Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Java : add request forgery query #3454

Merged
merged 10 commits into from
Nov 26, 2020
Merged

Java : add request forgery query #3454

merged 10 commits into from
Nov 26, 2020

Conversation

porcupineyhairs
Copy link
Contributor

This query adds support for detecting SSRF in Java.

@porcupineyhairs porcupineyhairs requested review from felicitymay and a team as code owners May 12, 2020 13:35
@porcupineyhairs
Copy link
Contributor Author

I just noticed #3452 tackles a similar issue. I will give a brief of how my PR differs from the latter.

  • That one adds support for only openConnection calls. I add support for multiple other calls from the java.net.http and apache http client libraries.

  • I have also included library as well as query tests for the same.

  • I haven't included any barriers for the flow while Java: CWE-918: Server side request forgery #3452 considers addition with lhs as :// as a blocking step.

  • Java: CWE-918: Server side request forgery #3452 is asking to be merged as an experimental one while I would like this to be included as stable.

@ghost ghost mentioned this pull request May 12, 2020
Closed
@pwntester
Copy link
Contributor

Can you please open a corresponding securitylab issue for tracking?

@porcupineyhairs porcupineyhairs mentioned this pull request May 13, 2020
Closed
@porcupineyhairs porcupineyhairs force-pushed the javaSSRf branch 2 times, most recently from 6b3a971 to d073603 Compare June 26, 2020 17:15
@porcupineyhairs
Copy link
Contributor Author

I have added a few stubs which I had missed earlier and rebased this to the latest master. This is now ready to be reviewed and merged.

@porcupineyhairs porcupineyhairs mentioned this pull request Jun 27, 2020
Closed
1 task
felicitymay
felicitymay reviewed Jul 9, 2020
View reviewed changes
Copy link
Contributor

@felicitymay felicitymay left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I should have mentioned earlier, I was added as a reviewer automatically by the CODEOWNERS file. However this PR doesn't need a review from the docs team because most of the changes are to the experimental directory. We've since updated the CODEOWNERS file to reflect this.

@adityasharad adityasharad changed the base branch from master to main August 14, 2020 18:34
@porcupineyhairs
Copy link
Contributor Author

@aschackmull I have rebased to the latest main. This is now ready for review.

@smowton smowton self-assigned this Oct 7, 2020
smowton
smowton reviewed Oct 9, 2020
View reviewed changes
Copy link
Contributor

@smowton smowton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello! Apologies for slowness on our part; I'm taking over reviewing and hope the process will be much quicker from here. Quite a few comments but nothing too time-consuming I hope.

java/ql/src/experimental/CWE-918/RequestForgery.qhelp Outdated Show resolved Hide resolved
java/ql/src/experimental/CWE-918/RequestForgery.qll Outdated Show resolved Hide resolved
java/ql/src/experimental/CWE-918/RequestForgeryCustomizations.qll Outdated Show resolved Hide resolved
java/ql/src/experimental/CWE-918/RequestForgeryCustomizations.qll Outdated Show resolved Hide resolved
java/ql/src/experimental/CWE-918/RequestForgeryCustomizations.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/Networking.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/Http.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/spring/SpringRestTemplate.qll Outdated Show resolved Hide resolved
java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.java Outdated Show resolved Hide resolved
...imental/stubs/springframework-5.2.6/org/springframework/core/ParameterizedTypeReference.java Outdated Show resolved Hide resolved
@smowton smowton mentioned this pull request Oct 14, 2020
Closed
@porcupineyhairs
Copy link
Contributor Author

@smowton Sorry for the delay in addressing the review. I was on a long vacation. I have made the changes and merged the latest master into the branch.

@porcupineyhairs porcupineyhairs mentioned this pull request Nov 3, 2020
Merged
smowton
smowton reviewed Nov 11, 2020
View reviewed changes
Copy link
Contributor

@smowton smowton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just noticed some public defns with missing doc comments

java/ql/src/semmle/code/java/frameworks/javase/URI.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/URL.qll Outdated
result = this.getArgument(1)
}

Expr protocolArg() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing doc comment

java/ql/src/semmle/code/java/frameworks/javase/URL.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/URI.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/URL.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/URL.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/spring/SpringHttp.qll Outdated
numArgs = this.getNumArgument()
}

Argument getUriArg() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing doc comment

aschackmull
aschackmull requested changes Nov 11, 2020
View reviewed changes
Copy link
Contributor

@aschackmull aschackmull left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have more comments, but let's start with this.

java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/JaxWS.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/Http.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/Http.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/Http.qll Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/URI.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/javase/URL.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/spring/SpringHttp.qll Outdated Show resolved Hide resolved
java/ql/src/semmle/code/java/frameworks/spring/SpringWebClient.qll Outdated Show resolved Hide resolved
@aschackmull
Copy link
Contributor

The qldoc generally needs a lot of updates to bring it in line with https://github.com/github/codeql/blob/main/docs/qldoc-style-guide.md. Note in particular:

  • Classes are documented with a noun-phrase, such as A <thing> that <has properties>. or The <some unique thing>.
  • Predicates with results use a third-person verb phrase of the form Gets (a|the) <thing>.

@porcupineyhairs
Copy link
Contributor Author

@aschackmull I have pushed a few changes. Do I fix them now?

@aschackmull
Copy link
Contributor

I've written a bunch of additional suggested changes in a PR against this PR. Please merge porcupineyhairs#2 into this PR.

aschackmull and others added 2 commits November 24, 2020 13:18
@porcupineyhairs
Copy link
Contributor Author

@aschackmull Merged!

@aschackmull aschackmull merged commit f70072a into github:main Nov 26, 2020
@porcupineyhairs porcupineyhairs deleted the javaSSRf branch November 26, 2020 16:39
@Marcono1234
Copy link
Contributor

Is it intended that the files of this query are directly in the src/experimental directory instead of src/experimental/Security/CWE?

(Sorry if this has been mentioned in one of the review comments; I only went over the pull request comments, but did not find anything regarding this)

@smowton
Copy link
Contributor

smowton commented Feb 11, 2021

They don't appear to be? What file are you referring to?

@Marcono1234
Copy link
Contributor

These:
Directories screenshot
See https://github.com/github/codeql/tree/main/java/ql/src/experimental

@smowton
Copy link
Contributor

smowton commented Feb 12, 2021

Doh right, I thought you meant files directly within the experimental directory

@smowton
Copy link
Contributor

smowton commented Feb 12, 2021

#5153

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@smowton smowton smowton left review comments

@JLLeitschuh JLLeitschuh JLLeitschuh left review comments

@felicitymay felicitymay felicitymay left review comments

@intrigus-lgtm intrigus-lgtm intrigus-lgtm left review comments

@aschackmull aschackmull aschackmull approved these changes

Assignees

@smowton smowton

Labels
documentation Java
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@porcupineyhairs @pwntester @smowton @aschackmull @Marcono1234 @JLLeitschuh @felicitymay @intrigus-lgtm