Skip to content

Commit 27884a6

Browse files
erik-krogherik-krogh
committed
update more queries
1 parent 8ff9cff commit 27884a6

30 files changed

+66
-66
lines changed

‎java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,5 @@ import DataFlow::PathGraph
1616
from DataFlow::PathNode source, DataFlow::PathNode sink
1717
where any(PartialPathTraversalFromRemoteConfig config).hasFlowPath(source, sink)
1818
select sink.getNode(), source, sink,
19-
"Partial Path Traversal Vulnerability due to insufficient guard against path traversal from user-supplied data."
19+
"Partial Path Traversal Vulnerability due to insufficient guard against path traversal from $@.",
20+
source, "user-supplied data"

‎java/ql/src/Security/CWE/CWE-089/SqlTaintedLocal.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,5 +36,5 @@ class LocalUserInputToQueryInjectionFlowConfig extends TaintTracking::Configurat
3636
from
3737
DataFlow::PathNode source, DataFlow::PathNode sink, LocalUserInputToQueryInjectionFlowConfig conf
3838
where conf.hasFlowPath(source, sink)
39-
select sink.getNode(), source, sink, "Query might include code from $@.", source.getNode(),
40-
"this user input"
39+
select sink.getNode(), source, sink, "This query depends on a $@.", source.getNode(),
40+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-094/GroovyInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from DataFlow::PathNode source, DataFlow::PathNode sink, GroovyInjectionConfig conf
1919
where conf.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Groovy Injection from $@.", source.getNode(),
21-
"this user input"
20+
select sink.getNode(), source, sink, "Groovy script depends on a $@.", source.getNode(),
21+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,5 +80,5 @@ where
8080
exists(SetMessageInterpolatorCall c | not c.isSafe())
8181
) and
8282
cfg.hasFlowPath(source, sink)
83-
select sink.getNode(), source, sink,
84-
"Custom constraint error message contains unsanitized user data."
83+
select sink.getNode(), source, sink, "Custom constraint error message contains an unsanitized $@.",
84+
source, "user-provided value"

‎java/ql/src/Security/CWE/CWE-094/JexlInjection.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,5 @@ import DataFlow::PathGraph
1717

1818
from DataFlow::PathNode source, DataFlow::PathNode sink, JexlInjectionConfig conf
1919
where conf.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "JEXL injection from $@.", source.getNode(), "this user input"
20+
select sink.getNode(), source, sink, "JEXL expression depends on a $@.", source.getNode(),
21+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-094/MvelInjection.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,5 @@ import DataFlow::PathGraph
1717

1818
from DataFlow::PathNode source, DataFlow::PathNode sink, MvelInjectionFlowConfig conf
1919
where conf.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "MVEL injection from $@.", source.getNode(), "this user input"
20+
select sink.getNode(), source, sink, "MVEL expression depends on a $@.", source.getNode(),
21+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-094/SpelInjection.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,5 @@ import DataFlow::PathGraph
1818

1919
from DataFlow::PathNode source, DataFlow::PathNode sink, SpelInjectionConfig conf
2020
where conf.hasFlowPath(source, sink)
21-
select sink.getNode(), source, sink, "SpEL injection from $@.", source.getNode(), "this user input"
21+
select sink.getNode(), source, sink, "SpEL expression depends on a $@.", source.getNode(),
22+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from TemplateInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where config.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Potential arbitrary code execution due to $@.",
21-
source.getNode(), "a template value loaded from a remote source."
20+
select sink.getNode(), source, sink, "Template, which may contain code, depends on a $@.",
21+
source.getNode(), "user-provided value"

‎java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,6 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
4747

4848
from DataFlow::PathNode source, DataFlow::PathNode sink, ResponseSplittingConfig conf
4949
where conf.hasFlowPath(source, sink)
50-
select sink.getNode(), source, sink, "Response-splitting vulnerability due to this $@.",
50+
select sink.getNode(), source, sink,
51+
"This header depends on a $@, which may cause a response-splitting vulnerability.",
5152
source.getNode(), "user-provided value"

‎java/ql/src/Security/CWE/CWE-113/ResponseSplittingLocal.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,6 @@ class ResponseSplittingLocalConfig extends TaintTracking::Configuration {
3131

3232
from DataFlow::PathNode source, DataFlow::PathNode sink, ResponseSplittingLocalConfig conf
3333
where conf.hasFlowPath(source, sink)
34-
select sink.getNode(), source, sink, "Response-splitting vulnerability due to this $@.",
34+
select sink.getNode(), source, sink,
35+
"This header depends on a $@, which may cause a response-splitting vulnerability.",
3536
source.getNode(), "user-provided value"

‎java/ql/src/Security/CWE/CWE-266/IntentUriPermissionManipulation.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,6 @@ import DataFlow::PathGraph
2020
from DataFlow::PathNode source, DataFlow::PathNode sink
2121
where any(IntentUriPermissionManipulationConf c).hasFlowPath(source, sink)
2222
select sink.getNode(), source, sink,
23-
"This Intent can be set with arbitrary flags from $@, " +
24-
"and used to give access to internal content providers.", source.getNode(), "this user input"
23+
"This Intent can be set with arbitrary flags from a $@, " +
24+
"and used to give access to internal content providers.", source.getNode(),
25+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,5 +121,5 @@ where
121121
not isNodeGuardedByFlag(sink.getNode()) and
122122
verifier = source.getNode().asExpr().(ClassInstanceExpr).getConstructedType()
123123
select sink, source, sink,
124-
"This uses a $@ that is defined $@ and accepts any certificate as valid.", source,
125-
"hostname verifier", verifier, "here"
124+
"The $@ defined by $@ always accepts any certificate, even if the hostname does not match.",
125+
source, "hostname verifier", verifier, "this type"

‎java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,4 @@ import DataFlow::PathGraph
1717
from DataFlow::PathNode source, DataFlow::PathNode sink
1818
where any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
1919
select sink.getNode(), source, sink, "URL may have been constructed with HTTP protocol, using $@.",
20-
source.getNode(), "this source"
20+
source.getNode(), "this HTTP URL"

‎java/ql/src/Security/CWE/CWE-470/FragmentInjection.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,6 @@ import DataFlow::PathGraph
1717

1818
from DataFlow::PathNode source, DataFlow::PathNode sink
1919
where any(FragmentInjectionTaintConf conf).hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Fragment injection from $@.", source.getNode(),
21-
"this user input"
20+
select sink.getNode(), source, sink,
21+
"Fragment depends on a $@, which may allow a malicious application to bypass access controls.",
22+
source.getNode(), "user-provided value"

‎java/ql/src/Security/CWE/CWE-522/InsecureBasicAuth.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
2020

2121
from DataFlow::PathNode source, DataFlow::PathNode sink, BasicAuthFlowConfig config
2222
where config.hasFlowPath(source, sink)
23-
select sink.getNode(), source, sink, "Insecure basic authentication from $@.", source.getNode(),
23+
select sink.getNode(), source, sink, "Insecure basic authentication from a $@.", source.getNode(),
2424
"HTTP URL"

‎java/ql/src/Security/CWE/CWE-601/UrlRedirectLocal.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,5 +26,5 @@ class UrlRedirectLocalConfig extends TaintTracking::Configuration {
2626

2727
from DataFlow::PathNode source, DataFlow::PathNode sink, UrlRedirectLocalConfig conf
2828
where conf.hasFlowPath(source, sink)
29-
select sink.getNode(), source, sink, "Potentially untrusted URL redirection due to $@.",
30-
source.getNode(), "user-provided value"
29+
select sink.getNode(), source, sink, "Untrusted URL redirection depends on a $@.", source.getNode(),
30+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-681/NumericCastTainted.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,4 +45,4 @@ where
4545
conf.hasFlowPath(source, sink)
4646
select exp, source, sink,
4747
"This cast to a narrower type depends on a $@, potentially causing truncation.", source.getNode(),
48-
"User-provided value"
48+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-681/NumericCastTaintedLocal.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,4 +47,4 @@ where
4747
not exists(RightShiftOp e | e.getShiftedVariable() = tainted.getVariable())
4848
select exp, source, sink,
4949
"This cast to a narrower type depends on a $@, potentially causing truncation.", source.getNode(),
50-
"User-provided value"
50+
"user-provided value"

‎java/ql/src/Security/CWE/CWE-807/ConditionalBypass.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,5 @@ where
2525
sink.getNode().asExpr() = e and
2626
conf.hasFlowPath(source, sink)
2727
select m, source, sink,
28-
"Sensitive method may not be executed depending on $@, which flows from $@.", e, "this condition",
29-
source.getNode(), "user input"
28+
"Sensitive method may not be executed depending on a $@, which flows from $@.", e,
29+
"this condition", source.getNode(), "user-controlled value"

‎java/ql/src/Security/CWE/CWE-807/TaintedPermissionsCheck.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,4 +66,5 @@ from
6666
DataFlow::PathNode source, DataFlow::PathNode sink, PermissionsConstruction p,
6767
TaintedPermissionsCheckFlowConfig conf
6868
where sink.getNode().asExpr() = p.getInput() and conf.hasFlowPath(source, sink)
69-
select p, source, sink, "Permissions check uses user-controlled $@.", source.getNode(), "data"
69+
select p, source, sink, "Permissions check depends on a $@.", source.getNode(),
70+
"user-controlled value"

‎java/ql/src/Security/CWE/CWE-917/OgnlInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from DataFlow::PathNode source, DataFlow::PathNode sink, OgnlInjectionFlowConfig conf
1919
where conf.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "OGNL expression might include data from $@.",
21-
source.getNode(), "this user input"
20+
select sink.getNode(), source, sink, "OGNL Expression Language statement depends on a $@.",
21+
source.getNode(), "user-provided value"

‎java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,4 @@ from DataFlow::PathNode source, DataFlow::PathNode sink, IntentRedirectionConfig
2121
where conf.hasFlowPath(source, sink)
2222
select sink.getNode(), source, sink,
2323
"Arbitrary Android activities or services can be started from $@.", source.getNode(),
24-
"this user input"
24+
"user-provided value"

‎java/ql/test/query-tests/security/CWE-089/semmle/examples/SqlTaintedLocal.expected

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,12 @@ nodes
3838
| Test.java:218:14:218:17 | args : String[] | semmle.label | args : String[] |
3939
subpaths
4040
#select
41-
| Mongo.java:17:45:17:67 | parse(...) | Mongo.java:10:29:10:41 | args : String[] | Mongo.java:17:45:17:67 | parse(...) | Query might include code from $@. | Mongo.java:10:29:10:41 | args | this user input |
42-
| Mongo.java:21:49:21:52 | json | Mongo.java:10:29:10:41 | args : String[] | Mongo.java:21:49:21:52 | json | Query might include code from $@. | Mongo.java:10:29:10:41 | args | this user input |
43-
| Test.java:36:47:36:52 | query1 | Test.java:213:26:213:38 | args : String[] | Test.java:36:47:36:52 | query1 | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
44-
| Test.java:42:57:42:62 | query2 | Test.java:213:26:213:38 | args : String[] | Test.java:42:57:42:62 | query2 | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
45-
| Test.java:50:62:50:67 | query3 | Test.java:213:26:213:38 | args : String[] | Test.java:50:62:50:67 | query3 | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
46-
| Test.java:62:47:62:61 | querySbToString | Test.java:213:26:213:38 | args : String[] | Test.java:62:47:62:61 | querySbToString | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
47-
| Test.java:70:40:70:44 | query | Test.java:213:26:213:38 | args : String[] | Test.java:70:40:70:44 | query | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
48-
| Test.java:78:46:78:50 | query | Test.java:213:26:213:38 | args : String[] | Test.java:78:46:78:50 | query | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
49-
| Test.java:209:47:209:68 | queryWithUserTableName | Test.java:213:26:213:38 | args : String[] | Test.java:209:47:209:68 | queryWithUserTableName | Query might include code from $@. | Test.java:213:26:213:38 | args | this user input |
41+
| Mongo.java:17:45:17:67 | parse(...) | Mongo.java:10:29:10:41 | args : String[] | Mongo.java:17:45:17:67 | parse(...) | This query depends on a $@. | Mongo.java:10:29:10:41 | args | user-provided value |
42+
| Mongo.java:21:49:21:52 | json | Mongo.java:10:29:10:41 | args : String[] | Mongo.java:21:49:21:52 | json | This query depends on a $@. | Mongo.java:10:29:10:41 | args | user-provided value |
43+
| Test.java:36:47:36:52 | query1 | Test.java:213:26:213:38 | args : String[] | Test.java:36:47:36:52 | query1 | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |
44+
| Test.java:42:57:42:62 | query2 | Test.java:213:26:213:38 | args : String[] | Test.java:42:57:42:62 | query2 | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |
45+
| Test.java:50:62:50:67 | query3 | Test.java:213:26:213:38 | args : String[] | Test.java:50:62:50:67 | query3 | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |
46+
| Test.java:62:47:62:61 | querySbToString | Test.java:213:26:213:38 | args : String[] | Test.java:62:47:62:61 | querySbToString | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |
47+
| Test.java:70:40:70:44 | query | Test.java:213:26:213:38 | args : String[] | Test.java:70:40:70:44 | query | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |
48+
| Test.java:78:46:78:50 | query | Test.java:213:26:213:38 | args : String[] | Test.java:78:46:78:50 | query | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |
49+
| Test.java:209:47:209:68 | queryWithUserTableName | Test.java:213:26:213:38 | args : String[] | Test.java:209:47:209:68 | queryWithUserTableName | This query depends on a $@. | Test.java:213:26:213:38 | args | user-provided value |

‎java/ql/test/query-tests/security/CWE-094/InsecureBeanValidation.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ nodes
55
| InsecureBeanValidation.java:11:64:11:68 | value | semmle.label | value |
66
subpaths
77
#select
8-
| InsecureBeanValidation.java:11:64:11:68 | value | InsecureBeanValidation.java:7:28:7:40 | object : String | InsecureBeanValidation.java:11:64:11:68 | value | Custom constraint error message contains unsanitized user data. |
8+
| InsecureBeanValidation.java:11:64:11:68 | value | InsecureBeanValidation.java:7:28:7:40 | object : String | InsecureBeanValidation.java:11:64:11:68 | value | Custom constraint error message contains an unsanitized $@. | InsecureBeanValidation.java:7:28:7:40 | object : String | user-provided value |

‎java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ nodes
1414
| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | semmle.label | replaceFirst(...) |
1515
subpaths
1616
#select
17-
| ResponseSplitting.java:23:23:23:28 | cookie | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:22:39:22:66 | getParameter(...) | user-provided value |
18-
| ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:28:38:28:72 | getParameter(...) | user-provided value |
19-
| ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:29:38:29:72 | getParameter(...) | user-provided value |
20-
| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:53:14:53:48 | getParameter(...) | user-provided value |
17+
| ResponseSplitting.java:23:23:23:28 | cookie | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:22:39:22:66 | getParameter(...) | user-provided value |
18+
| ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:28:38:28:72 | getParameter(...) | user-provided value |
19+
| ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:29:38:29:72 | getParameter(...) | user-provided value |
20+
| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:53:14:53:48 | getParameter(...) | user-provided value |

0 commit comments

Comments
 (0)