seaworthycode 1.1.2 → 1.1.4

package/rules/internal/taint/go.yaml

@@ -0,0 +1,325 @@
+# attribution: CWE-79
+attribution: CWE-79
+language: go
+applies-to: []
+
+sources:
+  - id: net/http.FormValue
+    class: http-params
+    query: |
+      (call_expression
+        function: (selector_expression
+          field: (field_identifier) @method
+          (#match? @method "^(FormValue|PostFormValue)$"))
+        arguments: (argument_list (_) @arg)) @source
+
+  - id: net/http.URL.Query
+    class: http-params
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (call_expression
+            function: (selector_expression
+              field: (field_identifier) @query
+              (#eq? @query "Query")))
+          field: (field_identifier) @get
+          (#eq? @get "Get"))
+        arguments: (argument_list (_) @arg)) @source
+
+  - id: gin.Context.Query
+    class: http-params
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @recv
+          field: (field_identifier) @method
+          (#match? @recv "^c$")
+          (#match? @method "^(Query|Param|PostForm)$"))
+        arguments: (argument_list (_) @arg)) @source
+
+  - id: echo.Context.Query
+    class: http-params
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @recv
+          field: (field_identifier) @method
+          (#match? @recv "^c$")
+          (#match? @method "^(QueryParam|FormValue)$"))
+        arguments: (argument_list (_) @arg)) @source
+
+  - id: net/http.Request.Body
+    class: http-body
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "io")
+          (#eq? @field "ReadAll"))
+        arguments: (argument_list
+          (selector_expression
+            field: (field_identifier) @body
+            (#eq? @body "Body")))) @source
+
+  - id: os.Args
+    class: process-argv
+    query: |
+      (index_expression
+        operand: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "os")
+          (#eq? @field "Args"))) @source
+
+  - id: os.Getenv
+    class: env-var
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "os")
+          (#eq? @field "Getenv"))
+        arguments: (argument_list (_) @arg)) @source
+
+  - id: io.ReadAll
+    class: network-response
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "io")
+          (#eq? @field "ReadAll"))
+        arguments: (argument_list
+          (_) @arg
+          (#not-match? @arg "Body"))) @source
+
+  - id: os.ReadFile
+    class: fs-read
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "os")
+          (#eq? @field "ReadFile"))
+        arguments: (argument_list (_) @arg)) @source
+
+sinks:
+  - id: fmt.Fprintf
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "fmt")
+          (#eq? @field "Fprintf"))
+        arguments: (argument_list (_) @sink .)) @match
+
+  - id: io.WriteString
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "io")
+          (#eq? @field "WriteString"))
+        arguments: (argument_list (_) @sink .)) @match
+
+  - id: template.HTML
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "template")
+          (#eq? @field "HTML"))
+        arguments: (argument_list (_) @sink)) @match
+
+  - id: gin.Context.String
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @recv
+          field: (field_identifier) @field
+          (#match? @recv "^c$")
+          (#match? @field "^(String|HTML)$"))
+        arguments: (argument_list (_) @sink .)) @match
+
+  - id: db.Query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (selector_expression
+          field: (field_identifier) @field
+          (#match? @field "^(Query|Exec|QueryRow)$"))
+        arguments: (argument_list . (_) @sink)) @match
+
+  - id: fmt.Sprintf-sql
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "fmt")
+          (#eq? @field "Sprintf"))
+        arguments: (argument_list
+          (interpreted_string_literal) @sink
+          (#match? @sink "SELECT|INSERT|UPDATE|DELETE|UNION"))) @match
+
+  - id: exec.Command
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "exec")
+          (#match? @field "^(Command|CommandContext)$"))
+        arguments: (argument_list (_) @sink .)) @match
+
+  - id: os.Open
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "os")
+          (#match? @field "^(Open|OpenFile|ReadFile|Create)$"))
+        arguments: (argument_list . (_) @sink)) @match
+
+  - id: http.Redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "http")
+          (#eq? @field "Redirect"))
+        arguments: (argument_list
+          (_) (_) (_) @sink
+          (#not-match? @sink "^[0-9]+$"))) @match
+
+  - id: gin.Context.Redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @recv
+          field: (field_identifier) @field
+          (#match? @recv "^c$")
+          (#eq? @field "Redirect"))
+        arguments: (argument_list
+          (_) (_) @sink
+          (#not-match? @sink "^[0-9]+$"))) @match
+
+  - id: maps.Copy
+    sink-class: prototype-pollution
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "maps")
+          (#eq? @field "Copy"))
+        arguments: (argument_list
+          (_)
+          [
+            (identifier) @sink
+            (call_expression) @sink
+            (selector_expression) @sink
+            (index_expression) @sink
+            (binary_expression) @sink
+          ])) @match
+
+  - id: plugin.Open
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "plugin")
+          (#eq? @field "Open"))
+        arguments: (argument_list . (_) @sink)) @match
+
+sanitisers:
+  - id: html.EscapeString
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "html")
+          (#eq? @field "EscapeString"))
+        arguments: (argument_list (_) @arg)) @sanitiser
+
+  - id: url.QueryEscape
+    sanitises: [url-injection]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "url")
+          (#eq? @field "QueryEscape"))
+        arguments: (argument_list (_) @arg)) @sanitiser
+
+  - id: filepath.Clean
+    sanitises: [path-traversal]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "filepath")
+          (#eq? @field "Clean"))
+        arguments: (argument_list (_) @arg)) @sanitiser
+
+  - id: maps.Clone
+    sanitises: [prototype-pollution]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "maps")
+          (#eq? @field "Clone"))
+        arguments: (argument_list (_) @arg)) @sanitiser
+
+  - id: parameterised-query
+    sanitises: [sql-injection]
+    query: |
+      (call_expression
+        function: (selector_expression
+          field: (field_identifier) @field
+          (#match? @field "^(Query|Exec|QueryRow)$"))
+        arguments: (argument_list
+          (interpreted_string_literal)
+          (_))) @sanitiser
+
+  - id: strconv.Quote
+    sanitises: [command-injection]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (selector_expression
+          operand: (identifier) @obj
+          field: (field_identifier) @field
+          (#eq? @obj "strconv")
+          (#eq? @field "Quote"))
+        arguments: (argument_list (_) @arg)) @sanitiser

package/rules/internal/taint/java.test.yaml

@@ -0,0 +1,158 @@
+language: java
+cases:
+  - name: "SQLi servlet — getParameter to executeQuery concat"
+    language: java
+    code: |
+      class T {
+        void f(java.sql.Statement stmt, javax.servlet.http.HttpServletRequest req) throws Exception {
+          String id = req.getParameter("id");
+          stmt.executeQuery("SELECT * FROM users WHERE id = " + id);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: servlet.request.getParameter
+          sinkId: java.Statement.execute
+
+  - name: "SQLi sanitised — parameterised execute"
+    language: java
+    code: |
+      class T {
+        void f(java.sql.PreparedStatement ps, javax.servlet.http.HttpServletRequest req) throws Exception {
+          String id = req.getParameter("id");
+          ps.executeQuery();
+        }
+      }
+    expect:
+      count: 0
+
+  - name: "SQLi Spring — RequestParam to JdbcTemplate query"
+    language: java
+    code: |
+      import org.springframework.web.bind.annotation.RequestParam;
+      class T {
+        void m(org.springframework.jdbc.core.JdbcTemplate jdbc, @RequestParam String id) {
+          jdbc.query("SELECT * FROM users WHERE id = " + id);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: spring.requestParam
+          sinkId: java.JdbcTemplate.query
+
+  - name: "Command injection — getParameter to Runtime.exec"
+    language: java
+    code: |
+      class T {
+        void f(javax.servlet.http.HttpServletRequest req) throws Exception {
+          String cmd = req.getParameter("cmd");
+          Runtime.getRuntime().exec(cmd);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: servlet.request.getParameter
+          sinkId: java.Runtime.exec
+
+  - name: "XSS — getParameter to response print"
+    language: java
+    code: |
+      class T {
+        void f(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res) throws Exception {
+          String html = req.getParameter("q");
+          res.getWriter().print(html);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: servlet.request.getParameter
+          sinkId: java.response.print
+
+  - name: "XSS sanitised — htmlEscape before print"
+    language: java
+    code: |
+      class T {
+        void f(javax.servlet.http.HttpServletResponse res, String html) throws Exception {
+          String safe = org.springframework.web.util.HtmlUtils.htmlEscape(html);
+          res.getWriter().print(safe);
+        }
+      }
+    expect:
+      count: 0
+
+  - name: "Path traversal — getParameter to File"
+    language: java
+    code: |
+      class T {
+        void f(javax.servlet.http.HttpServletRequest req) {
+          String path = req.getParameter("path");
+          new File(path);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: servlet.request.getParameter
+          sinkId: java.File.constructor
+
+  - name: "Open redirect — getParameter to sendRedirect"
+    language: java
+    code: |
+      class T {
+        void f(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res) throws Exception {
+          String url = req.getParameter("url");
+          res.sendRedirect(url);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: servlet.request.getParameter
+          sinkId: java.response.sendRedirect
+
+  - name: "Code execution — getenv to ScriptEngine eval"
+    language: java
+    code: |
+      class T {
+        void f(javax.script.ScriptEngine engine) throws Exception {
+          String code = System.getenv("CODE");
+          engine.eval(code);
+        }
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: java.System.getenv
+          sinkId: java.ScriptEngine.eval
+
+  - name: "Path not sanitised — normalize/getCanonicalPath before File"
+    language: java
+    code: |
+      class T {
+        void f(javax.servlet.http.HttpServletRequest req) throws Exception {
+          String path = req.getParameter("path");
+          String safe = new java.io.File(path).getCanonicalPath();
+          new java.io.File(safe);
+        }
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: servlet.request.getParameter
+          sinkId: java.File.constructorScoped
+
+  - name: "Command sanitised — parseInt before exec"
+    language: java
+    code: |
+      class T {
+        void f(String port) throws Exception {
+          int p = Integer.parseInt(port);
+          Runtime.getRuntime().exec(new String[] { "echo", String.valueOf(p) });
+        }
+      }
+    expect:
+      count: 0