Skip to content

Commit cb01613

Browse files
luchua-bcluchua-bc
committed
Exclude FP token patterns
1 parent fee0b94 commit cb01613

3 files changed

Lines changed: 40 additions & 1 deletion

File tree

‎java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ import DataFlow::PathGraph
1717
class SensitiveInfoExpr extends Expr {
1818
SensitiveInfoExpr() {
1919
exists(Variable v | this = v.getAnAccess() |
20-
v.getName().regexpMatch(getCommonSensitiveInfoRegex())
20+
v.getName().regexpMatch(getCommonSensitiveInfoRegex()) and
21+
not v.getName().regexpMatch("token.*") // exclude ^token$ and ^token.* since sensitive tokens are in the form of accessToken, authToken, ...
2122
)
2223
}
2324
}

‎java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ edges
66
| SensitiveGetQuery2.java:18:40:18:54 | password : Object | SensitiveGetQuery2.java:19:61:19:68 | password |
77
| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password |
88
| SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String |
9+
| SensitiveGetQuery4.java:14:24:14:66 | getRequestParameter(...) : String | SensitiveGetQuery4.java:16:37:16:47 | accessToken |
10+
| SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) : String | SensitiveGetQuery4.java:14:24:14:66 | getRequestParameter(...) : String |
911
| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password |
1012
| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password : String |
1113
| SensitiveGetQuery.java:14:29:14:36 | password : String | SensitiveGetQuery.java:17:40:17:54 | password : String |
@@ -20,6 +22,9 @@ nodes
2022
| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | semmle.label | getRequestParameter(...) : String |
2123
| SensitiveGetQuery3.java:13:57:13:64 | password | semmle.label | password |
2224
| SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | semmle.label | getParameter(...) : String |
25+
| SensitiveGetQuery4.java:14:24:14:66 | getRequestParameter(...) : String | semmle.label | getRequestParameter(...) : String |
26+
| SensitiveGetQuery4.java:16:37:16:47 | accessToken | semmle.label | accessToken |
27+
| SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) : String | semmle.label | getParameter(...) : String |
2328
| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
2429
| SensitiveGetQuery.java:14:29:14:36 | password | semmle.label | password |
2530
| SensitiveGetQuery.java:14:29:14:36 | password : String | semmle.label | password : String |
@@ -29,5 +34,6 @@ nodes
2934
| SensitiveGetQuery2.java:15:29:15:36 | password | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:15:29:15:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) | This request |
3035
| SensitiveGetQuery2.java:19:61:19:68 | password | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:19:61:19:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) | This request |
3136
| SensitiveGetQuery3.java:13:57:13:64 | password | SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) | This request |
37+
| SensitiveGetQuery4.java:16:37:16:47 | accessToken | SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) : String | SensitiveGetQuery4.java:16:37:16:47 | accessToken | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) | This request |
3238
| SensitiveGetQuery.java:14:29:14:36 | password | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) | This request |
3339
| SensitiveGetQuery.java:18:61:18:68 | password | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:18:61:18:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) | This request |

‎java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery4.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
import java.io.IOException;
2+
3+
import javax.servlet.http.HttpServlet;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
6+
import javax.servlet.ServletException;
7+
8+
public class SensitiveGetQuery4 extends HttpServlet {
9+
// BAD - Tests sending sensitive information in a GET request.
10+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
11+
String username = getRequestParameter(request, "username");
12+
String token = getRequestParameter(request, "token");
13+
String tokenType = getRequestParameter(request, "tokenType");
14+
String accessToken = getRequestParameter(request, "accessToken");
15+
System.out.println("Username="+username+"; token="+token+"; tokenType="+tokenType);
16+
System.out.println("AccessToken="+accessToken);
17+
}
18+
19+
String getRequestParameter(HttpServletRequest request, String paramName) {
20+
return request.getParameter(paramName);
21+
}
22+
23+
// GOOD - Tests sending sensitive information in a POST request.
24+
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
25+
String username = getRequestParameter(request, "username");
26+
String token = getRequestParameter(request, "token");
27+
String tokenType = getRequestParameter(request, "tokenType");
28+
String accessToken = getRequestParameter(request, "accessToken");
29+
System.out.println("Username="+username+"; token="+token+"; tokenType="+tokenType);
30+
System.out.println("AccessToken="+accessToken);
31+
}
32+
}

0 commit comments

Comments
 (0)