof NullLiteral
5533
)
5634
}
35+
36+
override string getFileSystemType() { result = "file" }
5737
}
5838

5939
class MethodGuavaFilesCreateTempFile extends Method {
@@ -67,8 +47,11 @@ class MethodAccessInsecureGuavaFilesCreateTempFile extends MethodAccessInsecureF
6747
MethodAccessInsecureGuavaFilesCreateTempFile() {
6848
getMethod() instanceof MethodGuavaFilesCreateTempFile
6949
}
50+
51+
override string getFileSystemType() { result = "directory" }
7052
}
7153

7254
from MethodAccessInsecureFileCreation methodAccess
7355
select methodAccess,
74-
"Local information disclosure vulnerability due to use of file or directory readable by other local users."
56+
"Local information disclosure vulnerability due to use of " + methodAccess.getFileSystemType() +
57+
" readable by other local users."

‎java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosureFromSystemProperty.ql‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,19 @@ private class FilesVulnerableCreationMethodAccess extends MethodAccess {
5656
(
5757
getMethod().hasName(["write", "newBufferedWriter", "newOutputStream"])
5858
or
59-
getMethod().hasName(["createFile", "createDirectory", "createDirectories"]) and getNumArgument() = 1
59+
getMethod().hasName(["createFile", "createDirectory", "createDirectories"]) and
60+
getNumArgument() = 1
61+
)
62+
}
63+
}
64+
65+
/**
66+
* A call to `java.io.File::createTempFile` where the the system temp dir sinks to the last argument.
67+
*/
68+
private class FileCreateTempFileSink extends FileCreationSink {
69+
FileCreateTempFileSink() {
70+
exists(MethodAccess ma |
71+
ma.getMethod() instanceof MethodFileCreateTempFile and ma.getArgument(2) = this.asExpr()
6072
)
6173
}
6274
}

‎java/ql/src/Security/CWE/CWE-200/TempDirUtils.qll‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,16 @@ private class MethodAccessApacheFileUtilsTempDir extends MethodAccessSystemGetPr
2929
}
3030
}
3131

32+
/**
33+
* All `java.io.File::createTempFile` methods.
34+
*/
35+
class MethodFileCreateTempFile extends Method {
36+
MethodFileCreateTempFile() {
37+
this.getDeclaringType() instanceof TypeFile and
38+
this.hasName("createTempFile")
39+
}
40+
}
41+
3242
/**
3343
* Find dataflow from the temp directory system property to the `File` constructor.
3444
* Examples:
@@ -44,7 +54,7 @@ private predicate isTaintedFileCreation(Expr expSource, Expr exprDest) {
4454
}
4555

4656
/**
47-
* Any `File` methods that
57+
* Any `File` methods where the temporary directory is still part of the root path.
4858
*/
4959
private class TaintFollowingFileMethod extends Method {
5060
TaintFollowingFileMethod() {

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/TempDirLocalInformationDisclosureFromMethodCall.expected‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
| Test.java:15:21:15:57 | createTempFile(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
2-
| Test.java:19:21:19:63 | createTempFile(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
3-
| Test.java:24:21:24:66 | createTempFile(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
4-
| Test.java:29:21:29:71 | createTempFile(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
5-
| Test.java:34:21:34:66 | createTempFile(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
6-
| Test.java:39:21:39:66 | createTempFile(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
7-
| Test.java:49:24:49:65 | createTempDir(...) | Local information disclosure vulnerability due to use of file or directory readable by other local users. |
1+
| Test.java:15:21:15:57 | createTempFile(...) | Local information disclosure vulnerability due to use of file readable by other local users. |
2+
| Test.java:19:21:19:63 | createTempFile(...) | Local information disclosure vulnerability due to use of file readable by other local users. |
3+
| Test.java:49:24:49:65 | createTempDir(...) | Local information disclosure vulnerability due to use of directory readable by other local users. |

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/TempDirLocalInformationDisclosureFromSystemProperty.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
edges
22
| Files.java:10:33:10:68 | getProperty(...) : String | Files.java:15:17:15:23 | tempDir |
3+
| Test.java:23:33:23:68 | getProperty(...) : String | Test.java:24:59:24:65 | tempDir |
4+
| Test.java:28:47:28:82 | getProperty(...) : String | Test.java:29:59:29:70 | tempDirChild |
5+
| Test.java:33:33:33:68 | getProperty(...) : String | Test.java:34:59:34:65 | tempDir |
6+
| Test.java:38:33:38:68 | getProperty(...) : String | Test.java:39:59:39:65 | tempDir |
37
| Test.java:53:38:53:73 | getProperty(...) : String | Test.java:54:9:54:20 | tempDirChild |
48
| Test.java:58:38:58:73 | getProperty(...) : String | Test.java:59:9:59:20 | tempDirChild |
59
| Test.java:63:38:63:73 | getProperty(...) : String | Test.java:64:21:64:41 | toPath(...) |
@@ -12,6 +16,14 @@ edges
1216
nodes
1317
| Files.java:10:33:10:68 | getProperty(...) : String | semmle.label | getProperty(...) : String |
1418
| Files.java:15:17:15:23 | tempDir | semmle.label | tempDir |
19+
| Test.java:23:33:23:68 | getProperty(...) : String | semmle.label | getProperty(...) : String |
20+
| Test.java:24:59:24:65 | tempDir | semmle.label | tempDir |
21+
| Test.java:28:47:28:82 | getProperty(...) : String | semmle.label | getProperty(...) : String |
22+
| Test.java:29:59:29:70 | tempDirChild | semmle.label | tempDirChild |
23+
| Test.java:33:33:33:68 | getProperty(...) : String | semmle.label | getProperty(...) : String |
24+
| Test.java:34:59:34:65 | tempDir | semmle.label | tempDir |
25+
| Test.java:38:33:38:68 | getProperty(...) : String | semmle.label | getProperty(...) : String |
26+
| Test.java:39:59:39:65 | tempDir | semmle.label | tempDir |
1527
| Test.java:53:38:53:73 | getProperty(...) : String | semmle.label | getProperty(...) : String |
1628
| Test.java:54:9:54:20 | tempDirChild | semmle.label | tempDirChild |
1729
| Test.java:58:38:58:73 | getProperty(...) : String | semmle.label | getProperty(...) : String |
@@ -32,6 +44,10 @@ nodes
3244
| Test.java:105:33:105:53 | toPath(...) | semmle.label | toPath(...) |
3345
#select
3446
| Files.java:10:33:10:68 | getProperty(...) | Files.java:10:33:10:68 | getProperty(...) : String | Files.java:15:17:15:23 | tempDir | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Files.java:10:33:10:68 | getProperty(...) | system temp directory |
47+
| Test.java:23:33:23:68 | getProperty(...) | Test.java:23:33:23:68 | getProperty(...) : String | Test.java:24:59:24:65 | tempDir | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:23:33:23:68 | getProperty(...) | system temp directory |
48+
| Test.java:28:47:28:82 | getProperty(...) | Test.java:28:47:28:82 | getProperty(...) : String | Test.java:29:59:29:70 | tempDirChild | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:28:47:28:82 | getProperty(...) | system temp directory |
49+
| Test.java:33:33:33:68 | getProperty(...) | Test.java:33:33:33:68 | getProperty(...) : String | Test.java:34:59:34:65 | tempDir | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:33:33:33:68 | getProperty(...) | system temp directory |
50+
| Test.java:38:33:38:68 | getProperty(...) | Test.java:38:33:38:68 | getProperty(...) : String | Test.java:39:59:39:65 | tempDir | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:38:33:38:68 | getProperty(...) | system temp directory |
3551
| Test.java:53:38:53:73 | getProperty(...) | Test.java:53:38:53:73 | getProperty(...) : String | Test.java:54:9:54:20 | tempDirChild | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:53:38:53:73 | getProperty(...) | system temp directory |
3652
| Test.java:58:38:58:73 | getProperty(...) | Test.java:58:38:58:73 | getProperty(...) : String | Test.java:59:9:59:20 | tempDirChild | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:58:38:58:73 | getProperty(...) | system temp directory |
3753
| Test.java:63:38:63:73 | getProperty(...) | Test.java:63:38:63:73 | getProperty(...) : String | Test.java:64:21:64:41 | toPath(...) | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:63:38:63:73 | getProperty(...) | system temp directory |

0 commit comments

Comments
 (0)