Java: Update CWE-918 model coverage for Apache HttpClient execute sinks
#21804
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * Improved modeling of Apache HttpClient `execute` method sinks for `java/ssrf` and `java/non-https-url`. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,195 @@ | ||
| import java.io.IOException; | ||
| import java.net.URI; | ||
|
|
||
| import org.apache.http.Header; | ||
| import org.apache.http.HeaderIterator; | ||
| import org.apache.http.HttpHost; | ||
| import org.apache.http.HttpRequest; | ||
| import org.apache.http.HttpResponse; | ||
| import org.apache.http.ProtocolVersion; | ||
| import org.apache.http.RequestLine; | ||
| import org.apache.http.client.HttpClient; | ||
| import org.apache.http.client.ResponseHandler; | ||
| import org.apache.http.client.methods.HttpUriRequest; | ||
| import org.apache.http.message.BasicHttpRequest; | ||
| import org.apache.http.params.HttpParams; | ||
| import org.apache.http.protocol.HttpContext; | ||
| import javax.servlet.ServletException; | ||
| import javax.servlet.http.HttpServlet; | ||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
|
|
||
| public class ApacheHttpClientExecuteSSRF extends HttpServlet { | ||
|
|
||
| protected void doGet(HttpServletRequest request, HttpServletResponse response) | ||
| throws ServletException, IOException { | ||
| try { | ||
|
|
||
| String sink = request.getParameter("host"); // $ Source | ||
|
|
||
| HttpHost host = new HttpHost(sink); | ||
| HttpRequest req = new BasicHttpRequest("GET", "/"); | ||
| HttpUriRequest uriReq = new HttpUriRequest() { | ||
| @Override | ||
| public String getMethod() { | ||
| return "GET"; | ||
| } | ||
|
|
||
| @Override | ||
| public URI getURI() { | ||
| return URI.create("https://" + sink); | ||
| } | ||
|
|
||
| @Override | ||
| public void abort() throws UnsupportedOperationException { | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isAborted() { | ||
| return false; | ||
| } | ||
|
|
||
| @Override | ||
| public RequestLine getRequestLine() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public ProtocolVersion getProtocolVersion() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean containsHeader(String name) { | ||
| return false; | ||
| } | ||
|
|
||
| @Override | ||
| public Header[] getHeaders(String name) { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public Header getFirstHeader(String name) { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public Header getLastHeader(String name) { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public Header[] getAllHeaders() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public void addHeader(Header header) { | ||
| } | ||
|
|
||
| @Override | ||
| public void addHeader(String name, String value) { | ||
| } | ||
|
|
||
| @Override | ||
| public void setHeader(Header header) { | ||
| } | ||
|
|
||
| @Override | ||
| public void setHeader(String name, String value) { | ||
| } | ||
|
|
||
| @Override | ||
| public void setHeaders(Header[] headers) { | ||
| } | ||
|
|
||
| @Override | ||
| public void removeHeader(Header header) { | ||
| } | ||
|
|
||
| @Override | ||
| public void removeHeaders(String name) { | ||
| } | ||
|
|
||
| @Override | ||
| public HeaderIterator headerIterator() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public HeaderIterator headerIterator(String name) { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public HttpParams getParams() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public void setParams(HttpParams params) { | ||
| } | ||
| }; | ||
| HttpContext context = null; | ||
| HttpClient client = new HttpClient() { | ||
| @Override | ||
| public HttpResponse execute(HttpHost target, HttpRequest request) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public HttpResponse execute(HttpHost target, HttpRequest request, HttpContext context) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public <T> T execute(HttpHost target, HttpRequest request, ResponseHandler<? extends T> responseHandler) | ||
| throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public <T> T execute(HttpHost target, HttpRequest request, ResponseHandler<? extends T> responseHandler, | ||
| HttpContext context) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public HttpResponse execute(HttpUriRequest request) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public HttpResponse execute(HttpUriRequest request, HttpContext context) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public <T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler) | ||
| throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public <T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler, | ||
| HttpContext context) throws IOException { | ||
| return null; | ||
| } | ||
| }; | ||
| ResponseHandler<Object> handler = null; | ||
|
Comment on lines
+30
to
+180
Contributor
There was a problem hiding this comment. I agree that this is confusing. Also, the source is named sink, which is confusing as well. |
||
|
|
||
| client.execute(host, req); // $ Alert | ||
| client.execute(host, req, context); // $ Alert | ||
| client.execute(host, req, handler); // $ Alert | ||
| client.execute(host, req, handler, context); // $ Alert | ||
| client.execute(uriReq); // $ Alert | ||
| client.execute(uriReq, context); // $ Alert | ||
| client.execute(uriReq, handler); // $ Alert | ||
| client.execute(uriReq, handler, context); // $ Alert | ||
|
|
||
| } catch (Exception e) { | ||
| // TODO: handle exception | ||
| } | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this right? Based on the type names and the models below, which target the
HttpUriRequestargument, I'd expect the sink to be theHttpRequestargument (possibly in addition toHttpHost).