前言

污点分析技术介绍

在Eclipse上搭建CodeQL环境

CodeQL for Eclipse - http://update.semmle.com/ql-for-eclipse/latest

cd codeql-projectcodeql database create ./database -s . --language=java --command="mvn install"

Successfully created database at D:\Program\Project\java\database.

codeql database bundle --include-uncompressed-source -o ./database.zip ./database

CodeQL数据流分析反序列化

class Node {  /** Gets the expression corresponding to this node, if any. */  Expr asExpr() { ... }
  /** Gets the parameter corresponding to this node, if any. */  Parameter asParameter() { ... }
  ...}

import semmle.code.java.dataflow.DataFlow
class MyDataFlowConfiguration extends DataFlow::Configuration {  MyDataFlowConfiguration() { this = "MyDataFlowConfiguration" } //定义Name
  override predicate isSource(DataFlow::Node source) {    ...  }
  override predicate isSink(DataFlow::Node sink) {    ...  }}

import semmle.code.java.dataflow.TaintTracking
class MyTaintTrackingConfiguration extends TaintTracking::Configuration {  MyTaintTrackingConfiguration() { this = "MyTaintTrackingConfiguration" }
  override predicate isSource(DataFlow::Node source) {    ...  }
  override predicate isSink(DataFlow::Node sink) {    ...  }}

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {    HttpServletRequest httpRequest = (HttpServletRequest)request;        java.security.Principal user = httpRequest.getUserPrincipal();        if(user == null && readOnlyContext != null)        {            javax.servlet.ServletInputStream sis = request.getInputStream();            ObjectInputStream ois = new ObjectInputStream(sis);            Object mi = null;            try            {                mi = (Object)ois.readObject();            }            catch(ClassNotFoundException e)            {                throw new ServletException("Failed to read MarshalledInvocation", e);            }            request.setAttribute("MarshalledInvocation", mi);        }        chain.doFilter(request, response);  }

/** * @name Deserialization of user-controlled data * @description Deserializing user-controlled data may allow attackers to *              execute arbitrary code. * @kind path-problem * @problem.severity error * @precision high * @id java/unsafe-deserialization * @tags security *       external/cwe/cwe-502 */
import javaimport semmle.code.java.dataflow.FlowSourcesimport semmle.code.java.security.UnsafeDeserializationimport DataFlow::PathGraph
class UnsafeDeserializationConfig extends TaintTracking::Configuration {  UnsafeDeserializationConfig() { this = "UnsafeDeserializationConfig" }
  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
  override predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserializationSink }}
from DataFlow::PathNode source, DataFlow::PathNode sink, UnsafeDeserializationConfig confwhere conf.hasFlowPath(source, sink)select sink.getNode().(UnsafeDeserializationSink).getMethodAccess(), source, sink,  "Unsafe deserialization of $@.", source.getNode(), "user input"

from DataFlow::PathNode source, DataFlow::PathNode sink, UnsafeDeserializationConfig confwhere conf.hasFlowPath(source, sink)select "Sink点:", sink.getNode().asExpr().getLocation(),"Source点:",source.getNode().asExpr().getLocation(),"Sink Method:",sink.getNode().(UnsafeDeserializationSink).getMethodAccess()

如何定位Sink

class ObjectInputStreamReadObjectMethod extends Method {  ObjectInputStreamReadObjectMethod() {    this.getDeclaringType().getASourceSupertype*().hasQualifiedName("java.io", "ObjectInputStream") and    (this.hasName("readObject") or this.hasName("readUnshared"))  }}

import java
from Method methodwhere method.hasName("readObject")select method, method.getDeclaringType()

import java
from Method methodwhere method.hasName("readObject") and method.getDeclaringType().hasQualifiedName("java.io", "ObjectInputStream")select method,method.getDeclaringType()

import java
from Method methodwhere method.hasName("readObject") and method.getDeclaringType().getAnAncestor().hasQualifiedName("java.io", "ObjectInputStream")select method,method.getDeclaringType()

import java
from MethodAccess call, Method methodwhere method.hasName("readObject") and method.getDeclaringType().getAnAncestor().hasQualifiedName("java.io", "ObjectInputStream") and call.getMethod() = methodselect call

Reference

喜欢本文点个在看