Skip to content

Commit 59572e5

Browse files
smowtonsmowton
authored
Merge pull request #16708 from am0o0/am0o0-java-PathInjection
Java: new path injection sinks
2 parents 6f23819 + e88bf31 commit 59572e5

566 files changed

Lines changed: 18975 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎java/ql/lib/ext/experimental/java.nio.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["java.nio.file","FileSystems",true,"getFileSystem","(URI)","","Argument[0]","path-injection","manual"]
7+
- ["java.nio.channels","AsynchronousFileChannel",true,"open","(Path,OpenOption[])","","Argument[0]","path-injection","manual"]
8+
- ["java.nio.channels","AsynchronousFileChannel",true,"open","(Path,Set,ExecutorService,FileAttribute[])","","Argument[0]","path-injection","manual"]

‎java/ql/lib/ext/experimental/java.util.zip.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["java.util.zip","ZipFile",true,"ZipFile","(String)","","Argument[0]","path-injection","manual"]

‎java/ql/lib/ext/experimental/s3-transfer-manager.model.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["software.amazon.awssdk.transfer.s3.model","ResumableFileUpload",true,"serializeToFile","(Path)","","Argument[0]","path-injection","manual"]
7+
- ["software.amazon.awssdk.transfer.s3.model","DownloadFileRequest$Builder",true,"destination","(Path)","","Argument[0]","path-injection","manual"]
8+
- ["software.amazon.awssdk.transfer.s3.model","UploadFileRequest$Builder",true,"source","(Path)","","Argument[0]","path-injection","manual"]
9+
- ["software.amazon.awssdk.transfer.s3.model","DownloadDirectoryRequest$Builder",true,"destination","(Path)","","Argument[0]","path-injection","manual"]
10+
- ["software.amazon.awssdk.transfer.s3.model","ResumableFileDownload",true,"fromFile","(Path)","","Argument[0]","path-injection","manual"]
11+
- ["software.amazon.awssdk.transfer.s3.model","ResumableFileDownload",true,"serializeToFile","(Path)","","Argument[0]","path-injection","manual"]
12+
- ["software.amazon.awssdk.transfer.s3.model","ResumableFileUpload",true,"fromFile","(Path)","","Argument[0]","path-injection","manual"]
13+
- ["software.amazon.awssdk.transfer.s3.model","UploadDirectoryRequest$Builder",true,"source","(Path)","","Argument[0]","path-injection","manual"]

‎java/ql/lib/ext/experimental/spring-core.model.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(FileSystem,String)","","Argument[1]","path-injection","manual"]
7+
- ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(File)","","Argument[0]","path-injection","manual"]
8+
- ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(Path)","","Argument[0]","path-injection","manual"]
9+
- ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(String)","","Argument[0]","path-injection","manual"]
10+
- ["org.springframework.core.io","FileUrlResource",true,"FileUrlResource","(String)","","Argument[0]","path-injection","manual"]
11+
- ["org.springframework.core.io","FileUrlResource",true,"FileUrlResource","(URL)","","Argument[0]","path-injection","manual"]
12+
- ["org.springframework.core.io","PathResource",true,"PathResource","(Path)","","Argument[0]","path-injection","manual"]
13+
- ["org.springframework.core.io","PathResource",true,"PathResource","(String)","","Argument[0]","path-injection","manual"]
14+
- ["org.springframework.core.io","PathResource",true,"PathResource","(URI)","","Argument[0]","path-injection","manual"]
15+
- ["org.springframework.core.io","UrlResource",true,"UrlResource","(String,String,String)","","Argument[1]","path-injection","manual"]
16+
- ["org.springframework.core.io","UrlResource",true,"UrlResource","(String,String)","","Argument[1]","path-injection","manual"]
17+
- ["org.springframework.core.io","UrlResource",true,"UrlResource","(String)","","Argument[0]","path-injection","manual"]
18+
- ["org.springframework.core.io","UrlResource",true,"UrlResource","(URI)","","Argument[0]","path-injection","manual"]
19+
- ["org.springframework.core.io","UrlResource",true,"UrlResource","(URL)","","Argument[0]","path-injection","manual"]
20+
- ["org.springframework.util","FileSystemUtils",true,"copyRecursively","(Path,Path)","","Argument[0]","path-injection","manual"]
21+
- ["org.springframework.util","FileSystemUtils",true,"copyRecursively","(Path,Path)","","Argument[1]","path-injection","manual"]
22+
- ["org.springframework.util","FileSystemUtils",true,"deleteRecursively","(File)","","Argument[0]","path-injection","manual"]
23+
- ["org.springframework.util","FileSystemUtils",true,"deleteRecursively","(Path)","","Argument[0]","path-injection","manual"]
24+
- ["org.springframework.util","ResourceUtils",true,"getFile","(String)","","Argument[0]","path-injection","manual"]
25+
- ["org.springframework.util","FileCopyUtils",true,"copyToByteArray","(File)","","Argument[0]","path-injection","manual"]
26+
- ["org.springframework.util","FileSystemUtils",true,"copyRecursively","(File,File)","","Argument[0]","path-injection","manual"]

‎java/ql/lib/ext/experimental/zip4j.model.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sinkModel
5+
data:
6+
- ["net.lingala.zip4j","ZipFile",true,"extractAll","(String)","","Argument[0]","path-injection","manual"]
7+
- ["net.lingala.zip4j","ZipFile",true,"ZipFile","(String)","","Argument[0]","path-injection","manual"]

‎java/ql/test/experimental/query-tests/security/CWE-022/AmazonS3.java‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
import software.amazon.awssdk.transfer.s3.S3TransferManager;
2+
import software.amazon.awssdk.transfer.s3.model.UploadFileRequest;
3+
import software.amazon.awssdk.transfer.s3.model.FileUpload;
4+
import software.amazon.awssdk.transfer.s3.model.FileDownload;
5+
import software.amazon.awssdk.transfer.s3.model.DirectoryUpload;
6+
import software.amazon.awssdk.transfer.s3.model.CompletedDirectoryUpload;
7+
import software.amazon.awssdk.transfer.s3.model.DirectoryDownload;
8+
import software.amazon.awssdk.transfer.s3.model.CompletedDirectoryDownload;
9+
import software.amazon.awssdk.transfer.s3.model.DownloadDirectoryRequest;
10+
import software.amazon.awssdk.transfer.s3.model.DownloadFileRequest;
11+
import software.amazon.awssdk.transfer.s3.model.ResumableFileUpload;
12+
import software.amazon.awssdk.transfer.s3.model.UploadDirectoryRequest;
13+
import software.amazon.awssdk.transfer.s3.model.ResumableFileDownload;
14+
import software.amazon.awssdk.transfer.s3.model.CompletedFileUpload;
15+
import software.amazon.awssdk.transfer.s3.model.CompletedFileDownload;
16+
import software.amazon.awssdk.transfer.s3.progress.LoggingTransferListener;
17+
18+
import java.net.URI;
19+
import java.nio.file.Paths;
20+
21+
public class AmazonS3 {
22+
S3TransferManager transferManager = S3TransferManager.create();
23+
String bucketName = "bucketTest";
24+
String key = "keyTest";
25+
26+
public String uploadFile(URI filePathURI) {
27+
UploadFileRequest uploadFileRequest =
28+
UploadFileRequest.builder()
29+
.putObjectRequest(b -> b.bucket(this.bucketName).key(this.key))
30+
.addTransferListener(LoggingTransferListener.create())
31+
.source(Paths.get(filePathURI)) // $ hasTaintFlow="get(...)"
32+
.build();
33+
34+
FileUpload fileUpload = this.transferManager.uploadFile(uploadFileRequest);
35+
36+
CompletedFileUpload uploadResult = fileUpload.completionFuture().join();
37+
return uploadResult.response().eTag();
38+
}
39+
40+
public String uploadFileResumable(URI filePathURI) {
41+
UploadFileRequest uploadFileRequest =
42+
UploadFileRequest.builder()
43+
.putObjectRequest(b -> b.bucket(this.bucketName).key(this.key))
44+
.addTransferListener(LoggingTransferListener.create())
45+
.source(Paths.get(filePathURI)) // $ hasTaintFlow="get(...)"
46+
.build();
47+
48+
// Initiate the transfer
49+
FileUpload upload = this.transferManager.uploadFile(uploadFileRequest);
50+
// Pause the upload
51+
ResumableFileUpload resumableFileUpload = upload.pause();
52+
// Optionally, persist the resumableFileUpload
53+
resumableFileUpload.serializeToFile(Paths.get(filePathURI)); // $ hasTaintFlow="get(...)"
54+
// Retrieve the resumableFileUpload from the file
55+
ResumableFileUpload persistedResumableFileUpload =
56+
ResumableFileUpload.fromFile(Paths.get(filePathURI)); // $ hasTaintFlow="get(...)"
57+
// Resume the upload
58+
FileUpload resumedUpload = this.transferManager.resumeUploadFile(persistedResumableFileUpload);
59+
// Wait for the transfer to complete
60+
resumedUpload.completionFuture().join();
61+
FileUpload fileUpload = this.transferManager.uploadFile(uploadFileRequest);
62+
CompletedFileUpload uploadResult = fileUpload.completionFuture().join();
63+
return uploadResult.response().eTag();
64+
}
65+
66+
public String downloadFileResumable(URI downloadedFileWithPath) {
67+
DownloadFileRequest downloadFileRequest =
68+
DownloadFileRequest.builder()
69+
.getObjectRequest(b -> b.bucket(this.bucketName).key(this.key))
70+
.addTransferListener(LoggingTransferListener.create())
71+
.destination(Paths.get(downloadedFileWithPath)) // $ hasTaintFlow="get(...)"
72+
.build();
73+
74+
// Initiate the transfer
75+
FileDownload download = this.transferManager.downloadFile(downloadFileRequest);
76+
// Pause the download
77+
ResumableFileDownload resumableFileDownload = download.pause();
78+
// Optionally, persist the resumableFileDownload
79+
resumableFileDownload.serializeToFile(Paths.get(downloadedFileWithPath)); // $ hasTaintFlow="get(...)"
80+
// Retrieve the resumableFileDownload from the file
81+
ResumableFileDownload persistedResumableFileDownload =
82+
ResumableFileDownload.fromFile(Paths.get(downloadedFileWithPath)); // $ hasTaintFlow="get(...)"
83+
// Resume the download
84+
FileDownload resumedDownload =
85+
this.transferManager.resumeDownloadFile(persistedResumableFileDownload);
86+
// Wait for the transfer to complete
87+
resumedDownload.completionFuture().join();
88+
FileDownload filedownload = this.transferManager.downloadFile(downloadFileRequest);
89+
CompletedFileDownload downloadResult = filedownload.completionFuture().join();
90+
return downloadResult.response().eTag();
91+
}
92+
93+
public Integer uploadDirectory(URI sourceDirectory) {
94+
DirectoryUpload directoryUpload =
95+
this.transferManager.uploadDirectory(
96+
UploadDirectoryRequest.builder()
97+
.source(Paths.get(sourceDirectory)) // $ hasTaintFlow="get(...)"
98+
.bucket(this.bucketName)
99+
.build());
100+
101+
CompletedDirectoryUpload completedDirectoryUpload = directoryUpload.completionFuture().join();
102+
return completedDirectoryUpload.failedTransfers().size();
103+
}
104+
105+
public Long downloadFile(String downloadedFileWithPath) {
106+
DownloadFileRequest downloadFileRequest =
107+
DownloadFileRequest.builder()
108+
.getObjectRequest(b -> b.bucket(this.bucketName).key(this.key))
109+
.addTransferListener(LoggingTransferListener.create())
110+
.destination(Paths.get(downloadedFileWithPath)) // $ hasTaintFlow="get(...)"
111+
.build();
112+
113+
FileDownload downloadFile = this.transferManager.downloadFile(downloadFileRequest);
114+
115+
CompletedFileDownload downloadResult = downloadFile.completionFuture().join();
116+
return downloadResult.response().contentLength();
117+
}
118+
119+
public Integer downloadObjectsToDirectory(URI destinationPathURI) {
120+
DirectoryDownload directoryDownload =
121+
this.transferManager.downloadDirectory(
122+
DownloadDirectoryRequest.builder()
123+
.destination(Paths.get(destinationPathURI)) // $ hasTaintFlow="get(...)"
124+
.bucket(this.bucketName)
125+
.build());
126+
CompletedDirectoryDownload completedDirectoryDownload =
127+
directoryDownload.completionFuture().join();
128+
129+
return completedDirectoryDownload.failedTransfers().size();
130+
}
131+
}

‎java/ql/test/experimental/query-tests/security/CWE-022/JavaNio.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
import java.io.IOException;
2+
import java.io.File;
3+
import java.nio.channels.AsynchronousFileChannel;
4+
import java.nio.file.Path;
5+
import java.nio.file.LinkOption;
6+
import java.nio.file.FileSystems;
7+
import java.nio.file.attribute.FileAttribute;
8+
import java.util.Set;
9+
import java.util.concurrent.ExecutorService;
10+
import java.util.concurrent.Executors;
11+
12+
public class JavaNio {
13+
static class FileAttr implements FileAttribute<String> {
14+
public String name() {
15+
return "file";
16+
}
17+
18+
public String value() {
19+
return "value";
20+
}
21+
}
22+
23+
public void PathInjection(Path src, File srcF) throws IOException {
24+
AsynchronousFileChannel.open(src); // $ hasTaintFlow="src"
25+
AsynchronousFileChannel.open(src, LinkOption.NOFOLLOW_LINKS); // $ hasTaintFlow="src"
26+
AsynchronousFileChannel.open(
27+
src, LinkOption.NOFOLLOW_LINKS, LinkOption.NOFOLLOW_LINKS); // $ hasTaintFlow="src"
28+
ExecutorService executor = Executors.newFixedThreadPool(10);
29+
AsynchronousFileChannel.open(
30+
src, Set.of(LinkOption.NOFOLLOW_LINKS), executor); // $ hasTaintFlow="src"
31+
AsynchronousFileChannel.open(
32+
src, // $ hasTaintFlow="src"
33+
Set.of(LinkOption.NOFOLLOW_LINKS),
34+
executor,
35+
new FileAttr());
36+
37+
FileSystems.getFileSystem(srcF.toURI()); // $ hasTaintFlow="toURI(...)"
38+
}
39+
}

‎java/ql/test/experimental/query-tests/security/CWE-022/Main.java‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
import java.io.BufferedReader;
2+
import java.io.InputStreamReader;
3+
import java.io.File;
4+
import java.io.IOException;
5+
import java.nio.charset.StandardCharsets;
6+
import java.nio.file.Path;
7+
import java.net.Socket;
8+
9+
public class Main {
10+
public void sendUserFileGood(Socket sock) throws IOException {
11+
BufferedReader filenameReader =
12+
new BufferedReader(new InputStreamReader(sock.getInputStream(), StandardCharsets.UTF_8));
13+
String path = filenameReader.readLine();
14+
Path src = Path.of(path);
15+
File srcF = new File(path);
16+
17+
new JavaNio().PathInjection(src, srcF);
18+
19+
new SpringIo().PathInjection(path);
20+
21+
AmazonS3 s3PathInjection = new AmazonS3();
22+
s3PathInjection.downloadFileResumable(src.toUri());
23+
s3PathInjection.downloadFile(path);
24+
s3PathInjection.downloadObjectsToDirectory(src.toUri());
25+
s3PathInjection.uploadFileResumable(src.toUri());
26+
s3PathInjection.uploadDirectory(src.toUri());
27+
s3PathInjection.uploadFile(src.toUri());
28+
29+
Zip4j zip4jfile = new Zip4j();
30+
zip4jfile.PathInjection(path);
31+
32+
ZipFile zipfile = new ZipFile();
33+
zipfile.PathInjection(path);
34+
}
35+
}

‎java/ql/test/experimental/query-tests/security/CWE-022/PathInjection.iml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module version="4">
3+
<component name="AdditionalModuleElements">
4+
<content url="file://$MODULE_DIR$" dumb="true">
5+
<sourceFolder url="file://$MODULE_DIR$" isTestSource="false" />
6+
</content>
7+
</component>
8+
</module>

‎java/ql/test/experimental/query-tests/security/CWE-022/SpringIo.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
import java.io.File;
2+
import java.io.IOException;
3+
import java.net.URI;
4+
import java.nio.file.FileSystems;
5+
import java.nio.file.Path;
6+
import java.nio.file.Paths;
7+
import org.springframework.core.io.FileUrlResource;
8+
import org.springframework.core.io.FileSystemResource;
9+
import org.springframework.core.io.PathResource;
10+
import org.springframework.core.io.UrlResource;
11+
import org.springframework.util.FileCopyUtils;
12+
import org.springframework.util.FileSystemUtils;
13+
14+
public class SpringIo {
15+
public void PathInjection(String path) throws IOException {
16+
Path fileStorageLocation = Paths.get(path).toAbsolutePath().normalize();
17+
Path filePath = fileStorageLocation.resolve(path).normalize();
18+
File pathFile = new File(path);
19+
20+
new UrlResource(filePath.toUri()); // $ hasTaintFlow="toUri(...)"
21+
new UrlResource(filePath.toUri().toURL()); // $ hasTaintFlow="toURL(...)"
22+
new UrlResource("file", path); // $ hasTaintFlow="path"
23+
new UrlResource("file", path, "#"); // $ hasTaintFlow="path"
24+
new UrlResource(path); // $ hasTaintFlow="path"
25+
26+
new PathResource(path); // $ hasTaintFlow="path"
27+
new PathResource(filePath); // $ hasTaintFlow="filePath"
28+
new PathResource(filePath.toUri()); // $ hasTaintFlow="toUri(...)"
29+
30+
new FileUrlResource(filePath.toUri().toURL()); // $ hasTaintFlow="toURL(...)"
31+
new FileUrlResource(path); // $ hasTaintFlow="path"
32+
33+
new FileSystemResource(pathFile); // $ hasTaintFlow="pathFile"
34+
new FileSystemResource(path); // $ hasTaintFlow="path"
35+
new FileSystemResource(filePath); // $ hasTaintFlow="filePath"
36+
new FileSystemResource(
37+
FileSystems.getFileSystem(URI.create("file:///")), path); // $ hasTaintFlow="path"
38+
39+
FileSystemUtils.copyRecursively(filePath, filePath.resolve("/newPath")); // $ hasTaintFlow="filePath" hasTaintFlow="resolve(...)"
40+
FileSystemUtils.copyRecursively(pathFile, pathFile); // $ hasTaintFlow="pathFile"
41+
FileSystemUtils.deleteRecursively(pathFile); // $ hasTaintFlow="pathFile"
42+
FileSystemUtils.deleteRecursively(filePath); // $ hasTaintFlow="filePath"
43+
FileCopyUtils.copy(pathFile, pathFile); // $ hasTaintFlow="pathFile"
44+
FileCopyUtils.copyToByteArray(pathFile); // $ hasTaintFlow="pathFile"
45+
}
46+
}

0 commit comments

Comments
 (0)