Path-problem result pattern
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
**Description of the issue**
Hello, I made a query that seems to be working just fine using the VS Code extension. However, when I try to query my database using the CLI with this query I am getting this error.
> A fatal error occurred: Could not process query metadata for C:\Users\Kyler\Documents\Work\cwe200\codeql\codeql-custom-queries-java\CWE-535\ExposureofInformationThroughShellErrorMessage copy.ql.
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
I have read through that link and I have also checked out [this](https://github.com/github/codeql-cli-binaries/issues/115) issue here and did some looking into other path problem examples. However, I am still getting this error after trying all of this. I believe that it is something simple that I am missing right in front of me. Any help would be appreciated. Thank you in advance.
My code
```
import java
import semmle.code.java.dataflow.TaintTracking
import DataFlow::PathGraph
/**
* @name Exposure of information through shell error message
* @description Exposing error messages from shell commands can lead to information disclosure.
* @kind path-problem
* @problem.severity warning
* @id java/shell-error-exposure
* @tags security
* external/cwe/cwe-535
*/
class ShellErrorExposureConfig extends DataFlow::Configuration {
ShellErrorExposureConfig() { this = "ShellErrorExposureConfig" }
override predicate isSource(DataFlow::Node source) {
exists(MethodAccess ma |
// Captures getting the error stream from a process
ma.getMethod().hasName("getErrorStream") and
// Ensure the Process is the result of exec or start, indicating command execution
(ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue() instanceof MethodAccess and
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("exec") or
ma.getQualifier().(VarAccess).getVariable().getAnAssignedValue().(MethodAccess).getMethod().hasName("start")) and
source.asExpr() = ma
)
or
exists(MethodAccess exec |
// Direct use of user input in command execution
exec.getMethod().hasName("exec") and
exec.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Runtime") and
source.asExpr() = exec
)
}
override predicate isSink(DataFlow::Node sink) {
// System.out.println or similar direct output methods as sinks
(exists(MethodAccess println |
println.getMethod().hasName("println") and
println.getQualifier().(VarAccess).getVariable().getType() instanceof RefType and
((RefType)println.getQualifier().(VarAccess).getVariable().getType()).hasQualifiedName("java.io", "PrintStream") and
sink.asExpr() = println.getAnArgument())
and
not exists(MethodAccess sanitizeErrorOutput |
sanitizeErrorOutput.getMethod().hasName("sanitizeErrorOutput") and
sink.asExpr() = sanitizeErrorOutput.getAnArgument()
))
or
exists(MethodAccess getMessage |
getMessage.getMethod().hasName(["getMessage", "getStackTrace", "getStackTraceAsString", "printStackTrace"]) and
getMessage.getMethod().getDeclaringType().getASupertype*().hasQualifiedName("java.lang", "Throwable") and
sink.asExpr() = getMessage
)
}
}
from ShellErrorExposureConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink, "Potential CWE-535: Exposure of information through shell error message"
```
I tried updating my select statement to match the example in this code
`codeql\ql\java\ql\src\Security\CWE\CWE-532\SensitiveInfoLog.ql`
To be
```
select sink.getNode(), source, sink, "This $@ is written to a log file.", source.getNode(),
"potentially sensitive information"
```
贡献指南
评估
这个 Issue 还没有评估数据。