Skip to content

Java : add fastjson detection. Improve RemoteFlowSource class, support SpringMvc #119

Closed
Closed
Java : add fastjson detection. Improve RemoteFlowSource class, support SpringMvc#119
Labels
All For OneSubmissions to the All for One, One for All bounty

Description

@haby0
haby0
opened on Jun 10, 2020

CVE

There is no CVE for this.

Report

This query adds Fastjson deserialization sinks.

JSON.parseObject(cmd);
JSON.parse(cmd);

It has been added to CWE-502. I found that RemoteFlowSource cannot be supported in the test: (1) SpringMVC directly submits parameters; (2) SpringMVC does routing access through Mapping annotations, and the original verification does not have this logic. I Some additions have been made here.

please check:

codeql\java\ql\src\semmle\code\java\frameworks\SpringMVC.qll

codeql\java\ql\src\semmle\code\java\dataflow\FlowSources.qll SpringMVC class

codeql\java\ql\src\semmle\code\java\security\UnsafeDeserialization.qll

codeql\java\ql\src\Security\CWE\CWE-502

Link to the PR:github/codeql#3665

Activity

  1. haby0
    added
    All For OneSubmissions to the All for One, One for All bounty
    on Jun 10, 2020

  2. haby0 commented on Jun 10, 2020

    @haby0
    haby0
    on Jun 10, 2020
    Author

    Some problems occurred on my side, new prs were added, the problem is the same.
    Link to the PR:github/codeql#3674

  3. ghsecuritylab commented on Aug 20, 2020

    @ghsecuritylab
    ghsecuritylab
    on Aug 20, 2020
    Collaborator

    Your submission is now in status SecLab review.

    For information, the evaluation workflow is the following:
    CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

  4. ghsecuritylab commented on Oct 6, 2020

    @ghsecuritylab
    ghsecuritylab
    on Oct 6, 2020
    Collaborator

    Your submission is now in status CodeQL review.

    For information, the evaluation workflow is the following:
    CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

  5. ghsecuritylab commented on Nov 23, 2020

    @ghsecuritylab
    ghsecuritylab
    on Nov 23, 2020
    Collaborator

    Your submission is now in status SecLab finalize.

    For information, the evaluation workflow is the following:
    CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

  6. xcorail commented on Dec 1, 2020

    @xcorail
    xcorail
    on Dec 1, 2020
    Contributor

    Hello @haby0
    Can you please privately send me your email?
    Thanks

  7. ghsecuritylab commented on Dec 4, 2020

    @ghsecuritylab
    ghsecuritylab
    on Dec 4, 2020
    Collaborator

    Your submission is now in status Pay.

    For information, the evaluation workflow is the following:
    CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

  8. ghsecuritylab commented on Dec 4, 2020

    @ghsecuritylab
    ghsecuritylab
    on Dec 4, 2020
    Collaborator

    Your submission is now in status Closed.

    For information, the evaluation workflow is the following:
    CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

  9. xcorail
    closed this as completedon Dec 4, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    All For OneSubmissions to the All for One, One for All bounty

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions