Skip to content

Commit 9ac212d

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: add related location to alert message
1 parent 4f0cdad commit 9ac212d

File tree

3 files changed

+43
-11
lines changed

3 files changed

+43
-11
lines changed

‎java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,9 @@ class ManagementEndPointInclude extends ApplicationPropertiesConfigPair {
6767
* Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
6868
* has a vulnerable configuration of Spring Boot Actuator management endpoints.
6969
*/
70-
predicate hasConfidentialEndPointExposed(SpringBootPom pom) {
70+
predicate hasConfidentialEndPointExposed(
71+
SpringBootPom pom, ApplicationPropertiesConfigPair ap, string configStr
72+
) {
7173
pom.isSpringBootActuatorUsed() and
7274
not pom.isSpringBootSecurityUsed() and
7375
exists(ApplicationPropertiesFile apFile |
@@ -79,14 +81,28 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom) {
7981
springBootVersion = pom.getParentElement().getVersionString()
8082
|
8183
springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
82-
not exists(ManagementSecurityConfig me | me.hasSecurityEnabled() and me.getFile() = apFile)
84+
(
85+
not exists(ManagementSecurityConfig me | me.getFile() = apFile) and
86+
// No `ManagementSecurityConfig` in the file, so nowhere to link to
87+
// in select message for this case.
88+
configStr = "configuration"
89+
or
90+
exists(ManagementSecurityConfig me |
91+
me.hasSecurityDisabled() and me.getFile() = apFile and me = ap
92+
) and
93+
configStr = "$@"
94+
)
8395
or
8496
springBootVersion.matches("1.5%") and // version 1.5
85-
exists(ManagementSecurityConfig me | me.hasSecurityDisabled() and me.getFile() = apFile)
97+
exists(ManagementSecurityConfig me |
98+
me.hasSecurityDisabled() and me.getFile() = apFile and me = ap
99+
) and
100+
configStr = "$@"
86101
or
87102
springBootVersion.matches("2.%") and //version 2.x
88103
exists(ManagementEndPointInclude mi |
89104
mi.getFile() = apFile and
105+
mi = ap and
90106
(
91107
mi.getValue() = "*" // all endpoints are enabled
92108
or
@@ -96,7 +112,8 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom) {
96112
"%env%", "%beans%", "%sessions%"
97113
]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
98114
)
99-
)
115+
) and
116+
configStr = "$@"
100117
)
101118
)
102119
}

‎java/ql/src/Security/CWE/CWE-200/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.ql

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,11 @@ import java
1515
import semmle.code.xml.MavenPom
1616
import semmle.code.java.security.SpringBootActuatorsConfigQuery
1717

18-
from SpringBootPom pom, Dependency d
18+
from SpringBootPom pom, Dependency d, ApplicationPropertiesConfigPair ap, string configStr
1919
where
20-
hasConfidentialEndPointExposed(pom) and
20+
hasConfidentialEndPointExposed(pom, ap, configStr) and
2121
d = pom.getADependency() and
2222
d.getArtifact().getValue() = "spring-boot-starter-actuator"
23-
select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
23+
select d,
24+
"Insecure " + configStr + " of Spring Boot Actuator exposes sensitive endpoints. (" +
25+
pom.getParentElement().getVersionString() + ")", ap, "configuration"

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.expected

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,17 @@
1-
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
2-
| Version1.4-/bad/false/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
3-
| Version1.5/bad/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
4-
| Version2+/bad/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
1+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version1.4-/bad/false/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
2+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version1.4-/good/application.properties:2:1:2:32 | management.security.enabled=true | configuration |
3+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version1.5/bad/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
4+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version1.5/good/application.properties:2:1:2:32 | management.security.enabled=true | configuration |
5+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/application.properties:6:1:6:33 | management.security.enabled=false | configuration |
6+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/application.properties:9:1:9:43 | management.endpoints.web.exposure.include=* | configuration |
7+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/application.properties:10:1:10:47 | management.endpoints.web.exposure.exclude=beans | configuration |
8+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/application.properties:12:1:12:41 | management.endpoint.shutdown.enabled=true | configuration |
9+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/application.properties:14:1:14:55 | management.endpoint.health.show-details=when_authorized | configuration |
10+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/bad/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |
11+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/bad/application.properties:3:1:3:47 | management.endpoints.web.exposure.exclude=beans | configuration |
12+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/bad/application.properties:5:1:5:41 | management.endpoint.shutdown.enabled=true | configuration |
13+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/bad/application.properties:7:1:7:55 | management.endpoint.health.show-details=when_authorized | configuration |
14+
| Version1.4-/bad/default/pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version2+/good/application.properties:2:1:2:59 | management.endpoints.web.exposure.include=beans,info,health | configuration |
15+
| Version1.4-/bad/false/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints. (1.2.6.RELEASE) | Version1.4-/bad/false/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
16+
| Version1.5/bad/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints. (1.5.6.RELEASE) | Version1.5/bad/application.properties:2:1:2:33 | management.security.enabled=false | configuration |
17+
| Version2+/bad/pom.xml:29:9:32:22 | dependency | Insecure $@ of Spring Boot Actuator exposes sensitive endpoints. (2.2.6.RELEASE) | Version2+/bad/application.properties:2:1:2:43 | management.endpoints.web.exposure.include=* | configuration |

0 commit comments

Comments
 (0)