Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 3f4f18e

Browse filesBrowse files
cklincklin
committed
Java: apply query alert restrictions
1 parent 5722556 commit 3f4f18e
Copy full SHA for 3f4f18e

File tree

60 files changed

+243
-13
lines changed
Filter options

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner

60 files changed

+243
-13
lines changed

‎java/ql/lib/semmle/code/java/security/CleartextStorageQuery.qll

Copy file name to clipboardExpand all lines: java/ql/lib/semmle/code/java/security/CleartextStorageQuery.qll
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ abstract class Storable extends Call {
3636
abstract Expr getAStore();
3737
}
3838

39-
private module SensitiveSourceFlowConfig implements DataFlow::ConfigSig {
39+
/** Flow configuration for sensitive data flowing into cleartext storage. */
40+
module SensitiveSourceFlowConfig implements DataFlow::ConfigSig {
4041
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof SensitiveExpr }
4142

4243
predicate isSink(DataFlow::Node sink) { sink instanceof CleartextStorageSink }

‎java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll

Copy file name to clipboardExpand all lines: java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll
+12-4Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import semmle.code.java.security.InformationLeak
77
/**
88
* One of the `printStackTrace()` overloads on `Throwable`.
99
*/
10-
private class PrintStackTraceMethod extends Method {
10+
class PrintStackTraceMethod extends Method {
1111
PrintStackTraceMethod() {
1212
this.getDeclaringType()
1313
.getSourceDeclaration()
@@ -17,7 +17,11 @@ private class PrintStackTraceMethod extends Method {
1717
}
1818
}
1919

20-
private module ServletWriterSourceToPrintStackTraceMethodFlowConfig implements DataFlow::ConfigSig {
20+
/**
21+
* Flow configuration for xss vulnerable writer source flowing to `Throwable.printStackTrace()` on
22+
* a stream that is connected to external output.
23+
*/
24+
module ServletWriterSourceToPrintStackTraceMethodFlowConfig implements DataFlow::ConfigSig {
2125
predicate isSource(DataFlow::Node src) { src instanceof XssVulnerableWriterSourceNode }
2226

2327
predicate isSink(DataFlow::Node sink) {
@@ -55,7 +59,10 @@ private predicate printWriterOnStringWriter(Expr printWriter, Variable stringWri
5559
)
5660
}
5761

58-
private predicate stackTraceExpr(Expr exception, MethodCall stackTraceString) {
62+
/**
63+
* Holds if `stackTraceString` writes the stack trace from `exception` to a string.
64+
*/
65+
predicate stackTraceExpr(Expr exception, MethodCall stackTraceString) {
5966
exists(Expr printWriter, Variable stringWriterVar, MethodCall printStackCall |
6067
printWriterOnStringWriter(printWriter, stringWriterVar) and
6168
printStackCall.getMethod() instanceof PrintStackTraceMethod and
@@ -66,7 +73,8 @@ private predicate stackTraceExpr(Expr exception, MethodCall stackTraceString) {
6673
)
6774
}
6875

69-
private module StackTraceStringToHttpResponseSinkFlowConfig implements DataFlow::ConfigSig {
76+
/** Flow configuration for stack trace flowing to http response. */
77+
module StackTraceStringToHttpResponseSinkFlowConfig implements DataFlow::ConfigSig {
7078
predicate isSource(DataFlow::Node src) { stackTraceExpr(_, src.asExpr()) }
7179

7280
predicate isSink(DataFlow::Node sink) { sink instanceof InformationLeakSink }

‎java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll

Copy file name to clipboardExpand all lines: java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,7 @@ deprecated class UnsafeDeserializationConfig extends TaintTracking::Configuratio
334334
}
335335

336336
/** Tracks flows from remote user input to a deserialization sink. */
337-
private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
337+
module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
338338
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
339339

340340
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserializationSink }

‎java/ql/src/Likely Bugs/Arithmetic/InformationLoss.ql

Copy file name to clipboardExpand all lines: java/ql/src/Likely Bugs/Arithmetic/InformationLoss.ql
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ Variable getVariable(Expr dest) {
3535

3636
from DangerousAssignOpExpr a, Expr e, Top v
3737
where
38+
AlertFiltering::filterByLocatable(a) and
3839
e = a.getSource() and
3940
problematicCasting(a.getDest().getType(), e) and
4041
(

‎java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* external/cwe/cwe-020
1313
*/
1414

15+
private import semmle.code.java.AlertFiltering
1516
private import semmle.code.java.regex.RegexTreeView::RegexTreeView as TreeView
1617
import codeql.regex.OverlyLargeRangeQuery::Make<TreeView>
1718

@@ -22,6 +23,7 @@ TreeView::RegExpCharacterClass potentialMisparsedCharClass() {
2223

2324
from TreeView::RegExpCharacterRange range, string reason
2425
where
26+
AlertFiltering::filterByLocation(range.getLocation()) and
2527
problem(range, reason) and
2628
not range.getParent() = potentialMisparsedCharClass()
2729
select range, "Suspicious character range that " + reason + "."

‎java/ql/src/Security/CWE/CWE-022/TaintedPath.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-022/TaintedPath.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
import java
1717
import semmle.code.java.security.PathCreation
1818
import semmle.code.java.security.TaintedPathQuery
19+
20+
module TaintedPathFlow = TaintTracking::Global<DataFlow::FilteredConfig<TaintedPathConfig>>;
21+
1922
import TaintedPathFlow::PathGraph
2023

2124
from TaintedPathFlow::PathNode source, TaintedPathFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-022/ZipSlip.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414

1515
import java
1616
import semmle.code.java.security.ZipSlipQuery
17+
18+
module ZipSlipFlow = TaintTracking::Global<DataFlow::FilteredConfig<ZipSlipConfig>>;
19+
1720
import ZipSlipFlow::PathGraph
1821

1922
from ZipSlipFlow::PathNode source, ZipSlipFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@
1111
*/
1212

1313
import semmle.code.java.security.PartialPathTraversalQuery
14+
15+
module PartialPathTraversalFromRemoteFlow =
16+
TaintTracking::Global<DataFlow::FilteredConfig<PartialPathTraversalFromRemoteConfig>>;
17+
1418
import PartialPathTraversalFromRemoteFlow::PathGraph
1519

1620
from

‎java/ql/src/Security/CWE/CWE-074/JndiInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-074/JndiInjection.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.JndiInjectionQuery
16+
17+
module JndiInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<JndiInjectionFlowConfig>>;
18+
1619
import JndiInjectionFlow::PathGraph
1720

1821
from JndiInjectionFlow::PathNode source, JndiInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-074/XsltInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-074/XsltInjection.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.XsltInjectionQuery
16+
17+
module XsltInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<XsltInjectionFlowConfig>>;
18+
1619
import XsltInjectionFlow::PathGraph
1720

1821
from XsltInjectionFlow::PathNode source, XsltInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-078/ExecTainted.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-078/ExecTainted.ql
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,20 @@
1414

1515
import java
1616
import semmle.code.java.security.CommandLineQuery
17+
private import semmle.code.java.dataflow.TaintTracking
18+
19+
module InputToArgumentToExecFlow =
20+
TaintTracking::Global<DataFlow::FilteredConfig<InputToArgumentToExecFlowConfig>>;
21+
1722
import InputToArgumentToExecFlow::PathGraph
1823

24+
predicate execIsTainted(
25+
InputToArgumentToExecFlow::PathNode source, InputToArgumentToExecFlow::PathNode sink, Expr execArg
26+
) {
27+
InputToArgumentToExecFlow::flowPath(source, sink) and
28+
argumentToExec(execArg, sink.getNode())
29+
}
30+
1931
from
2032
InputToArgumentToExecFlow::PathNode source, InputToArgumentToExecFlow::PathNode sink, Expr execArg
2133
where execIsTainted(source, sink, execArg)

‎java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ predicate builtFromUncontrolledConcat(Expr expr) {
4747

4848
from StringArgumentToExec argument
4949
where
50+
AlertFiltering::filterByLocatable(argument) and
5051
builtFromUncontrolledConcat(argument) and
5152
not execIsTainted(_, _, argument)
5253
select argument, "Command line is built with string concatenation."

‎java/ql/src/Security/CWE/CWE-079/XSS.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-079/XSS.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.XssQuery
16+
17+
module XssFlow = TaintTracking::Global<DataFlow::FilteredConfig<XssConfig>>;
18+
1619
import XssFlow::PathGraph
1720

1821
from XssFlow::PathNode source, XssFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-089/SqlTainted.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,18 @@
1515
import java
1616
import semmle.code.java.dataflow.FlowSources
1717
import semmle.code.java.security.SqlInjectionQuery
18+
19+
module QueryInjectionFlow =
20+
TaintTracking::Global<DataFlow::FilteredConfig<QueryInjectionFlowConfig>>;
21+
1822
import QueryInjectionFlow::PathGraph
1923

24+
predicate queryIsTaintedBy(
25+
QueryInjectionSink query, QueryInjectionFlow::PathNode source, QueryInjectionFlow::PathNode sink
26+
) {
27+
QueryInjectionFlow::flowPath(source, sink) and sink.getNode() = query
28+
}
29+
2030
from
2131
QueryInjectionSink query, QueryInjectionFlow::PathNode source, QueryInjectionFlow::PathNode sink
2232
where queryIsTaintedBy(query, source, sink)

‎java/ql/src/Security/CWE/CWE-090/LdapInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-090/LdapInjection.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
import java
1515
import semmle.code.java.dataflow.FlowSources
1616
import semmle.code.java.security.LdapInjectionQuery
17+
18+
module LdapInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<LdapInjectionFlowConfig>>;
19+
1720
import LdapInjectionFlow::PathGraph
1821

1922
from LdapInjectionFlow::PathNode source, LdapInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/GroovyInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-094/GroovyInjection.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.GroovyInjectionQuery
16+
17+
module GroovyInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<GroovyInjectionConfig>>;
18+
1619
import GroovyInjectionFlow::PathGraph
1720

1821
from GroovyInjectionFlow::PathNode source, GroovyInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@
1212

1313
import java
1414
import semmle.code.java.security.InsecureBeanValidationQuery
15+
16+
module BeanValidationFlow = TaintTracking::Global<DataFlow::FilteredConfig<BeanValidationConfig>>;
17+
1518
import BeanValidationFlow::PathGraph
1619

1720
from BeanValidationFlow::PathNode source, BeanValidationFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/JexlInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-094/JexlInjection.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.JexlInjectionQuery
16+
17+
module JexlInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<JexlInjectionConfig>>;
18+
1619
import JexlInjectionFlow::PathGraph
1720

1821
from JexlInjectionFlow::PathNode source, JexlInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/MvelInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-094/MvelInjection.ql
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
import java
1515
import semmle.code.java.security.MvelInjectionQuery
16+
17+
module MvelInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<MvelInjectionFlowConfig>>;
18+
1619
import MvelInjectionFlow::PathGraph
1720

1821
from MvelInjectionFlow::PathNode source, MvelInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/SpelInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-094/SpelInjection.ql
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.SpelInjectionQuery
16-
import semmle.code.java.dataflow.DataFlow
16+
import semmle.code.java.dataflow.TaintTracking
17+
18+
module SpelInjectionFlow = TaintTracking::Global<DataFlow::FilteredConfig<SpelInjectionConfig>>;
19+
1720
import SpelInjectionFlow::PathGraph
1821

1922
from SpelInjectionFlow::PathNode source, SpelInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.TemplateInjectionQuery
16+
17+
module TemplateInjectionFlow =
18+
TaintTracking::Global<DataFlow::FilteredConfig<TemplateInjectionFlowConfig>>;
19+
1620
import TemplateInjectionFlow::PathGraph
1721

1822
from TemplateInjectionFlow::PathNode source, TemplateInjectionFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-113/NettyResponseSplitting.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-113/NettyResponseSplitting.ql
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,4 +93,5 @@ private class InsecureDefaultFullHttpRequestClassInstantiation extends RequestSp
9393
}
9494

9595
from InsecureNettyObjectCreation new
96+
where AlertFiltering::filterByLocatable(new)
9697
select new, new.splittingType() + " vulnerability due to header value verification being disabled."

‎java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.ResponseSplittingQuery
16+
17+
module ResponseSplittingFlow =
18+
TaintTracking::Global<DataFlow::FilteredConfig<ResponseSplittingConfig>>;
19+
1620
import ResponseSplittingFlow::PathGraph
1721

1822
from ResponseSplittingFlow::PathNode source, ResponseSplittingFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-1204/StaticInitializationVector.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-1204/StaticInitializationVector.ql
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313

1414
import java
1515
import semmle.code.java.security.StaticInitializationVectorQuery
16+
17+
module StaticInitializationVectorFlow =
18+
TaintTracking::Global<DataFlow::FilteredConfig<StaticInitializationVectorConfig>>;
19+
1620
import StaticInitializationVectorFlow::PathGraph
1721

1822
from StaticInitializationVectorFlow::PathNode source, StaticInitializationVectorFlow::PathNode sink

‎java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,13 @@
1111
*/
1212

1313
import java
14+
import semmle.code.java.dataflow.TaintTracking
1415
import semmle.code.java.security.ExternallyControlledFormatStringQuery
1516
import semmle.code.java.StringFormat
17+
18+
module ExternallyControlledFormatStringFlow =
19+
TaintTracking::Global<DataFlow::FilteredConfig<ExternallyControlledFormatStringConfig>>;
20+
1621
import ExternallyControlledFormatStringFlow::PathGraph
1722

1823
from

‎java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
+27Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,35 @@
1515

1616
import java
1717
import semmle.code.java.dataflow.DataFlow
18+
import semmle.code.java.dataflow.TaintTracking
1819
import semmle.code.java.security.StackTraceExposureQuery
1920

21+
private module ServletWriterSourceToPrintStackTraceMethodFlow =
22+
TaintTracking::Global<DataFlow::FilteredConfig<ServletWriterSourceToPrintStackTraceMethodFlowConfig>>;
23+
24+
private predicate printsStackToWriter(MethodCall call) {
25+
exists(PrintStackTraceMethod printStackTrace |
26+
call.getMethod() = printStackTrace and
27+
ServletWriterSourceToPrintStackTraceMethodFlow::flowToExpr(call.getAnArgument())
28+
)
29+
}
30+
31+
predicate printsStackExternally(MethodCall call, Expr stackTrace) {
32+
printsStackToWriter(call) and
33+
call.getQualifier() = stackTrace and
34+
not call.getQualifier() instanceof SuperAccess
35+
}
36+
37+
private module StackTraceStringToHttpResponseSinkFlow =
38+
TaintTracking::Global<DataFlow::FilteredConfig<StackTraceStringToHttpResponseSinkFlowConfig>>;
39+
40+
predicate stringifiedStackFlowsExternally(DataFlow::Node externalExpr, Expr stackTrace) {
41+
exists(MethodCall stackTraceString |
42+
stackTraceExpr(stackTrace, stackTraceString) and
43+
StackTraceStringToHttpResponseSinkFlow::flow(DataFlow::exprNode(stackTraceString), externalExpr)
44+
)
45+
}
46+
2047
from Expr externalExpr, Expr errorInformation
2148
where
2249
printsStackExternally(externalExpr, errorInformation) or

‎java/ql/src/Security/CWE/CWE-266/IntentUriPermissionManipulation.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-266/IntentUriPermissionManipulation.ql
+5-1Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,11 @@
1414

1515
import java
1616
import semmle.code.java.security.IntentUriPermissionManipulationQuery
17-
import semmle.code.java.dataflow.DataFlow
17+
import semmle.code.java.dataflow.TaintTracking
18+
19+
module IntentUriPermissionManipulationFlow =
20+
TaintTracking::Global<DataFlow::FilteredConfig<IntentUriPermissionManipulationConfig>>;
21+
1822
import IntentUriPermissionManipulationFlow::PathGraph
1923

2024
from

‎java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql
+3-1Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,7 @@ import java
1414
import semmle.code.java.security.AndroidLocalAuthQuery
1515

1616
from AuthenticationSuccessCallback c
17-
where not exists(c.getAResultUse())
17+
where
18+
AlertFiltering::filterByLocatable(c) and
19+
not exists(c.getAResultUse())
1820
select c, "This authentication callback does not use its result for a cryptographic operation."

‎java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.ql
+3-1Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,7 @@ import java
1414
import semmle.code.java.security.AndroidWebViewCertificateValidationQuery
1515

1616
from OnReceivedSslErrorMethod m
17-
where trustsAllCerts(m)
17+
where
18+
AlertFiltering::filterByLocatable(m) and
19+
trustsAllCerts(m)
1820
select m, "This handler accepts all SSL certificates."

‎java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.ql

Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.ql
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313
import java
1414
import semmle.code.java.dataflow.DataFlow
1515
import semmle.code.java.security.InsecureTrustManagerQuery
16+
17+
module InsecureTrustManagerFlow =
18+
DataFlow::Global<DataFlow::FilteredConfig<InsecureTrustManagerConfig>>;
19+
1620
import InsecureTrustManagerFlow::PathGraph
1721

1822
from InsecureTrustManagerFlow::PathNode source, InsecureTrustManagerFlow::PathNode sink

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.