Skip to content

Commit b8dd047

Browse files
michaelnebelmichaelnebel
committed
Java: Indentify more APIs as supported in the telemetry queries (as QL defined sources).
1 parent c5bdd5b commit b8dd047

File tree

10 files changed

+139
-22
lines changed

10 files changed

+139
-22
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ApiSources.qll‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/** Provides classes representing various flow sources for data flow / taint tracking. */
2+
3+
private import semmle.code.java.dataflow.ExternalFlow
4+
private import semmle.code.java.dataflow.FlowSources
5+
6+
/**
7+
* A data flow source node.
8+
*/
9+
abstract class SourceNode extends DataFlow::Node { }
10+
11+
/**
12+
* Module that adds all API like sources to `SourceNode`, excluding sources for cryptography based
13+
* queries, and queries where sources are not succifiently.
14+
*/
15+
private module ApiSources {
16+
private import FlowSources as FlowSources
17+
private import semmle.code.java.security.ArbitraryApkInstallation as ArbitraryApkInstallation
18+
private import semmle.code.java.security.CleartextStorageAndroidDatabaseQuery as CleartextStorageAndroidDatabaseQuery
19+
private import semmle.code.java.security.CleartextStorageAndroidFilesystemQuery as CleartextStorageAndroidFilesystemQuery
20+
private import semmle.code.java.security.CleartextStorageSharedPrefsQuery as CleartextStorageSharedPrefsQuery
21+
private import semmle.code.java.security.ImplicitPendingIntentsQuery as ImplicitPendingIntentsQuery
22+
private import semmle.code.java.security.ImproperIntentVerificationQuery as ImproperIntentVerificationQuery
23+
private import semmle.code.java.security.InsecureTrustManagerQuery as InsecureTrustManagerQuery
24+
private import semmle.code.java.security.MissingJWTSignatureCheckQuery as MissingJWTSignatureCheckQuery
25+
private import semmle.code.java.security.XSS as Xss
26+
private import semmle.code.java.security.StackTraceExposureQuery as StackTraceExposureQuery
27+
private import semmle.code.java.security.UnsafeCertTrustQuery as UnsafeCertTrustQuery
28+
private import semmle.code.java.security.ZipSlipQuery as ZipSlipQuery
29+
30+
private class FlowSourcesSourceNode extends SourceNode instanceof FlowSources::SourceNode { }
31+
32+
private class ArbitraryApkInstallationSources extends SourceNode instanceof ArbitraryApkInstallation::ExternalApkSource
33+
{ }
34+
35+
private class CleartextStorageAndroidDatabaseQuerySources extends SourceNode instanceof CleartextStorageAndroidDatabaseQuery::LocalDatabaseOpenMethodCallSource
36+
{ }
37+
38+
private class CleartextStorageAndroidFilesystemQuerySources extends SourceNode instanceof CleartextStorageAndroidFilesystemQuery::LocalFileOpenCallSource
39+
{ }
40+
41+
private class CleartextStorageSharedPrefsQuerySources extends SourceNode instanceof CleartextStorageSharedPrefsQuery::SharedPreferencesEditorMethodCallSource
42+
{ }
43+
44+
private class ImplicitPendingIntentsQuerySources extends SourceNode instanceof ImplicitPendingIntentsQuery::ImplicitPendingIntentSource
45+
{ }
46+
47+
private class ImproperIntentVerificationQuerySources extends SourceNode instanceof ImproperIntentVerificationQuery::VerifiedIntentConfigSource
48+
{ }
49+
50+
private class InsecureTrustManagerQuerySources extends SourceNode instanceof InsecureTrustManagerQuery::InsecureTrustManagerSource
51+
{ }
52+
53+
private class MissingJWTSignatureCheckQuerySources extends SourceNode instanceof MissingJWTSignatureCheckQuery::JwtParserWithInsecureParseSource
54+
{ }
55+
56+
private class XssSources extends SourceNode instanceof Xss::XssVulnerableWriterSourceNode { }
57+
58+
private class StackTraceExposureQuerySources extends SourceNode instanceof StackTraceExposureQuery::GetMessageFlowSource
59+
{ }
60+
61+
private class UnsafeCertTrustQuerySources extends SourceNode instanceof UnsafeCertTrustQuery::SslConnectionInit
62+
{ }
63+
64+
private class ZipSlipQuerySources extends SourceNode instanceof ZipSlipQuery::ArchiveEntryNameMethodSource
65+
{ }
66+
67+
/**
68+
* Add all models as data sources.
69+
*/
70+
private class SourceNodeExternal extends SourceNode {
71+
SourceNodeExternal() { sourceNode(this, _) }
72+
}
73+
}

‎java/ql/lib/semmle/code/java/dataflow/FlowSources.qll‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -194,15 +194,17 @@ private class AndroidExternalStorageSource extends RemoteFlowSource {
194194
}
195195

196196
/** Class for `tainted` user input. */
197-
abstract class UserInput extends DataFlow::Node { }
197+
abstract class UserInput extends SourceNode { }
198198

199199
/**
200200
* Input that may be controlled by a remote user.
201201
*/
202-
private class RemoteUserInput extends UserInput instanceof RemoteFlowSource { }
202+
private class RemoteUserInput extends UserInput instanceof RemoteFlowSource {
203+
override string getThreatModel() { result = super.getThreatModel() }
204+
}
203205

204206
/** A node with input that may be controlled by a local user. */
205-
abstract class LocalUserInput extends UserInput, SourceNode {
207+
abstract class LocalUserInput extends UserInput {
206208
override string getThreatModel() { result = "local" }
207209
}
208210

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,15 @@ private predicate localDatabaseStore(DataFlow::Node database, MethodCall store)
9696
)
9797
}
9898

99+
/**
100+
* A class of local database open method call source nodes.
101+
*/
102+
class LocalDatabaseOpenMethodCallSource extends DataFlow::Node {
103+
LocalDatabaseOpenMethodCallSource() { this.asExpr() instanceof LocalDatabaseOpenMethodCall }
104+
}
105+
99106
private module LocalDatabaseFlowConfig implements DataFlow::ConfigSig {
100-
predicate isSource(DataFlow::Node source) {
101-
source.asExpr() instanceof LocalDatabaseOpenMethodCall
102-
}
107+
predicate isSource(DataFlow::Node source) { source instanceof LocalDatabaseOpenMethodCallSource }
103108

104109
predicate isSink(DataFlow::Node sink) {
105110
localDatabaseInput(sink, _) or

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidFilesystemQuery.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,15 @@ private class CloseFileMethod extends Method {
7979
}
8080
}
8181

82+
/**
83+
* A class of local file open call source nodes.
84+
*/
85+
class LocalFileOpenCallSource extends DataFlow::Node {
86+
LocalFileOpenCallSource() { this.asExpr() instanceof LocalFileOpenCall }
87+
}
88+
8289
private module FilesystemFlowConfig implements DataFlow::ConfigSig {
83-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof LocalFileOpenCall }
90+
predicate isSource(DataFlow::Node src) { src instanceof LocalFileOpenCallSource }
8491

8592
predicate isSink(DataFlow::Node sink) {
8693
filesystemInput(sink, _) or

‎java/ql/lib/semmle/code/java/security/CleartextStorageSharedPrefsQuery.qll‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,18 @@ private predicate sharedPreferencesStore(DataFlow::Node editor, MethodCall m) {
6767
editor.asExpr() = m.getQualifier().getUnderlyingExpr()
6868
}
6969

70+
/**
71+
* A shared preferences editor method call source nodes.
72+
*/
73+
class SharedPreferencesEditorMethodCallSource extends DataFlow::Node {
74+
SharedPreferencesEditorMethodCallSource() {
75+
this.asExpr() instanceof SharedPreferencesEditorMethodCall
76+
}
77+
}
78+
7079
/** Flow from `SharedPreferences.Editor` to either a setter or a store method. */
7180
private module SharedPreferencesFlowConfig implements DataFlow::ConfigSig {
72-
predicate isSource(DataFlow::Node src) {
73-
src.asExpr() instanceof SharedPreferencesEditorMethodCall
74-
}
81+
predicate isSource(DataFlow::Node src) { src instanceof SharedPreferencesEditorMethodCallSource }
7582

7683
predicate isSink(DataFlow::Node sink) {
7784
sharedPreferencesInput(sink, _) or

‎java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,18 @@ private class OnReceiveMethod extends Method {
1313
Parameter getIntentParameter() { result = this.getParameter(1) }
1414
}
1515

16+
/**
17+
* A class of verified intent source nodes.
18+
*/
19+
class VerifiedIntentConfigSource extends DataFlow::Node {
20+
VerifiedIntentConfigSource() {
21+
this.asParameter() = any(OnReceiveMethod orm).getIntentParameter()
22+
}
23+
}
24+
1625
/** A configuration to detect whether the `action` of an `Intent` is checked. */
1726
private module VerifiedIntentConfig implements DataFlow::ConfigSig {
18-
predicate isSource(DataFlow::Node src) {
19-
src.asParameter() = any(OnReceiveMethod orm).getIntentParameter()
20-
}
27+
predicate isSource(DataFlow::Node src) { src instanceof VerifiedIntentConfigSource }
2128

2229
predicate isSink(DataFlow::Node sink) {
2330
exists(MethodCall ma |

‎java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ private class PrintStackTraceMethod extends Method {
1919
}
2020

2121
private module ServletWriterSourceToPrintStackTraceMethodFlowConfig implements DataFlow::ConfigSig {
22-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof XssVulnerableWriterSource }
22+
predicate isSource(DataFlow::Node src) { src instanceof XssVulnerableWriterSourceNode }
2323

2424
predicate isSink(DataFlow::Node sink) {
2525
exists(MethodCall ma |
@@ -95,7 +95,10 @@ predicate stringifiedStackFlowsExternally(DataFlow::Node externalExpr, Expr stac
9595
)
9696
}
9797

98-
private class GetMessageFlowSource extends DataFlow::Node {
98+
/**
99+
* A class of get message source nodes.
100+
*/
101+
class GetMessageFlowSource extends DataFlow::Node {
99102
GetMessageFlowSource() {
100103
exists(Method method | this.asExpr().(MethodCall).getMethod() = method |
101104
method.hasName("getMessage") and

‎java/ql/lib/semmle/code/java/security/XSS.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ private class DefaultXssSanitizer extends XssSanitizer {
6262

6363
/** A configuration that tracks data from a servlet writer to an output method. */
6464
private module XssVulnerableWriterSourceToWritingMethodFlowConfig implements DataFlow::ConfigSig {
65-
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof XssVulnerableWriterSource }
65+
predicate isSource(DataFlow::Node src) { src instanceof XssVulnerableWriterSourceNode }
6666

6767
predicate isSink(DataFlow::Node sink) {
6868
exists(MethodCall ma |
@@ -105,6 +105,13 @@ class XssVulnerableWriterSource extends MethodCall {
105105
}
106106
}
107107

108+
/**
109+
* A class of xss vulnerable writer source nodes.
110+
*/
111+
class XssVulnerableWriterSourceNode extends DataFlow::Node {
112+
XssVulnerableWriterSourceNode() { this.asExpr() instanceof XssVulnerableWriterSource }
113+
}
114+
108115
/**
109116
* Holds if `s` is an HTTP Content-Type vulnerable to XSS.
110117
*/

‎java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,20 @@ private class ArchiveEntryNameMethod extends Method {
2121
}
2222
}
2323

24+
/**
25+
* A class of entry name method source nodes.
26+
*/
27+
class ArchiveEntryNameMethodSource extends DataFlow::Node {
28+
ArchiveEntryNameMethodSource() {
29+
this.asExpr().(MethodCall).getMethod() instanceof ArchiveEntryNameMethod
30+
}
31+
}
32+
2433
/**
2534
* A taint-tracking configuration for reasoning about unsafe zip file extraction.
2635
*/
2736
module ZipSlipConfig implements DataFlow::ConfigSig {
28-
predicate isSource(DataFlow::Node source) {
29-
source.asExpr().(MethodCall).getMethod() instanceof ArchiveEntryNameMethod
30-
}
37+
predicate isSource(DataFlow::Node source) { source instanceof ArchiveEntryNameMethodSource }
3138

3239
predicate isSink(DataFlow::Node sink) { sink instanceof FileCreationSink }
3340

‎java/ql/src/Telemetry/ExternalApi.qll‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/** Provides classes and predicates related to handling APIs from external libraries. */
22

33
private import java
4+
private import semmle.code.java.dataflow.ApiSources as ApiSources
45
private import semmle.code.java.dataflow.DataFlow
56
private import semmle.code.java.dataflow.ExternalFlow
67
private import semmle.code.java.dataflow.FlowSources
@@ -69,9 +70,7 @@ class ExternalApi extends Callable {
6970
}
7071

7172
pragma[nomagic]
72-
predicate isSource() {
73-
this.getAnOutput() instanceof RemoteFlowSource or sourceNode(this.getAnOutput(), _)
74-
}
73+
predicate isSource() { this.getAnOutput() instanceof ApiSources::SourceNode }
7574

7675
/** Holds if this API is a known sink. */
7776
pragma[nomagic]

0 commit comments

Comments
 (0)