@@ -63,11 +63,37 @@ class ManagementEndPointInclude extends ApplicationPropertiesConfigPair {
6363 string getValue ( ) { result = this .getValueElement ( ) .getValue ( ) .trim ( ) }
6464}
6565
66+ private newtype TOption =
67+ TNone ( ) or
68+ TSome ( ApplicationPropertiesConfigPair ap )
69+
70+ /**
71+ * An option type that is either a singleton `None` or a `Some` wrapping
72+ * the `ApplicationPropertiesConfigPair` type.
73+ */
74+ class ApplicationPropertiesOption extends TOption {
75+ /** Gets a textual representation of this element. */
76+ string toString ( ) {
77+ this = TNone ( ) and result = "(none)"
78+ or
79+ result = this .asSome ( ) .toString ( )
80+ }
81+
82+ /** Gets the location of this element. */
83+ Location getLocation ( ) { result = this .asSome ( ) .getLocation ( ) }
84+
85+ /** Gets the wrapped element, if any. */
86+ ApplicationPropertiesConfigPair asSome ( ) { this = TSome ( result ) }
87+
88+ /** Holds if this option is the singleton `None`. */
89+ predicate isNone ( ) { this = TNone ( ) }
90+ }
91+
6692/**
6793 * Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
6894 * has a vulnerable configuration of Spring Boot Actuator management endpoints.
6995 */
70- predicate hasConfidentialEndPointExposed ( SpringBootPom pom ) {
96+ predicate hasConfidentialEndPointExposed ( SpringBootPom pom , ApplicationPropertiesOption apOption ) {
7197 pom .isSpringBootActuatorUsed ( ) and
7298 not pom .isSpringBootSecurityUsed ( ) and
7399 exists ( ApplicationPropertiesFile apFile |
@@ -79,14 +105,24 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom) {
79105 springBootVersion = pom .getParentElement ( ) .getVersionString ( )
80106 |
81107 springBootVersion .regexpMatch ( "1\\.[0-4].*" ) and // version 1.0, 1.1, ..., 1.4
82- not exists ( ManagementSecurityConfig me | me .hasSecurityEnabled ( ) and me .getFile ( ) = apFile )
108+ (
109+ not exists ( ManagementSecurityConfig me | me .getFile ( ) = apFile ) and
110+ apOption .isNone ( )
111+ or
112+ exists ( ManagementSecurityConfig me |
113+ me .hasSecurityDisabled ( ) and me .getFile ( ) = apFile and me = apOption .asSome ( )
114+ )
115+ )
83116 or
84117 springBootVersion .matches ( "1.5%" ) and // version 1.5
85- exists ( ManagementSecurityConfig me | me .hasSecurityDisabled ( ) and me .getFile ( ) = apFile )
118+ exists ( ManagementSecurityConfig me |
119+ me .hasSecurityDisabled ( ) and me .getFile ( ) = apFile and me = apOption .asSome ( )
120+ )
86121 or
87122 springBootVersion .matches ( "2.%" ) and //version 2.x
88123 exists ( ManagementEndPointInclude mi |
89124 mi .getFile ( ) = apFile and
125+ mi = apOption .asSome ( ) and
90126 (
91127 mi .getValue ( ) = "*" // all endpoints are enabled
92128 or
0 commit comments