Skip to content

Commit adf905d

Browse files
atorralbaatorralba
authored
Merge pull request github#11368 from ka1n4t/main
Java: Add binding between annotation and sink-param in MyBatis SQL Injection query
2 parents 1d57663 + 4bbc1dc commit adf905d

File tree

5 files changed

+51
-10
lines changed

5 files changed

+51
-10
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-089/MyBatisCommonLib.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,9 @@ predicate isMybatisXmlOrAnnotationSqlInjection(
134134
.matches("${" + annotation.getValue("value").(CompileTimeConstantExpr).getStringValue() +
135135
"%}") and
136136
annotation.getType() instanceof TypeParam and
137-
ma.getAnArgument() = node.asExpr()
137+
ma.getAnArgument() = node.asExpr() and
138+
annotation.getTarget() =
139+
ma.getMethod().getParameter(node.asExpr().(Argument).getParameterPos())
138140
)
139141
or
140142
// MyBatis default parameter sql injection vulnerabilities.the default parameter form of the method is arg[0...n] or param[1...n].

‎java/ql/test/experimental/query-tests/security/CWE-089/src/main/MyBatisAnnotationSqlInjection.expected‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,30 @@
11
edges
22
| MybatisSqlInjection.java:62:19:62:43 | name : String | MybatisSqlInjection.java:63:35:63:38 | name : String |
33
| MybatisSqlInjection.java:63:35:63:38 | name : String | MybatisSqlInjectionService.java:48:19:48:29 | name : String |
4+
| MybatisSqlInjection.java:94:20:94:44 | name : String | MybatisSqlInjection.java:95:36:95:39 | name : String |
5+
| MybatisSqlInjection.java:95:36:95:39 | name : String | MybatisSqlInjectionService.java:76:20:76:30 | name : String |
6+
| MybatisSqlInjection.java:99:20:99:43 | age : String | MybatisSqlInjection.java:100:36:100:38 | age : String |
7+
| MybatisSqlInjection.java:100:36:100:38 | age : String | MybatisSqlInjectionService.java:80:20:80:29 | age : String |
48
| MybatisSqlInjectionService.java:48:19:48:29 | name : String | MybatisSqlInjectionService.java:50:23:50:26 | name : String |
59
| MybatisSqlInjectionService.java:50:3:50:9 | hashMap [post update] [<map.value>] : String | MybatisSqlInjectionService.java:51:27:51:33 | hashMap |
610
| MybatisSqlInjectionService.java:50:23:50:26 | name : String | MybatisSqlInjectionService.java:50:3:50:9 | hashMap [post update] [<map.value>] : String |
11+
| MybatisSqlInjectionService.java:76:20:76:30 | name : String | MybatisSqlInjectionService.java:77:28:77:31 | name |
12+
| MybatisSqlInjectionService.java:80:20:80:29 | age : String | MybatisSqlInjectionService.java:81:28:81:30 | age |
713
nodes
814
| MybatisSqlInjection.java:62:19:62:43 | name : String | semmle.label | name : String |
915
| MybatisSqlInjection.java:63:35:63:38 | name : String | semmle.label | name : String |
16+
| MybatisSqlInjection.java:94:20:94:44 | name : String | semmle.label | name : String |
17+
| MybatisSqlInjection.java:95:36:95:39 | name : String | semmle.label | name : String |
18+
| MybatisSqlInjection.java:99:20:99:43 | age : String | semmle.label | age : String |
19+
| MybatisSqlInjection.java:100:36:100:38 | age : String | semmle.label | age : String |
1020
| MybatisSqlInjectionService.java:48:19:48:29 | name : String | semmle.label | name : String |
1121
| MybatisSqlInjectionService.java:50:3:50:9 | hashMap [post update] [<map.value>] : String | semmle.label | hashMap [post update] [<map.value>] : String |
1222
| MybatisSqlInjectionService.java:50:23:50:26 | name : String | semmle.label | name : String |
1323
| MybatisSqlInjectionService.java:51:27:51:33 | hashMap | semmle.label | hashMap |
24+
| MybatisSqlInjectionService.java:76:20:76:30 | name : String | semmle.label | name : String |
25+
| MybatisSqlInjectionService.java:77:28:77:31 | name | semmle.label | name |
26+
| MybatisSqlInjectionService.java:80:20:80:29 | age : String | semmle.label | age : String |
27+
| MybatisSqlInjectionService.java:81:28:81:30 | age | semmle.label | age |
1428
subpaths
1529
#select
1630
| MybatisSqlInjectionService.java:51:27:51:33 | hashMap | MybatisSqlInjection.java:62:19:62:43 | name : String | MybatisSqlInjectionService.java:51:27:51:33 | hashMap | MyBatis annotation SQL injection might include code from $@ to $@. | MybatisSqlInjection.java:62:19:62:43 | name | this user input | SqlInjectionMapper.java:33:2:33:54 | Select | this SQL operation |

‎java/ql/test/experimental/query-tests/security/CWE-089/src/main/MybatisSqlInjection.java‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public String badSelect(@RequestParam String name) {
7979
public void badDelete(@RequestParam String name) {
8080
mybatisSqlInjectionService.badDelete(name);
8181
}
82-
82+
8383
@GetMapping(value = "badUpdate")
8484
public void badUpdate(@RequestParam String name) {
8585
mybatisSqlInjectionService.badUpdate(name);
@@ -89,4 +89,14 @@ public void badUpdate(@RequestParam String name) {
8989
public void badInsert(@RequestParam String name) {
9090
mybatisSqlInjectionService.badInsert(name);
9191
}
92+
93+
@GetMapping(value = "good2")
94+
public void good2(@RequestParam String name, @RequestParam Integer age) {
95+
mybatisSqlInjectionService.good2(name, age);
96+
}
97+
98+
@GetMapping(value = "good3")
99+
public void good3(@RequestParam String age) {
100+
mybatisSqlInjectionService.good3(age);
101+
}
92102
}

‎java/ql/test/experimental/query-tests/security/CWE-089/src/main/MybatisSqlInjectionService.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,4 +72,12 @@ public void badUpdate(String input) {
7272
public void badInsert(String input) {
7373
sqlInjectionMapper.badInsert(input);
7474
}
75+
76+
public void good2(String name, Integer age){
77+
sqlInjectionMapper.good2(name, age);
78+
}
79+
80+
public void good3(String age){
81+
sqlInjectionMapper.good3(age);
82+
}
7583
}

‎java/ql/test/experimental/query-tests/security/CWE-089/src/main/SqlInjectionMapper.java‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -37,26 +37,33 @@ public interface SqlInjectionMapper {
3737

3838
//using providers
3939
@SelectProvider(
40-
type = MyBatisProvider.class,
41-
method = "badSelect"
40+
type = MyBatisProvider.class,
41+
method = "badSelect"
4242
)
4343
String badSelect(String input);
4444

4545
@DeleteProvider(
46-
type = MyBatisProvider.class,
47-
method = "badDelete"
46+
type = MyBatisProvider.class,
47+
method = "badDelete"
4848
)
4949
void badDelete(String input);
5050

5151
@UpdateProvider(
52-
type = MyBatisProvider.class,
53-
method = "badUpdate"
52+
type = MyBatisProvider.class,
53+
method = "badUpdate"
5454
)
5555
void badUpdate(String input);
5656

5757
@InsertProvider(
58-
type = MyBatisProvider.class,
59-
method = "badInsert"
58+
type = MyBatisProvider.class,
59+
method = "badInsert"
6060
)
6161
void badInsert(String input);
62+
63+
@Select("select * from user_info where name = #{name} and age = ${age}")
64+
String good2(@Param("name") String name, Integer age);
65+
66+
@Select("select * from user_info where age = #{age}")
67+
String good3(@Param("age") String age);
68+
6269
}

0 commit comments

Comments
 (0)