github / github/codeql

Path-problem result pattern

Abierto
#15,744 6 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the issue**

Hello, I made a query that seems to be working just fine using the VS Code extension. However, when I try to query my database using the CLI with this query I am getting this error.

> A fatal error occurred: Could not process query metadata for C:\Users\Kyler\Documents\Work\cwe200\codeql\codeql-custom-queries-java\CWE-535\ExposureofInformationThroughShellErrorMessage copy.ql.
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]

I have read through that link and I have also checked out [this](https://github.com/github/codeql-cli-binaries/issues/115) issue here and did some looking into other path problem examples. However, I am still getting this error after trying all of this. I believe that it is something simple that I am missing right in front of me. Any help would be appreciated. Thank you in advance.

My code

```
import java
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph
/**
* @name Exposure of information through shell error message
* @description Exposing error messages from shell commands can lead to information disclosure.
* @kind path-problem
* @problem.severity warning
* @id java/shell-error-exposure
* @tags security
* external/cwe/cwe-535
*/
class ShellErrorExposureConfig extends DataFlow::Configuration {
ShellErrorExposureConfig() { this = "ShellErrorExposureConfig" }

override predicate isSource(DataFlow::Node source) {
exists(MethodAccess ma |
// Captures getting the error stream from a process
ma.getMethod().hasName("getErrorStream") and
// Ensure the Process is the result of exec or start, indicating command execution
(ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue() instanceof MethodAccess and
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("exec") or
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("start")) and
source.asExpr() = ma
)
or
exists(MethodAccess exec |
// Direct use of user input in command execution
exec.getMethod().hasName("exec") and
exec.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Runtime") and
source.asExpr() = exec
)
}

override predicate isSink(DataFlow::Node sink) {
// System.out.println or similar direct output methods as sinks
(exists(MethodAccess println |
println.getMethod().hasName("println") and
println.getQualifier().(VarAccess).getVariable().getType() instanceof RefType and
((RefType)println.getQualifier().(VarAccess).getVariable().getType()).hasQualifiedName("java.io", "PrintStream") and
sink.asExpr() = println.getAnArgument())
and
not exists(MethodAccess sanitizeErrorOutput |
sanitizeErrorOutput.getMethod().hasName("sanitizeErrorOutput") and
sink.asExpr() = sanitizeErrorOutput.getAnArgument()
))
or
exists(MethodAccess getMessage |
getMessage.getMethod().hasName(["getMessage", "getStackTrace", "getStackTraceAsString", "printStackTrace"]) and
getMessage.getMethod().getDeclaringType().getASupertype*().hasQualifiedName("java.lang", "Throwable") and
sink.asExpr() = getMessage
)
}
}

from ShellErrorExposureConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink, "Potential CWE-535: Exposure of information through shell error message"
```
I tried updating my select statement to match the example in this code
`codeql\ql\java\ql\src\Security\CWE\CWE-532\SensitiveInfoLog.ql`

To be
```
select sink.getNode(), source, sink, "This $@ is written to a log file.", source.getNode(),
"potentially sensitive information"
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.