Apache Jena 代码执行漏洞(CVE-2023-22665)

/**
 * @kind path-problem
 */

import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph

class PublicMethodParameter extends DataFlow::Node {
  PublicMethodParameter() {
    exists(Method m, Parameter p |
      m.getDeclaringType().isPublic() and
      m.isPublic() and
      p = m.getAParameter() and
      p.getType().hasName("String") and
      this.asParameter() = p
    )
  }
}

class ScriptEngineSink extends DataFlow::Node {
  ScriptEngineSink() {
    exists(MethodAccess ma, Interface i |
      this.asExpr() = ma.getAnArgument() and
      ma.getCallee().getDeclaringType().getASupertype*() = i and
      (
        i.hasQualifiedName("javax.script", "Invocable") and
        (
          ma.getCallee().hasName("invokeFunction") or
          ma.getCallee().hasName("invokeMethod")
        )
        or
        i.hasQualifiedName("javax.script", "Compilable") and
        ma.getCallee().hasName("compile")
        or
        i.hasQualifiedName("javax.script", "ScriptEngine") and
        ma.getCallee().hasName("eval")
      )
    )
  }
}


class TaintTrackingConfig extends TaintTracking::Configuration {
  TaintTrackingConfig() { this = "TaintTrackingConfig" }

  override predicate isSource(DataFlow::Node source) { source instanceof PublicMethodParameter }

  override predicate isSink(DataFlow::Node sink) { sink instanceof ScriptEngineSink }
}

from TaintTrackingConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink,
  "Source: " + source.getNode().asParameter().getCallable().getDeclaringType() + "." +
    source.getNode().asParameter().getCallable()