github / github/codeql

Path-problem result pattern

Đang mở
#15,744 6 bình luận 0 reaction 0 người được giao Xem trên GitHub
question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

**Description of the issue**

Hello, I made a query that seems to be working just fine using the VS Code extension. However, when I try to query my database using the CLI with this query I am getting this error.

> A fatal error occurred: Could not process query metadata for C:\Users\Kyler\Documents\Work\cwe200\codeql\codeql-custom-queries-java\CWE-535\ExposureofInformationThroughShellErrorMessage copy.ql.
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]

I have read through that link and I have also checked out [this](https://github.com/github/codeql-cli-binaries/issues/115) issue here and did some looking into other path problem examples. However, I am still getting this error after trying all of this. I believe that it is something simple that I am missing right in front of me. Any help would be appreciated. Thank you in advance.

My code

```
import java
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph
/**
* @name Exposure of information through shell error message
* @description Exposing error messages from shell commands can lead to information disclosure.
* @kind path-problem
* @problem.severity warning
* @id java/shell-error-exposure
* @tags security
* external/cwe/cwe-535
*/
class ShellErrorExposureConfig extends DataFlow::Configuration {
ShellErrorExposureConfig() { this = "ShellErrorExposureConfig" }

override predicate isSource(DataFlow::Node source) {
exists(MethodAccess ma |
// Captures getting the error stream from a process
ma.getMethod().hasName("getErrorStream") and
// Ensure the Process is the result of exec or start, indicating command execution
(ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue() instanceof MethodAccess and
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("exec") or
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("start")) and
source.asExpr() = ma
)
or
exists(MethodAccess exec |
// Direct use of user input in command execution
exec.getMethod().hasName("exec") and
exec.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Runtime") and
source.asExpr() = exec
)
}

override predicate isSink(DataFlow::Node sink) {
// System.out.println or similar direct output methods as sinks
(exists(MethodAccess println |
println.getMethod().hasName("println") and
println.getQualifier().(VarAccess).getVariable().getType() instanceof RefType and
((RefType)println.getQualifier().(VarAccess).getVariable().getType()).hasQualifiedName("java.io", "PrintStream") and
sink.asExpr() = println.getAnArgument())
and
not exists(MethodAccess sanitizeErrorOutput |
sanitizeErrorOutput.getMethod().hasName("sanitizeErrorOutput") and
sink.asExpr() = sanitizeErrorOutput.getAnArgument()
))
or
exists(MethodAccess getMessage |
getMessage.getMethod().hasName(["getMessage", "getStackTrace", "getStackTraceAsString", "printStackTrace"]) and
getMessage.getMethod().getDeclaringType().getASupertype*().hasQualifiedName("java.lang", "Throwable") and
sink.asExpr() = getMessage
)
}
}

from ShellErrorExposureConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink, "Potential CWE-535: Exposure of information through shell error message"
```
I tried updating my select statement to match the example in this code
`codeql\ql\java\ql\src\Security\CWE\CWE-532\SensitiveInfoLog.ql`

To be
```
select sink.getNode(), source, sink, "This $@ is written to a log file.", source.getNode(),
"potentially sensitive information"
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.