Java: Add Guard Classes for checking OS & unify System Property Access #8032

JLLeitschuh · 2022-02-14T20:34:45Z

This is useful when you have a bit of logic that is only vulnerable on specific OSes. Additionally, it unifies the access of all system properties (from all libraries and JDK APIs) into one method call getSystemProperty(_).

JLLeitschuh · 2022-02-14T21:53:33Z

java/ql/test/query-tests/security/CWE-200/semmle/tests/TestSafe.java

+                }
+            } else if (!Files.exists(tempDirChild)) {
+                // On Windows, we still need to create the directory, when it doesn't already exist.
+                Files.createDirectory(tempDirChild); // GOOD: Windows doesn't share the temp directory between users


Without the OS guard changes, this gets flagged as vulnerable

JLLeitschuh · 2022-02-14T21:53:43Z

java/ql/test/query-tests/security/CWE-200/semmle/tests/TestSafe.java

+                }
+            } else if (!Files.exists(tempDirChild)) {
+                // On Windows, we still need to create the directory, when it doesn't already exist.
+                Files.createDirectories(tempDirChild); // GOOD: Windows doesn't share the temp directory between users


Without the OS guard changes, this also gets flagged as vulnerable

JLLeitschuh · 2022-02-14T21:54:54Z

java/ql/src/Security/CWE/CWE-200/TempDirUsageSafe.java

@@ -30,7 +34,7 @@ void exampleSafeWithWindowsSupportFile() {
        createTempFile(tempChildFile.toPath()); // GOOD: Good has permissions `-rw-------`
    }

-    static void createTempFile(Path tempDir) {
+    static void createTempFile(Path tempDirChild) {


Simple fix because this wouldn't have compiled earlier

java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll

java/ql/lib/semmle/code/java/os/OSCheck.qll

JLLeitschuh · 2022-02-15T15:26:57Z

Thanks @intrigus-lgtm for the feedback! 🙂

java/ql/lib/semmle/code/java/StringCheck.qll

java/ql/lib/semmle/code/java/os/OSCheck.qll

Marcono1234

Would it make sense to also consider OperatingSystemMXBean.getName()?

Sometimes the OS path separator (File.pathSeparator, File.pathSeparatorChar) and OS file path separator (File.separator, File.separatorChar) are used for OS detection; examples:

Would it make sense to consider these as well? (That is, comparison in EqualityTest, and maybe EqualsMethod call (qualifier or argument), where the compared value is a compile time constant)

(Feel free to consider this only as suggestion; I am not a member of this project)

java/ql/lib/semmle/code/java/StringCheck.qll

java/ql/lib/semmle/code/java/os/OSCheck.qll

java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql

java/ql/lib/semmle/code/java/os/OSCheck.qll

Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>

Co-authored-by: Chris Smowton <smowton@github.com>

atorralba · 2022-03-11T07:36:10Z

This has some QLDoc errors:

The following CodeQL elements are lacking documentation:
semmle/code/java/environment/SystemProperty.qll  SystemProperty                   file
semmle/code/java/frameworks/Properties.qll       Properties::PropertiesGetMethod  class

Also, a bunch of autoformatting required:

Error: ql/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql would change by autoformatting.
Error: ql/java/ql/test/library-tests/os/unix-test.ql would change by autoformatting.
Error: ql/java/ql/test/library-tests/os/specific-unix-variant-test.ql would change by autoformatting.
Error: ql/java/ql/test/library-tests/os/windows-test.ql would change by autoformatting.
Error: ql/java/ql/test/library-tests/os/specific-windows-variant-test.ql would change by autoformatting.

smowton · 2022-03-11T11:31:28Z

Having to revert #8360 because of apparent performance problems. Remind me why you needed concatenation of string + char again?

If you still want it, a few possibilities to investigate:

Using test project https://lgtm.com/projects/g/geogebra/geogebra, why do we end up performing millions of string concatenations at considerable cost? Are there really millions of string + non-string-constant operations in the codebase?
If there really are some long concatenation sequences in the codebase causing this to cost a lot, consider a recursion that finds the parts of the concatenation and assigns them integer indices, before finally concatenating them in one go using QL's concat aggregate.

JLLeitschuh · 2022-03-11T12:37:30Z

Remind me why you needed concatenation of string + char again?

For this particular change, I don't really, I wrote that new predicate to be more extensive than I needed so that it was generally more useful. In this particular PR, I just need to do equality checking between both string and characters because the new system property predicate sometimes returns a expression that has the type char.

Would adding the cached annotation to getStrigifiedValue and getString resolve the performance issues?

smowton · 2022-03-11T12:38:55Z

No, cached is only useful if we're recomputing a particular predicate repeatedly. Here one evaluation of it is expensive.

JLLeitschuh · 2022-03-11T12:38:58Z

If there really are some long concatenation sequences in the codebase causing this to cost a lot, consider a recursion that finds the parts of the concatenation and assigns them integer indices, before finally concatenating them in one go using QL's concat aggregate.

I have no idea what this would look like unfortunately. I'd need some pointers on what the code would look like here.

smowton · 2022-03-11T12:50:27Z

Probably not worth the difficulty just for this. I've made #8407 to revert the original addition of CharacterLiteral to getStringValue per Marcono's objections in #8325, and recommend you simply special-case CharacterLiteral in this PR as you did originally for the time being. We can investigate how to do this in a performant manner as and when the need arises.

JLLeitschuh · 2022-03-14T16:23:35Z

I'm ready for a final PR review or a merge if everyone is happy with this in it's current state. 😃

smowton

I believe we don't have tests for the Guava cases yet?

smowton · 2022-03-15T11:50:18Z

I also made a minor commit above to improve some class names.

JLLeitschuh · 2022-03-15T16:38:49Z

I believe we don't have tests for the Guava cases yet?

Done

JLLeitschuh · 2022-03-17T12:23:29Z

Anything else required here?

smowton · 2022-03-17T13:00:48Z

Just running a new performance evaluation as I realised the first one only considered queries with precision >= high, whereas the temp-dir-local-info query has precision = medium

JLLeitschuh · 2022-03-18T12:48:07Z

Yeay! Very happy this is finally merged!

aschackmull · 2022-04-04T13:14:32Z

java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql

+private class IsNotUnixBarrierGuard extends WindowsOsBarrierGuard instanceof IsUnixGuard {
+  override predicate checks(Expr e, boolean branch) {
+    this.controls(e.getBasicBlock(), branch.booleanNot())
+  }
+}
+
+private class IsWindowsBarrierGuard extends WindowsOsBarrierGuard instanceof IsWindowsGuard {
+  override predicate checks(Expr e, boolean branch) { this.controls(e.getBasicBlock(), branch) }
+}
+
+private class IsSpecificWindowsBarrierGuard extends WindowsOsBarrierGuard instanceof IsSpecificWindowsVariant {
+  override predicate checks(Expr e, boolean branch) {
+    branch = true and this.controls(e.getBasicBlock(), branch)
+  }
+}


These three barrier-guards don't really make sense. Using Guard.controls in the checks predicate of a barrier-guard is almost guaranteed to be completely wrong, as the barrier-guard abstraction is explicitly designed to handle the .controls-aspect of guards.
The expression e should be the variable access being checked by the guard, and the branch should be the result of the guard that indicates that e is safe. So the basic implementation hint for the checks predicate should just be to use the AST and nothing more. If you really want to use Guard.controls to pick out the nodes that are sanitised then you're really just defining a regular sanitizer and not a sanitizer-guard.

So, I partially understand what you're saying. That being said, I don't know how to fix it.

Also, could you suggest a test case that this doesn't work for that I could use as a unit test

A barrierguard is just syntactic sugar for a sanitizer with a specific pattern. To see how a barrier-guard gets desugared into a sanitizer, look at the getAGuardedNode() predicate:

final Node getAGuardedNode() { exists(SsaVariable v, boolean branch, RValue use | this.checks(v.getAUse(), branch) and use = v.getAUse() and this.controls(use.getBasicBlock(), branch) and result.asExpr() = use ) }

You end up just joining this.controls with itself, which semantically is mostly harmless. But you can simplify things by just defining the sanitizers directly. E.g. replace IsSpecificWindowsBarrierGuard with the following:

abstract private class WindowsOsSanitizer extends DataFlow::Node { } private class IsSpecificWindowsSanitizer extends WindowsOsSanitizer { IsSpecificWindowsSanitizer() { any(IsSpecificWindowsVariant guard).control(this.asExpr().getBasicBlock(), true) } } ... override predicate isSanitizer(DataFlow::Node node) { node instanceof WindowsOsSanitizer }

This is mostly equivalent to your IsSpecificWindowsBarrierGuard except it drops the restriction that only uses of ssa variables are sanitized.
The other two, IsNotUnixBarrierGuard and IsWindowsBarrierGuard, can be similarly rewritten, but note that they are somewhat broken as-is, since they currently guard both of their branches. In

if (<IsWindowsBarrierGuard>) { foo } else { bar }

you're sanitizing both foo and bar.

aschackmull · 2022-04-05T11:50:52Z

java/ql/lib/semmle/code/java/os/OSCheck.qll

+private predicate isOsFromApacheCommons(FieldAccess fa, string fieldNamePattern) {
+  exists(Field f | f = fa.getField() |
+    f.getDeclaringType() instanceof TypeApacheSystemUtils and
+    f.getName().matches(fieldNamePattern)


I guess it is unlikely that this will give spurious matches, but do note that _ is a wildcard for the .matches predicate, so all of the underscores in the names below could be matched with anything.

Resolves github#8032 (comment)

github-actions bot added the Java label Feb 14, 2022

JLLeitschuh force-pushed the feat/JLL/check_os branch from a31231f to e5c7e88 Compare February 14, 2022 20:36

JLLeitschuh commented Feb 14, 2022

View reviewed changes

JLLeitschuh marked this pull request as ready for review February 14, 2022 21:55

JLLeitschuh requested a review from a team as a code owner February 14, 2022 21:55

JLLeitschuh mentioned this pull request Feb 14, 2022

Java: CWE-200: Temp directory local information disclosure vulnerability #4388

Merged

JLLeitschuh force-pushed the feat/JLL/check_os branch from 0aabaa5 to f55ef0e Compare February 14, 2022 23:10

github-actions bot added the documentation label Feb 14, 2022

intrigus-lgtm reviewed Feb 15, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll Outdated Show resolved Hide resolved

intrigus-lgtm reviewed Feb 15, 2022

View reviewed changes

java/ql/lib/semmle/code/java/frameworks/apache/Lang.qll Outdated Show resolved Hide resolved

intrigus-lgtm reviewed Feb 15, 2022

View reviewed changes

java/ql/lib/semmle/code/java/os/OSCheck.qll Outdated Show resolved Hide resolved

intrigus-lgtm reviewed Feb 15, 2022

View reviewed changes

java/ql/lib/semmle/code/java/os/OSCheck.qll Outdated Show resolved Hide resolved

smowton reviewed Feb 15, 2022

View reviewed changes

JLLeitschuh force-pushed the feat/JLL/check_os branch from d50e09b to 2896c0c Compare February 15, 2022 17:05

Marcono1234 reviewed Feb 20, 2022

View reviewed changes

java/ql/lib/semmle/code/java/StringCheck.qll Outdated Show resolved Hide resolved

java/ql/lib/semmle/code/java/os/OSCheck.qll Outdated Show resolved Hide resolved

java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql Outdated Show resolved Hide resolved

Marcono1234 reviewed Feb 21, 2022

View reviewed changes

java/ql/lib/semmle/code/java/os/OSCheck.qll Show resolved Hide resolved

JLLeitschuh force-pushed the feat/JLL/check_os branch from 97ca09a to cf2bfb5 Compare March 1, 2022 00:57

JLLeitschuh and others added 9 commits March 2, 2022 12:50

Java: Add Guard Classes for checking OS

cd073a2

Apply OS guard checks to TempDirLocalInformationDisclosure

39828fd

Cleanup from review feedback

3cdfc00

Update java/ql/lib/semmle/code/java/os/OSCheck.qll

4951344

Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>

Review fixup and add test for apache SystemUtils

9f5022e

Update OS Check from Review Feedback

fd63107

Refactor OS Guard Checks

5913c9a

Update TempDirInfoDisclosure with new OS Guards

dad9a02

Improve system property lookup

82d3cd8

JLLeitschuh force-pushed the feat/JLL/check_os branch from 8a8f0fc to 82d3cd8 Compare March 2, 2022 17:51

JLLeitschuh and others added 2 commits March 10, 2022 11:48

Apply suggestions from code review

ecb8911

Co-authored-by: Chris Smowton <smowton@github.com>

Remove SystemProperty from FlowSources

1c98642

Code cleanup from code review

50ff2c2

JLLeitschuh force-pushed the feat/JLL/check_os branch from b73c74a to 50ff2c2 Compare March 11, 2022 16:44

JLLeitschuh requested a review from smowton March 14, 2022 21:01

Improve guard class names

451661d

smowton reviewed Mar 15, 2022

View reviewed changes

Add tests for StandardSystemProperty

09cc8ee

JLLeitschuh requested a review from smowton March 15, 2022 17:52

JLLeitschuh mentioned this pull request Mar 15, 2022

Java: CWE-378: Temp Directory Hijacking Race Condition Vulnerability #4473

Open

Change note tense and detail level

b11340c

smowton approved these changes Mar 18, 2022

View reviewed changes

smowton merged commit 7674535 into github:main Mar 18, 2022

aschackmull reviewed Apr 4, 2022

View reviewed changes

aschackmull reviewed Apr 5, 2022

View reviewed changes

JLLeitschuh added a commit to JLLeitschuh/ql that referenced this pull request Apr 6, 2022

Java: Fix Local Temp File/Dir Incorrect Guard Logic

e65d4c0

Resolves github#8032 (comment)

JLLeitschuh mentioned this pull request Apr 6, 2022

Java: Fix Local Temp File/Dir Incorrect Guard Logic #8681

Merged

JLLeitschuh added a commit to JLLeitschuh/ql that referenced this pull request Apr 6, 2022

Java: Fix Local Temp File/Dir Incorrect Guard Logic

2753521

Resolves github#8032 (comment)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Java: Add Guard Classes for checking OS & unify System Property Access #8032

Java: Add Guard Classes for checking OS & unify System Property Access #8032

JLLeitschuh commented Feb 14, 2022 •

edited

Loading

JLLeitschuh Feb 14, 2022

JLLeitschuh Feb 14, 2022

JLLeitschuh Feb 14, 2022

JLLeitschuh commented Feb 15, 2022

Marcono1234 left a comment •

edited

Loading

atorralba commented Mar 11, 2022 •

edited

Loading

smowton commented Mar 11, 2022

JLLeitschuh commented Mar 11, 2022

smowton commented Mar 11, 2022

JLLeitschuh commented Mar 11, 2022

smowton commented Mar 11, 2022

JLLeitschuh commented Mar 14, 2022

smowton left a comment

smowton commented Mar 15, 2022

JLLeitschuh commented Mar 15, 2022

JLLeitschuh commented Mar 17, 2022

smowton commented Mar 17, 2022

JLLeitschuh commented Mar 18, 2022

aschackmull Apr 4, 2022

JLLeitschuh Apr 5, 2022

aschackmull Apr 5, 2022 •

edited

Loading

aschackmull Apr 5, 2022

Java: Add Guard Classes for checking OS & unify System Property Access #8032

Java: Add Guard Classes for checking OS & unify System Property Access #8032

Conversation

JLLeitschuh commented Feb 14, 2022 • edited Loading

JLLeitschuh Feb 14, 2022

Choose a reason for hiding this comment

JLLeitschuh Feb 14, 2022

Choose a reason for hiding this comment

JLLeitschuh Feb 14, 2022

Choose a reason for hiding this comment

JLLeitschuh commented Feb 15, 2022

Marcono1234 left a comment • edited Loading

Choose a reason for hiding this comment

atorralba commented Mar 11, 2022 • edited Loading

smowton commented Mar 11, 2022

JLLeitschuh commented Mar 11, 2022

smowton commented Mar 11, 2022

JLLeitschuh commented Mar 11, 2022

smowton commented Mar 11, 2022

JLLeitschuh commented Mar 14, 2022

smowton left a comment

Choose a reason for hiding this comment

smowton commented Mar 15, 2022

JLLeitschuh commented Mar 15, 2022

JLLeitschuh commented Mar 17, 2022

smowton commented Mar 17, 2022

JLLeitschuh commented Mar 18, 2022

aschackmull Apr 4, 2022

Choose a reason for hiding this comment

JLLeitschuh Apr 5, 2022

Choose a reason for hiding this comment

aschackmull Apr 5, 2022 • edited Loading

Choose a reason for hiding this comment

aschackmull Apr 5, 2022

Choose a reason for hiding this comment

JLLeitschuh commented Feb 14, 2022 •

edited

Loading

Marcono1234 left a comment •

edited

Loading

atorralba commented Mar 11, 2022 •

edited

Loading

aschackmull Apr 5, 2022 •

edited

Loading