Skip to content

Java: Extract module HardcodedCredentials from CWE-798 #3992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Java: Extract module HardcodedCredentials from CWE-798 #3992

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
431e231
Move HardcodedCredentials and SensitiveApi libs
rvermeulen Jul 29, 2020
d1b383e
Extend credential sink from dataflow expr
rvermeulen Jul 30, 2020
6be583e
Add top-level qldoc describing the modules
rvermeulen Jul 30, 2020
2c76c01
Generalize the UsernameVariable and PasswordVariable
rvermeulen Jul 30, 2020
2a1f73c
Change predicate qldocs style
rvermeulen Jul 30, 2020
d52c070
Fix punctuation and typo
rvermeulen Jul 31, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@

import java
import semmle.code.java.dataflow.DataFlow
import HardcodedCredentials
import semmle.code.java.security.HardcodedCredentials
import DataFlow::PathGraph

class HardcodedCredentialApiCallConfiguration extends DataFlow::Configuration {
Expand Down
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsComparison.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
*/

import java
import HardcodedCredentials
import semmle.code.java.security.HardcodedCredentials

class EqualsAccess extends MethodAccess {
EqualsAccess() { getMethod() instanceof EqualsMethod }
Expand Down
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsSourceCall.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.DataFlow2
import HardcodedCredentials
import semmle.code.java.security.HardcodedCredentials
import DataFlow::PathGraph

class HardcodedCredentialSourceCallConfiguration extends DataFlow::Configuration {
Expand Down
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-798/HardcodedPasswordField.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
*/

import java
import HardcodedCredentials
import semmle.code.java.security.HardcodedCredentials

from PasswordVariable f, CompileTimeConstantExpr e
where
Expand Down
6 changes: 3 additions & 3 deletions ...src/Security/CWE/CWE-798/SensitiveApi.qll → .../java/security/CredentialReceivingApi.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
/** Provides predicates to reason about methods that accept a credential (e.g., username, password, or cryptographic secret). */

import java

/**
* Holds if callable `c` from a standard Java API expects a password parameter at index `i`.
*/
/** Holds if callable `c` from a standard Java API expects a password parameter at index `i`. */
predicate javaApiCallablePasswordParam(Callable c, int i) {
exists(c.getParameter(i)) and
javaApiCallablePasswordParam(c.getDeclaringType().getQualifiedName() + ";" +
Expand Down
35 changes: 19 additions & 16 deletions ...rity/CWE/CWE-798/HardcodedCredentials.qll → ...de/java/security/HardcodedCredentials.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
/** Provides classes to analyze the use of hardcoded credentials. */

import java
import SensitiveApi
import semmle.code.java.dataflow.DataFlow
import CredentialReceivingApi

/**
* An array creation expression of type `byte[]` with
Expand Down Expand Up @@ -37,10 +40,8 @@ class HardcodedExpr extends Expr {
}
}

/**
* An argument to a sensitive call, expected to contain credentials.
*/
abstract class CredentialsSink extends Expr {
/** An argument to a sensitive call, expected to contain credentials. */
abstract class CredentialsSink extends DataFlow::Expr {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
abstract class CredentialsSink extends DataFlow::Expr {
abstract class CredentialsSink extends Expr {

The type Expr is not intentionally exposed through the DataFlow module (though with all the import java statements it's no surprise that it slipped in).

Call getSurroundingCall() { this = result.getAnArgument() }
}

Expand All @@ -63,24 +64,26 @@ class CredentialsApiSink extends CredentialsSink {
}
}

/**
* A variable whose name indicates that it may hold a password.
*/
class PasswordVariable extends Variable {
PasswordVariable() {
/** A variable that holds a password. */
abstract class PasswordVariable extends Variable { }

/** A variable whose name indicates that it may hold a password. */
private class ByNamePasswordVariable extends PasswordVariable {
ByNamePasswordVariable() {
getName().regexpMatch("(?i)(encrypted|old|new)?pass(wd|word|code|phrase)(chars|value)?")
}
}

/**
* A variable whose name indicates that it may hold a user name.
*/
class UsernameVariable extends Variable {
UsernameVariable() { getName().regexpMatch("(?i)(user|username)") }
/** A variable that holds a username. */
abstract class UsernameVariable extends Variable { }

/** A variable whose name indicates that it may hold a username. */
private class ByNameUsernameVariable extends UsernameVariable {
ByNameUsernameVariable() { getName().regexpMatch("(?i)(user|username)") }
}

/**
* An argument to a call, where the parameter name corresponding
* An argument to a call, where the parameter corresponding
* to the argument indicates that it may contain credentials.
*/
class CredentialsSourceSink extends CredentialsSink {
Expand Down