CodeQL静态代码扫描之实现关联接口、入参、和危险方法并自动化构造payload及抽象类探究

from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink where queryTaintedBy(query, source, sink)

select

query, source,sink

class QueryInjectionFlowConfig extends TaintTracking::Configuration {

//定义配置 this可以随意写  

    QueryInjectionFlowConfig() { this = "SqlInjectionLib::QueryInjectionFlowConfig" }

//定义source的来源，这里是来自RemoteFlowSource，这是一个官方写的class，较为全面的定义了远程可控的来源，但是还是有一些问题。我做了一些补充，以后会提及  

    override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }

//QueryInjectionSink定义了sink的约束条件  

    override predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }

//过滤条件，这里对node中的数据类型做了判断，如果是一些int long之类的数据类型就会抛弃不会进入数据流判断，这也是CodeQL较为准确的识别SQL注入的原因之一。  

    override predicate isSanitizer(DataFlow::Node node) {    node.getType() instanceof PrimitiveType or    node.getType() instanceof BoxedType or    node.getType() instanceof NumberType 

    }

}

predicate queryTaintedBy(  

    QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink

) {  

    exists(QueryInjectionFlowConfig conf | conf.hasFlowPath(source, sink) and sink.getNode() = query)

}

from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink 

where queryTaintedBy(query, source, sink)

select

query, "接口地址:",

//获得source的注解的值，Spring中为接口地址

source    

    .getNode()    

    .asParameter()    

    .getCallable()    

    .getAnAnnotation()    

    .getValue("value"),

"接口参数:",

//获得接口的参数名

source    

    .getNode()    

    .asParameter()    

    .getAnAnnotation()

    .getValue("value"),

//获得sink所在的文件位置

"文件地址:",

sink.getNode().asExpr().getLocation(),

//获得source节点的路径的http方法"请求类型:",

methodIsPostOrGet(sink),

"注解内容为:",

//获得注解source.getNode().asParameter().getAnAnnotation().toString()

POST http/1.1

header:xxx

xx

Username=xsser’ and 1=1

GET /url/from/Spring?username=xsser%27 and 1=1 http/1.1

heder

xxxx

xxx

abstract class PathCreation extends Expr {  

    abstract Expr getInput();

}
class PathsGet extends PathCreation, MethodAccess {  

    PathsGet() {    

        …  

    }

    override Expr getInput() { result = this.getAnArgument() }}

class FileSystemGetPath extends PathCreation, MethodAccess {  

    FileSystemGetPath() {    

        …  

    }

    override Expr getInput() { result = this.getAnArgument() }

}

class FileCreation extends PathCreation, ClassInstanceExpr {  

    FileCreation() { …}

override Expr getInput() {    

    result = this.getAnArgument() and    

    // Relevant arguments include those that are not a `File`.    

    not result.getType() instanceof TypeFile  

    }

}

class FileWriterCreation extends PathCreation, ClassInstanceExpr {  

    FileWriterCreation() { this.getConstructedType().getQualifiedName() = "java.io.FileWriter" }

    override Expr getInput() {    

        result = this.getAnArgument() and    

        // Relevant arguments are those of type `String`.    

        result.getType() instanceof TypeString  

    }

}
predicate inWeakCheck(Expr e) {  

    none()

}

// Ignore cases where the variable has been checked somehow,

// but allow some particularly obviously bad cases.predicate guarded(VarAccess e) {  

    none()  

    )

}

abstract class PathCreation extends Expr {    

    abstract Expr getInput();  

}   

class PathsGet extends PathCreation, MethodAccess {    

    // 寻找`java.nio.file.Paths`类下的get方法    

    PathsGet() {      

        exists(Method m | m = this.getMethod() |        

            m.getDeclaringType() instanceof TypePaths and        

            m.getName() = "get"      

        )    

    }    

    // 返回这个方法的集合    

    override Expr getInput() { result = this.getAnArgument() }  

}   

class FileSystemGetPath extends PathCreation, MethodAccess {    

    // 寻找`java.nio.file.FileSystem`类下的getPath方法并通过getInput方法返回这个集合    

    FileSystemGetPath() {      

        exists(Method m | m = this.getMethod() |        

            m.getDeclaringType() instanceof TypeFileSystem and        

            m.getName() = "getPath"      

    )    

}     

    override Expr getInput() { result = this.getAnArgument() }  

}   

class FileCreation extends PathCreation, ClassInstanceExpr {    

    //   限定实例化的对象的原型在`java.io.File`类下    

    // 例如new xxx()  这个xxx必须在`java.io.File`下    

    FileCreation() { this.getConstructedType() instanceof TypeFile } 

    override Expr getInput() {        

        // 获得上述实例化的class的参数，并且这个参数的类型必须是file类型的，并返回满足and条件的参数集合      

        result = this.getAnArgument() and      

        // Relevant arguments include those that are not a `File`.      

        not result.getType() instanceof TypeFile    

    }  

}   

class FileWriterCreation extends PathCreation, ClassInstanceExpr { 

    //   限定在`java.io.FileWriter`类下    

    FileWriterCreation() { this.getConstructedType().getQualifiedName() = "java.io.FileWriter" }    

    // 返回参数类型是String类型的参数    

    override Expr getInput() {      

        result = this.getAnArgument() and      

        // Relevant arguments are those of type `String`.      

        result.getType() instanceof TypeString    

    }  

}   

predicate inWeakCheck(Expr e) {    

    // None of these are sufficient to guarantee that a string is safe.  

    // 约束一个类下的方法如果是startswith等方法，注意这里的方法是原生的，这里建议扩大覆盖范围，使用matches去匹配类似的方法名    

    exists(MethodAccess m, Method def | m.getQualifier() = e and m.getMethod() = def |      

        def.getName() = "startsWith" or      

        def.getName() = "endsWith" or      

        def.getName() = "isEmpty" or      

        def.getName() = "equals"    

    )    

    or    

    // Checking against `null` has no bearing on path traversal.    

    exists(EqualityTest b | b.getAnOperand() = e | b.getAnOperand() instanceof NullLiteral)  

}   

// Ignore cases where the variable has been checked somehow,  

// but allow some particularly obviously bad cases.  

predicate guarded(VarAccess e) {    

    //   一个参数必须存在于上面抽象类返回结果的集合中且条件分支为True的情况下的方法，还要不是StartsWith等方法    

    exists(PathCreation p | e = p.getInput()) and    

    exists(ConditionBlock cb, Expr c |      

    cb.getCondition().getAChildExpr*() = c and      

    c = e.getVariable().getAnAccess() and      

    cb.controls(e.getBasicBlock(), true) and      

    // Disallow a few obviously bad checks.      

    not inWeakCheck(c)    

    )  

}