Skip to content

Add missing security tags #10180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Sep 2, 2022
Merged

Add missing security tags #10180

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4353937
PY: add missing security tags on Python queries
erik-krogh Aug 29, 2022
f678c8a
PY: add python change-note
erik-krogh Aug 29, 2022
8b37168
Java: remove security tag from queries not in the security folder and…
erik-krogh Aug 29, 2022
f09fc7b
Java: add java change-note
erik-krogh Aug 29, 2022
33ba019
Go: add CWE tag and @security-severity tag to go/insecure-hostkeycall…
erik-krogh Aug 29, 2022
d0814aa
Go: add change-note for go
erik-krogh Aug 29, 2022
bd5fd7d
fix typo in change-note
erik-krogh Aug 29, 2022
b1e5328
fix that the wrong line got deleted
erik-krogh Aug 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,11 @@
* @description Detects insecure SSL client configurations with an implementation of the `HostKeyCallback` that accepts all host keys.
* @kind path-problem
* @problem.severity warning
* @security-severity 8.2
* @precision high
* @id go/insecure-hostkeycallback
* @tags security
* external/cwe/cwe-322
*/

import go
Expand Down
4 changes: 4 additions & 0 deletions go/ql/src/change-notes/2022-08-29-add-security-severity.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Added the `security-severity` tag and CWE tag to the `go/insecure-hostkeycallback` query.
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbContainerInterference.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
* Such operations could interfere with the EJB container's operation.
* @kind problem
* @problem.severity error
* @security-severity 5.8
* @precision low
* @id java/ejb/container-interference
* @tags reliability
Expand Down
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbFileIO.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
* for enterprise components.
* @kind problem
* @problem.severity error
* @security-severity 5.8
* @precision low
* @id java/ejb/file-io
* @tags reliability
Expand Down
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbNative.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
* Such use could compromise security and system stability.
* @kind problem
* @problem.severity error
* @security-severity 5.8
* @precision low
* @id java/ejb/native-code
* @tags reliability
Expand Down
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbReflection.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
* as this could compromise security.
* @kind problem
* @problem.severity error
* @security-severity 5.8
* @precision low
* @id java/ejb/reflection
* @tags external/cwe/cwe-573
Expand Down
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbSecurityConfiguration.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
* This functionality is reserved for the EJB container for security reasons.
* @kind problem
* @problem.severity error
* @security-severity 5.8
* @precision low
* @id java/ejb/security-configuration-access
* @tags external/cwe/cwe-573
Expand Down
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbSerialization.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
* the Java serialization protocol, since their use could compromise security.
* @kind problem
* @problem.severity error
* @security-severity 5.8
* @precision low
* @id java/ejb/substitution-in-serialization
* @tags external/cwe/cwe-573
Expand Down
1 change: 0 additions & 1 deletion java/ql/src/Frameworks/JavaEE/EJB/EjbSetSocketOrUrlFactory.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
* or the stream handler factory used by URL. Such operations could
* compromise security or interfere with the EJB container's operation.
* @kind problem
* @problem.severity error
* @security-severity 5.8
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the intention here was to remove the line below instead.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it was 👍

* @precision low
* @id java/ejb/socket-or-stream-handler-factory
Expand Down
4 changes: 4 additions & 0 deletions java/ql/src/change-notes/2022-08-29-remove-security-tag.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Removed the `security` tag from several queries not in the `Security/` folder that also had missing `@security-severity` tags.
1 change: 1 addition & 0 deletions python/ql/src/Security/CWE-730/PolynomialReDoS.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
* to match may be vulnerable to denial-of-service attacks.
* @kind path-problem
* @problem.severity warning
* @security-severity 7.5
* @precision high
* @id py/polynomial-redos
* @tags security
Expand Down
1 change: 1 addition & 0 deletions python/ql/src/Security/CWE-730/ReDoS.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
* attacks.
* @kind problem
* @problem.severity error
* @security-severity 7.5
* @precision high
* @id py/redos
* @tags security
Expand Down
1 change: 1 addition & 0 deletions python/ql/src/Security/CWE-730/RegexInjection.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
* exponential time on certain inputs.
* @kind path-problem
* @problem.severity error
* @security-severity 7.5
* @precision high
* @id py/regex-injection
* @tags security
Expand Down
4 changes: 4 additions & 0 deletions python/ql/src/change-notes/2022-08-29-missing-security-severity.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Added the `security-severity` tag the `py/redos`, `py/polynomial-redos`, and `py/regex-injection` queries.