8000 Java: Promote Unsafe certificate trust query from experimental by atorralba · Pull Request #6171 · github/codeql · GitHub
[go: up one dir, main page]
Skip to content

Java: Promote Unsafe certificate trust query from experimental #6171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 26 commits into from
Jan 20, 2022
Merged

Java: Promote Unsafe certificate trust query from experimental #6171

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
e0f4c73
Move from experimental
atorralba Jun 21, 2021
4313baf
Big refactor:
atorralba Jun 21, 2021
02d0fa9
Minor changes in QLDocs and a sanitizer's type
atorralba Jun 22, 2021
e43fff2
Use InlineExpectationsTest
atorralba Jun 22, 2021
5d4cd70
Adjusted sources and sanitizer of UnsafeCertTrust taint tracking config
atorralba Jun 22, 2021
e842acf
Improve qhelp
atorralba Jun 23, 2021
4508945
Fix assumption regarding when an SSLSocket does the TLS handhsake
atorralba Jun 23, 2021
64518bf
Handle a specific pass-by-reference flow issue
atorralba Jun 23, 2021
19d1a78
Generalize sanitizer using local flow
atorralba Jun 23, 2021
9e93aec
Add spurious test case
atorralba Jun 28, 2021
5997b87
Add change note
atorralba Jun 28, 2021
c24520c
Adjust qhelp after rebase
atorralba Jun 28, 2021
68fe3dd
Fix conflicts in experimental query
atorralba Jun 28, 2021
698fd64
Adjust test after rebase
atorralba Jun 28, 2021
e9712f0
Add missing QLDoc
atorralba Jun 29, 2021
999acb0
Improve qhelp references
atorralba Jul 1, 2021
4d20710
Fix QLDoc
atorralba Jul 1, 2021
d9e98ce
Consider setSslContextFactory and fix tests
atorralba Jul 1, 2021
1e2a956
Remove unused stub
atorralba Jul 1, 2021
000a544
Decouple UnsafeCertTrust.qll to reuse the taint tracking configuration
atorralba Jul 21, 2021
c16181d
QLDocs
atorralba Jul 21, 2021
9ffc5ab
Update java/ql/src/semmle/code/java/security/UnsafeCertTrustQuery.qll
atorralba Jul 26, 2021
0302058
Apply suggestions from code review
atorralba Jul 29, 2021
101ad77
Move things around after rebase
atorralba Nov 12, 2021
e442e50
Apply suggestions from code review
atorralba Jan 19, 2022
695e77a
Simplify isSslSocket predicate
atorralba Jan 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix assumption regarding when an SSLSocket does the TLS handhsake
  • Loading branch information
@atorralba
atorralba committed Jan 19, 2022
commit 4508945f85371bde2e31aee70d5fe741112cf1ae
10 changes: 9 additions & 1 deletion java/ql/lib/semmle/code/java/frameworks/Networking.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,14 @@ class SocketGetInputStreamMethod extends Method {
}
}

class SocketGetOutputStreamMethod extends Method {
SocketGetOutputStreamMethod() {
this.getDeclaringType() instanceof TypeSocket and
this.hasName("getOutputStream") and
this.hasNoParameters()
}
}

/** A method or constructor call that returns a new `URI`. */
class UriCreation extends Call {
UriCreation() {
Expand Down Expand Up @@ -152,7 +160,7 @@ class UrlOpenConnectionMethod extends Method {
class CreateSocketMethod extends Method {
CreateSocketMethod() {
this.hasName("createSocket") and
this.getDeclaringType() instanceof TypeSocketFactory
this.getDeclaringType().getASupertype*() instanceof TypeSocketFactory
}
}

Expand Down
22 changes: 9 additions & 13 deletions java/ql/lib/semmle/code/java/security/UnsafeCertTrust.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,14 @@ private import semmle.code.java.dataflow.DataFlow2
*/
class SslConnectionInit extends DataFlow::Node {
SslConnectionInit() {
this.asExpr().(MethodAccess).getMethod() instanceof CreateSslEngineMethod or
this.asExpr().(MethodAccess).getMethod() instanceof CreateSocketMethod
exists(MethodAccess ma, Method m |
this.asExpr() = ma and
ma.getMethod() = m
|
m instanceof CreateSslEngineMethod
or
m instanceof CreateSocketMethod and isSslSocket(ma)
)
}
}

Expand All @@ -29,21 +35,11 @@ class SslConnectionCreation extends DataFlow::Node {
m instanceof BeginHandshakeMethod or
m instanceof SslWrapMethod or
m instanceof SslUnwrapMethod or
m instanceof SocketConnectMethod
m instanceof SocketGetOutputStreamMethod
|
ma.getMethod() = m and
this.asExpr() = ma.getQualifier()
)
or
// calls to SocketFactory.createSocket with parameters immediately create the connection
exists(MethodAccess ma, Method m |
ma.getMethod() = m and
m instanceof CreateSocketMethod and
m.getNumberOfParameters() > 0 and
isSslSocket(ma)
|
this.asExpr() = ma
)
}
}

Expand Down
57 changes: 8 additions & 49 deletions java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
import java.net.InetSocketAddress;
import java.net.Socket;
import java.nio.ByteBuffer;
import javax.net.SocketFactory;
Expand All @@ -25,9 +24,6 @@ public void testSSLEngineEndpointIdSetNull() throws Exception {
sslEngine.unwrap(null, null, 0, 0); // $hasUnsafeCertTrust
}

/**
* Test the endpoint identification of SSL engine is set to null
*/
public void testSSLEngineEndpointIdSetEmpty() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLEngine sslEngine = sslContext.createSSLEngine();
Expand All @@ -39,9 +35,6 @@ public void testSSLEngineEndpointIdSetEmpty() throws Exception {
sslEngine.unwrap(null, null, 0, 0); // $hasUnsafeCertTrust
}

/**
* Test the endpoint identification of SSL engine is set to HTTPS
*/
public void testSSLEngineEndpointIdSafe() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLEngine sslEngine = sslContext.createSSLEngine();
Expand All @@ -53,9 +46,6 @@ public void testSSLEngineEndpointIdSafe() throws Exception {
sslEngine.unwrap(null, null, 0, 0); // Safe
}

/**
* Test the endpoint identification of SSL engine is set to HTTPS
*/
public void testSSLEngineInServerMode() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLEngine sslEngine = sslContext.createSSLEngine();
Expand All @@ -65,95 +55,64 @@ public void testSSLEngineInServerMode() throws Exception {
sslEngine.unwrap(null, null, 0, 0); // Safe
}

/**
* Test the endpoint identification of SSL socket is not set
*/
public void testSSLSocketImmediatelyConnects() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SocketFactory socketFactory = sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket) socketFactory.createSocket("www.example.com", 443); // $hasUnsafeCertTrust
}

/**
* Test the endpoint identification of SSL socket is not set
*/
public void testSSLSocketEndpointIdNotSet() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
socket.connect(new InetSocketAddress("www.example.com", 443)); // $hasUnsafeCertTrust
socket.getOutputStream(); // $hasUnsafeCertTrust
}

/**
* Test the endpoint identification of SSL socket is set to null
*/
public void testSSLSocketEndpointIdSetNull() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
SSLParameters sslParameters = socket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm(null);
socket.setSSLParameters(sslParameters);
socket.connect(new InetSocketAddress("www.example.com", 443)); // $hasUnsafeCertTrust
socket.getOutputStream(); // $hasUnsafeCertTrust
}

/**
* Test the endpoint identification of SSL socket is set to empty
*/
public void testSSLSocketEndpointIdSetEmpty() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
SSLParameters sslParameters = socket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("");
socket.setSSLParameters(sslParameters);
socket.connect(new InetSocketAddress("www.example.com", 443)); // $hasUnsafeCertTrust
socket.getOutputStream(); // $hasUnsafeCertTrust
}

/**
* Test the endpoint identification of SSL socket is not set
*/
public void testSSLSocketEndpointIdAfterConnecting() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket) socketFactory.createSocket("www.example.com", 443); // $hasUnsafe 685C CertTrust
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
socket.getOutputStream(); // $hasUnsafeCertTrust
SSLParameters sslParameters = socket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
socket.setSSLParameters(sslParameters);
}

/**
* Test the endpoint identification of SSL socket is not set
*/
public void testSSLSocketEndpointIdSafe() throws Exception {
SSLContext sslContext = SSLContext.getInstance("TLS");
SSLSocketFactory socketFactory = sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket) socketFactory.createSocket();
SSLParameters sslParameters = socket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
socket.setSSLParameters(sslParameters);
socket.connect(new InetSocketAddress("www.example.com", 443)); // Safe
socket.getOutputStream(); // Safe
}

/**
* Test the endpoint identification of regular socket is not set
*/
public void testSocketEndpointIdNotSet() throws Exception {
SocketFactory socketFactory = SocketFactory.getDefault();
Socket socket = socketFactory.createSocket("www.example.com", 80); // Safe
Socket socket = socketFactory.createSocket("www.example.com", 80);
socket.getOutputStream(); // Safe
}

/**
* Test the enableHostnameVerification of RabbitMQConnectionFactory is not set
*/
public void testRabbitMQFactoryEnableHostnameVerificationNotSet() throws Exception {
ConnectionFactory connectionFactory = new ConnectionFactory();
connectionFactory.useSslProtocol(); // $hasUnsafeCertTrust
}

/**
* Test the enableHostnameVerification of RabbitMQConnectionFactory is not set
*/
public void testRabbitMQFactorySafe() throws Exception {
ConnectionFactory connectionFactory = new ConnectionFactory();
connectionFactory.useSslProtocol(); // Safe
Expand Down
0