Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fee0b94

Browse files
luchua-bcluchua-bc
committed
Use isRequestGetParamMethod as the source
1 parent 3d26e5b commit fee0b94

2 files changed

Lines changed: 39 additions & 30 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql‎

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,29 @@ class SensitiveInfoExpr extends Expr {
2525
/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
2626
private predicate isGetServletMethod(Method m) { isServletMethod(m) and m.getName() = "doGet" }
2727

28+
/** The `doGet` method of `HttpServlet`. */
29+
class DoGetServletMethod extends Method {
30+
DoGetServletMethod() { isGetServletMethod(this) }
31+
}
32+
33+
/** Holds if `ma` is called from the `doGet` method of `HttpServlet`. */
34+
predicate isServletGetCall(MethodAccess ma) {
35+
ma.getEnclosingCallable() instanceof DoGetServletMethod
36+
or
37+
exists(Method pm, MethodAccess pma |
38+
ma.getEnclosingCallable() = pm and
39+
pma.getMethod() = pm and
40+
isServletGetCall(pma)
41+
)
42+
}
43+
2844
/** Source of GET servlet requests. */
29-
class GetHttpRequestSource extends DataFlow::ExprNode {
30-
GetHttpRequestSource() {
31-
exists(Method m |
32-
isGetServletMethod(m) and
33-
m.getParameter(0).getAnAccess() = this.asExpr()
45+
class RequestGetParamSource extends DataFlow::ExprNode {
46+
RequestGetParamSource() {
47+
exists(MethodAccess ma |
48+
isRequestGetParamMethod(ma) and
49+
ma = this.asExpr() and
50+
isServletGetCall(ma)
3451
)
3552
}
3653
}
@@ -39,14 +56,14 @@ class GetHttpRequestSource extends DataFlow::ExprNode {
3956
class SensitiveGetQueryConfiguration extends TaintTracking::Configuration {
4057
SensitiveGetQueryConfiguration() { this = "SensitiveGetQueryConfiguration" }
4158

42-
override predicate isSource(DataFlow::Node source) { source instanceof GetHttpRequestSource }
59+
override predicate isSource(DataFlow::Node source) { source instanceof RequestGetParamSource }
4360

4461
override predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof SensitiveInfoExpr }
4562

46-
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
47-
exists(MethodAccess ma |
48-
isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
49-
)
63+
/** Holds if the node is in a servlet method other than `doGet`. */
64+
override predicate isSanitizer(DataFlow::Node node) {
65+
isServletMethod(node.getEnclosingCallable()) and
66+
not isGetServletMethod(node.getEnclosingCallable())
5067
}
5168
}
5269

‎java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected‎

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,33 @@
11
edges
2-
| SensitiveGetQuery2.java:12:13:12:19 | request : HttpServletRequest | SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object |
2+
| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object |
33
| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | SensitiveGetQuery2.java:15:29:15:36 | password |
44
| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | SensitiveGetQuery2.java:15:29:15:36 | password : Object |
55
| SensitiveGetQuery2.java:15:29:15:36 | password : Object | SensitiveGetQuery2.java:18:40:18:54 | password : Object |
66
| SensitiveGetQuery2.java:18:40:18:54 | password : Object | SensitiveGetQuery2.java:19:61:19:68 | password |
7-
| SensitiveGetQuery3.java:11:41:11:47 | request : HttpServletRequest | SensitiveGetQuery3.java:12:41:12:47 | request : HttpServletRequest |
87
| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password |
9-
| SensitiveGetQuery3.java:12:41:12:47 | request : HttpServletRequest | SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String |
10-
| SensitiveGetQuery.java:11:21:11:27 | request : HttpServletRequest | SensitiveGetQuery.java:14:29:14:36 | password |
11-
| SensitiveGetQuery.java:11:21:11:27 | request : HttpServletRequest | SensitiveGetQuery.java:14:29:14:36 | password : String |
12-
| SensitiveGetQuery.java:12:21:12:27 | request : HttpServletRequest | SensitiveGetQuery.java:14:29:14:36 | password |
13-
| SensitiveGetQuery.java:12:21:12:27 | request : HttpServletRequest | SensitiveGetQuery.java:14:29:14:36 | password : String |
8+
| SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String |
9+
| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password |
10+
| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password : String |
1411
| SensitiveGetQuery.java:14:29:14:36 | password : String | SensitiveGetQuery.java:17:40:17:54 | password : String |
1512
| SensitiveGetQuery.java:17:40:17:54 | password : String | SensitiveGetQuery.java:18:61:18:68 | password |
1613
nodes
17-
| SensitiveGetQuery2.java:12:13:12:19 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
14+
| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | semmle.label | getParameterMap(...) : Map |
1815
| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | semmle.label | (...)... : Object |
1916
| SensitiveGetQuery2.java:15:29:15:36 | password | semmle.label | password |
2017
| SensitiveGetQuery2.java:15:29:15:36 | password : Object | semmle.label | password : Object |
2118
| SensitiveGetQuery2.java:18:40:18:54 | password : Object | semmle.label | password : Object |
2219
| SensitiveGetQuery2.java:19:61:19:68 | password | semmle.label | password |
23-
| SensitiveGetQuery3.java:11:41:11:47 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
2420
| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | semmle.label | getRequestParameter(...) : String |
25-
| SensitiveGetQuery3.java:12:41:12:47 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
2621
| SensitiveGetQuery3.java:13:57:13:64 | password | semmle.label | password |
27-
| SensitiveGetQuery.java:11:21:11:27 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
28-
| SensitiveGetQuery.java:12:21:12:27 | request : HttpServletRequest | semmle.label | request : HttpServletRequest |
22+
| SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | semmle.label | getParameter(...) : String |
23+
| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
2924
| SensitiveGetQuery.java:14:29:14:36 | password | semmle.label | password |
3025
| SensitiveGetQuery.java:14:29:14:36 | password : String | semmle.label | password : String |
3126
| SensitiveGetQuery.java:17:40:17:54 | password : String | semmle.label | password : String |
3227
| SensitiveGetQuery.java:18:61:18:68 | password | semmle.label | password |
3328
#select
34-
| SensitiveGetQuery2.java:15:29:15:36 | password | SensitiveGetQuery2.java:12:13:12:19 | request : HttpServletRequest | SensitiveGetQuery2.java:15:29:15:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:19 | request | This request |
35-
| SensitiveGetQuery2.java:19:61:19:68 | password | SensitiveGetQuery2.java:12:13:12:19 | request : HttpServletRequest | SensitiveGetQuery2.java:19:61:19:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:19 | request | This request |
36-
| SensitiveGetQuery3.java:13:57:13:64 | password | SensitiveGetQuery3.java:11:41:11:47 | request : HttpServletRequest | SensitiveGetQuery3.java:13:57:13:64 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery3.java:11:41:11:47 | request | This request |
37-
| SensitiveGetQuery3.java:13:57:13:64 | password | SensitiveGetQuery3.java:12:41:12:47 | request : HttpServletRequest | SensitiveGetQuery3.java:13:57:13:64 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery3.java:12:41:12:47 | request | This request |
38-
| SensitiveGetQuery.java:14:29:14:36 | password | SensitiveGetQuery.java:11:21:11:27 | request : HttpServletRequest | SensitiveGetQuery.java:14:29:14:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:11:21:11:27 | request | This request |
39-
| SensitiveGetQuery.java:14:29:14:36 | password | SensitiveGetQuery.java:12:21:12:27 | request : HttpServletRequest | SensitiveGetQuery.java:14:29:14:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:27 | request | This request |
40-
| SensitiveGetQuery.java:18:61:18:68 | password | SensitiveGetQuery.java:11:21:11:27 | request : HttpServletRequest | SensitiveGetQuery.java:18:61:18:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:11:21:11:27 | request | This request |
41-
| SensitiveGetQuery.java:18:61:18:68 | password | SensitiveGetQuery.java:12:21:12:27 | request : HttpServletRequest | SensitiveGetQuery.java:18:61:18:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:27 | request | This request |
29+
| SensitiveGetQuery2.java:15:29:15:36 | password | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:15:29:15:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) | This request |
30+
| SensitiveGetQuery2.java:19:61:19:68 | password | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:19:61:19:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) | This request |
31+
| SensitiveGetQuery3.java:13:57:13:64 | password | SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) | This request |
32+
| SensitiveGetQuery.java:14:29:14:36 | password | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) | This request |
33+
| SensitiveGetQuery.java:18:61:18:68 | password | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:18:61:18:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) | This request |

0 commit comments

Comments
 (0)