Java: Add `MyBatis`' `Providers` sinks #8345

jorgectf · 2022-03-06T18:45:56Z

See https://mybatis.org/mybatis-3/apidocs/reference/org/apache/ibatis/jdbc/AbstractSQL.html

FYI: This PR is not tied to a Bug Bounty submission.

java/ql/test/experimental/query-tests/security/CWE-089/src/main/MybatisSqlInjectionService.java

jorgectf · 2022-03-07T01:13:43Z

This PR has been inspired by a recent CTF challenge (D3CTF - ezsql) in which a GET parameter was injected into AbstractSQL.WHERE(here). Our solution (cc: @TheGrandPew) involves achieving RCE through a JNDI lookup using OGNL (meaning there is a OGNL injection abusing Dynamic SQL). Annotations seem not to be vulnerable, but this PR's methods seem to.

Should OgnlInjection.ql cover these sinks?

// cc: @pwntester

atorralba · 2022-03-07T11:59:43Z

Should OgnlInjection.ql cover these sinks?

Judging by your explanation, these sinks are both SQLi and OGNL injection sinks. I'm not sure whether we have other cases of this kind of "dual" sinks in the codebase that we could get inspiration from, but one thing we could do is labeling these differently (so, instead of sql, something like sql-ognl) and adding them to both the SQLi and the OGNL injection queries.

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

pwntester · 2022-03-07T14:42:05Z

Annotations seem not to be vulnerable, but this PR's methods seem to.

From a quick look, annotation's queries are also evaluated but they are not vulnerable since there is no double evaluations. So for @Select("SELECT * FROM FOO WHERE id = ${id}"), id is evaluated against the OGNL context. An attacker providing an OGNL expression for id (eg: ${1}) will just result in the query resolving id to ${1} but not in a second evaluation.

When controlling the arguments to the AbstractSQL methods, attackers can influence the query before the Ognl evaluation and therefore evaluate arbitrary expressions. But just if the SQL object is used as a query.

Therefore, Its not really these methods what makes it vulnerable to SQLInjection and OGNL Injection. We should sink at the return statement of the query providers (methods identified by @SelectProvider and similars) since these two cases are equally vulnerable:

public class VillageProvider {
    public String getVillageById(final @Param(value="vid") String vid) {
        return new SQL(){
            {
                this.SELECT("*");
                this.FROM("village");
                this.WHERE("id = " + vid);
            }
        }.toString();
    }
}

and

public class VillageProvider {
    public String getVillageById(final @Param(value="vid") String vid) {
        return "SELECT id, name, district from village WHERE id =\'" + vid + "\'";
    }
}

atorralba · 2022-03-07T15:05:56Z

We should sink at the return statement of the query providers

Interesting. That means that we'd also need taint steps from the AbstractSQL methods' arguments to the returned AbstractSQL object.

pwntester · 2022-03-07T15:42:46Z

Interesting. That means that we'd also need taint steps from the AbstractSQL methods' arguments to the returned AbstractSQL object.

Yep, AbstractSQL seems to be a helper builder to build queries

jorgectf · 2022-03-09T03:18:41Z

I doubt so, but would this be interesting enough to add as a sink for ognli? https://mybatis.org/mybatis-3/apidocs/org/apache/ibatis/annotations/CacheNamespace.html (@Property's value)

…njection queries

jorgectf · 2022-03-09T03:22:24Z

Ideally, you'd have (at least) a test line for each new sink being added.

Tests are still WIP.

pwntester · 2022-03-09T06:48:28Z

I doubt so, but would this be interesting enough to add as a sink for ognli? https://mybatis.org/mybatis-3/apidocs/org/apache/ibatis/annotations/CacheNamespace.html (@Property's value)

I dont think user controlled data can flow to an annotation value

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

jorgectf · 2022-03-13T13:00:36Z

Pending looking into refactoring using SummaryModelCsv.

See #8345 (comment)

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

java/ql/lib/semmle/code/java/security/OgnlInjection.qll

java/ql/lib/semmle/code/java/security/QueryInjection.qll

Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>

jorgectf · 2022-03-16T09:13:33Z

The test java/ql/test/experimental/query-tests/security/CWE-089/src/main/MyBatisAnnotationSqlInjection.qlref is failing @jorgectf.

Fixed 👍

github-actions · 2022-03-16T09:18:12Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,283,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,284,929,,,,14,18,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,183,6226,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,1,,,,,,,,,,,,,,,,,6,,,,,,,,,,1,

github-actions · 2022-03-16T14:22:32Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,283,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,284,929,,,,14,18,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,183,6226,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,1,,,,,,,,,,,,,,,,,6,,,,,,,,,,1,

github-actions · 2022-03-16T14:25:05Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,283,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,284,929,,,,14,18,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,183,6226,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,1,,,,,,,,,,,,,,,,,6,,,,,,,,,,1,

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

github-actions · 2022-04-15T11:03:51Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,283,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,340,929,,,,14,18,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,183,6282,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,6,,,,,,,,,,57,

github-actions · 2022-04-15T11:10:54Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,283,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",44,340,929,,,,14,18,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,183,6282,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,6,,,,,,,,,,57,

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

github-advanced-security

Found 16 vulnerabilities.

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

github-actions · 2022-04-28T21:39:26Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",65,290,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",65,347,929,,,,14,18,,
-    Totals,,213,6305,1441,106,6,10,107,33,1,81
+    Totals,,213,6362,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,6,,,,,,,,,,57,

jorgectf · 2022-04-28T22:17:23Z

All changes done @aschackmull :D

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

github-actions · 2022-04-29T12:46:56Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",65,290,929,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``",65,347,929,,,,14,18,,
-    Totals,,213,6305,1441,106,6,10,107,33,1,81
+    Totals,,213,6362,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- org.apache.ibatis.jdbc,6,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,
+ org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,6,,,,,,,,,,57,

github-actions bot added the Java label Mar 6, 2022

jorgectf commented Mar 6, 2022

View reviewed changes

java/ql/test/experimental/query-tests/security/CWE-089/src/main/MybatisSqlInjectionService.java Outdated Show resolved Hide resolved

jorgectf marked this pull request as ready for review March 6, 2022 22:24

jorgectf requested a review from a team as a code owner March 6, 2022 22:24

smowton reviewed Mar 7, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

jorgectf added 2 commits March 9, 2022 04:20

Properly model AbstractSQL sinks and taint steps

e000163

Attempt to add MyBatis' sinks and taint steps to SQL and OGNL i…

447636b

…njection queries

jorgectf force-pushed the mybatis-new-sinks branch from 6221ab5 to 447636b Compare March 9, 2022 03:21

jorgectf changed the title ~~Java: Add MyBatis's AbstractSQL sinks~~ Java: Add MyBatis' Providers sinks Mar 9, 2022

pwntester reviewed Mar 9, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

atorralba reviewed Mar 10, 2022

View reviewed changes

Finish taint steps

ded9663

atorralba reviewed Mar 14, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

Generally extend TaintTracking::AdditionalTaintStep

a0bf68f

atorralba reviewed Mar 14, 2022

View reviewed changes

jorgectf and others added 6 commits March 14, 2022 21:27

Apply suggestions from code review

158366a

Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>

Add tests

d47fced

Use SummaryModelCsv in MyBatisAbstractSQLMethodsStep

32f494e

Make MyBatisProviderStep an AdditionalValueStep

8482c01

Add MyBatisInjectionSink's QLDoc

c683b48

Use SummaryModelCsv for the toString taint step

b62b8c8

Style fixes

8790df7

atorralba force-pushed the mybatis-new-sinks branch from 4b1f87e to 8790df7 Compare March 16, 2022 14:11

aschackmull requested changes Apr 8, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

Detach MyBatisAbstractSqlMethodsStep from MyBatisAbstractSql

9e1b98e

jorgectf force-pushed the mybatis-new-sinks branch from f9ae1ef to 9e1b98e Compare April 15, 2022 11:08

jorgectf requested a review from aschackmull April 21, 2022 09:18

aschackmull reviewed Apr 25, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

aschackmull reviewed Apr 25, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

aschackmull reviewed Apr 25, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

aschackmull reviewed Apr 25, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

jorgectf and others added 2 commits April 28, 2022 21:55

Delete MyBatisAbstractSql and inline MyBatisAbstractSqlMethodsStep

834f2e8

Apply suggestions from code review

50e95b5

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

github-advanced-security bot found potential problems Apr 28, 2022

View reviewed changes

jorgectf force-pushed the mybatis-new-sinks branch from 4a058e6 to 50e95b5 Compare April 28, 2022 20:25

jorgectf and others added 2 commits April 28, 2022 22:26

Merge branch 'main' into mybatis-new-sinks

193ea1a

Fix MyBatisInjectionSink

548721a

aschackmull reviewed Apr 29, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/MyBatis.qll Outdated Show resolved Hide resolved

Apply suggestions from code review

37b051a

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

aschackmull approved these changes May 2, 2022

View reviewed changes

aschackmull merged commit b2e9555 into github:main May 2, 2022

jorgectf mentioned this pull request May 22, 2022

LGTM.com - false positive in cas-bigdatalab/piflow-web #9246

Closed

Java: Add MyBatis' Providers sinks #8345

Java: Add MyBatis' Providers sinks #8345

Uh oh!

Conversation

jorgectf commented Mar 6, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jorgectf commented Mar 7, 2022

Uh oh!

atorralba commented Mar 7, 2022

Uh oh!

Uh oh!

Uh oh!

pwntester commented Mar 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

atorralba commented Mar 7, 2022

Uh oh!

pwntester commented Mar 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jorgectf commented Mar 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jorgectf commented Mar 9, 2022

Uh oh!

pwntester commented Mar 9, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jorgectf commented Mar 13, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jorgectf commented Mar 16, 2022

Uh oh!

github-actions bot commented Mar 16, 2022

java

Generated file changes for java

Uh oh!

github-actions bot commented Mar 16, 2022

java

Generated file changes for java

Uh oh!

github-actions bot commented Mar 16, 2022

java

Generated file changes for java

Uh oh!

Uh oh!

github-actions bot commented Apr 15, 2022

java

Generated file changes for java

Uh oh!

github-actions bot commented Apr 15, 2022

java

Generated file changes for java

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Java: Add `MyBatis`' `Providers` sinks #8345

Java: Add `MyBatis`' `Providers` sinks #8345

jorgectf commented Mar 6, 2022 •

edited

Loading

pwntester commented Mar 7, 2022 •

edited

Loading

pwntester commented Mar 7, 2022 •

edited

Loading

jorgectf commented Mar 9, 2022 •

edited

Loading