Skip to content

Commit 09ceb7b

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add YAML security rules for DocumentBuilderFactory external entities (#163)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * documentbuilderfactory-external-parameter-entities-true-java * documentbuilderfactory-external-general-entities-true-java --------- Co-authored-by: Sakshis <[email protected]>
1 parent ad77298 commit 09ceb7b

6 files changed

+652
-0
lines changed

‎rules/java/security/documentbuilderfactory-external-general-entities-true-java.yml

+288
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
id: documentbuilderfactory-external-general-entities-true-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
External entities are allowed for $DBFACTORY. This is vulnerable to XML
6+
external entity attacks. Disable this by setting the feature
7+
"http://xml.org/sax/features/external-general-entities" to false.
8+
note: >-
9+
[CWE-798]: Use of Hard-coded Credentials
10+
[OWASP A07:2021]: Identification and Authentication Failures
11+
[REFERENCES]
12+
https://blog.sonarsource.com/secure-xml-processor
13+
14+
ast-grep-essentials: true
15+
16+
utils:
17+
match_expression_statement:
18+
kind: method_invocation
19+
all:
20+
- has:
21+
stopBy: neighbor
22+
kind: identifier
23+
- has:
24+
stopBy: neighbor
25+
kind: identifier
26+
regex: ^setFeature$
27+
nthChild: 2
28+
- has:
29+
stopBy: end
30+
kind: argument_list
31+
all:
32+
- has:
33+
stopBy: neighbor
34+
kind: string_literal
35+
regex: ^"http://xml.org/sax/features/external-general-entities"$
36+
nthChild:
37+
position: 1
38+
ofRule:
39+
not:
40+
kind: line_comment
41+
- has:
42+
stopBy: neighbor
43+
regex: "^true$"
44+
nthChild:
45+
position: 2
46+
ofRule:
47+
not:
48+
kind: line_comment
49+
50+
match_expression_statement_Boolean_Instance:
51+
kind: expression_statement
52+
has:
53+
stopBy: end
54+
kind: method_invocation
55+
all:
56+
- has:
57+
stopBy: neighbor
58+
kind: identifier
59+
- has:
60+
stopBy: neighbor
61+
kind: identifier
62+
regex: ^setFeature$
63+
nthChild: 2
64+
has:
65+
stopBy: end
66+
kind: argument_list
67+
field: arguments
68+
all:
69+
- has:
70+
stopBy: neighbor
71+
kind: string_literal
72+
regex: ^"http://xml.org/sax/features/external-general-entities"$
73+
nthChild:
74+
position: 1
75+
ofRule:
76+
not:
77+
kind: line_comment
78+
- has:
79+
stopBy: neighbor
80+
pattern: $TRUE
81+
nthChild:
82+
position: 2
83+
ofRule:
84+
not:
85+
kind: line_comment
86+
any:
87+
- inside:
88+
stopBy: end
89+
follows:
90+
stopBy: end
91+
kind: local_variable_declaration
92+
has:
93+
kind: variable_declarator
94+
all:
95+
- has:
96+
kind: identifier
97+
pattern: $TRUE
98+
nthChild: 1
99+
- has:
100+
regex: "^true$"
101+
- follows:
102+
stopBy: end
103+
kind: local_variable_declaration
104+
has:
105+
kind: variable_declarator
106+
all:
107+
- has:
108+
kind: identifier
109+
pattern: $TRUE
110+
nthChild: 1
111+
- has:
112+
regex: "^true$"
113+
114+
match_expression_statement_Link_Instance:
115+
kind: expression_statement
116+
has:
117+
stopBy: end
118+
kind: method_invocation
119+
all:
120+
- has:
121+
stopBy: neighbor
122+
kind: identifier
123+
nthChild: 1
124+
- has:
125+
stopBy: neighbor
126+
kind: identifier
127+
regex: ^setFeature$
128+
nthChild: 2
129+
has:
130+
stopBy: end
131+
kind: argument_list
132+
field: arguments
133+
all:
134+
- has:
135+
stopBy: neighbor
136+
pattern: $URL
137+
nthChild:
138+
position: 1
139+
ofRule:
140+
not:
141+
kind: line_comment
142+
- has:
143+
stopBy: neighbor
144+
regex: "^true$"
145+
nthChild:
146+
position: 2
147+
ofRule:
148+
not:
149+
kind: line_comment
150+
any:
151+
- inside:
152+
stopBy: end
153+
follows:
154+
stopBy: end
155+
kind: local_variable_declaration
156+
has:
157+
kind: variable_declarator
158+
all:
159+
- has:
160+
kind: identifier
161+
pattern: $URL
162+
nthChild: 1
163+
- has:
164+
kind: string_literal
165+
regex: ^"http://xml.org/sax/features/external-general-entities"$
166+
- follows:
167+
stopBy: end
168+
kind: local_variable_declaration
169+
has:
170+
kind: variable_declarator
171+
all:
172+
- has:
173+
kind: identifier
174+
pattern: $URL
175+
nthChild: 1
176+
- has:
177+
kind: string_literal
178+
regex: ^"http://xml.org/sax/features/external-general-entities"$
179+
180+
match_expression_statement_with_both_instance:
181+
kind: expression_statement
182+
has:
183+
stopBy: end
184+
kind: method_invocation
185+
all:
186+
- has:
187+
stopBy: neighbor
188+
kind: identifier
189+
- has:
190+
stopBy: neighbor
191+
kind: identifier
192+
regex: ^setFeature$
193+
nthChild: 2
194+
- has:
195+
kind: argument_list
196+
all:
197+
- not:
198+
has:
199+
nthChild:
200+
position: 3
201+
ofRule:
202+
not:
203+
kind: line_comment
204+
- has:
205+
kind: identifier
206+
pattern: $URL
207+
nthChild:
208+
position: 1
209+
ofRule:
210+
not:
211+
kind: line_comment
212+
- has:
213+
kind: identifier
214+
pattern: $TRUE
215+
nthChild:
216+
position: 2
217+
ofRule:
218+
not:
219+
kind: line_comment
220+
- any:
221+
- follows:
222+
stopBy: end
223+
kind: local_variable_declaration
224+
has:
225+
kind: variable_declarator
226+
all:
227+
- has:
228+
kind: identifier
229+
pattern: $TRUE
230+
nthChild: 1
231+
- has:
232+
regex: "^true$"
233+
- inside:
234+
stopBy: end
235+
follows:
236+
stopBy: end
237+
kind: local_variable_declaration
238+
has:
239+
kind: variable_declarator
240+
all:
241+
- has:
242+
kind: identifier
243+
pattern: $TRUE
244+
nthChild: 1
245+
- has:
246+
regex: "^true$"
247+
- any:
248+
- follows:
249+
stopBy: end
250+
kind: local_variable_declaration
251+
has:
252+
kind: variable_declarator
253+
all:
254+
- has:
255+
kind: identifier
256+
pattern: $URL
257+
nthChild: 1
258+
- has:
259+
regex: ^"http://xml.org/sax/features/external-general-entities"$
260+
- inside:
261+
stopBy: end
262+
follows:
263+
stopBy: end
264+
kind: local_variable_declaration
265+
has:
266+
kind: variable_declarator
267+
all:
268+
- has:
269+
kind: identifier
270+
pattern: $URL
271+
nthChild: 1
272+
- has:
273+
regex: ^"http://xml.org/sax/features/external-general-entities"$
274+
275+
rule:
276+
any:
277+
- matches: match_expression_statement
278+
- matches: match_expression_statement_Boolean_Instance
279+
- matches: match_expression_statement_Link_Instance
280+
- matches: match_expression_statement_with_both_instance
281+
not:
282+
all:
283+
- has:
284+
stopBy: end
285+
kind: ERROR
286+
- inside:
287+
stopBy: end
288+
kind: ERROR

0 commit comments

Comments
 (0)