Skip to content

Commit 6516539

Browse files
jcogs33jcogs33
authored
Merge pull request #14913 from jcogs33/jcogs33/unsafe-url-forward_path-inj-related_cve-2019-3799
Java: add Spring models
2 parents 5a4ea77 + 7e869b9 commit 6516539

File tree

4 files changed

+20
-71
lines changed

4 files changed

+20
-71
lines changed

‎java/ql/lib/change-notes/2023-11-29-new-spring-models.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added a sink model for the `createRelative` method of the `org.springframework.core.io.Resource` interface.
5+
* Added source models for methods of the `org.springframework.web.util.UrlPathHelper` class and removed their taint flow models.

‎java/ql/lib/ext/org.springframework.core.io.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6+
- ["org.springframework.core.io", "Resource", True, "createRelative", "(String)", "", "Argument[0]", "path-injection", "manual"]
67
- ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "path-injection", "ai-manual"]
78
- ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "request-forgery", "manual"]

‎java/ql/lib/ext/org.springframework.web.util.model.yml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sourceModel
5+
data:
6+
- ["org.springframework.web.util", "UrlPathHelper", False, "getLookupPathForRequest", "", "", "ReturnValue", "remote", "manual"]
7+
- ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingQueryString", "", "", "ReturnValue", "remote", "manual"]
8+
- ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingRequestUri", "", "", "ReturnValue", "remote", "manual"]
9+
- ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinApplication", "", "", "ReturnValue", "remote", "manual"]
10+
- ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinServletMapping", "", "", "ReturnValue", "remote", "manual"]
11+
- ["org.springframework.web.util", "UrlPathHelper", False, "getRequestUri", "", "", "ReturnValue", "remote", "manual"]
12+
- ["org.springframework.web.util", "UrlPathHelper", False, "getResolvedLookupPath", "", "", "ReturnValue", "remote", "manual"]
13+
- ["org.springframework.web.util", "UrlPathHelper", False, "getServletPath", "", "", "ReturnValue", "remote", "manual"]
14+
- ["org.springframework.web.util", "UrlPathHelper", False, "resolveAndCacheLookupPath", "", "", "ReturnValue", "remote", "manual"]
15+
216
- addsTo:
317
pack: codeql/java-all
418
extensible: summaryModel
@@ -147,15 +161,7 @@ extensions:
147161
- ["org.springframework.web.util", "UrlPathHelper", False, "decodeRequestString", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
148162
- ["org.springframework.web.util", "UrlPathHelper", False, "getContextPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
149163
- ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingContextPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
150-
- ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingQueryString", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
151-
- ["org.springframework.web.util", "UrlPathHelper", False, "getOriginatingRequestUri", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
152-
- ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinApplication", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
153-
- ["org.springframework.web.util", "UrlPathHelper", False, "getPathWithinServletMapping", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
154-
- ["org.springframework.web.util", "UrlPathHelper", False, "getRequestUri", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
155-
- ["org.springframework.web.util", "UrlPathHelper", False, "getResolvedLookupPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
156-
- ["org.springframework.web.util", "UrlPathHelper", False, "getServletPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
157164
- ["org.springframework.web.util", "UrlPathHelper", False, "removeSemicolonContent", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
158-
- ["org.springframework.web.util", "UrlPathHelper", False, "resolveAndCacheLookupPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
159165
- ["org.springframework.web.util", "WebUtils", False, "findParameterValue", "(Map,String)", "", "Argument[0].MapValue", "ReturnValue", "value", "manual"]
160166
- ["org.springframework.web.util", "WebUtils", False, "findParameterValue", "(ServletRequest,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
161167
- ["org.springframework.web.util", "WebUtils", False, "getCookie", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

‎java/ql/test/library-tests/frameworks/spring/webutil/Test.java‎

Lines changed: 0 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -2396,45 +2396,6 @@ public void test() throws Exception {
23962396
out = instance.getOriginatingContextPath(in);
23972397
sink(out); // $hasTaintFlow
23982398
}
2399-
{
2400-
// "org.springframework.web.util;UrlPathHelper;false;getOriginatingQueryString;;;Argument[0];ReturnValue;taint;manual"
2401-
String out = null;
2402-
HttpServletRequest in = (HttpServletRequest)source();
2403-
UrlPathHelper instance = null;
2404-
out = instance.getOriginatingQueryString(in);
2405-
sink(out); // $hasTaintFlow
2406-
}
2407-
{
2408-
// "org.springframework.web.util;UrlPathHelper;false;getOriginatingRequestUri;;;Argument[0];ReturnValue;taint;manual"
2409-
String out = null;
2410-
HttpServletRequest in = (HttpServletRequest)source();
2411-
UrlPathHelper instance = null;
2412-
out = instance.getOriginatingRequestUri(in);
2413-
sink(out); // $hasTaintFlow
2414-
}
2415-
{
2416-
// "org.springframework.web.util;UrlPathHelper;false;getRequestUri;;;Argument[0];ReturnValue;taint;manual"
2417-
String out = null;
2418-
HttpServletRequest in = (HttpServletRequest)source();
2419-
UrlPathHelper instance = null;
2420-
out = instance.getRequestUri(in);
2421-
sink(out); // $hasTaintFlow
2422-
}
2423-
{
2424-
// "org.springframework.web.util;UrlPathHelper;false;getResolvedLookupPath;;;Argument[0];ReturnValue;taint;manual"
2425-
String out = null;
2426-
ServletRequest in = (ServletRequest)source();
2427-
out = UrlPathHelper.getResolvedLookupPath(in);
2428-
sink(out); // $hasTaintFlow
2429-
}
2430-
{
2431-
// "org.springframework.web.util;UrlPathHelper;false;getServletPath;;;Argument[0];ReturnValue;taint;manual"
2432-
String out = null;
2433-
HttpServletRequest in = (HttpServletRequest)source();
2434-
UrlPathHelper instance = null;
2435-
out = instance.getServletPath(in);
2436-
sink(out); // $hasTaintFlow
2437-
}
24382399
{
24392400
// "org.springframework.web.util;UrlPathHelper;false;removeSemicolonContent;;;Argument[0];ReturnValue;taint;manual"
24402401
String out = null;
@@ -2443,14 +2404,6 @@ public void test() throws Exception {
24432404
out = instance.removeSemicolonContent(in);
24442405
sink(out); // $hasTaintFlow
24452406
}
2446-
{
2447-
// "org.springframework.web.util;UrlPathHelper;false;resolveAndCacheLookupPath;;;Argument[0];ReturnValue;taint;manual"
2448-
String out = null;
2449-
HttpServletRequest in = (HttpServletRequest)source();
2450-
UrlPathHelper instance = null;
2451-
out = instance.resolveAndCacheLookupPath(in);
2452-
sink(out); // $hasTaintFlow
2453-
}
24542407
{
24552408
// "org.springframework.web.util;WebUtils;false;findParameterValue;(Map,String);;MapValue of Argument[0];ReturnValue;value;manual"
24562409
String out = null;
@@ -2605,22 +2558,6 @@ public void test() throws Exception {
26052558
out = in.toString();
26062559
sink(out); // $ hasTaintFlow
26072560
}
2608-
{
2609-
// "org.springframework.web.util;UrlPathHelper;false;getPathWithinApplication;;;Argument[0];ReturnValue;taint;manual"
2610-
String out = null;
2611-
HttpServletRequest in = (HttpServletRequest)source();
2612-
UrlPathHelper instance = null;
2613-
out = instance.getPathWithinApplication(in);
2614-
sink(out); // $ hasTaintFlow
2615-
}
2616-
{
2617-
// "org.springframework.web.util;UrlPathHelper;false;getPathWithinServletMapping;;;Argument[0];ReturnValue;taint;manual"
2618-
String out = null;
2619-
HttpServletRequest in = (HttpServletRequest)source();
2620-
UrlPathHelper instance = null;
2621-
out = instance.getPathWithinServletMapping(in);
2622-
sink(out); // $ hasTaintFlow
2623-
}
26242561
{
26252562
// "org.springframework.web.util;WebUtils;false;setSessionAttribute;;;Argument[2];Argument[0];taint;manual"
26262563
HttpServletRequest out = null;

0 commit comments

Comments
 (0)