René's URL Explorer Experiment

Title: Java: Promote Unsafe certificate trust query from experimental by atorralba · Pull Request #6171 · github/codeql · GitHub

Open Graph Title: Java: Promote Unsafe certificate trust query from experimental by atorralba · Pull Request #6171 · github/codeql

X Title: Java: Promote Unsafe certificate trust query from experimental by atorralba · Pull Request #6171 · github/codeql

Description: PR to promote the Unsafe certificate trust query created in #3550 Changes Existing files were moved out of experimental The UnsafeCertTrust.qll file was created to contain most of the classes and predicates used by the query. Some classes that will probably be reusable by other queries were added to the Networking.qll and Encryption.qll libraries. The piece of logic that was handling flawed hostname verifications because of a missing (or wrong) SSL endpoint identification algorithm was refactored - now, a taint tracking configuration is used to properly detect established connections without a safe SSL configuration (see SslEndpointIdentificationFlowConfig). Changed tests to use InlineExpectationsTest and added some RabbitMQ stubs. Evaluation ➕ The following CVEs are now detected by the query: CVE-2020-11050 TooTallNate/Java-WebSocket@2dbe2d3 ✅ The following CVEs are still detected by the query: CVE-2018-17187 apache/qpid-proton-j@0cb8ca0 CVE-2018-11087 spring-projects/spring-amqp@444b74e CVE-2018-11775 apache/activemq@69fad2a ➡️ The following CVEs are now detected by the Insecure TrustManager query (#4879): CVE-2020-1929 apache/beam@a7dd23d ⚠️ The following CVEs are still not detected by the query: CVE-2018-10936 pgjdbc/pgjdbc@cdeeaca ❌ The following CVEs are no longer detected by the query: CVE-2018-8034 apache/tomcat@2835bb4. This is due to taint tracking now being used, and the flow being lost because of it crossing through a class field used in a nested class. To Consider The sources of SafeSslParametersFlowConfig are PostUpdateNodes because what characterizes them is the update done by setEndpointIdentificationAlgorithm. The predicate isSslSocket is an heuristic and could (probably) be improved. SslConnectionWithSafeSslParameters uses localFlow to add subsequent uses of the sanitizer. This is to correctly identify sanitizers that are added with the following pattern: SSLSocket socket = (SSLSocket) socketFactory.createSocket(); if (safe) { SSLParameters sslParameters = socket.getSSLParameters(); sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); socket.setSSLParameters(sslParameters); } socket.getOutputStream(); where safe is a boolean that is (almost) always true (e.g. a configuration value that defaults to true, or something like socket instanceof SSLSocket). This is needed because the fix applied to several CVEs follows this pattern, e.g. a configuration value is added in order to give the user the option to revert to the old behavior (no forced hostname verification).

Open Graph Description: PR to promote the Unsafe certificate trust query created in #3550 Changes Existing files were moved out of experimental The UnsafeCertTrust.qll file was created to contain most of the classes and ...

X Description: PR to promote the Unsafe certificate trust query created in #3550 Changes Existing files were moved out of experimental The UnsafeCertTrust.qll file was created to contain most of the classes and ...

Opengraph URL: https://github.com/github/codeql/pull/6171

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width