Path-problem result pattern
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
**Description of the issue**
Hello, I made a query that seems to be working just fine using the VS Code extension. However, when I try to query my database using the CLI with this query I am getting this error.
> A fatal error occurred: Could not process query metadata for C:\Users\Kyler\Documents\Work\cwe200\codeql\codeql-custom-queries-java\CWE-535\ExposureofInformationThroughShellErrorMessage copy.ql.
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
I have read through that link and I have also checked out [this](https://github.com/github/codeql-cli-binaries/issues/115) issue here and did some looking into other path problem examples. However, I am still getting this error after trying all of this. I believe that it is something simple that I am missing right in front of me. Any help would be appreciated. Thank you in advance.
My code
```
import java
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph
/**
* @name Exposure of information through shell error message
* @description Exposing error messages from shell commands can lead to information disclosure.
* @kind path-problem
* @problem.severity warning
* @id java/shell-error-exposure
* @tags security
* external/cwe/cwe-535
*/
class ShellErrorExposureConfig extends DataFlow::Configuration {
ShellErrorExposureConfig() { this = "ShellErrorExposureConfig" }
override predicate isSource(DataFlow::Node source) {
exists(MethodAccess ma |
// Captures getting the error stream from a process
ma.getMethod().hasName("getErrorStream") and
// Ensure the Process is the result of exec or start, indicating command execution
(ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue() instanceof MethodAccess and
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("exec") or
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("start")) and
source.asExpr() = ma
)
or
exists(MethodAccess exec |
// Direct use of user input in command execution
exec.getMethod().hasName("exec") and
exec.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Runtime") and
source.asExpr() = exec
)
}
override predicate isSink(DataFlow::Node sink) {
// System.out.println or similar direct output methods as sinks
(exists(MethodAccess println |
println.getMethod().hasName("println") and
println.getQualifier().(VarAccess).getVariable().getType() instanceof RefType and
((RefType)println.getQualifier().(VarAccess).getVariable().getType()).hasQualifiedName("java.io", "PrintStream") and
sink.asExpr() = println.getAnArgument())
and
not exists(MethodAccess sanitizeErrorOutput |
sanitizeErrorOutput.getMethod().hasName("sanitizeErrorOutput") and
sink.asExpr() = sanitizeErrorOutput.getAnArgument()
))
or
exists(MethodAccess getMessage |
getMessage.getMethod().hasName(["getMessage", "getStackTrace", "getStackTraceAsString", "printStackTrace"]) and
getMessage.getMethod().getDeclaringType().getASupertype*().hasQualifiedName("java.lang", "Throwable") and
sink.asExpr() = getMessage
)
}
}
from ShellErrorExposureConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink, "Potential CWE-535: Exposure of information through shell error message"
```
I tried updating my select statement to match the example in this code
`codeql\ql\java\ql\src\Security\CWE\CWE-532\SensitiveInfoLog.ql`
To be
```
select sink.getNode(), source, sink, "This $@ is written to a log file.", source.getNode(),
"potentially sensitive information"
```
Contributor guide
Research direction
Start with the path-problem query shown in the issue and compare its final select statement with codeql\ql\java\ql\src\Security\CWE\CWE-532\SensitiveInfoLog.ql and the creating path queries documentation. Reproduce the metadata error through the CLI, then verify that the query's result patterns are accepted while preserving the reported path output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100