codeql/java/ql/src/Security/CWE/CWE-319/UseSSL.ql at codeql-cli/v2.19.1 · github/codeql · GitHub

History

45 lines (41 loc) · 1.15 KB

Raw

/**

* @name Failure to use SSL

* @description Non-SSL connections can be intercepted by third parties.

* @kind problem

* @problem.severity recommendation

* @security-severity 7.5

* @precision medium

* @id java/non-ssl-connection

* @tags security

* external/cwe/cwe-319

import java

import semmle.code.java.dataflow.TypeFlow

import semmle.code.java.security.Encryption

class UrlConnection extends RefType {

UrlConnection() {

this.getAnAncestor().hasQualifiedName("java.net", "URLConnection") and

not this.hasName("JarURLConnection")

}

class Socket extends RefType {

Socket() { this.getAnAncestor().hasQualifiedName("java.net", "Socket") }

}

from MethodCall m, Class c, string type

where

m.getQualifier().getType() = c and

(

c instanceof UrlConnection and type = "connection"

c instanceof Socket and type = "socket"

) and

not c instanceof SslClass and

not exists(RefType t |

exprTypeFlow(m.getQualifier(), t, _) and

t instanceof SslClass

) and

(

m.getMethod().getName() = "getInputStream" or

m.getMethod().getName() = "getOutputStream"

)

select m, "Stream using vulnerable non-SSL " + type + "."

codeql/java/ql/src/Security/CWE/CWE-319/UseSSL.ql at codeql-cli/v2.19.1 · github/codeql · GitHub

Uh oh!

Expand file tree

Breadcrumbs

UseSSL.ql

Latest commit

History

Breadcrumbs

UseSSL.ql

File metadata and controls