Java: Fix LdapInjection qltest

github · aschackmull · Jul 8, 2020 · May 15, 2020 · May 15, 2020 · May 15, 2020
commit 581d496167bb2e6e228114bfad3ed1f68e97a921
diff --git a/java/ql/test/query-tests/security/CWE-090/LdapInjection.expected b/java/ql/test/query-tests/security/CWE-090/LdapInjection.expected
diff --git a/java/ql/test/query-tests/security/CWE-090/LdapInjection.java b/java/ql/test/query-tests/security/CWE-090/LdapInjection.java
@@ -34,273 +34,327 @@
 import org.springframework.ldap.support.LdapEncoder;
 import org.springframework.ldap.support.LdapNameBuilder;
 import org.springframework.ldap.support.LdapUtils;
+import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RequestMapping;
 
+@Controller
 public class LdapInjection {
   // JNDI
+  @RequestMapping
   public void testJndiBad1(@RequestParam String jBad, @RequestParam String jBadDN, DirContext ctx)
       throws NamingException {
     ctx.search("ou=system" + jBadDN, "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad2(@RequestParam String jBad, @RequestParam String jBadDNName, InitialDirContext ctx)
       throws NamingException {
     ctx.search(new LdapName("ou=system" + jBadDNName), "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad3(@RequestParam String jBad, @RequestParam String jOkDN, LdapContext ctx)
       throws NamingException {
     ctx.search(new LdapName(List.of(new Rdn("ou=" + jOkDN))), "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad4(@RequestParam String jBadInitial, InitialLdapContext ctx)
       throws NamingException {
     ctx.search("ou=system", "(uid=" + jBadInitial + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad5(@RequestParam String jBad, @RequestParam String jBadDNNameAdd, InitialDirContext ctx)
       throws NamingException {
     ctx.search(new LdapName("").addAll(new LdapName("ou=system" + jBadDNNameAdd)), "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad6(@RequestParam String jBad, @RequestParam String jBadDNNameAdd2, InitialDirContext ctx)
       throws NamingException {
     LdapName name = new LdapName("");
     name.addAll(new LdapName("ou=system" + jBadDNNameAdd2).getRdns());
     ctx.search(new LdapName("").addAll(name), "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad7(@RequestParam String jBad, @RequestParam String jBadDNNameToString, InitialDirContext ctx)
       throws NamingException {
     ctx.search(new LdapName("ou=system" + jBadDNNameToString).toString(), "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiBad8(@RequestParam String jBad, @RequestParam String jBadDNNameClone, InitialDirContext ctx)
       throws NamingException {
     ctx.search((Name) new LdapName("ou=system" + jBadDNNameClone).clone(), "(uid=" + jBad + ")", new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiOk1(@RequestParam String jOkFilterExpr, DirContext ctx) throws NamingException {
     ctx.search("ou=system", "(uid={0})", new String[] { jOkFilterExpr }, new SearchControls());
   }
 
+  @RequestMapping
   public void testJndiOk2(@RequestParam String jOkAttribute, DirContext ctx) throws NamingException {
     ctx.search("ou=system", new BasicAttributes(jOkAttribute, jOkAttribute));
   }
 
   // UnboundID
+  @RequestMapping
   public void testUnboundBad1(@RequestParam String uBad, @RequestParam String uBadDN, LDAPConnection c)
       throws LDAPSearchException {
     c.search(null, "ou=system" + uBadDN, null, null, 1, 1, false, "(uid=" + uBad + ")");
   }
 
+  @RequestMapping
   public void testUnboundBad2(@RequestParam String uBadFilterCreate, LDAPConnection c) throws LDAPException {
     c.search(null, "ou=system", null, null, 1, 1, false, Filter.create(uBadFilterCreate));
   }
 
+  @RequestMapping
   public void testUnboundBad3(@RequestParam String uBadROSearchRequest, @RequestParam String uBadROSRDN,
       LDAPConnection c) throws LDAPException {
     ReadOnlySearchRequest s = new SearchRequest(null, "ou=system" + uBadROSRDN, null, null, 1, 1, false,
         "(uid=" + uBadROSearchRequest + ")");
     c.search(s);
   }
 
+  @RequestMapping
   public void testUnboundBad4(@RequestParam String uBadSearchRequest, @RequestParam String uBadSRDN, LDAPConnection c)
       throws LDAPException {
     SearchRequest s = new SearchRequest(null, "ou=system" + uBadSRDN, null, null, 1, 1, false,
         "(uid=" + uBadSearchRequest + ")");
     c.search(s);
   }
 
+  @RequestMapping
   public void testUnboundBad5(@RequestParam String uBad, @RequestParam String uBadDNSFR, LDAPConnection c)
       throws LDAPSearchException {
     c.searchForEntry("ou=system" + uBadDNSFR, null, null, 1, false, "(uid=" + uBad + ")");
   }
 
+  @RequestMapping
   public void testUnboundBad6(@RequestParam String uBadROSearchRequestAsync, @RequestParam String uBadROSRDNAsync,
       LDAPConnection c) throws LDAPException {
     ReadOnlySearchRequest s = new SearchRequest(null, "ou=system" + uBadROSRDNAsync, null, null, 1, 1, false,
         "(uid=" + uBadROSearchRequestAsync + ")");
     c.asyncSearch(s);
   }
 
+  @RequestMapping
   public void testUnboundBad7(@RequestParam String uBadSearchRequestAsync, @RequestParam String uBadSRDNAsync, LDAPConnection c)
       throws LDAPException {
     SearchRequest s = new SearchRequest(null, "ou=system" + uBadSRDNAsync, null, null, 1, 1, false,
         "(uid=" + uBadSearchRequestAsync + ")");
     c.asyncSearch(s);
   }
 
+  @RequestMapping
   public void testUnboundBad8(@RequestParam String uBadFilterCreateNOT, LDAPConnection c) throws LDAPException {
     c.search(null, "ou=system", null, null, 1, 1, false, Filter.createNOTFilter(Filter.create(uBadFilterCreateNOT)));
   }
 
+  @RequestMapping
   public void testUnboundBad9(@RequestParam String uBadFilterCreateToString, LDAPConnection c) throws LDAPException {
     c.search(null, "ou=system", null, null, 1, 1, false, Filter.create(uBadFilterCreateToString).toString());
   }
 
+  @RequestMapping
   public void testUnboundBad10(@RequestParam String uBadFilterCreateToStringBuffer, LDAPConnection c) throws LDAPException {
     StringBuilder b = new StringBuilder();
     Filter.create(uBadFilterCreateToStringBuffer).toNormalizedString(b);
     c.search(null, "ou=system", null, null, 1, 1, false, b.toString());
   }
-
+
+  @RequestMapping
   public void testUnboundBad11(@RequestParam String uBadSearchRequestDuplicate, LDAPConnection c)
       throws LDAPException {
     SearchRequest s = new SearchRequest(null, "ou=system", null, null, 1, 1, false,
         "(uid=" + uBadSearchRequestDuplicate + ")");
     c.search(s.duplicate());
   }
 
+  @RequestMapping
   public void testUnboundBad12(@RequestParam String uBadROSearchRequestDuplicate, LDAPConnection c)
       throws LDAPException {
     ReadOnlySearchRequest s = new SearchRequest(null, "ou=system", null, null, 1, 1, false,
         "(uid=" + uBadROSearchRequestDuplicate + ")");
     c.search(s.duplicate());
   }
 
+  @RequestMapping
   public void testUnboundBad13(@RequestParam String uBadSearchRequestSetDN, LDAPConnection c)
       throws LDAPException {
     SearchRequest s = new SearchRequest(null, "", null, null, 1, 1, false, "");
     s.setBaseDN(uBadSearchRequestSetDN);
     c.search(s);
   }
 
+  @RequestMapping
   public void testUnboundBad14(@RequestParam String uBadSearchRequestSetFilter, LDAPConnection c)
       throws LDAPException {
     SearchRequest s = new SearchRequest(null, "ou=system", null, null, 1, 1, false, "");
     s.setFilter(uBadSearchRequestSetFilter);
     c.search(s);
   }
 
+  @RequestMapping
   public void testUnboundOk1(@RequestParam String uOkEqualityFilter, LDAPConnection c) throws LDAPSearchException {
     c.search(null, "ou=system", null, null, 1, 1, false, Filter.createEqualityFilter("uid", uOkEqualityFilter));
   }
 
+  @RequestMapping
   public void testUnboundOk2(@RequestParam String uOkVaragsAttr, LDAPConnection c) throws LDAPSearchException {
     c.search("ou=system", null, null, 1, 1, false, "(uid=fixed)", "a" + uOkVaragsAttr);
   }
 
+  @RequestMapping
   public void testUnboundOk3(@RequestParam String uOkFilterSearchRequest, LDAPConnection c) throws LDAPException {
     SearchRequest s = new SearchRequest(null, "ou=system", null, null, 1, 1, false,
         Filter.createEqualityFilter("uid", uOkFilterSearchRequest));
     c.search(s);
   }
 
+  @RequestMapping
   public void testUnboundOk4(@RequestParam String uOkSearchRequestVarargs, LDAPConnection c) throws LDAPException {
     SearchRequest s = new SearchRequest("ou=system", null, "(uid=fixed)", "va1", "va2", "va3",
         "a" + uOkSearchRequestVarargs);
     c.search(s);
   }
 
   // Spring LDAP
+  @RequestMapping
   public void testSpringBad1(@RequestParam String sBad, @RequestParam String sBadDN, LdapTemplate c) {
     c.search("ou=system" + sBadDN, "(uid=" + sBad + ")", 1, false, null);
   }
 
+  @RequestMapping
   public void testSpringBad2(@RequestParam String sBad, @RequestParam String sBadDNLNBuilder, LdapTemplate c) {
     c.authenticate(LdapNameBuilder.newInstance("ou=system" + sBadDNLNBuilder).build(), "(uid=" + sBad + ")", "pass");
   }
 
+  @RequestMapping
   public void testSpringBad3(@RequestParam String sBad, @RequestParam String sBadDNLNBuilderAdd, LdapTemplate c) {
     c.searchForObject(LdapNameBuilder.newInstance().add("ou=system" + sBadDNLNBuilderAdd).build(), "(uid=" + sBad + ")", null);
   }
 
+  @RequestMapping
   public void testSpringBad4(@RequestParam String sBadLdapQuery, LdapTemplate c) {
     c.findOne(LdapQueryBuilder.query().filter("(uid=" + sBadLdapQuery + ")"), null);
   }
 
+  @RequestMapping
   public void testSpringBad5(@RequestParam String sBadFilter, @RequestParam String sBadDNLdapUtils, LdapTemplate c) {
     c.find(LdapUtils.newLdapName("ou=system" + sBadDNLdapUtils), new HardcodedFilter("(uid=" + sBadFilter + ")"), null, null);
   }
 
+  @RequestMapping
   public void testSpringBad6(@RequestParam String sBadLdapQuery, LdapTemplate c) {
     c.searchForContext(LdapQueryBuilder.query().filter("(uid=" + sBadLdapQuery + ")"));
   }
 
+  @RequestMapping
   public void testSpringBad7(@RequestParam String sBadLdapQuery2, LdapTemplate c) {
     LdapQuery q = LdapQueryBuilder.query().filter("(uid=" + sBadLdapQuery2 + ")");
     c.searchForContext(q);
   }
 
+  @RequestMapping
   public void testSpringBad8(@RequestParam String sBadLdapQueryWithFilter, LdapTemplate c) {
     c.searchForContext(LdapQueryBuilder.query().filter(new HardcodedFilter("(uid=" + sBadLdapQueryWithFilter + ")")));
   }
 
+  @RequestMapping
   public void testSpringBad9(@RequestParam String sBadLdapQueryWithFilter2, LdapTemplate c) {
     org.springframework.ldap.filter.Filter f = new HardcodedFilter("(uid=" + sBadLdapQueryWithFilter2 + ")");
     c.searchForContext(LdapQueryBuilder.query().filter(f));
   }
 
+  @RequestMapping
   public void testSpringBad10(@RequestParam String sBadLdapQueryBase, LdapTemplate c) {
     c.find(LdapQueryBuilder.query().base(sBadLdapQueryBase).base(), null, null, null);
   }
 
+  @RequestMapping
   public void testSpringBad11(@RequestParam String sBadLdapQueryComplex, LdapTemplate c) {
     c.searchForContext(LdapQueryBuilder.query().base(sBadLdapQueryComplex).where("uid").is("test"));
   }
 
+  @RequestMapping
   public void testSpringBad12(@RequestParam String sBadFilterToString, LdapTemplate c) {
     c.search("", new HardcodedFilter("(uid=" + sBadFilterToString + ")").toString(), 1, false, null);
   }
 
+  @RequestMapping
   public void testSpringBad13(@RequestParam String sBadFilterEncode, LdapTemplate c) {
     StringBuffer s = new StringBuffer();
     new HardcodedFilter("(uid=" + sBadFilterEncode + ")").encode(s);
     c.search("", s.toString(), 1, false, null);
   }
 
+  @RequestMapping
   public void testSpringOk1(@RequestParam String sOkLdapQuery, LdapTemplate c) {
     c.find(LdapQueryBuilder.query().filter("(uid={0})", sOkLdapQuery), null);
   }
 
+  @RequestMapping
   public void testSpringOk2(@RequestParam String sOkFilter, @RequestParam String sOkDN, LdapTemplate c) {
     c.find(LdapNameBuilder.newInstance().add("ou", sOkDN).build(), new EqualsFilter("uid", sOkFilter), null, null);
   }
 
+  @RequestMapping
   public void testSpringOk3(@RequestParam String sOkLdapQuery, @RequestParam String sOkPassword, LdapTemplate c) {
     c.authenticate(LdapQueryBuilder.query().filter("(uid={0})", sOkLdapQuery), sOkPassword);
   }
 
   // Apache LDAP API
+  @RequestMapping
   public void testApacheBad1(@RequestParam String aBad, @RequestParam String aBadDN, LdapConnection c)
       throws LdapException {
     c.search("ou=system" + aBadDN, "(uid=" + aBad + ")", null);
   }
 
+  @RequestMapping
   public void testApacheBad2(@RequestParam String aBad, @RequestParam String aBadDNObjToString, LdapNetworkConnection c)
       throws LdapException {
     c.search(new Dn("ou=system" + aBadDNObjToString).getName(), "(uid=" + aBad + ")", null);
   }
 
+  @RequestMapping
   public void testApacheBad3(@RequestParam String aBadSearchRequest, LdapConnection c)
       throws LdapException {
     org.apache.directory.api.ldap.model.message.SearchRequest s = new SearchRequestImpl();
     s.setFilter("(uid=" + aBadSearchRequest + ")");
     c.search(s);
   }
 
+  @RequestMapping
   public void testApacheBad4(@RequestParam String aBadSearchRequestImpl, @RequestParam String aBadDNObj, LdapConnection c)
       throws LdapException {
     SearchRequestImpl s = new SearchRequestImpl();
     s.setBase(new Dn("ou=system" + aBadDNObj));
     c.search(s);
   }
 
+  @RequestMapping
   public void testApacheBad5(@RequestParam String aBadDNSearchRequestGet, LdapConnection c)
       throws LdapException {
     org.apache.directory.api.ldap.model.message.SearchRequest s = new SearchRequestImpl();
     s.setBase(new Dn("ou=system" + aBadDNSearchRequestGet));
     c.search(s.getBase(), "(uid=test", null);
   }
 
+  @RequestMapping
   public void testApacheOk1(@RequestParam String aOk, LdapConnection c)
       throws LdapException {
     org.apache.directory.api.ldap.model.message.SearchRequest s = new SearchRequestImpl();
     s.setFilter(new EqualityNode<String>("uid", aOk));
     c.search(s);
   }
 
+  @RequestMapping
   public void testApacheOk2(@RequestParam String aOk, LdapConnection c)
       throws LdapException {
     SearchRequestImpl s = new SearchRequestImpl();
@@ -309,17 +363,20 @@ public void testApacheOk2(@RequestParam String aOk, LdapConnection c)
   }
 
   // ESAPI encoder sanitizer
+  @RequestMapping
   public void testOk3(@RequestParam String okEncodeForLDAP, DirContext ctx) throws NamingException {
     Encoder encoder = DefaultEncoder.getInstance();
     ctx.search("ou=system", "(uid=" + encoder.encodeForLDAP(okEncodeForLDAP) + ")", new SearchControls());
   }
 
   // Spring LdapEncoder sanitizer
+  @RequestMapping
   public void testOk4(@RequestParam String okFilterEncode, DirContext ctx) throws NamingException {
     ctx.search("ou=system", "(uid=" + LdapEncoder.filterEncode(okFilterEncode) + ")", new SearchControls());
   }
 
   // UnboundID Filter.encodeValue sanitizer
+  @RequestMapping
   public void testOk5(@RequestParam String okUnboundEncodeValue, DirContext ctx) throws NamingException {
     ctx.search("ou=system", "(uid=" + Filter.encodeValue(okUnboundEncodeValue) + ")", new SearchControls());
   }

diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Component.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Component.java
@@ -0,0 +1,9 @@
+package org.springframework.stereotype;
+
+import java.lang.annotation.*;
+
+@Target(value=ElementType.TYPE)
+@Retention(value=RetentionPolicy.RUNTIME)
+@Documented
+@Indexed
+public @interface Component { }
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
@@ -0,0 +1,9 @@
+package org.springframework.stereotype;
+
+import java.lang.annotation.*;
+
+@Target(value=ElementType.TYPE)
+@Retention(value=RetentionPolicy.RUNTIME)
+@Documented
+@Component
+public @interface Controller { }
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Indexed.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Indexed.java
@@ -0,0 +1,8 @@
+package org.springframework.stereotype;
+
+import java.lang.annotation.*;
+
+@Target(value=ElementType.TYPE)
+@Retention(value=RetentionPolicy.RUNTIME)
+@Documented
+public @interface Indexed { }
diff --git a/...t/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java b/...t/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
@@ -0,0 +1,8 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.*;
+
+@Target(value={ElementType.METHOD,ElementType.TYPE})
+@Retention(value=RetentionPolicy.RUNTIME)
+@Documented
+public @interface RequestMapping { }