Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ffe9d4a

Browse files
luchua-bcluchua-bc
committed
Sensitive GET Query
1 parent 49f902d commit ffe9d4a

7 files changed

Lines changed: 133 additions & 0 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
public class SensitiveGetQuery extends HttpServlet {
2+
// BAD - Tests sending sensitive information in a GET request.
3+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
4+
String password = request.getParameter("password");
5+
System.out.println("password = " + password);
6+
}
7+
8+
// GOOD - Tests sending sensitive information in a POST request.
9+
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
10+
String password = request.getParameter("password");
11+
System.out.println("password = " + password);
12+
}
13+
}

‎java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.qhelp‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
4+
<overview>
5+
<p>Sensitive information like user passwords is transmitted within the query string of the requested URL in GET requests. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passwords into the URL increases the risk that they will be captured by an attacker.</p>
6+
7+
<p>Vulnerabilities that result in the disclosure of users' passwords can result in compromises that are extremely difficult to investigate due to obscured audit trails. Even if an application itself only handles non-sensitive information, exposing passwords puts users who have re-used their password elsewhere at risk.</p>
8+
</overview>
9+
10+
<recommendation>
11+
<p>Use HTTP POST to send sensitive information either in web forms or REST web services calls.</p>
12+
</recommendation>
13+
14+
<example>
15+
<p>The following example shows two ways of sending sensitive information. In the 'BAD' case, password is transmitted using the GET method. In the 'GOOD' case, the password is transmitted using the POST method.</p>
16+
<sample src="SensitiveGetQuery.java" />
17+
</example>
18+
19+
<references>
20+
<li>
21+
CWE:
22+
<a href="https://cwe.mitre.org/data/definitions/598.html">CWE-598: Use of GET Request Method with Sensitive Query Strings</a>
23+
</li>
24+
<li>
25+
PortSwigger (Burp):
26+
<a href="https://portswigger.net/kb/issues/00400300_password-submitted-using-get-method">Password Submitted using GET Method</a>
27+
</li>
28+
<li>
29+
OWASP:
30+
<a href="https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url">Information Exposure through Query Strings in URL</a>
31+
</li>
32+
</references>
33+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* @name Sensitive GET Query
3+
* @description Use of GET request method with sensitive query strings.
4+
* @kind path-problem
5+
* @id java/sensitive-query-with-get
6+
* @tags security
7+
* external/cwe-598
8+
*/
9+
10+
import java
11+
import semmle.code.java.dataflow.FlowSources
12+
import semmle.code.java.dataflow.TaintTracking
13+
import semmle.code.java.frameworks.Servlets
14+
import semmle.code.java.security.SensitiveActions
15+
import DataFlow::PathGraph
16+
17+
/** Finds variables that hold sensitive information judging by their names. */
18+
class SensitiveInfoExpr extends Expr {
19+
SensitiveInfoExpr() {
20+
exists(Variable v | this = v.getAnAccess() |
21+
v.getName().regexpMatch(getCommonSensitiveInfoRegex())
22+
)
23+
}
24+
}
25+
26+
/** GET servlet method of `javax.servlet.http.Servlet` and subtypes. */
27+
private predicate isGetServletMethod(Callable c) {
28+
c.getDeclaringType() instanceof ServletClass and
29+
c.getNumberOfParameters() = 2 and
30+
c.getParameter(1).getType() instanceof ServletResponse and
31+
c.getName() = "doGet"
32+
}
33+
34+
/** Sink of GET servlet requests. */
35+
class GetServletMethodSink extends DataFlow::ExprNode {
36+
GetServletMethodSink() {
37+
exists(Method m, MethodAccess ma | ma.getMethod() = m |
38+
isGetServletMethod(ma.getEnclosingCallable()) and
39+
ma.getAnArgument() = this.getExpr()
40+
)
41+
}
42+
}
43+
44+
/** Taint configuration of using GET requests with sensitive query strings. */
45+
class SensitiveGetQueryConfiguration extends TaintTracking::Configuration {
46+
SensitiveGetQueryConfiguration() { this = "SensitiveGetQueryConfiguration" }
47+
48+
override predicate isSource(DataFlow::Node source) {
49+
source.asExpr() instanceof SensitiveInfoExpr
50+
}
51+
52+
override predicate isSink(DataFlow::Node sink) { sink instanceof GetServletMethodSink }
53+
}
54+
55+
from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveGetQueryConfiguration c
56+
where c.hasFlowPath(source, sink)
57+
select sink.getNode(), source, sink, "$@ uses GET request method with sensitive information.",
58+
source.getNode(), "sensitive query string"

‎java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
edges
2+
| SensitiveGetQuery.java:12:38:12:45 | password : String | SensitiveGetQuery.java:12:22:12:45 | ... + ... |
3+
nodes
4+
| SensitiveGetQuery.java:12:22:12:45 | ... + ... | semmle.label | ... + ... |
5+
| SensitiveGetQuery.java:12:38:12:45 | password : String | semmle.label | password : String |
6+
#select
7+
| SensitiveGetQuery.java:12:22:12:45 | ... + ... | SensitiveGetQuery.java:12:38:12:45 | password : String | SensitiveGetQuery.java:12:22:12:45 | ... + ... | $@ uses GET request method with sensitive information. | SensitiveGetQuery.java:12:38:12:45 | password | sensitive query string |

‎java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import java.io.IOException;
2+
3+
import javax.servlet.http.HttpServlet;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
6+
import javax.servlet.ServletException;
7+
8+
public class SensitiveGetQuery extends HttpServlet {
9+
// BAD - Tests sending sensitive information in a GET request.
10+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
11+
String password = request.getParameter("password");
12+
System.out.println("password = " + password);
13+
}
14+
15+
// GOOD - Tests sending sensitive information in a POST request.
16+
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
17+
String password = request.getParameter("password");
18+
System.out.println("password = " + password);
19+
}
20+
}

‎java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql

‎java/ql/test/experimental/query-tests/security/CWE-598/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4

0 commit comments

Comments
 (0)