|
| 1 | +/** |
| 2 | + * @name Temporary Directory Local information disclosure |
| 3 | + * @description Writing information without explicit permissions to a shared temporary directory may disclose it to other users. |
| 4 | + * @kind path-problem |
| 5 | + * @problem.severity warning |
| 6 | + * @precision very-high |
| 7 | + * @id java/local-temp-file-or-directory-information-disclosure |
| 8 | + * @tags security |
| 9 | + * external/cwe/cwe-200 |
| 10 | + * external/cwe/cwe-732 |
| 11 | + */ |
| 12 | + |
| 13 | +import java |
| 14 | +import TempDirUtils |
| 15 | +import DataFlow::PathGraph |
| 16 | + |
| 17 | +private class MethodFileSystemFileCreation extends Method { |
| 18 | + MethodFileSystemFileCreation() { |
| 19 | + getDeclaringType() instanceof TypeFile and |
| 20 | + hasName(["mkdir", "mkdirs", "createNewFile"]) |
| 21 | + } |
| 22 | +} |
| 23 | + |
| 24 | +abstract private class FileCreationSink extends DataFlow::Node { } |
| 25 | + |
| 26 | +/** |
| 27 | + * Sink for tainted `File` having a file or directory creation method called on it. |
| 28 | + */ |
| 29 | +private class FileFileCreationSink extends FileCreationSink { |
| 30 | + FileFileCreationSink() { |
| 31 | + exists(MethodAccess ma | |
| 32 | + ma.getMethod() instanceof MethodFileSystemFileCreation and |
| 33 | + ma.getQualifier() = this.asExpr() |
| 34 | + ) |
| 35 | + } |
| 36 | +} |
| 37 | + |
| 38 | +/** |
| 39 | + * Sink for if tained File/Path having some `Files` method called on it that creates a file or directory. |
| 40 | + */ |
| 41 | +private class FilesFileCreationSink extends FileCreationSink { |
| 42 | + FilesFileCreationSink() { |
| 43 | + exists(FilesVulnerableCreationMethodAccess ma | ma.getArgument(0) = this.asExpr()) |
| 44 | + } |
| 45 | +} |
| 46 | + |
| 47 | +/** |
| 48 | + * Captures all of the vulnerable methods on `Files` that create files/directories without explicitly |
| 49 | + * setting the permissions. |
| 50 | + */ |
| 51 | +private class FilesVulnerableCreationMethodAccess extends MethodAccess { |
| 52 | + FilesVulnerableCreationMethodAccess() { |
| 53 | + exists(Method m | |
| 54 | + m = this.getMethod() and |
| 55 | + m.getDeclaringType().hasQualifiedName("java.nio.file", "Files") |
| 56 | + | |
| 57 | + m.hasName(["write", "newBufferedWriter", "newOutputStream"]) |
| 58 | + or |
| 59 | + m.hasName(["createFile", "createDirectory", "createDirectories"]) and |
| 60 | + getNumArgument() = 1 |
| 61 | + ) |
| 62 | + } |
| 63 | +} |
| 64 | + |
| 65 | +/** |
| 66 | + * A call to `java.io.File::createTempFile` where the the system temp dir sinks to the last argument. |
| 67 | + */ |
| 68 | +private class FileCreateTempFileSink extends FileCreationSink { |
| 69 | + FileCreateTempFileSink() { |
| 70 | + exists(MethodAccess ma | |
| 71 | + ma.getMethod() instanceof MethodFileCreateTempFile and ma.getArgument(2) = this.asExpr() |
| 72 | + ) |
| 73 | + } |
| 74 | +} |
| 75 | + |
| 76 | +private class TempDirSystemGetPropertyToCreateConfig extends TaintTracking::Configuration { |
| 77 | + TempDirSystemGetPropertyToCreateConfig() { this = "TempDirSystemGetPropertyToCreateConfig" } |
| 78 | + |
| 79 | + override predicate isSource(DataFlow::Node source) { |
| 80 | + source.asExpr() instanceof MethodAccessSystemGetPropertyTempDirTainted |
| 81 | + } |
| 82 | + |
| 83 | + override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { |
| 84 | + isAdditionalFileTaintStep(node1, node2) |
| 85 | + } |
| 86 | + |
| 87 | + override predicate isSink(DataFlow::Node sink) { sink instanceof FileCreationSink } |
| 88 | +} |
| 89 | + |
| 90 | +abstract class MethodAccessInsecureFileCreation extends MethodAccess { |
| 91 | + /** |
| 92 | + * Docstring describing the file system type (ie. file, directory, etc...) returned. |
| 93 | + */ |
| 94 | + abstract string getFileSystemType(); |
| 95 | +} |
| 96 | + |
| 97 | +/** |
| 98 | + * Insecure calls to `java.io.File::createTempFile`. |
| 99 | + */ |
| 100 | +class MethodAccessInsecureFileCreateTempFile extends MethodAccessInsecureFileCreation { |
| 101 | + MethodAccessInsecureFileCreateTempFile() { |
| 102 | + this.getMethod() instanceof MethodFileCreateTempFile and |
| 103 | + ( |
| 104 | + this.getNumArgument() = 2 |
| 105 | + or |
| 106 | + // Vulnerablilty exists when the last argument is `null` |
| 107 | + getArgument(2) instanceof NullLiteral |
| 108 | + ) |
| 109 | + } |
| 110 | + |
| 111 | + override string getFileSystemType() { result = "file" } |
| 112 | +} |
| 113 | + |
| 114 | +class MethodGuavaFilesCreateTempFile extends Method { |
| 115 | + MethodGuavaFilesCreateTempFile() { |
| 116 | + getDeclaringType().hasQualifiedName("com.google.common.io", "Files") and |
| 117 | + hasName("createTempDir") |
| 118 | + } |
| 119 | +} |
| 120 | + |
| 121 | +class MethodAccessInsecureGuavaFilesCreateTempFile extends MethodAccessInsecureFileCreation { |
| 122 | + MethodAccessInsecureGuavaFilesCreateTempFile() { |
| 123 | + getMethod() instanceof MethodGuavaFilesCreateTempFile |
| 124 | + } |
| 125 | + |
| 126 | + override string getFileSystemType() { result = "directory" } |
| 127 | +} |
| 128 | + |
| 129 | +/** |
| 130 | + * This is a hack: we include use of inherently insecure methods, which don't have any associated |
| 131 | + * flow path, in with results describing a path from reading java.io.tmpdir or similar to use |
| 132 | + * in a file creation op. |
| 133 | + * |
| 134 | + * We achieve this by making inherently-insecure method invocations both a source and a sink in |
| 135 | + * this configuration, resulting in a zero-length path which is type-compatible with the actual |
| 136 | + * path-flow results. |
| 137 | + */ |
| 138 | +class InsecureMethodPseudoConfiguration extends DataFlow::Configuration { |
| 139 | + InsecureMethodPseudoConfiguration() { this = "InsecureMethodPseudoConfiguration " } |
| 140 | + |
| 141 | + override predicate isSource(DataFlow::Node node) { |
| 142 | + node.asExpr() instanceof MethodAccessInsecureFileCreation |
| 143 | + } |
| 144 | + |
| 145 | + override predicate isSink(DataFlow::Node node) { |
| 146 | + node.asExpr() instanceof MethodAccessInsecureFileCreation |
| 147 | + } |
| 148 | +} |
| 149 | + |
| 150 | +from DataFlow::PathNode source, DataFlow::PathNode sink, string message |
| 151 | +where |
| 152 | + any(TempDirSystemGetPropertyToCreateConfig conf).hasFlowPath(source, sink) and |
| 153 | + message = |
| 154 | + "Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users." |
| 155 | + or |
| 156 | + any(InsecureMethodPseudoConfiguration conf).hasFlowPath(source, sink) and |
| 157 | + // Note this message has no "$@" placeholder, so the "system temp directory" template parameter below is not used. |
| 158 | + message = |
| 159 | + "Local information disclosure vulnerability due to use of " + |
| 160 | + source.getNode().asExpr().(MethodAccessInsecureFileCreation).getFileSystemType() + |
| 161 | + " readable by other local users." |
| 162 | +select source.getNode(), source, sink, message, source.getNode(), "system temp directory" |
0 commit comments