github · artem-smotrakov · artem-smotrakov · artem-smotrakov · Jan 17, 2021 · artem-smotrakov
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+class TaintedSpringRequestBody extends DataFlow::Node {
+  TaintedSpringRequestBody() {
+    exists(SpringServletInputAnnotation a | this.asParameter().getAnAnnotation() = a)
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+ */
+predicate returningTaintedDataFromBean(DataFlow::Node node1, DataFlow::Node node2) {
+  exists(MethodAccess ma, Method m | ma.getMethod() = m |
+    m instanceof GetterMethod and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjection.qhelp
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+ * It supports both Jexl2 and Jexl3.
+ */
+class JexlInjectionConfig extends TaintTracking::Configuration {
+  TaintPropagatingJexlMethodCall taintPropagatingJexlMethodCall;
-  TaintPropagatingJexlMethodCall taintPropagatingJexlMethodCall;
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+  override predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    taintPropagatingJexlMethodCall.taintFlow(fromNode, toNode) or
-    taintPropagatingJexlMethodCall.taintFlow(fromNode, toNode) or
+    any(TaintPropagatingJexlMethodCall c).taintFlow(fromNode, toNode) or
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+ */
+private class JexlEvaluationSink extends DataFlow::ExprNode {
+  JexlEvaluationSink() {
+    exists(MethodAccess ma, Method m, Expr tainted | ma.getMethod() = m and tainted = asExpr() |
-    exists(MethodAccess ma, Method m, Expr tainted | ma.getMethod() = m and tainted = asExpr() |
+    exists(MethodAccess ma, Method m, Expr taintFrom | ma.getMethod() = m and tainted = this.asExpr() |
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+/**
+ * Defines methods that triggers direct evaluation of Jexl expressions.
+ */
+abstract private class DirectJexlEvaluationMethod extends Method { }
+
+/**
+ * A method in the `JexlExpression` class that evaluates a Jexl expression.
+ */
+private class JexlExpressionEvaluateMethod extends DirectJexlEvaluationMethod {
+  JexlExpressionEvaluateMethod() {
+    getDeclaringType() instanceof JexlExpression and hasName("evaluate")
+  }
+}
+
+/**
+ * A method in the `JexlScript` class that executes a Jexl script.
+ */
+private class JexlScriptExecuteMethod extends DirectJexlEvaluationMethod {
+  JexlScriptExecuteMethod() { getDeclaringType() instanceof JexlScript and hasName("execute") }
+}
+
+/**
+ * A method in the `JxltEngine.Expression` class that evaluates an expression.
+ */
+private class JxltEngineExpressionEvaluateMethod extends DirectJexlEvaluationMethod {
+  JxltEngineExpressionEvaluateMethod() {
+    getDeclaringType() instanceof JxltEngineExpression and hasName("evaluate")
+  }
+}
+
+/**
+ * A method in the `JxltEngine.Expression` class that evaluates the immediate sub-expressions.
+ */
+private class JxltEngineExpressionPrepareMethod extends DirectJexlEvaluationMethod {
+  JxltEngineExpressionPrepareMethod() {
+    getDeclaringType() instanceof JxltEngineExpression and hasName("prepare")
+  }
+}
+
+/**
+ * A method in the `JxltEngine.Template` class that evaluates a template.
+ */
+private class JxltEngineTemplateEvaluateMethod extends DirectJexlEvaluationMethod {
+  JxltEngineTemplateEvaluateMethod() {
+    getDeclaringType() instanceof JxltEngineTemplate and hasName("evaluate")
+  }
+}
+
+/**
+ * A method in the `UnifiedJEXL.Expression` class that evaluates a template.
+ */
+private class UnifiedJexlExpressionEvaluateMethod extends DirectJexlEvaluationMethod {
+  UnifiedJexlExpressionEvaluateMethod() {
+    getDeclaringType() instanceof UnifiedJexlExpression and hasName("evaluate")
+  }
+}
+
+/**
+ * A method in the `UnifiedJEXL.Expression` class that evaluates the immediate sub-expressions.
+ */
+private class UnifiedJexlExpressionPrepareMethod extends DirectJexlEvaluationMethod {
+  UnifiedJexlExpressionPrepareMethod() {
+    getDeclaringType() instanceof UnifiedJexlExpression and hasName("prepare")
+  }
+}
+
+/**
+ * A method in the `UnifiedJEXL.Template` class that evaluates a template.
+ */
+private class UnifiedJexlTemplateEvaluateMethod extends DirectJexlEvaluationMethod {
+  UnifiedJexlTemplateEvaluateMethod() {
+    getDeclaringType() instanceof UnifiedJexlTemplate and hasName("evaluate")
+  }
+}
-/**
- * Defines methods that triggers direct evaluation of Jexl expressions.
- */
-abstract private class DirectJexlEvaluationMethod extends Method { }
-
-/**
- * A method in the `JexlExpression` class that evaluates a Jexl expression.
- */
-private class JexlExpressionEvaluateMethod extends DirectJexlEvaluationMethod {
-  JexlExpressionEvaluateMethod() {
-    getDeclaringType() instanceof JexlExpression and hasName("evaluate")
-  }
-}
-
-/**
- * A method in the `JexlScript` class that executes a Jexl script.
- */
-private class JexlScriptExecuteMethod extends DirectJexlEvaluationMethod {
-  JexlScriptExecuteMethod() { getDeclaringType() instanceof JexlScript and hasName("execute") }
-}
-
-/**
- * A method in the `JxltEngine.Expression` class that evaluates an expression.
- */
-private class JxltEngineExpressionEvaluateMethod extends DirectJexlEvaluationMethod {
-  JxltEngineExpressionEvaluateMethod() {
-    getDeclaringType() instanceof JxltEngineExpression and hasName("evaluate")
-  }
-}
-
-/**
- * A method in the `JxltEngine.Expression` class that evaluates the immediate sub-expressions.
- */
-private class JxltEngineExpressionPrepareMethod extends DirectJexlEvaluationMethod {
-  JxltEngineExpressionPrepareMethod() {
-    getDeclaringType() instanceof JxltEngineExpression and hasName("prepare")
-  }
-}
-
-/**
- * A method in the `JxltEngine.Template` class that evaluates a template.
- */
-private class JxltEngineTemplateEvaluateMethod extends DirectJexlEvaluationMethod {
-  JxltEngineTemplateEvaluateMethod() {
-    getDeclaringType() instanceof JxltEngineTemplate and hasName("evaluate")
-  }
-}
-
-/**
- * A method in the `UnifiedJEXL.Expression` class that evaluates a template.
- */
-private class UnifiedJexlExpressionEvaluateMethod extends DirectJexlEvaluationMethod {
-  UnifiedJexlExpressionEvaluateMethod() {
-    getDeclaringType() instanceof UnifiedJexlExpression and hasName("evaluate")
-  }
-}
-
-/**
- * A method in the `UnifiedJEXL.Expression` class that evaluates the immediate sub-expressions.
- */
-private class UnifiedJexlExpressionPrepareMethod extends DirectJexlEvaluationMethod {
-  UnifiedJexlExpressionPrepareMethod() {
-    getDeclaringType() instanceof UnifiedJexlExpression and hasName("prepare")
-  }
-}
-
-/**
- * A method in the `UnifiedJEXL.Template` class that evaluates a template.
- */
-private class UnifiedJexlTemplateEvaluateMethod extends DirectJexlEvaluationMethod {
-  UnifiedJexlTemplateEvaluateMethod() {
-    getDeclaringType() instanceof UnifiedJexlTemplate and hasName("evaluate")
-  }
-}
+/**
+ * Defines methods that triggers direct evaluation of Jexl expressions.
+ */
+private class DirectJexlEvaluationMethod extends Method {
+  DirectJexlEvaluationMethod() {
+    getDeclaringType() instanceof JexlExpression and hasName("evaluate") or
+    getDeclaringType() instanceof JexlScript and hasName("execute") or
+    getDeclaringType() instanceof JxltEngineExpression and hasName(["evaluate", "prepare"]) or
+    getDeclaringType() instanceof JxltEngineTemplate and hasName("evaluate") or
+    getDeclaringType() instanceof UnifiedJexlExpression and hasName(["evaluate", "prepare"]) or
+    getDeclaringType() instanceof UnifiedJexlTemplate and hasName("evaluate")
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+      ma.getAnArgument().getType() instanceof TypeString and
+      ma.getAnArgument() = taintFrom
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+    |
+      m instanceof DirectJexlEvaluationMethod and ma.getQualifier() = taintFrom
+      or
+      m instanceof CallableCallMethod and ma.getQualifier() = taintFrom
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+  override predicate isSource(DataFlow::Node node) { node instanceof SandboxedJexlSource }
+
+  override predicate isSink(DataFlow::Node node) {
+    node.asExpr().getType() instanceof JexlEngine or
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+
+/**
+ * Holds if `fromNode` to `toNode` is a dataflow step that returns data from
+ * a tainted bean by calling one of its getters.
- * a tainted bean by calling one of its getters.
+ * a bean by calling one of its getters.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+}
+
+/**
+ * Method in the `JexlEngine` class that get or set a property with a Jexl expression.
- * Method in the `JexlEngine` class that get or set a property with a Jexl expression.
+ * A method in the `JexlEngine` class that get or set a property with a Jexl expression.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+}
+
+/**
+ * Defines methods that create a Jexl script.
- * Defines methods that create a Jexl script.
+ * A methods that create a Jexl script.
	taintPropagatingJexlMethodCall.taintFlow(fromNode, toNode) or
	any(TaintPropagatingJexlMethodCall c).taintFlow(fromNode, toNode) or
	exists(MethodAccess ma, Method m, Expr tainted \| ma.getMethod() = m and tainted = asExpr() \|
	exists(MethodAccess ma, Method m, Expr taintFrom \| ma.getMethod() = m and tainted = this.asExpr() \|
		ma.getAnArgument().getType() instanceof TypeString and
		ma.getAnArgument() = taintFrom
	* a tainted bean by calling one of its getters.
	* a bean by calling one of its getters.
	* Method in the `JexlEngine` class that get or set a property with a Jexl expression.
	* A method in the `JexlEngine` class that get or set a property with a Jexl expression.
	* Defines methods that create a Jexl script.
	* A methods that create a Jexl script.