Skip to content

Commit 4412335

Browse files
d10cd10c
committed
Java: convert UnsafeDeserialization test to .qlref
1 parent c4b0955 commit 4412335

15 files changed

+528
-131
lines changed

‎java/ql/test/query-tests/security/CWE-502/A.java‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,15 @@
1111

1212
public class A {
1313
public Object deserialize1(Socket sock) throws java.io.IOException, ClassNotFoundException {
14-
InputStream inputStream = sock.getInputStream();
14+
InputStream inputStream = sock.getInputStream(); // $ Source
1515
ObjectInputStream in = new ObjectInputStream(inputStream);
16-
return in.readObject(); // $unsafeDeserialization
16+
return in.readObject(); // $ Alert
1717
}
1818

1919
public Object deserialize2(Socket sock) throws java.io.IOException, ClassNotFoundException {
20-
InputStream inputStream = sock.getInputStream();
20+
InputStream inputStream = sock.getInputStream(); // $ Source
2121
ObjectInputStream in = new ObjectInputStream(inputStream);
22-
return in.readUnshared(); // $unsafeDeserialization
22+
return in.readUnshared(); // $ Alert
2323
}
2424

2525
public Object deserializeWithSerialKiller(Socket sock) throws java.io.IOException, ClassNotFoundException {
@@ -29,24 +29,24 @@ public Object deserializeWithSerialKiller(Socket sock) throws java.io.IOExceptio
2929
}
3030

3131
public Object deserialize3(Socket sock) throws java.io.IOException {
32-
InputStream inputStream = sock.getInputStream();
32+
InputStream inputStream = sock.getInputStream(); // $ Source
3333
XMLDecoder d = new XMLDecoder(inputStream);
34-
return d.readObject(); // $unsafeDeserialization
34+
return d.readObject(); // $ Alert
3535
}
3636

3737
public Object deserialize4(Socket sock) throws java.io.IOException {
3838
XStream xs = new XStream();
39-
InputStream inputStream = sock.getInputStream();
39+
InputStream inputStream = sock.getInputStream(); // $ Source
4040
Reader reader = new InputStreamReader(inputStream);
41-
return xs.fromXML(reader); // $unsafeDeserialization
41+
return xs.fromXML(reader); // $ Alert
4242
}
4343

4444
public void deserialize5(Socket sock) throws java.io.IOException {
4545
Kryo kryo = new Kryo();
46-
Input input = new Input(sock.getInputStream());
47-
A a1 = kryo.readObject(input, A.class); // $unsafeDeserialization
48-
A a2 = kryo.readObjectOrNull(input, A.class); // $unsafeDeserialization
49-
Object o = kryo.readClassAndObject(input); // $unsafeDeserialization
46+
Input input = new Input(sock.getInputStream()); // $ Source
47+
A a1 = kryo.readObject(input, A.class); // $ Alert
48+
A a2 = kryo.readObjectOrNull(input, A.class); // $ Alert
49+
Object o = kryo.readClassAndObject(input); // $ Alert
5050
}
5151

5252
private Kryo getSafeKryo() throws java.io.IOException {
@@ -64,22 +64,22 @@ public void deserialize6(Socket sock) throws java.io.IOException {
6464

6565
public void deserializeSnakeYaml(Socket sock) throws java.io.IOException {
6666
Yaml yaml = new Yaml();
67-
InputStream input = sock.getInputStream();
68-
Object o = yaml.load(input); // $unsafeDeserialization
69-
Object o2 = yaml.loadAll(input); // $unsafeDeserialization
70-
Object o3 = yaml.parse(new InputStreamReader(input)); // $unsafeDeserialization
71-
A o4 = yaml.loadAs(input, A.class); // $unsafeDeserialization
72-
A o5 = yaml.loadAs(new InputStreamReader(input), A.class); // $unsafeDeserialization
67+
InputStream input = sock.getInputStream(); // $ Source
68+
Object o = yaml.load(input); // $ Alert
69+
Object o2 = yaml.loadAll(input); // $ Alert
70+
Object o3 = yaml.parse(new InputStreamReader(input)); // $ Alert
71+
A o4 = yaml.loadAs(input, A.class); // $ Alert
72+
A o5 = yaml.loadAs(new InputStreamReader(input), A.class); // $ Alert
7373
}
7474

7575
public void deserializeSnakeYaml2(Socket sock) throws java.io.IOException {
7676
Yaml yaml = new Yaml(new Constructor());
77-
InputStream input = sock.getInputStream();
78-
Object o = yaml.load(input); // $unsafeDeserialization
79-
Object o2 = yaml.loadAll(input); // $unsafeDeserialization
80-
Object o3 = yaml.parse(new InputStreamReader(input)); // $unsafeDeserialization
81-
A o4 = yaml.loadAs(input, A.class); // $unsafeDeserialization
82-
A o5 = yaml.loadAs(new InputStreamReader(input), A.class); // $unsafeDeserialization
77+
InputStream input = sock.getInputStream(); // $ Source
78+
Object o = yaml.load(input); // $ Alert
79+
Object o2 = yaml.loadAll(input); // $ Alert
80+
Object o3 = yaml.parse(new InputStreamReader(input)); // $ Alert
81+
A o4 = yaml.loadAs(input, A.class); // $ Alert
82+
A o5 = yaml.loadAs(new InputStreamReader(input), A.class); // $ Alert
8383
}
8484

8585
public void deserializeSnakeYaml3(Socket sock) throws java.io.IOException {
@@ -94,11 +94,11 @@ public void deserializeSnakeYaml3(Socket sock) throws java.io.IOException {
9494

9595
public void deserializeSnakeYaml4(Socket sock) throws java.io.IOException {
9696
Yaml yaml = new Yaml(new Constructor(A.class));
97-
InputStream input = sock.getInputStream();
98-
Object o = yaml.load(input); // $unsafeDeserialization
99-
Object o2 = yaml.loadAll(input); // $unsafeDeserialization
100-
Object o3 = yaml.parse(new InputStreamReader(input)); // $unsafeDeserialization
101-
A o4 = yaml.loadAs(input, A.class); // $unsafeDeserialization
102-
A o5 = yaml.loadAs(new InputStreamReader(input), A.class); // $unsafeDeserialization
97+
InputStream input = sock.getInputStream(); // $ Source
98+
Object o = yaml.load(input); // $ Alert
99+
Object o2 = yaml.loadAll(input); // $ Alert
100+
Object o3 = yaml.parse(new InputStreamReader(input)); // $ Alert
101+
A o4 = yaml.loadAs(input, A.class); // $ Alert
102+
A o5 = yaml.loadAs(new InputStreamReader(input), A.class); // $ Alert
103103
}
104104
}

‎java/ql/test/query-tests/security/CWE-502/B.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,30 @@
44

55
public class B {
66
public Object deserializeJson1(Socket sock) throws java.io.IOException {
7-
InputStream inputStream = sock.getInputStream();
8-
return JSON.parseObject(inputStream, null); // $unsafeDeserialization
7+
InputStream inputStream = sock.getInputStream(); // $ Source
8+
return JSON.parseObject(inputStream, null); // $ Alert
99
}
1010

1111
public Object deserializeJson2(Socket sock) throws java.io.IOException {
12-
InputStream inputStream = sock.getInputStream();
12+
InputStream inputStream = sock.getInputStream(); // $ Source
1313
byte[] bytes = new byte[100];
1414
inputStream.read(bytes);
15-
return JSON.parse(bytes); // $unsafeDeserialization
15+
return JSON.parse(bytes); // $ Alert
1616
}
1717

1818
public Object deserializeJson3(Socket sock) throws java.io.IOException {
19-
InputStream inputStream = sock.getInputStream();
19+
InputStream inputStream = sock.getInputStream(); // $ Source
2020
byte[] bytes = new byte[100];
2121
inputStream.read(bytes);
2222
String s = new String(bytes);
23-
return JSON.parseObject(s); // $unsafeDeserialization
23+
return JSON.parseObject(s); // $ Alert
2424
}
2525

2626
public Object deserializeJson4(Socket sock) throws java.io.IOException {
27-
InputStream inputStream = sock.getInputStream();
27+
InputStream inputStream = sock.getInputStream(); // $ Source
2828
byte[] bytes = new byte[100];
2929
inputStream.read(bytes);
3030
String s = new String(bytes);
31-
return JSON.parse(s); // $unsafeDeserialization
31+
return JSON.parse(s); // $ Alert
3232
}
3333
}

‎java/ql/test/query-tests/security/CWE-502/C.java‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -20,75 +20,75 @@ public class C {
2020

2121
@GetMapping(value = "jyaml")
2222
public void bad1(HttpServletRequest request) throws Exception {
23-
String data = request.getParameter("data");
24-
Yaml.load(data); // $unsafeDeserialization
25-
Yaml.loadStream(data); // $unsafeDeserialization
26-
Yaml.loadStreamOfType(data, Object.class); // $unsafeDeserialization
27-
Yaml.loadType(data, Object.class); // $unsafeDeserialization
23+
String data = request.getParameter("data"); // $ Source
24+
Yaml.load(data); // $ Alert
25+
Yaml.loadStream(data); // $ Alert
26+
Yaml.loadStreamOfType(data, Object.class); // $ Alert
27+
Yaml.loadType(data, Object.class); // $ Alert
2828

2929
org.ho.yaml.YamlConfig yamlConfig = new YamlConfig();
30-
yamlConfig.load(data); // $unsafeDeserialization
31-
yamlConfig.loadStream(data); // $unsafeDeserialization
32-
yamlConfig.loadStreamOfType(data, Object.class); // $unsafeDeserialization
33-
yamlConfig.loadType(data, Object.class); // $unsafeDeserialization
30+
yamlConfig.load(data); // $ Alert
31+
yamlConfig.loadStream(data); // $ Alert
32+
yamlConfig.loadStreamOfType(data, Object.class); // $ Alert
33+
yamlConfig.loadType(data, Object.class); // $ Alert
3434
}
3535

3636
@GetMapping(value = "jsonio")
3737
public void bad2(HttpServletRequest request) {
38-
String data = request.getParameter("data");
38+
String data = request.getParameter("data"); // $ Source
3939

4040
HashMap hashMap = new HashMap();
4141
hashMap.put("USE_MAPS", true);
4242

43-
JsonReader.jsonToJava(data); // $unsafeDeserialization
43+
JsonReader.jsonToJava(data); // $ Alert
4444

4545
JsonReader jr = new JsonReader(data, null);
46-
jr.readObject(); // $unsafeDeserialization
46+
jr.readObject(); // $ Alert
4747
}
4848

4949
@GetMapping(value = "yamlbeans")
5050
public void bad3(HttpServletRequest request) throws Exception {
51-
String data = request.getParameter("data");
51+
String data = request.getParameter("data"); // $ Source
5252
YamlReader r = new YamlReader(data);
53-
r.read(); // $unsafeDeserialization
54-
r.read(Object.class); // $unsafeDeserialization
55-
r.read(Object.class, Object.class); // $unsafeDeserialization
53+
r.read(); // $ Alert
54+
r.read(Object.class); // $ Alert
55+
r.read(Object.class, Object.class); // $ Alert
5656
}
5757

5858
@GetMapping(value = "hessian")
5959
public void bad4(HttpServletRequest request) throws Exception {
60-
byte[] bytes = request.getParameter("data").getBytes();
60+
byte[] bytes = request.getParameter("data").getBytes(); // $ Source
6161
ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
6262
HessianInput hessianInput = new HessianInput(bis);
63-
hessianInput.readObject(); // $unsafeDeserialization
64-
hessianInput.readObject(Object.class); // $unsafeDeserialization
63+
hessianInput.readObject(); // $ Alert
64+
hessianInput.readObject(Object.class); // $ Alert
6565
}
6666

6767
@GetMapping(value = "hessian2")
6868
public void bad5(HttpServletRequest request) throws Exception {
69-
byte[] bytes = request.getParameter("data").getBytes();
69+
byte[] bytes = request.getParameter("data").getBytes(); // $ Source
7070
ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
7171
Hessian2Input hessianInput = new Hessian2Input(bis);
72-
hessianInput.readObject(); // $unsafeDeserialization
73-
hessianInput.readObject(Object.class); // $unsafeDeserialization
72+
hessianInput.readObject(); // $ Alert
73+
hessianInput.readObject(Object.class); // $ Alert
7474
}
7575

7676
@GetMapping(value = "castor")
7777
public void bad6(HttpServletRequest request) throws Exception {
7878
Unmarshaller unmarshaller = new Unmarshaller();
79-
unmarshaller.unmarshal(new StringReader(request.getParameter("data"))); // $unsafeDeserialization
79+
unmarshaller.unmarshal(new StringReader(request.getParameter("data"))); // $ Alert
8080
}
8181

8282
@GetMapping(value = "burlap")
8383
public void bad7(HttpServletRequest request) throws Exception {
84-
byte[] serializedData = request.getParameter("data").getBytes();
84+
byte[] serializedData = request.getParameter("data").getBytes(); // $ Source
8585
ByteArrayInputStream is = new ByteArrayInputStream(serializedData);
8686
BurlapInput burlapInput = new BurlapInput(is);
87-
burlapInput.readObject(); // $unsafeDeserialization
87+
burlapInput.readObject(); // $ Alert
8888

8989
BurlapInput burlapInput1 = new BurlapInput();
9090
burlapInput1.init(is);
91-
burlapInput1.readObject(); // $unsafeDeserialization
91+
burlapInput1.readObject(); // $ Alert
9292
}
9393

9494
@GetMapping(value = "jsonio1")

‎java/ql/test/query-tests/security/CWE-502/FlexjsonServlet.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -33,23 +33,23 @@ public void doHead(HttpServletRequest req, HttpServletResponse resp) throws IOEx
3333
// BAD: allow class name to be controlled by remote source
3434
public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
3535
JSONDeserializer<User> deserializer = new JSONDeserializer<>();
36-
User user = (User) deserializer.deserialize(req.getReader()); // $unsafeDeserialization
36+
User user = (User) deserializer.deserialize(req.getReader()); // $ Alert
3737

3838
}
3939

4040
@Override
4141
// BAD: allow class name to be controlled by remote source
4242
public void doTrace(HttpServletRequest req, HttpServletResponse resp) throws IOException {
4343
JSONDeserializer deserializer = new JSONDeserializer<>();
44-
User user = (User) deserializer.deserialize(req.getReader()); // $unsafeDeserialization
44+
User user = (User) deserializer.deserialize(req.getReader()); // $ Alert
4545

4646
}
4747

4848
@Override
4949
// BAD: specify overly generic class type
5050
public void doPut(HttpServletRequest req, HttpServletResponse resp) throws IOException {
5151
JSONDeserializer deserializer = new JSONDeserializer();
52-
User user = (User) deserializer.deserialize(req.getReader(), Object.class); // $unsafeDeserialization
52+
User user = (User) deserializer.deserialize(req.getReader(), Object.class); // $ Alert
5353
}
5454

5555
private Person fromJsonToPerson(String json) {
@@ -64,8 +64,8 @@ public void doPut2(HttpServletRequest req, HttpServletResponse resp) throws IOEx
6464

6565
// BAD: Specify a concrete class type to `use` with `ObjectFactory`
6666
public void doPut3(HttpServletRequest req, HttpServletResponse resp) throws IOException {
67-
String json = req.getParameter("json");
68-
Person person = new JSONDeserializer<Person>().use(Person.class, new ExistingObjectFactory(new Person())).deserialize(json); // $unsafeDeserialization
67+
String json = req.getParameter("json"); // $ Source
68+
Person person = new JSONDeserializer<Person>().use(Person.class, new ExistingObjectFactory(new Person())).deserialize(json); // $ Alert
6969
}
7070

7171
// GOOD: Specify a null path to `use` with a concrete class type
@@ -76,8 +76,8 @@ public void doPut4(HttpServletRequest req, HttpServletResponse resp) throws IOEx
7676

7777
// BAD: Specify a non-null json path to `use` with a concrete class type
7878
public void doPut5(HttpServletRequest req, HttpServletResponse resp) throws IOException {
79-
String json = req.getParameter("json");
80-
Person person = new JSONDeserializer<Person>().use("abc", Person.class).deserialize(json); // $unsafeDeserialization
79+
String json = req.getParameter("json"); // $ Source
80+
Person person = new JSONDeserializer<Person>().use("abc", Person.class).deserialize(json); // $ Alert
8181
}
8282

8383
// GOOD: Specify a null json path to `use` with `ObjectFactory`
@@ -116,11 +116,11 @@ public void doPut10(HttpServletRequest req, HttpServletResponse resp) throws IOE
116116

117117
// BAD: Specify a non-null json path to `use` with a concrete class type, interwoven with irrelevant use directives, without using fluent method chaining
118118
public void doPut11(HttpServletRequest req, HttpServletResponse resp) throws IOException {
119-
String json = req.getParameter("json");
119+
String json = req.getParameter("json"); // $ Source
120120
JSONDeserializer<Person> deserializer = new JSONDeserializer<Person>();
121121
deserializer.use(Person.class, null);
122122
deserializer.use("someKey", Person.class);
123123
deserializer.use(String.class, null);
124-
Person person = deserializer.deserialize(json); // $unsafeDeserialization
124+
Person person = deserializer.deserialize(json); // $ Alert
125125
}
126126
}

‎java/ql/test/query-tests/security/CWE-502/GsonActivity.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
import android.os.Parcel;
66
import android.os.Parcelable;
77

8-
import com.google.gson.Gson;
8+
import com.google.gson.Gson;
99

1010
public class GsonActivity extends Activity {
1111
public void onCreate(Bundle savedInstanceState) {
1212
super.onCreate(savedInstanceState);
1313
setContentView(-1);
1414

15-
ParcelableEntity entity = (ParcelableEntity) getIntent().getParcelableExtra("jsonEntity");
15+
ParcelableEntity entity = (ParcelableEntity) getIntent().getParcelableExtra("jsonEntity"); // $ Source
1616
}
1717
}

‎java/ql/test/query-tests/security/CWE-502/GsonServlet.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ public void doPut(HttpServletRequest req, HttpServletResponse resp) throws IOExc
3636
@Override
3737
// BAD: allow class name to be controlled by remote source
3838
public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
39-
String json = req.getParameter("json");
39+
String json = req.getParameter("json"); // $ Source
4040
String clazz = req.getParameter("class");
4141

4242
try {
4343
Gson gson = new Gson();
44-
Object obj = gson.fromJson(json, Class.forName(clazz)); // $unsafeDeserialization
44+
Object obj = gson.fromJson(json, Class.forName(clazz)); // $ Alert
4545
} catch (ClassNotFoundException cne) {
4646
throw new IOException(cne.getMessage());
4747
}
@@ -50,14 +50,14 @@ public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOEx
5050
@Override
5151
// BAD: allow class name to be controlled by remote source even with a type adapter factory
5252
public void doHead(HttpServletRequest req, HttpServletResponse resp) throws IOException {
53-
String json = req.getParameter("json");
53+
String json = req.getParameter("json"); // $ Source
5454
String clazz = req.getParameter("class");
5555

5656
try {
5757
RuntimeTypeAdapterFactory<User> runtimeTypeAdapterFactory = RuntimeTypeAdapterFactory
5858
.of(User.class, "type");
5959
Gson gson = new GsonBuilder().registerTypeAdapterFactory(runtimeTypeAdapterFactory).create();
60-
Object obj = gson.fromJson(json, Class.forName(clazz)); // $unsafeDeserialization
60+
Object obj = gson.fromJson(json, Class.forName(clazz)); // $ Alert
6161
} catch (ClassNotFoundException cne) {
6262
throw new IOException(cne.getMessage());
6363
}
@@ -74,4 +74,4 @@ public void doTrace(HttpServletRequest req, HttpServletResponse resp) throws IOE
7474
Gson gson = new GsonBuilder().registerTypeAdapterFactory(runtimeTypeAdapterFactory).create();
7575
Person obj = gson.fromJson(json, Person.class);
7676
}
77-
}
77+
}

0 commit comments

Comments
 (0)