Skip to content

Commit 6a6c805

Browse files
artem-smotrakovartem-smotrakov
committed
Java: Added Accessor sink for MVEL injections
1 parent 12e0234 commit 6a6c805

File tree

6 files changed

+37
-10
lines changed

6 files changed

+37
-10
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-094/MvelInjectionLib.qll‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ class MvelEvaluationSink extends DataFlow::ExprNode {
3737
(
3838
m instanceof ExecutableStatementEvaluationMethod or
3939
m instanceof CompiledExpressionEvaluationMethod or
40-
m instanceof CompiledAccExpressionEvaluationMethod
40+
m instanceof CompiledAccExpressionEvaluationMethod or
41+
m instanceof AccessorEvaluationMethod
4142
) and
4243
(ma = asExpr() or ma.getQualifier() = asExpr())
4344
)
@@ -159,6 +160,16 @@ class CompiledAccExpressionEvaluationMethod extends Method {
159160
}
160161
}
161162

163+
/**
164+
* Methods in `Accessor` that trigger evaluating a MVEL expression.
165+
*/
166+
class AccessorEvaluationMethod extends Method {
167+
AccessorEvaluationMethod() {
168+
getDeclaringType() instanceof Accessor and
169+
hasName("getValue")
170+
}
171+
}
172+
162173
class MVEL extends RefType {
163174
MVEL() { hasQualifiedName("org.mvel2", "MVEL") }
164175
}
@@ -178,3 +189,7 @@ class CompiledExpression extends RefType {
178189
class CompiledAccExpression extends RefType {
179190
CompiledAccExpression() { hasQualifiedName("org.mvel2.compiler", "CompiledAccExpression") }
180191
}
192+
193+
class Accessor extends RefType {
194+
Accessor() { hasQualifiedName("org.mvel2.compiler", "Accessor") }
195+
}

‎java/ql/test/experimental/Security/CWE/CWE-094/MvelInjection.expected‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,25 @@ edges
22
| MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | MvelInjection.java:20:17:20:21 | input |
33
| MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | MvelInjection.java:30:30:30:39 | expression |
44
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:41:7:41:15 | statement |
5-
| MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | MvelInjection.java:52:7:52:16 | expression |
6-
| MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | MvelInjection.java:62:7:62:16 | expression |
5+
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:42:7:42:15 | statement |
6+
| MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | MvelInjection.java:53:7:53:16 | expression |
7+
| MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | MvelInjection.java:63:7:63:16 | expression |
78
nodes
89
| MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
910
| MvelInjection.java:20:17:20:21 | input | semmle.label | input |
1011
| MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
1112
| MvelInjection.java:30:30:30:39 | expression | semmle.label | expression |
1213
| MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
1314
| MvelInjection.java:41:7:41:15 | statement | semmle.label | statement |
14-
| MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
15-
| MvelInjection.java:52:7:52:16 | expression | semmle.label | expression |
16-
| MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
17-
| MvelInjection.java:62:7:62:16 | expression | semmle.label | expression |
15+
| MvelInjection.java:42:7:42:15 | statement | semmle.label | statement |
16+
| MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
17+
| MvelInjection.java:53:7:53:16 | expression | semmle.label | expression |
18+
| MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
19+
| MvelInjection.java:63:7:63:16 | expression | semmle.label | expression |
1820
#select
1921
| MvelInjection.java:20:17:20:21 | input | MvelInjection.java:16:27:16:49 | getInputStream(...) : InputStream | MvelInjection.java:20:17:20:21 | input | MVEL injection from $@. | MvelInjection.java:16:27:16:49 | getInputStream(...) | this user input |
2022
| MvelInjection.java:30:30:30:39 | expression | MvelInjection.java:25:27:25:49 | getInputStream(...) : InputStream | MvelInjection.java:30:30:30:39 | expression | MVEL injection from $@. | MvelInjection.java:25:27:25:49 | getInputStream(...) | this user input |
2123
| MvelInjection.java:41:7:41:15 | statement | MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:41:7:41:15 | statement | MVEL injection from $@. | MvelInjection.java:35:27:35:49 | getInputStream(...) | this user input |
22-
| MvelInjection.java:52:7:52:16 | expression | MvelInjection.java:46:27:46:49 | getInputStream(...) : InputStream | MvelInjection.java:52:7:52:16 | expression | MVEL injection from $@. | MvelInjection.java:46:27:46:49 | getInputStream(...) | this user input |
23-
| MvelInjection.java:62:7:62:16 | expression | MvelInjection.java:57:27:57:49 | getInputStream(...) : InputStream | MvelInjection.java:62:7:62:16 | expression | MVEL injection from $@. | MvelInjection.java:57:27:57:49 | getInputStream(...) | this user input |
24+
| MvelInjection.java:42:7:42:15 | statement | MvelInjection.java:35:27:35:49 | getInputStream(...) : InputStream | MvelInjection.java:42:7:42:15 | statement | MVEL injection from $@. | MvelInjection.java:35:27:35:49 | getInputStream(...) | this user input |
25+
| MvelInjection.java:53:7:53:16 | expression | MvelInjection.java:47:27:47:49 | getInputStream(...) : InputStream | MvelInjection.java:53:7:53:16 | expression | MVEL injection from $@. | MvelInjection.java:47:27:47:49 | getInputStream(...) | this user input |
26+
| MvelInjection.java:63:7:63:16 | expression | MvelInjection.java:58:27:58:49 | getInputStream(...) : InputStream | MvelInjection.java:63:7:63:16 | expression | MVEL injection from $@. | MvelInjection.java:58:27:58:49 | getInputStream(...) | this user input |

‎java/ql/test/experimental/Security/CWE/CWE-094/MvelInjection.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ public static void testWithExpressionCompiler(Socket socket) throws IOException
3939
ExpressionCompiler compiler = new ExpressionCompiler(input);
4040
ExecutableStatement statement = compiler.compile();
4141
statement.getValue(new Object(), new ImmutableDefaultFactory());
42+
statement.getValue(new Object(), new Object(), new ImmutableDefaultFactory());
4243
}
4344
}
4445

‎java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/Accessor.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package org.mvel2.compiler;
2+
3+
import org.mvel2.integration.VariableResolverFactory;
4+
5+
public interface Accessor {
6+
public Object getValue(Object ctx, Object elCtx, VariableResolverFactory factory);
7+
}

‎java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/CompiledExpression.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@
55
public class CompiledExpression implements ExecutableStatement {
66
public Object getDirectValue(Object staticContext, VariableResolverFactory factory) { return null; }
77
public Object getValue(Object staticContext, VariableResolverFactory factory) { return null; }
8+
public Object getValue(Object ctx, Object elCtx, VariableResolverFactory factory) { return null; }
89
}

‎java/ql/test/stubs/mvel2-2.4.7/org/mvel2/compiler/ExecutableStatement.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
import org.mvel2.integration.VariableResolverFactory;
44

5-
public interface ExecutableStatement {
5+
public interface ExecutableStatement extends Accessor {
66
public Object getValue(Object staticContext, VariableResolverFactory factory);
77
}

0 commit comments

Comments
 (0)