Skip to content

Commit b68e666

Browse files
atorralbaatorralba
committed
Refactor TemplateInjection libraries
1 parent c972809 commit b68e666

File tree

10 files changed

+159
-419
lines changed

10 files changed

+159
-419
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ private module Frameworks {
117117
private import semmle.code.java.frameworks.Retrofit
118118
private import semmle.code.java.frameworks.Stream
119119
private import semmle.code.java.frameworks.Strings
120+
private import semmle.code.java.frameworks.Velocity
120121
private import semmle.code.java.frameworks.ratpack.Ratpack
121122
private import semmle.code.java.frameworks.ratpack.RatpackExec
122123
private import semmle.code.java.frameworks.spring.SpringCache
@@ -141,6 +142,7 @@ private module Frameworks {
141142
private import semmle.code.java.security.LdapInjection
142143
private import semmle.code.java.security.MvelInjection
143144
private import semmle.code.java.security.OgnlInjection
145+
private import semmle.code.java.security.TemplateInjection
144146
private import semmle.code.java.security.XPath
145147
private import semmle.code.java.security.XsltInjection
146148
private import semmle.code.java.frameworks.Jdbc

‎java/ql/lib/semmle/code/java/frameworks/FreeMarker.qll

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎java/ql/lib/semmle/code/java/frameworks/JinJava.qll

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎java/ql/lib/semmle/code/java/frameworks/Pebble.qll

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎java/ql/lib/semmle/code/java/frameworks/Thymeleaf.qll

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎java/ql/lib/semmle/code/java/frameworks/Velocity.qll

Lines changed: 9 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -1,119 +1,14 @@
11
/** Definitions related to the Apache Velocity Templating library. */
22

33
import java
4-
5-
/** The `org.apache.velocity.context.AbstractContext` class of the Velocity Templating Engine. */
6-
class TypeVelocityAbstractContext extends Class {
7-
TypeVelocityAbstractContext() {
8-
this.hasQualifiedName("org.apache.velocity.context", "AbstractContext")
9-
}
10-
}
11-
12-
/** The `org.apache.velocity.runtime.RuntimeServices` class of the Velocity Templating Engine. */
13-
class TypeVelocityRuntimeRuntimeServices extends Class {
14-
TypeVelocityRuntimeRuntimeServices() {
15-
this.hasQualifiedName("org.apache.velocity.runtime", "RuntimeServices")
16-
}
17-
}
18-
19-
/** The `org.apache.velocity.Template` class of the Velocity Templating Engine. */
20-
class TypeVelocityTemplate extends Class {
21-
TypeVelocityTemplate() { this.hasQualifiedName("org.apache.velocity", "Template") }
22-
}
23-
24-
/** The `org.apache.velocity.runtime.RuntimeSingleton` classTemplating Engine. */
25-
class TypeVelocityRuntimeRuntimeSingleton extends Class {
26-
TypeVelocityRuntimeRuntimeSingleton() {
27-
this.hasQualifiedName("org.apache.velocity.runtime", "RuntimeSingleton")
28-
}
29-
}
30-
31-
/** The `org.apache.velocity.VelocityEngine` class of the Velocity Templating Engine. */
32-
class TypeVelocityVelocityEngine extends Class {
33-
TypeVelocityVelocityEngine() { this.hasQualifiedName("org.apache.velocity", "VelocityEngine") }
34-
}
35-
36-
/** The `org.apache.velocity.app.VelocityEngine` class of the Velocity Templating Engine. */
37-
class TypeVelocityAppVelocityEngine extends RefType {
38-
TypeVelocityAppVelocityEngine() {
39-
this.hasQualifiedName("org.apache.velocity.app", "VelocityEngine")
40-
}
41-
}
42-
43-
/** The `org.apache.velocity.app.Velocity` class of the Velocity Templating Engine. */
44-
class TypeVelocityAppVelocity extends RefType {
45-
TypeVelocityAppVelocity() { this.hasQualifiedName("org.apache.velocity.app", "Velocity") }
46-
}
47-
48-
/**
49-
* The `org.apache.velocity.runtime.resource.util.StringResourceRepository` interface
50-
* of the Velocity Templating Engine.
51-
*/
52-
class TypeVelocityStringResourceRepo extends RefType {
53-
TypeVelocityStringResourceRepo() {
54-
this.hasQualifiedName("org.apache.velocity.runtime.resource.util", "StringResourceRepository")
55-
}
56-
}
57-
58-
/** The `internalPut` and `put` methods of the Velocity Templating Engine. */
59-
class MethodVelocityContextPut extends Method {
60-
MethodVelocityContextPut() {
61-
this.getDeclaringType().getASupertype*() instanceof TypeVelocityAbstractContext and
62-
this.hasName(["put", "internalPut"])
63-
}
64-
}
65-
66-
/** The `evaluate` method of the Velocity Templating Engine. */
67-
class MethodVelocityEvaluate extends Method {
68-
MethodVelocityEvaluate() {
69-
// static boolean evaluate(Context context, Writer out, String logTag, String instring)
70-
// static boolean evaluate(Context context, Writer writer, String logTag, Reader reader)
71-
(
72-
this.getDeclaringType() instanceof TypeVelocityAppVelocity or
73-
this.getDeclaringType() instanceof TypeVelocityAppVelocityEngine or
74-
this.getDeclaringType().getASupertype*() instanceof TypeVelocityRuntimeRuntimeServices
75-
) and
76-
this.hasName("evaluate")
77-
}
78-
}
79-
80-
/** The `mergeTemplate` method of the Velocity Templating Engine. */
81-
class MethodVelocityMergeTemplate extends Method {
82-
MethodVelocityMergeTemplate() {
83-
// static boolean mergeTemplate(String templateName, String encoding, Context context, Writer writer)
84-
(
85-
this.getDeclaringType() instanceof TypeVelocityAppVelocity or
86-
this.getDeclaringType() instanceof TypeVelocityAppVelocityEngine
87-
) and
88-
this.hasName("mergeTemplate")
89-
}
90-
}
91-
92-
/** The `merge` method of the Velocity Templating Engine. */
93-
class MethodVelocityMerge extends Method {
94-
MethodVelocityMerge() {
95-
// void merge(Context context, Writer writer)
96-
// void merge(Context context, Writer writer, List<String> macroLibraries)
97-
this.getDeclaringType() instanceof TypeVelocityTemplate and
98-
this.hasName("merge")
99-
}
100-
}
101-
102-
/** The `parse` method of the Velocity Templating Engine. */
103-
class MethodVelocityParse extends Method {
104-
MethodVelocityParse() {
105-
(
106-
this.getDeclaringType().getASupertype*() instanceof TypeVelocityRuntimeRuntimeSingleton or
107-
this.getDeclaringType().getASupertype*() instanceof TypeVelocityRuntimeRuntimeServices
108-
) and
109-
this.hasName("parse")
110-
}
111-
}
112-
113-
/** The `putStringResource` method of the Velocity Templating Engine. */
114-
class MethodVelocityPutStringResource extends Method {
115-
MethodVelocityPutStringResource() {
116-
this.getDeclaringType().getASupertype*() instanceof TypeVelocityStringResourceRepo and
117-
this.hasName("putStringResource")
4+
private import semmle.code.java.dataflow.ExternalFlow
5+
6+
private class VelocitySummaryModels extends SummaryModelCsv {
7+
override predicate row(string row) {
8+
row =
9+
[
10+
"org.apache.velocity.context;AbstractContext;true;put;;;Argument[1];Argument[-1];taint;manual",
11+
"org.apache.velocity.context;AbstractContext;true;internalPut;;;Argument[1];Argument[-1];taint;manual",
12+
]
11813
}
11914
}

‎java/ql/lib/semmle/code/java/security/TemplateInjection.qll

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
/** Definitions related to the server-side template injection (SST) query. */
2+
3+
import java
4+
private import semmle.code.java.dataflow.FlowSources
5+
private import semmle.code.java.dataflow.ExternalFlow
6+
private import semmle.code.java.dataflow.TaintTracking
7+
8+
/**
9+
* A source for server-side template injection (SST) vulnerabilities.
10+
*/
11+
abstract class TemplateInjectionSource extends DataFlow::Node {
12+
/** Holds if this source has the specified `state`. */
13+
predicate hasState(DataFlow::FlowState state) { state instanceof DataFlow::FlowStateEmpty }
14+
}
15+
16+
/**
17+
* A sink for server-side template injection (SST) vulnerabilities.
18+
*/
19+
abstract class TemplateInjectionSink extends DataFlow::Node {
20+
/** Holds if this sink has the specified `state`. */
21+
predicate hasState(DataFlow::FlowState state) { state instanceof DataFlow::FlowStateEmpty }
22+
}
23+
24+
/**
25+
* A unit class for adding additional taint steps.
26+
*
27+
* Extend this class to add additional taint steps that should apply to flows related to
28+
* server-side template injection (SST) vulnerabilities.
29+
*/
30+
class TemplateInjectionAdditionalTaintStep extends Unit {
31+
/**
32+
* Holds if the step from `node1` to `node2` should be considered a taint
33+
* step for flows related to server-side template injection (SST) vulnerabilities.
34+
*/
35+
predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
36+
37+
/**
38+
* Holds if the step from `node1` to `node2` should be considered a taint
39+
* step for flows related toserver-side template injection (SST) vulnerabilities.
40+
* This step is only applicable in `state1` and updates the flow state to `state2`.
41+
*/
42+
predicate isAdditionalTaintStep(
43+
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
44+
DataFlow::FlowState state2
45+
) {
46+
none()
47+
}
48+
}
49+
50+
/**
51+
* A sanitizer for server-side template injection (SST) vulnerabilities.
52+
*/
53+
abstract class TemplateInjectionSanitizer extends DataFlow::Node {
54+
/** Holds if this sanitizer has the specified `state`. */
55+
predicate hasState(DataFlow::FlowState state) { state instanceof DataFlow::FlowStateEmpty }
56+
}
57+
58+
private class DefaultTemplateInjectionSource extends TemplateInjectionSource instanceof RemoteFlowSource {
59+
}
60+
61+
private class DefaultTemplateInjectionSink extends TemplateInjectionSink {
62+
DefaultTemplateInjectionSink() { sinkNode(this, "ssti") }
63+
}
64+
65+
private class DefaultTemplateInjectionSanitizer extends TemplateInjectionSanitizer {
66+
DefaultTemplateInjectionSanitizer() {
67+
this.getType() instanceof PrimitiveType or
68+
this.getType() instanceof BoxedType or
69+
this.getType() instanceof NumericType
70+
}
71+
}
72+
73+
private class TemplateInjectionSinkModels extends SinkModelCsv {
74+
override predicate row(string row) {
75+
row =
76+
[
77+
"freemarker.template;Template;true;process;;;Argument[0];ssti;manual",
78+
"freemarker.template;Template;true;Template;(String,Reader);;Argument[1];ssti;manual",
79+
"freemarker.template;Template;true;Template;(String,Reader,Configuration);;Argument[1];ssti;manual",
80+
"freemarker.template;Template;true;Template;(String,Reader,Configuration,String);;Argument[1];ssti;manual",
81+
"freemarker.template;Template;true;Template;(String,String,Reader,Configuration);;Argument[2];ssti;manual",
82+
"freemarker.template;Template;true;Template;(String,String,Reader,Configuration,String);;Argument[2];ssti;manual",
83+
"freemarker.template;Template;true;Template;(String,String,Reader,Configuration,ParserConfiguration,String);;Argument[2];ssti;manual",
84+
"freemarker.template;Template;true;Template;(String,String,Configuration);;Argument[1];ssti;manual",
85+
"freemarker.cache;StringTemplateLoader;true;putTemplate;;;Argument[1];ssti;manual",
86+
"com.mitchellbosecke.pebble;PebbleEngine;true;getTemplate;;;Argument[0];ssti;manual",
87+
"com.mitchellbosecke.pebble;PebbleEngine;true;getLiteralTemplate;;;Argument[0];ssti;manual",
88+
"com.hubspot.jinjava;Jinjava;true;renderForResult;;;Argument[0];ssti;manual",
89+
"com.hubspot.jinjava;Jinjava;true;render;;;Argument[0];ssti;manual",
90+
"org.thymeleaf;ITemplateEngine;true;process;;;Argument[0];ssti;manual",
91+
"org.thymeleaf;ITemplateEngine;true;processThrottled;;;Argument[0];ssti;manual",
92+
"org.apache.velocity.app;Velocity;true;evaluate;;;Argument[0];ssti;manual",
93+
"org.apache.velocity.app;Velocity;true;evaluate;;;Argument[3];ssti;manual",
94+
"org.apache.velocity,app;VelocityEngine;true;evaluate;;;Argument[0];ssti;manual",
95+
"org.apache.velocity,app;VelocityEngine;true;evaluate;;;Argument[3];ssti;manual",
96+
"org.apache.velocity.app;Velocity;true;mergeTemplate;;;Argument[2];ssti;manual",
97+
"org.apache.velocity.app;VelocityEngine;true;mergeTemplate;;;Argument[2];ssti;manual",
98+
"org.apache.velocity.runtime.resource.util;StringResourceRepository;true;putStringResource;;;Argument[1];ssti;manual",
99+
"org.apache.velocity.runtime;RuntimeServices;true;evaluate;;;Argument[0];ssti;manual",
100+
"org.apache.velocity.runtime;RuntimeServices;true;evaluate;;;Argument[3];ssti;manual",
101+
"org.apache.velocity.runtime;RuntimeServices;true;parse;;;Argument[0];ssti;manual",
102+
"org.apache.velocity.runtime;RuntimeSingleton;true;parse;;;Argument[0];ssti;manual",
103+
"org.apache.velocity;Template;true;merge;;;Argument[0];ssti;manual"
104+
]
105+
}
106+
}

‎java/ql/lib/semmle/code/java/security/TemplateInjectionQuery.qll

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/** Provides a taint tracking configuration for server-side template injection (SST) vulnerabilities */
2+
3+
import java
4+
import semmle.code.java.dataflow.TaintTracking
5+
import semmle.code.java.dataflow.FlowSources
6+
import semmle.code.java.security.TemplateInjection
7+
8+
/** A taint tracking configuration to reason about server-side template injection (SST) vulnerabilities */
9+
class TemplateInjectionFlowConfig extends TaintTracking::Configuration {
10+
TemplateInjectionFlowConfig() { this = "TemplateInjectionFlowConfig" }
11+
12+
override predicate isSource(DataFlow::Node source) { this.isSource(source, _) }
13+
14+
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
15+
source.(TemplateInjectionSource).hasState(state)
16+
}
17+
18+
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
19+
20+
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
21+
sink.(TemplateInjectionSink).hasState(state)
22+
}
23+
24+
override predicate isSanitizer(DataFlow::Node sanitizer) { this.isSanitizer(sanitizer, _) }
25+
26+
override predicate isSanitizer(DataFlow::Node sanitizer, DataFlow::FlowState state) {
27+
sanitizer.(TemplateInjectionSanitizer).hasState(state)
28+
}
29+
30+
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
31+
any(TemplateInjectionAdditionalTaintStep a).isAdditionalTaintStep(node1, node2)
32+
}
33+
34+
override predicate isAdditionalTaintStep(
35+
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
36+
DataFlow::FlowState state2
37+
) {
38+
any(TemplateInjectionAdditionalTaintStep a).isAdditionalTaintStep(node1, state1, node2, state2)
39+
}
40+
}

0 commit comments

Comments
 (0)