11/** Provides classes to reason about insecure LDAP authentication. */
22
33import java
4- import semmle.code.java.frameworks.Networking
5- import semmle.code.java.frameworks.Jndi
4+ private import semmle.code.java.frameworks.Networking
5+ private import semmle.code.java.frameworks.Jndi
66
77/**
88 * An insecure (non-SSL, non-private) LDAP URL string literal.
99 */
10- class InsecureLdapUrlLiteral extends StringLiteral {
10+ private class InsecureLdapUrlLiteral extends StringLiteral {
1111 InsecureLdapUrlLiteral ( ) {
1212 // Match connection strings with the LDAP protocol and without private IP addresses to reduce false positives.
1313 exists ( string s | this .getValue ( ) = s |
@@ -18,7 +18,7 @@ class InsecureLdapUrlLiteral extends StringLiteral {
1818}
1919
2020/** The class `java.util.Hashtable`. */
21- class TypeHashtable extends Class {
21+ private class TypeHashtable extends Class {
2222 TypeHashtable ( ) { this .getSourceDeclaration ( ) .hasQualifiedName ( "java.util" , "Hashtable" ) }
2323}
2424
@@ -86,7 +86,7 @@ predicate hasFieldValueEnv(MethodAccess ma, string fieldValue, string envValue)
8686 * Holds if `ma` sets attribute name `fieldName` to `envValue` in some `Hashtable`.
8787 */
8888bindingset [ fieldName, envValue]
89- predicate hasFieldNameEnv ( MethodAccess ma , string fieldName , string envValue ) {
89+ private predicate hasFieldNameEnv ( MethodAccess ma , string fieldName , string envValue ) {
9090 // environment.put(Context.SECURITY_AUTHENTICATION, "simple")
9191 ma .getMethod ( ) .getDeclaringType ( ) .getAnAncestor ( ) instanceof TypeHashtable and
9292 ma .getMethod ( ) .hasName ( [ "put" , "setProperty" ] ) and
0 commit comments