sourcecode 5.2.0__py3-none-any.whl → 5.3.0__py3-none-any.whl

sourcecode/sql_taint.py

@@ -0,0 +1,362 @@
+"""sql_taint.py — does request input reach a spliced SQL statement? (F-BF)
+
+SEC-008 reports every MyBatis `${}` in a mapper: `#{x}` binds a parameter, `${x}`
+splices text into the statement, so a request-controlled value can change the
+*structure* of the query. That report is a list of places to review. What a team
+asks next is which of them an attacker can actually reach — *"la diferencia entre
+16 sitios que revisar y 2 sitios que arreglar hoy"* — and `risk`'s
+`query_construction` axis answered `not_observed` (×1,0) on **all 98 rows** of
+the field's repository, because its propagation ends at Java query-builder calls
+and that repository's SQL lives in mapper XML.
+
+This is the bounded join between the two ends the product already resolves:
+
+* **sources** — parameters annotated `@RequestParam` / `@PathVariable` /
+  `@RequestBody`, the same seeds `risk` already walks from;
+* **sinks** — the `${}` interpolations SEC-008 already indexes, keyed by the
+  mapper namespace and statement id they belong to;
+* **the path** — the same bounded, positional call propagation over repository
+  Java sources. Not interprocedural taint in the CodeQL sense, and this product
+  must not claim to be that.
+
+The verdict is three-state and the third state is the load-bearing one:
+
+* ``reaches`` — a tainted value is passed to a call whose name is a statement of a
+  mapper that splices, with the trace that showed it;
+* ``does_not_reach`` — that statement **is** called in this repository, and no
+  call site passes anything derived from an HTTP input. A bounded negative, and
+  it is stated only where the call sites were found;
+* ``undecidable`` — no resolvable call site, a namespace this repository does not
+  declare, or a path that leaves the sources this walk reads. Declared, never
+  guessed: answering `does_not_reach` by approximation would put a confident *no*
+  on a route that does leak, which is the one failure mode that would make this
+  feature worse than not shipping it (NC-001, NC-008).
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Optional
+
+SCHEMA_VERSION = "sql-taint-v1"
+
+REACHES = "reaches"
+DOES_NOT_REACH = "does_not_reach"
+UNDECIDABLE = "undecidable"
+
+_MAPPER_TAG = re.compile(r"<mapper\b[^>]*>", re.IGNORECASE)
+_NAMESPACE = re.compile(r"namespace\s*=\s*['\"]([^'\"]+)['\"]", re.IGNORECASE)
+_STATEMENT = re.compile(
+    r"<(?P<tag>select|insert|update|delete)\b(?P<attrs>[^>]*)>(?P<body>.*?)</(?P=tag)>",
+    re.IGNORECASE | re.DOTALL,
+)
+_ID_ATTR = re.compile(r"\bid\s*=\s*['\"]([^'\"]+)['\"]", re.IGNORECASE)
+_INTERPOLATION = re.compile(r"\$\{\s*([^}]+?)\s*\}")
+
+#: Bound on the walk, mirroring the one `risk` already applies: a repository that
+#: would need more than this to answer is answered `undecidable` rather than
+#: answered late.
+_MAX_VISITS = 2000
+
+
+@dataclass(frozen=True)
+class SqlSink:
+    """One spliced statement: where it is written, and what it splices."""
+
+    namespace: str
+    statement_id: str
+    tag: str
+    file: str
+    line: int
+    interpolations: tuple[str, ...]
+
+    @property
+    def symbol(self) -> str:
+        return f"{self.namespace}#{self.statement_id}" if self.namespace else self.statement_id
+
+    def to_dict(self) -> dict:
+        return {
+            "namespace": self.namespace,
+            "statement_id": self.statement_id,
+            "statement": self.tag.lower(),
+            "symbol": self.symbol,
+            "file": self.file,
+            "line": self.line,
+            "interpolates": list(self.interpolations),
+        }
+
+
+def _line_of(text: str, index: int) -> int:
+    return text.count("\n", 0, index) + 1
+
+
+def _mapper_files(root: Path, cir: Any) -> list[str]:
+    """Every mapper XML under *root*, found the way SEC-008 finds them.
+
+    The CIR's file list is Java, so a sink family that lives in XML cannot be
+    read off it — reading `cir.files` here answered "no mappers" on every real
+    repository while the fixtures that injected XML into the list passed. The
+    walk is `repository_ir.walk_source_tree` with the same `*Mapper.xml`
+    admission `security_config_scan` uses, so this surface and SEC-008 cannot
+    disagree about what a mapper is. Anything a caller has already put in
+    `cir.files` is honoured too, which keeps a scoped or synthetic IR readable.
+    """
+    found: list[str] = [
+        str(rel) for rel in (getattr(cir, "files", []) or []) if str(rel).endswith(".xml")
+    ]
+    try:
+        from sourcecode.repository_ir import walk_source_tree
+
+        for path in walk_source_tree(Path(root)):
+            if not path.name.endswith("Mapper.xml"):
+                continue
+            try:
+                rel = path.relative_to(Path(root)).as_posix()
+            except ValueError:
+                continue
+            if rel not in found:
+                found.append(rel)
+    except Exception:
+        pass  # an unreadable tree yields what the IR already carried
+    return found
+
+
+def mapper_sinks(root: Path, cir: Any) -> list[SqlSink]:
+    """Every `${}`-splicing statement in the repository's MyBatis mappers.
+
+    The same population SEC-008 reports, read here with the two keys the join
+    needs and SEC-008 does not publish: the namespace and the statement id.
+    """
+    out: list[SqlSink] = []
+    for name in _mapper_files(root, cir):
+        try:
+            text = (Path(root) / name).read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        tag = _MAPPER_TAG.search(text)
+        if not tag:
+            continue
+        namespace_match = _NAMESPACE.search(tag.group(0))
+        namespace = namespace_match.group(1) if namespace_match else ""
+        for statement in _STATEMENT.finditer(text):
+            body = statement.group("body")
+            interpolations = tuple(
+                " ".join(m.group(1).split()) for m in _INTERPOLATION.finditer(body)
+            )
+            if not interpolations:
+                continue
+            id_match = _ID_ATTR.search(statement.group("attrs"))
+            out.append(SqlSink(
+                namespace=namespace,
+                statement_id=id_match.group(1) if id_match else "",
+                tag=statement.group("tag"),
+                file=name,
+                line=_line_of(text, statement.start()),
+                interpolations=interpolations,
+            ))
+    return out
+
+
+def _tainted_call_names(methods: list) -> dict[str, list[str]]:
+    """Call name → traces, for every call that receives an HTTP-derived value.
+
+    The walk is `risk`'s, unchanged and imported rather than copied: the seeds,
+    the positional argument mapping and the visit bound are one authority, and a
+    second copy of them would drift into a second answer to the same question.
+    """
+    from sourcecode.risk import _call_edges_with_tainted_args, _CALL_RE
+
+    by_name: dict[str, list] = {}
+    for method in methods:
+        by_name.setdefault(method.name, []).append(method)
+
+    reached: dict[str, list[str]] = {}
+    queue: list[tuple[Any, frozenset, str]] = [
+        (
+            method,
+            method.http_inputs,
+            f"{method.owner}({', '.join(sorted(method.http_inputs))})",
+        )
+        for method in methods
+        if method.http_inputs
+    ]
+    seen: set[tuple[str, tuple[str, ...]]] = set()
+    while queue and len(seen) < _MAX_VISITS:
+        method, tainted, path = queue.pop(0)
+        key = (method.owner, tuple(sorted(tainted)))
+        if key in seen:
+            continue
+        seen.add(key)
+        # Any call in this body that receives a tainted argument is a candidate
+        # sink invocation — including calls this repository cannot resolve to a
+        # body, which is exactly the mapper-interface case: the method is
+        # declared in an interface and implemented by MyBatis at runtime.
+        for call in _CALL_RE.finditer(method.body):
+            name = call.group(1)
+            args = [a.strip() for a in call.group(2).split(",")]
+            if not any(
+                re.search(rf"\b{re.escape(src)}\b", arg)
+                for arg in args for src in tainted
+            ):
+                continue
+            # `path` already ends at this method, so the trace names the call
+            # rather than repeating the owner it is inside.
+            reached.setdefault(name, []).append(f"{path} calls {name}(…)")
+        for target, mapped in _call_edges_with_tainted_args(method, tainted, by_name):
+            queue.append((target, mapped, f"{path} -> {target.owner}"))
+    return reached
+
+
+def _called_names(methods: list) -> set[str]:
+    """Every call name invoked anywhere in the repository's sources.
+
+    What separates *"called, never with request input"* from *"never called
+    here"* — the difference between a bounded negative and an unknown.
+    """
+    from sourcecode.risk import _CALL_RE
+
+    names: set[str] = set()
+    for method in methods:
+        for call in _CALL_RE.finditer(method.body):
+            names.add(call.group(1))
+    return names
+
+
+def build_sql_taint(root: Path, cir: Any) -> dict:
+    """Which spliced statements request input reaches, and which are undecided."""
+    from sourcecode.risk import _has_http_input_parameter, _java_methods
+
+    root = Path(root)
+    sinks = mapper_sinks(root, cir)
+    payload: dict = {
+        "schema_version": SCHEMA_VERSION,
+        "sinks_total": len(sinks),
+        "verdict_lattice": [REACHES, DOES_NOT_REACH, UNDECIDABLE],
+        "basis": (
+            "Sources are parameters annotated @RequestParam/@PathVariable/"
+            "@RequestBody; sinks are MyBatis `${}` interpolations (the SEC-008 "
+            "population, keyed by namespace and statement id); the path is "
+            "bounded positional propagation over repository Java sources. This is "
+            "NOT interprocedural taint analysis, and `does_not_reach` is stated "
+            "only where the call sites were found — everything else is "
+            "`undecidable`, never a confident no."
+        ),
+    }
+    if not sinks:
+        payload.update({"answered": False, "sinks": [], "summary": {}})
+        payload["statement"] = (
+            "No MyBatis mapper in this repository splices a value into its SQL, so "
+            "there is no sink of this shape to reach. That is a fact about this "
+            "sink family only."
+        )
+        return payload
+
+    if not _has_http_input_parameter(root, cir):
+        # The same equivalence C3-88 established: with no annotated HTTP input
+        # anywhere, the walk's result is fixed whatever the method universe holds,
+        # so the parse is not paid. Every sink is undecided rather than clean —
+        # input can still arrive through a shape this walk does not read.
+        payload.update({
+            "answered": True,
+            "sinks": [
+                {**sink.to_dict(), "verdict": UNDECIDABLE,
+                 "why": "no annotated HTTP input parameter exists in this repository, "
+                        "so no source of this shape can be traced to this statement"}
+                for sink in sinks
+            ],
+            "summary": {REACHES: 0, DOES_NOT_REACH: 0, UNDECIDABLE: len(sinks)},
+        })
+        return payload
+
+    methods = _java_methods(root, cir)
+    tainted_calls = _tainted_call_names(methods)
+    called = _called_names(methods)
+    declared_namespaces = {
+        s for s in _class_symbols(cir)
+    }
+
+    rows: list[dict] = []
+    counts = {REACHES: 0, DOES_NOT_REACH: 0, UNDECIDABLE: 0}
+    for sink in sinks:
+        row = sink.to_dict()
+        traces = tainted_calls.get(sink.statement_id) if sink.statement_id else None
+        if traces:
+            row["verdict"] = REACHES
+            row["trace"] = traces[0]
+            row["trace_count"] = len(traces)
+            row["why"] = (
+                "an annotated HTTP input parameter is passed, through bounded "
+                "positional propagation, to a call named for this statement"
+            )
+        elif not sink.statement_id:
+            row["verdict"] = UNDECIDABLE
+            row["why"] = (
+                "the statement declares no id, so no call site can be matched to it"
+            )
+        elif sink.statement_id in called:
+            row["verdict"] = DOES_NOT_REACH
+            row["why"] = (
+                "this statement is called in repository sources and no call site "
+                "passes a value derived from an annotated HTTP input. Bounded: "
+                "input arriving by a shape this walk does not read (reflection, "
+                "dynamic mapper invocation, another repository) is not covered"
+            )
+        else:
+            row["verdict"] = UNDECIDABLE
+            row["why"] = (
+                "no call site for this statement was found in repository sources — "
+                "it may be invoked dynamically, from another module, or by a name "
+                "this walk cannot resolve"
+                + (
+                    ""
+                    if sink.namespace in declared_namespaces
+                    else "; the mapper namespace is not declared in this repository"
+                )
+            )
+        counts[row["verdict"]] += 1
+        rows.append(row)
+
+    payload.update({"answered": True, "sinks": rows, "summary": counts})
+    payload["statement"] = (
+        f"{counts[REACHES]} spliced statement(s) are reached by request input, "
+        f"{counts[DOES_NOT_REACH]} are called without it, and "
+        f"{counts[UNDECIDABLE]} could not be decided here."
+    )
+    return payload
+
+
+def _class_symbols(cir: Any) -> set[str]:
+    symbols = getattr(cir, "symbols", None)
+    raw = symbols.keys() if isinstance(symbols, dict) else (symbols or [])
+    out: set[str] = set()
+    for item in raw:
+        if isinstance(item, str):
+            fqn = item
+        elif isinstance(item, dict):
+            fqn = str(item.get("fqn") or item.get("id") or "")
+        else:
+            fqn = str(getattr(item, "fqn", "") or getattr(item, "id", ""))
+        if fqn and "#" not in fqn:
+            out.add(fqn)
+    return out
+
+
+def reached_files(payload: Optional[dict]) -> dict[str, str]:
+    """mapper file → the trace that reached it, for the `risk` axis to read.
+
+    Keyed on the file because that is the symbol SEC-008 records a finding
+    against, so the join needs no second identity.
+    """
+    if not payload or not payload.get("answered"):
+        return {}
+    out: dict[str, str] = {}
+    for row in payload.get("sinks") or []:
+        if row.get("verdict") != REACHES:
+            continue
+        out.setdefault(
+            row["file"],
+            f"{row['trace']} -> {row['symbol']} splices ${{{row['interpolates'][0]}}}"
+            if row.get("interpolates") else row.get("trace", ""),
+        )
+    return out