Skip to content

Commit e3997f6

Browse files
michaelnebelmichaelnebel
committed
Java: Deprecate experimental queries.
1 parent eaeeafe commit e3997f6

File tree

98 files changed

+713
-400
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+713
-400
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,9 +111,11 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationPropertie
111111
)
112112
}
113113

114-
from SpringBootPom pom, ApplicationProperties ap, Dependency d
115-
where
116-
hasConfidentialEndPointExposed(pom, ap) and
117-
d = pom.getADependency() and
118-
d.getArtifact().getValue() = "spring-boot-starter-actuator"
119-
select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
114+
deprecated query predicate problems(Dependency d, string message) {
115+
exists(SpringBootPom pom |
116+
hasConfidentialEndPointExposed(pom, _) and
117+
d = pom.getADependency() and
118+
d.getArtifact().getValue() = "spring-boot-starter-actuator"
119+
) and
120+
message = "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
121+
}

‎java/ql/src/experimental/Security/CWE/CWE-016/SpringBootActuators.ql‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@
1212
*/
1313

1414
import java
15-
import SpringBootActuators
15+
deprecated import SpringBootActuators
1616

17-
from PermitAllCall permitAllCall
18-
where permitAllCall.permitsSpringBootActuators()
19-
select permitAllCall, "Unauthenticated access to Spring Boot actuator is allowed."
17+
deprecated query predicate problems(PermitAllCall permitAllCall, string message) {
18+
permitAllCall.permitsSpringBootActuators() and
19+
message = "Unauthenticated access to Spring Boot actuator is allowed."
20+
}

‎java/ql/src/experimental/Security/CWE/CWE-016/SpringBootActuators.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
deprecated module;
2+
13
import java
24

35
/** The class `org.springframework.security.config.annotation.web.builders.HttpSecurity`. */

‎java/ql/src/experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,13 @@ module Log4jInjectionConfig implements DataFlow::ConfigSig {
5252
*/
5353
module Log4jInjectionFlow = TaintTracking::Global<Log4jInjectionConfig>;
5454

55-
from Log4jInjectionFlow::PathNode source, Log4jInjectionFlow::PathNode sink
56-
where Log4jInjectionFlow::flowPath(source, sink)
57-
select sink.getNode(), source, sink, "Log4j log entry depends on a $@.", source.getNode(),
58-
"user-provided value"
55+
deprecated query predicate problems(
56+
DataFlow::Node sinkNode, Log4jInjectionFlow::PathNode source, Log4jInjectionFlow::PathNode sink,
57+
string message1, DataFlow::Node sourceNode, string message2
58+
) {
59+
Log4jInjectionFlow::flowPath(source, sink) and
60+
sinkNode = sink.getNode() and
61+
message1 = "Log4j log entry depends on a $@." and
62+
sourceNode = source.getNode() and
63+
message2 = "user-provided value"
64+
}

‎java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,11 @@ module RemoteUrlToOpenStreamFlowConfig implements DataFlow::ConfigSig {
5353

5454
module RemoteUrlToOpenStreamFlow = TaintTracking::Global<RemoteUrlToOpenStreamFlowConfig>;
5555

56-
from
57-
RemoteUrlToOpenStreamFlow::PathNode source, RemoteUrlToOpenStreamFlow::PathNode sink,
58-
MethodCall call
59-
where
56+
deprecated query predicate problems(
57+
MethodCall call, RemoteUrlToOpenStreamFlow::PathNode source,
58+
RemoteUrlToOpenStreamFlow::PathNode sink, string message
59+
) {
6060
sink.getNode().asExpr() = call.getQualifier() and
61-
RemoteUrlToOpenStreamFlow::flowPath(source, sink)
62-
select call, source, sink,
63-
"URL on which openStream is called may have been constructed from remote source."
61+
RemoteUrlToOpenStreamFlow::flowPath(source, sink) and
62+
message = "URL on which openStream is called may have been constructed from remote source."
63+
}

‎java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import semmle.code.java.dataflow.TaintTracking
1717
import semmle.code.java.dataflow.ExternalFlow
1818
import semmle.code.java.dataflow.FlowSources
1919
import semmle.code.java.security.TaintedPathQuery
20-
import JFinalController
20+
deprecated import JFinalController
2121
import semmle.code.java.security.PathSanitizer
2222
private import semmle.code.java.security.Sanitizers
2323
import InjectFilePathFlow::PathGraph
@@ -66,7 +66,13 @@ module InjectFilePathConfig implements DataFlow::ConfigSig {
6666

6767
module InjectFilePathFlow = TaintTracking::Global<InjectFilePathConfig>;
6868

69-
from InjectFilePathFlow::PathNode source, InjectFilePathFlow::PathNode sink
70-
where InjectFilePathFlow::flowPath(source, sink)
71-
select sink.getNode(), source, sink, "External control of file name or path due to $@.",
72-
source.getNode(), "user-provided value"
69+
deprecated query predicate problems(
70+
DataFlow::Node sinkNode, InjectFilePathFlow::PathNode source, InjectFilePathFlow::PathNode sink,
71+
string message1, DataFlow::Node sourceNode, string message2
72+
) {
73+
InjectFilePathFlow::flowPath(source, sink) and
74+
sinkNode = sink.getNode() and
75+
message1 = "External control of file name or path due to $@." and
76+
sourceNode = source.getNode() and
77+
message2 = "user-provided value"
78+
}

‎java/ql/src/experimental/Security/CWE/CWE-073/JFinalController.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
deprecated module;
2+
13
import java
24
private import semmle.code.java.dataflow.FlowSources
35

‎java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.ql‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,21 @@
1111
* external/cwe/cwe-078
1212
*/
1313

14-
import CommandInjectionRuntimeExec
15-
import ExecUserFlow::PathGraph
14+
deprecated import CommandInjectionRuntimeExec
15+
deprecated import ExecUserFlow::PathGraph
1616

17-
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
17+
deprecated class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
1818

19-
from
20-
ExecUserFlow::PathNode source, ExecUserFlow::PathNode sink, DataFlow::Node sourceCmd,
21-
DataFlow::Node sinkCmd
22-
where callIsTaintedByUserInputAndDangerousCommand(source, sink, sourceCmd, sinkCmd)
23-
select sink, source, sink,
24-
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
25-
sourceCmd, sourceCmd.toString(), source.getNode(), source.toString()
19+
deprecated query predicate problems(
20+
ExecUserFlow::PathNode sink, ExecUserFlow::PathNode source, ExecUserFlow::PathNode sink0,
21+
string message1, DataFlow::Node sourceCmd, string message2, DataFlow::Node sourceNode,
22+
string message3
23+
) {
24+
callIsTaintedByUserInputAndDangerousCommand(source, sink, sourceCmd, _) and
25+
sink0 = sink and
26+
message1 =
27+
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'" and
28+
message2 = sourceCmd.toString() and
29+
sourceNode = source.getNode() and
30+
message3 = source.toString()
31+
}

‎java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
deprecated module;
2+
13
import java
24
import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions
35
import semmle.code.java.dataflow.DataFlow

‎java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExecLocal.ql‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,21 @@
1212
* external/cwe/cwe-078
1313
*/
1414

15-
import CommandInjectionRuntimeExec
16-
import ExecUserFlow::PathGraph
15+
deprecated import CommandInjectionRuntimeExec
16+
deprecated import ExecUserFlow::PathGraph
1717

18-
class LocalSource extends Source instanceof LocalUserInput { }
18+
deprecated class LocalSource extends Source instanceof LocalUserInput { }
1919

20-
from
21-
ExecUserFlow::PathNode source, ExecUserFlow::PathNode sink, DataFlow::Node sourceCmd,
22-
DataFlow::Node sinkCmd
23-
where callIsTaintedByUserInputAndDangerousCommand(source, sink, sourceCmd, sinkCmd)
24-
select sink, source, sink,
25-
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
26-
sourceCmd, sourceCmd.toString(), source.getNode(), source.toString()
20+
deprecated query predicate problems(
21+
ExecUserFlow::PathNode sink, ExecUserFlow::PathNode source, ExecUserFlow::PathNode sink0,
22+
string message1, DataFlow::Node sourceCmd, string message2, DataFlow::Node sourceNode,
23+
string message3
24+
) {
25+
callIsTaintedByUserInputAndDangerousCommand(source, sink, sourceCmd, _) and
26+
sink0 = sink and
27+
message1 =
28+
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'" and
29+
message2 = sourceCmd.toString() and
30+
sourceNode = source.getNode() and
31+
message3 = source.toString()
32+
}

0 commit comments

Comments
 (0)