Merge pull request #13773 from atorralba/atorralba/java/mdht-xxe-sink

Java: Add XXE sinks for MDHT

Author: atorralba

java/ql/lib/semmle/code/java/frameworks/mdht/MdhtXml.qll

@@ -0,0 +1,22 @@
+/** Provides definitions related to XML parsing in Model-Driven Health Tools. */
+
+import java
+private import semmle.code.java.security.XmlParsers
+
+/** A call to `CDAUtil.load` or `CDAUtil.loadAs`. */
+private class CdaUtilLoad extends XmlParserCall {
+  CdaUtilLoad() {
+    this.getMethod()
+        .hasQualifiedName("org.openhealthtools.mdht.uml.cda.util", "CDAUtil", ["load", "loadAs"])
+  }
+
+  override Expr getSink() {
+    result = this.getAnArgument() and
+    exists(RefType t | result.getType().(RefType).getASourceSupertype*() = t |
+      t instanceof TypeInputStream or
+      t instanceof InputSource
+    )
+  }
+
+  override predicate isSafe() { none() }
+}

java/ql/lib/semmle/code/java/security/XmlParsers.qll

@@ -9,6 +9,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.apache.CommonsXml
   private import semmle.code.java.frameworks.javaee.Xml
   private import semmle.code.java.frameworks.javase.Beans
+  private import semmle.code.java.frameworks.mdht.MdhtXml
   private import semmle.code.java.frameworks.rundeck.RundeckXml
 }
 

java/ql/src/change-notes/2023-07-19-xxe-new-sinks.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The queries "Resolving XML external entity in user-controlled data" (`java/xxe`) and "Resolving XML external entity in user-controlled data from local source" (`java/xxe-local`) now recognize sinks in the MDHT library.

java/ql/test/query-tests/security/CWE-611/CdaUtilTests.java

@@ -0,0 +1,23 @@
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.net.Socket;
+import org.openhealthtools.mdht.uml.cda.util.CDAUtil;
+import org.xml.sax.InputSource;
+
+public class CdaUtilTests {
+
+    public void test(Socket sock) throws Exception {
+        InputStream is = sock.getInputStream();
+        InputSource iSrc = new InputSource(new InputStreamReader(is));
+        CDAUtil.load(is); // $ hasTaintFlow
+        CDAUtil.load(iSrc); // $ hasTaintFlow
+        CDAUtil.load(is, (CDAUtil.ValidationHandler) null); // $ hasTaintFlow
+        CDAUtil.load(is, (CDAUtil.LoadHandler) null); // $ hasTaintFlow
+        CDAUtil.load(null, null, is, null); // $ hasTaintFlow
+        CDAUtil.load(iSrc, (CDAUtil.ValidationHandler) null); // $ hasTaintFlow
+        CDAUtil.load(iSrc, (CDAUtil.LoadHandler) null); // $ hasTaintFlow
+        CDAUtil.load(null, null, iSrc, null); // $ hasTaintFlow
+        CDAUtil.loadAs(is, null); // $ hasTaintFlow
+        CDAUtil.loadAs(is, null, null); // $ hasTaintFlow
+    }
+}

java/ql/test/query-tests/security/CWE-611/options

@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/apache-commons-digester3-3.2:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/rundeck-api-java-client-13.2:${testdir}/../../../stubs/springframework-5.3.8/
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/apache-commons-digester3-3.2:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/rundeck-api-java-client-13.2:${testdir}/../../../stubs/springframework-5.3.8/:${testdir}/../../../stubs/mdht-1.2.0/