Skip to content

Commit c137160

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: move code to .qll file
1 parent cde1939 commit c137160

File tree

2 files changed

+94
-97
lines changed

2 files changed

+94
-97
lines changed

‎java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
/** Provides classes and predicates to reason about Spring Boot actuators exposed in configuration files. */
2+
3+
import java
4+
private import semmle.code.configfiles.ConfigFiles
5+
private import semmle.code.xml.MavenPom
6+
7+
/** The parent node of the `org.springframework.boot` group. */
8+
class SpringBootParent extends Parent {
9+
SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
10+
}
11+
12+
/** Class of Spring Boot dependencies. */
13+
class SpringBootPom extends Pom {
14+
SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
15+
16+
/** Holds if the Spring Boot Actuator module `spring-boot-starter-actuator` is used in the project. */
17+
predicate isSpringBootActuatorUsed() {
18+
this.getADependency().getArtifact().getValue() = "spring-boot-starter-actuator"
19+
}
20+
21+
/**
22+
* Holds if the Spring Boot Security module is used in the project, which brings in other security
23+
* related libraries.
24+
*/
25+
predicate isSpringBootSecurityUsed() {
26+
this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
27+
}
28+
}
29+
30+
/** The properties file `application.properties`. */
31+
class ApplicationProperties extends ConfigPair {
32+
ApplicationProperties() { this.getFile().getBaseName() = "application.properties" }
33+
}
34+
35+
/** The configuration property `management.security.enabled`. */
36+
class ManagementSecurityConfig extends ApplicationProperties {
37+
ManagementSecurityConfig() { this.getNameElement().getName() = "management.security.enabled" }
38+
39+
/** Gets the whitespace-trimmed value of this property. */
40+
string getValue() { result = this.getValueElement().getValue().trim() }
41+
42+
/** Holds if `management.security.enabled` is set to `false`. */
43+
predicate hasSecurityDisabled() { this.getValue() = "false" }
44+
45+
/** Holds if `management.security.enabled` is set to `true`. */
46+
predicate hasSecurityEnabled() { this.getValue() = "true" }
47+
}
48+
49+
/** The configuration property `management.endpoints.web.exposure.include`. */
50+
class ManagementEndPointInclude extends ApplicationProperties {
51+
ManagementEndPointInclude() {
52+
this.getNameElement().getName() = "management.endpoints.web.exposure.include"
53+
}
54+
55+
/** Gets the whitespace-trimmed value of this property. */
56+
string getValue() { result = this.getValueElement().getValue().trim() }
57+
}
58+
59+
/**
60+
* Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
61+
* has a vulnerable configuration of Spring Boot Actuator management endpoints.
62+
*/
63+
predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationProperties ap) {
64+
pom.isSpringBootActuatorUsed() and
65+
not pom.isSpringBootSecurityUsed() and
66+
ap.getFile()
67+
.getParentContainer()
68+
.getAbsolutePath()
69+
.matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
70+
exists(string springBootVersion | springBootVersion = pom.getParentElement().getVersionString() |
71+
springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
72+
not exists(ManagementSecurityConfig me |
73+
me.hasSecurityEnabled() and me.getFile() = ap.getFile()
74+
)
75+
or
76+
springBootVersion.matches("1.5%") and // version 1.5
77+
exists(ManagementSecurityConfig me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
78+
or
79+
springBootVersion.matches("2.%") and //version 2.x
80+
exists(ManagementEndPointInclude mi |
81+
mi.getFile() = ap.getFile() and
82+
(
83+
mi.getValue() = "*" // all endpoints are enabled
84+
or
85+
mi.getValue()
86+
.matches([
87+
"%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%", "%env%",
88+
"%beans%", "%sessions%"
89+
]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
90+
)
91+
)
92+
)
93+
}

‎java/ql/src/Security/CWE/CWE-200/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.ql

Lines changed: 1 addition & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -11,105 +11,9 @@
1111
* external/cwe/cwe-016
1212
*/
1313

14-
/*
15-
* Note this query requires properties files to be indexed before it can produce results.
16-
* If creating your own database with the CodeQL CLI, you should run
17-
* `codeql database index-files --language=properties ...`
18-
* If using lgtm.com, you should add `properties_files: true` to the index block of your
19-
* lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
20-
*/
21-
2214
import java
23-
import semmle.code.configfiles.ConfigFiles
2415
import semmle.code.xml.MavenPom
25-
26-
/** The parent node of the `org.springframework.boot` group. */
27-
class SpringBootParent extends Parent {
28-
SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
29-
}
30-
31-
/** Class of Spring Boot dependencies. */
32-
class SpringBootPom extends Pom {
33-
SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
34-
35-
/** Holds if the Spring Boot Actuator module `spring-boot-starter-actuator` is used in the project. */
36-
predicate isSpringBootActuatorUsed() {
37-
this.getADependency().getArtifact().getValue() = "spring-boot-starter-actuator"
38-
}
39-
40-
/**
41-
* Holds if the Spring Boot Security module is used in the project, which brings in other security
42-
* related libraries.
43-
*/
44-
predicate isSpringBootSecurityUsed() {
45-
this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
46-
}
47-
}
48-
49-
/** The properties file `application.properties`. */
50-
class ApplicationProperties extends ConfigPair {
51-
ApplicationProperties() { this.getFile().getBaseName() = "application.properties" }
52-
}
53-
54-
/** The configuration property `management.security.enabled`. */
55-
class ManagementSecurityConfig extends ApplicationProperties {
56-
ManagementSecurityConfig() { this.getNameElement().getName() = "management.security.enabled" }
57-
58-
/** Gets the whitespace-trimmed value of this property. */
59-
string getValue() { result = this.getValueElement().getValue().trim() }
60-
61-
/** Holds if `management.security.enabled` is set to `false`. */
62-
predicate hasSecurityDisabled() { this.getValue() = "false" }
63-
64-
/** Holds if `management.security.enabled` is set to `true`. */
65-
predicate hasSecurityEnabled() { this.getValue() = "true" }
66-
}
67-
68-
/** The configuration property `management.endpoints.web.exposure.include`. */
69-
class ManagementEndPointInclude extends ApplicationProperties {
70-
ManagementEndPointInclude() {
71-
this.getNameElement().getName() = "management.endpoints.web.exposure.include"
72-
}
73-
74-
/** Gets the whitespace-trimmed value of this property. */
75-
string getValue() { result = this.getValueElement().getValue().trim() }
76-
}
77-
78-
/**
79-
* Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
80-
* has a vulnerable configuration of Spring Boot Actuator management endpoints.
81-
*/
82-
predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationProperties ap) {
83-
pom.isSpringBootActuatorUsed() and
84-
not pom.isSpringBootSecurityUsed() and
85-
ap.getFile()
86-
.getParentContainer()
87-
.getAbsolutePath()
88-
.matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
89-
exists(string springBootVersion | springBootVersion = pom.getParentElement().getVersionString() |
90-
springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
91-
not exists(ManagementSecurityConfig me |
92-
me.hasSecurityEnabled() and me.getFile() = ap.getFile()
93-
)
94-
or
95-
springBootVersion.matches("1.5%") and // version 1.5
96-
exists(ManagementSecurityConfig me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
97-
or
98-
springBootVersion.matches("2.%") and //version 2.x
99-
exists(ManagementEndPointInclude mi |
100-
mi.getFile() = ap.getFile() and
101-
(
102-
mi.getValue() = "*" // all endpoints are enabled
103-
or
104-
mi.getValue()
105-
.matches([
106-
"%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%", "%env%",
107-
"%beans%", "%sessions%"
108-
]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
109-
)
110-
)
111-
)
112-
}
16+
import semmle.code.java.security.SpringBootActuatorsConfigQuery
11317

11418
from SpringBootPom pom, ApplicationProperties ap, Dependency d
11519
where

0 commit comments

Comments
 (0)